Written and maintained by CASRAI Editorial Board
Last updated
A controlled substance diversion prevention program is the layer of organizational structure a hospital builds on top of its bare DEA registrant obligations — a standing committee, routine automated-dispensing-cabinet (ADC) analytics, a witnessed-wasting practice, and a defined investigation-and-reporting path — so that theft or misuse of controlled substances by staff gets caught in days, not months. It is a distinct layer from the storage and inventory requirements every DEA registrant must meet regardless of program maturity: see DEA controlled substance storage requirements and controlled substance inventory for that regulatory floor. This guide covers what sits above it.
Regulatory citations below (21 CFR 1301.71/1301.72, 21 CFR 1304.11, 42 CFR §482.25) are drawn from eCFR primary text. The Joint Commission Quick Safety citation (Issue 48, April 2019) is an advisory bulletin, not an accreditation standard — it recommends practice, it doesn’t mandate a specific program design. Where a practice (witnessed wasting, ADC outlier reporting) is a professional-standard convention rather than a codified requirement, that distinction is called out explicitly rather than implied. Verify current text directly against ecfr.gov and jointcommission.org before citing a specific provision in a written policy, since regulatory text is amended on its own schedule.
The regulatory floor vs. the program layer
Every DEA registrant handling Schedule II–V controlled substances — a hospital pharmacy included — must meet two baseline obligations regardless of whether it runs a diversion prevention program at all. 21 CFR 1301.71 and 1301.72 require “effective controls and procedures” against theft and diversion, including specified physical security standards for storage areas. 21 CFR 1304.11 requires a complete physical inventory of all Schedule II–V stock at least once every two years. Neither provision, on its own, requires a hospital to stand up a committee, run ADC discrepancy analytics, or investigate a pattern of small losses across a unit — a facility that meets both requirements to the letter can still have an active diverter working undetected for months. That gap is what a diversion prevention program exists to close.
Separately, the Medicare Conditions of Participation add an operational duty that does push toward a program: 42 CFR §482.25(b)(7) requires a hospital’s pharmacy service to report controlled substance abuses or losses to the individual responsible for pharmacy services and to the hospital’s chief executive officer. CMS’s interpretive guidance for §482.25 further expects a hospital to be capable of readily identifying loss or diversion — which in practice means having a detection mechanism in place, not just a reporting line for losses that surface some other way. A hospital with no ADC analytics, no discrepancy-review cadence, and no defined escalation path has a hard time demonstrating it can meet that “readily identify” expectation if a surveyor asks how a loss would actually get caught.
ASHP’s framing: prevention, detection, response
The most-cited professional guidance in this space is ASHP’s Guidelines on Preventing Diversion of Controlled Substances (Brummond, Chen, et al., American Journal of Health-System Pharmacy 2017;74(5):325–348), later revised in 2022. It frames diversion prevention as a collaborative, organization-wide program built around three functions rather than a single control: prevention (limiting access and opportunity in the first place — storage, order sets, and smart pump drug library hard limits among them), detection (routine surveillance that catches an anomaly before it becomes a pattern), and response (an investigation and reporting path that’s defined before it’s needed, not improvised after the fact). That three-part structure is the organizing frame the rest of this guide follows. Confirm the exact wording of your local policy against ASHP’s current published version rather than treating any paraphrase — here or elsewhere — as a direct quotation.
Building the diversion prevention committee
Programs that function past their first year typically have a standing, multidisciplinary committee rather than a single owner in pharmacy. In practice that draws on pharmacy leadership (who owns the ADC and inventory data), nursing leadership (who owns unit-level practice and staff conversations), security or loss prevention, human resources and legal/compliance (for the investigation and disciplinary path), and a medical staff representative. The committee’s job is narrower than it sounds: agree the surveillance thresholds that trigger a look, own the discrepancy-review cadence, and hold the investigation-and-reporting path so it doesn’t have to be built from scratch under time pressure. A committee that meets quarterly to review aggregate trend data but has no defined trigger for an individual case investigation is a reporting exercise, not a detection program — the trigger thresholds are the part that actually does the work.
ADC analytics and discrepancy review
Automated dispensing cabinets generate two kinds of data a diversion program actually uses: individual discrepancy reports (a count doesn’t reconcile at the point of removal or return) and aggregate outlier reports (a user’s removal frequency, removal-to-administration time gap, or waste rate sits meaningfully outside their peer group’s pattern). Neither is a DEA- or ASHP-defined metric set with a single correct threshold — vendors and health systems vary in exactly what they track and how sensitive the alerting is tuned — but the two practices that separate a working program from a paper one are consistent across the field: every discrepancy gets resolved and documented within a defined window (same-shift resolution is common practice; a growing backlog of “still investigating” discrepancies is itself a warning sign), and outlier reports get reviewed on a fixed cadence rather than only when someone happens to notice. See smart pump drug library governance for the adjacent infusion-pump side of this same surveillance discipline, and ISMP’s targeted medication safety best practices for the broader self-assessment context these controls sit inside.
Witnessed wasting: a practice standard, not a DEA rule
Two-person witnessed wasting — a second clinician independently verifies and co-signs the destruction of an unused partial dose — is one of the most consistently applied diversion controls in hospital pharmacy, and it’s worth being precise about its legal status: DEA regulation does not name witnessed wasting as a requirement. 21 CFR 1301/1304 govern security controls and inventory, not the mechanics of partial-dose disposal. Witnessed wasting is a practice standard promoted by ASHP and ISMP and, in many states, required or expected under state board of pharmacy or board of nursing rules and individual hospital policy — which means the specific requirement (is a witness mandatory for every waste, or only above a threshold; does the witness need to observe destruction or just co-sign the record) varies by state and by facility policy, not by federal law. A program that states “witnessed wasting is a DEA requirement” in its own policy has a citation it can’t actually produce if challenged; state it as what it is, an evidence-based practice standard your facility has adopted. Some health systems have moved toward supplementing witnessed wasting with random waste testing (return-to-lab verification that a “wasted” quantity is actually the drug in question, not a substituted substance) as an added layer, on the reasoning that a compromised witness relationship provides no real check — a genuine and growing practice, though not yet a codified requirement anywhere.
Investigation and reporting duties
When surveillance turns up a real pattern, the program’s response function has three separate audiences, each with its own duty:
- Internal escalation — the diversion prevention committee’s defined investigation path: pulling the full ADC transaction history for the individual, cross-referencing against scheduled shifts and patient census, and involving HR/legal before any conversation with the employee.
- CMS reporting — 42 CFR §482.25(b)(7)’s requirement to report abuses or losses to the person responsible for pharmacy services and to the CEO is a Condition of Participation, not optional internal practice; a confirmed diversion event that never reaches that reporting line is itself a compliance gap independent of the underlying diversion.
- External reporting — DEA Form 106 for a theft or significant loss of controlled substances, plus applicable state board of pharmacy/nursing licensure reporting and, where a patient may have been harmed (a diverted dose replaced with saline, for example), the hospital’s own patient-safety event process. The Joint Commission’s Quick Safety Issue 48 (April 2019), “Drug diversion and impaired health care workers,” is the most directly on-point accreditation-adjacent guidance here — it’s an advisory bulletin recommending practice (staff education on signs of impairment, a defined reporting and support pathway), not a standard that’s separately scored on survey.
A program that has strong detection but no rehearsed answer to “who do we call, in what order, once we’ve confirmed this” turns a caught diversion into a slower, messier response than it needs to be — the investigation path is worth writing down and testing before it’s needed, the same discipline as a root cause analysis process for any other patient safety event.
How this connects to the rest of medication safety
Diversion prevention overlaps with, but is distinct from, several adjacent programs already covered here. Opioid stewardship governs appropriate prescribing — it shapes whether an opioid order is clinically justified at all, upstream of whether the dispensed drug reaches the patient intact. High-alert medication safeguards and the smart pump drug library reduce harm from error, not theft, though the same ADC and pump data streams often feed both programs. And a confirmed diversion event that reached a patient (a syringe swap, a diluted vial) is itself a reportable patient safety event that should route through the hospital’s standard root cause analysis and patient safety plan structure, not be handled solely as a personnel matter.
Frequently asked questions
Is a diversion prevention committee required by law?
No federal regulation requires a hospital to have a named diversion prevention committee. The requirement that exists is functional: 42 CFR §482.25’s Conditions of Participation expect a hospital to be able to readily identify loss or diversion, and DEA’s 21 CFR 1301.71/1301.72 require effective controls against theft. A standing committee is the practical way most hospitals meet those functional expectations, not a distinct legal mandate in its own right.
Does DEA require witnessed wasting for partial doses?
No. Witnessed wasting is a practice standard from ASHP and ISMP, often reinforced by state board of pharmacy or nursing rules and hospital policy — not a DEA regulation. Check your state board’s specific requirement rather than assuming a uniform national rule.
What’s the difference between a diversion prevention program and opioid stewardship?
Opioid stewardship governs whether and how much of a controlled substance should be prescribed in the first place — it’s a clinical-appropriateness program. Diversion prevention assumes the prescribing decision was appropriate and focuses on whether the dispensed drug actually reached the patient, rather than being stolen or substituted along the way. See opioid stewardship programs for the prescribing side.
Who has to be told when a diversion is confirmed?
At minimum: the person responsible for pharmacy services and the hospital CEO, per 42 CFR §482.25(b)(7). Depending on the facts, that also extends to DEA (Form 106 for theft/significant loss), the relevant state licensing board, and — if a patient may have received a diverted-and-substituted dose — the hospital’s own patient safety event process.
