The current state of suspicious- order monitoring

The DEA was established in 1973 to prevent drug trafficking and diversion; but within the DEA, it is the Diversion Control Division that is tasked with preventing diversion of controlled pharmaceuticals from legitimate sources to illegitimate markets. As the abuse of opioids by US citizens continued to expand in the 2000s, the DEA established the Distributor Initiative Program in 2005 to educate registrants on maintaining effective controls against diversion, and monitoring for and reporting suspicious orders. Specifically, the Program expanded controlled-substance gatekeeper responsibilities from practitioners to chokeholds higher up the distribution chain--at pharmacy, distributor and manufacturer levels. Although pharmacists have a corresponding responsibility to ensure controlled substance prescriptions they filled were for legitimate medical purposes, DEA has been holding distributors and manufacturers accountable for pharmacies dispensing their drugs downstream.

DEA began enforcing a vague regulation for suspicious order monitoring that had been in place since 1971. Regulation requires manufacturers and distributors to design and operate a system to identify suspicious orders of controlled substances and to report suspicious orders to the local DEA Field Division upon discovery. 21 C.F.R. § 1301.74(b).

The regulation defines suspicious orders as:

• Orders of unusual size;
• Orders deviating substantially from a normal pattern; and
• Orders of unusual frequency.

What Does Robust Customer Due Diligence Look Like?

Suspicious Order Monitoring Programs should include:

• Detailed customer questionnaire.
• Verification of DEA registration and state licensure.
• Online investigation.
• Initial and periodic site visits.
• Dispensing/utilization reports.
• Review of all information by trained team member.
• Reporting/stop shipment/termination of customer mechanisms.
• Ongoing suspicious order monitoring.

Legal Enforcement

The CSA authorizes DEA to seek civil penalties for recordkeeping and reporting violations.

Failure to make, keep or furnish a complete and accurate record or report can result in civil penalties now up to $14,700 and in some cases, up to $63,500 per violation. Per fine violation varies on a case-by-case basis and is based on how DEA calculates alleged violations; each record can be counted as a separate violation.

DEA, with US Attorneys offices, has collected millions of dollars in civil penalties from distributors and manufacturers who allegedly distributed to pharmacies that dispensed for non-legitimate medical purposes.

For example, in recent years DEA collected:

• $13,500,000 from McKesson, 2008
• $34,000,000 from Cardinal Health, 2008
• $80,000,000 from Walgreens, 2013
• $44,000,000 from Cardinal Health/Kinray, 2016
• $150,000,000 from McKesson, 2017
• $35,000,000 from Mallinckrodt, 2017.

Types of Civil and Criminal Enforcement

Letters of Admonition: For minor recordkeeping, reporting and security violations, the local DEA office may issue a “Letter of Admonition” that identifies alleged violations requesting a response, usually within 30 days, of how the registrant will remediate.

Informal Administrative Hearings: The local DEA office following cyclic inspection, may issue a notice for the registrant to participate in a voluntary informal hearing to provide an opportunity to discuss alleged violations with DEA; often result in a Memorandum of Agreement.

Orders to Show Cause (“OTSC”): DEA can issue an OTSC to deny or revoke a registration where violations are more serious. The OTSC is served on the applicant/registrant, provides notice of the action and opportunity for a hearing. Applicants/registrants can now submit a corrective action plan prior to hearing. If DEA meets burden of proving sufficient evidence against continued registration, burden shifts to registrant. ALJ recommends decision; DEA Administrator or Deputy Administrator issues a final order, which applicant/registrant can appeal to appropriate U.S. Court of Appeals.

Immediate Suspension Order (“ISO”): DEA can issue an ISO when it believes continued registration creates “an imminent danger to the public health and safety;” i.e., potential ongoing diversion. DEA issues ISO contemporaneously with an OTSC. The purpose is to suspend authority to handle controlled substances while administrative proceedings are pending. ISOs continue in effect until conclusion of formal administrative proceedings. Registrants are entitled to an expedited hearing on the ISO/OTSC before DEA. The process for issuing an ISO was modified by Congress in 2016 (the Ensuring Patient Access and Effective Drug Enforcement Act), making the ISO standard more rigorous for DEA.

Recent high-profile DEA OTSCs and/or ISOs:

• Harvard Drug, 2011
• KeySource Medical, 2012
• Cardinal Health, Lakeland, Florida 2012
• Walgreens, Jupiter, Florida, 2013
• Masters, Pharmaceutical , Ohio, June 2017 (U. S Court of Appeals for the District of Columbia Circuit);
• McKesson, several facilities, 2017
• Morris & Dickson, Louisiana, 2018 (ISO overturned by U.S. District Court); matter pending before DEA.

Criminal and Forfeiture Enforcement:

The CSA also provides for criminal penalties against DEA registrants and non-registrants for knowing and intentional acts involving the unlawful manufacture, distribution, dispensing or other unlawful activities involving controlled substances. Criminal cases can arise where registrants act with reckless disregard or willful blindness in dispensing or distributing controlled substances.

Recent Legal Cases

Over the last decade, there have been a number of cases that the DEA pursued targeting Suspicious Order Monitoring programs for registrants.

Southwood Pharmaceuticals

The Southwood Pharmaceuticals case is one of the most straightforward cases in which the DEA has revoked a company’s ability to transact business in controlled substances. The company, closed March 2013, was subject to an extensive investigation by the DEA which found it was illegally shipping large quantities of controlled substances to multiple pharmacies that, at least partially, obtained prescriptions from the internet and through tele-medicine activities.

Mallinckrodt Pharmaceuticals: Manufacturers Must Analyze Chargeback Data

A truly landmark case for manufacturers - in July 2017, the DOJ demonstrated that manufacturers must maintain due diligence programs, including Suspicious Order Monitoring and Know Your Customer programs. Although manufacturers of opioids were normally targeted for alleged sales and marketing infractions, this is the first case that the DOJ pursued in which a manufacturer of opioids was targeted for allegedly failing to prevent diversion. A key takeaway for manufacturers of controlled substances is to review their current due diligence processes and ensure they have

Masters Pharmaceutical: Must Identify and Report Suspicious Orders

In August 2013, DEA issued Masters a “Show Cause Order” alleging that, between 2009 and 2011, Masters sold Oxycodone to eight of its retail pharmacy customers that it knew or should have known they were engaged in illegal diversion. After a bit of legal battle, on June 30, 2017, the Court of Appeals for the D.C. Circuit issued an order that confirmed the revocation of Masters’ DEA registration, preventing the Company from distributing any controlled substances.

Registrants must adhere to last year’s Masters Pharma-ceutical decision until DEA issues new regulations clarifying requirements. The Court agreed with DEA that suspicious orders are more than orders of unusual size, orders deviating substantially from normal pattern and orders of unusual frequency, and could include:

• Pharmacy dispensing high percentage of controlled to non-controlled substances;
• High percentage of cash paid for controlled prescriptions; and
• Prescriptions for large quantities of controlled substances for individual patients.

Distributors must analyze dispensing data from pharmacy customers to determine whether orders are suspicious and identify potential red flags. Distributors cannot obviate the reporting requirement by limiting order, deleting it or treating it as an attempted order. Once a registrant identifies an order as suspicious, it must report it to DEA (i.e., the “Reporting Requirement”).

If the distributor’s SOPs definition of “Orders of Interest” meets the definition of “suspicious orders,” they must be reported. Then, distributor can only fill and ship the order after conducting sufficient due diligence to dispel suspicion and ensure the drug will not be diverted (i.e., the “Shipping Requirement”).

Future Electronic Reporting of Suspicious Orders

Due to the opioid epidemic, there has been increasing public, industry and political pressure for DEA to revamp enforcement and provide clarity/transparency in their regulation of the supply chain.

The centralized database for the collection of suspicious order reports is required by the SUPPORT Act was to be up and running in October 2019. An RFP for the development of such a database was released on November 22, 2017 (RFP 15DDHQ18R00000001). Registrants will soon be required to access a new Suspicious Order Reporting system (SORS) to submit suspicious order reports. Suspicious Orders Reports will have over 10 components.

Registrants will be required to report the suspicious (i.e. “flagged” order), whether the registrant elected to proceed with the order, what steps the registrant took to determine whether the order was for legitimate purposes and whether the registrant ultimately distributed the controlled substances ordered, and, if so, the date on which the distribution occurred.

About The Author

Sumeet Singh is founder and president of Five Rivers RX. Based just outside of Philadelphia, Five Rivers RX provides actionable guidance and superior administrative services with a focus on client care across Compliance, Commercial, and Quality solutions.