How to Detect and Prevent Drug Diversion - Lessons from an Academic Medical Center. Session Objectives

Transcription

1 How to Detect and Prevent Drug Diversion - Lessons from an Academic Medical Center Presenters Tim Marshall, Director, Oregon Health & Science University Meaghan Smith, Lead Auditor, Oregon Health & Science University Session Objectives After this session, participants will be able to: Demonstrate an understanding of regulatory requirements for controlled substances. Describe key controls and processes to prevent and detect potential diversion of controlled substances. Utilize data analysis to monitor and identify trends and concerns in handling of controlled substances. 1

2 Agenda OHSU and Audit & Advisory Services Drug Diversion Overview Regulations Audit Overview Key Controls Data Analysis Training and Monitoring Questions OHSU and Audit & Advisory Services 2

3 Oregon Health and Science University (OHSU) OHSU is a university, a research facility, and a hospital - Oregon s only public academic medical center. $2.8 billion annual operating budget (FY16) $389.6 million grants/awards 15,642 employees 3,454 students in OHSU degree programs 290,194 patient visits 576 licensed beds Audit & Advisory Services Our Team o Director: Tim Marshall, CIA o Lead Auditor: Meaghan Smith, CPA, CIA, MBA o Senior Auditor: Mona Rabii, CIA, CISA, CGAP o Senior Auditor: Open o Integrity Analyst: Allee Griffin 3

4 Drug Diversion Overview The Drug Overdose Epidemic The United States is in the midst of an unprecedented drug overdose epidemic 91 Americans die every day from an opioid overdose From 1999 to 2013, the amount of prescription opioids dispensed in the U.S. nearly quadrupled, without an overall change in the amount of pain reported The most common drugs involved in prescription opioid overdose deaths include Methadone, Oxycodone, and Hydrocodone Source: 4

5 Introductory Discussion Questions 1. What is drug diversion? 2. What are some potential impacts of drug diversion? Drug Diversion Defined Uniform Controlled Substances Act Diversion is defined as the transfer of a controlled substance from a lawful to an unlawful change of distribution or use. Centers for Disease Control and Prevention - Drug diversion occurs when prescription medicines are obtained or used illegally. 5

6 Why Do People Divert? Personal use o Self-medicating for mood, sleep, or pain o Recreational use o Support an addiction Provide to a known associate (family member, friend, neighbor, etc.) Sell for financial gain Case Study 1 Exeter Hospital David Kwiatkowski, a traveling radiology technician who worked at 19 hospitals in 8 states, infected at least 45 people with hepatitis C via tainted syringes. Discussion Question: What could the hospitals have done differently to stop the diverter sooner? 6

7 Drug Diversion Risks Patient Institution Diverter Substandard care delivered by an impaired provider Denial of essential pain medication Risk of blood-borne infections Negative publicity Financial loss Regulatory and civil liability o $2.3M Mass General Hospital o $1.55M Dignity Health Loss of accreditation Exclusion from participation in federal healthcare programs Health risks, including morbidity/mortality Civil and criminal penalties Suspension or loss of professional license Loss of personal relationships Source: Source: Source: Regulations 7

8 Applicable Regulations The Controlled Substances Act of 1970 (CSA) Centers for Medicare and Medicaid Services (CMS) Conditions of Participation Joint Commission standards for medication management Other federal agencies o Environmental Protection Agency (EPA) wasting of hazardous controlled drugs State and local laws o State prescription drug laws o Board of Pharmacy o Other professional licensure boards Controlled Substances Act of Overview The Controlled Substances Act (CSA) is the federal U.S. drug policy that regulates controlled substances The Drug Enforcement Agency (DEA) was established in 1973 to enforce the regulations of the CSA The CSA lists the schedules of controlled drugs and provides various requirements for any entity that manufactures, distributes, dispenses, imports, or exports controlled drugs 8

9 Controlled Substances Act of Schedules Schedule Description Examples Schedule I No accepted medical use, high potential for abuse Heroin, Ecstasy Schedule II Has a currently accepted medical use, high potential for abuse Oxycodone, Fentanyl, Morphine Schedule III Schedule IV Schedule V Non-controlled Has a currently accepted medical use, moderate to low potential for abuse (< Schedule I and II) Has a currently accepted medical use, low potential for abuse (< Schedule III) Has a currently accepted medical use, low potential for abuse (< Schedule IV) Drugs that are not subject to the Controlled Substances Act Codeine, Vicodin, Ketamine Xanax, Valium, Ambien Cough preparations such as Robitussin AC Propofol, insulin, asthma inhalers, antibiotics Controlled Substances Act of Requirements Registration with the DEA (21 CFR ) Physical security controls for controlled substances (21 CFR ) Notification of loss/theft within 1 business day of discovery (21 CFR ) Employee responsibility to report drug diversion (21 CFR ) Maintain records and inventories (21 CFR 1304) Perform biennial inventory of all controlled substances (21 CFR ) Ordering requirements for CI and CII drugs (21 CFR 1305) Destruction of controlled substances (21 CFR ) 9

10 CMS Conditions of Participation Centers for Medicare and Medicaid Services (CMS) develops Conditions of Participation (CoPs) that health care organizations must meet to participate in Medicare and Medicaid programs Conditions of Participation for hospitals related to pharmaceutical services (see 42 CFR ): o Current and accurate records must be kept of the receipt and disposition of all scheduled drugs o All drugs and biologicals must be kept in a secure area, and locked when appropriate o Abuses and losses of controlled substances must be reported The Joint Commission Standards The Joint Commission sets standards that organizations are required to meet to receive accreditation The Joint Commission standards for medication management include: o The hospital safely manages high-alert and hazardous medications o The hospital safely stores medications, including security of the drug between the time it is dispensed and when it is administered to the patient o Medication orders are clear and accurate o The hospital evaluates the effectiveness of its medication management system 10

11 Audit Overview Audit Objectives & Scope Objective: The purpose of the engagement was to assess the effectiveness of controls and processes in place to prevent, detect, and respond to drug diversion. Scope: The review focused on controls and processes related to controlled substances (Schedule II through Schedule V) stored at the inpatient pharmacy as well as at selected nursing units, procedural areas, operating rooms, and clinics. The review did not include outpatient/retail pharmacy processes. 11

12 Key Areas and Processes Reviewed Inpatient pharmacy ordering, receiving, stocking, physical security, monitoring Nursing and procedural units with Omnicell automated dispensing cabinets dispensing, wasting, physical security Clinics without Omnicell automated dispensing cabinets dispensing, wasting, physical security, manual inventory records Operating rooms dispensing, wasting, physical security Physicians prescriptions Audit Procedures Reviewed OHSU policies and procedures related to controlled substances Performed observations at inpatient pharmacy as well as 10 nursing units/procedural areas, 5 clinics, and 3 operating rooms Reviewed documentation for a sample of controlled substance orders Reviewed badge access reports for inpatient pharmacy Reviewed inventory count reports and processes Reviewed Record of Controlled Substances documentation for clinics without Omnicell cabinets Performed data analytics on Omnicell controlled drug transactions Reviewed Omnicell user access lists and assigned access levels for reasonableness Reviewed Omnicell monitoring reports used to follow-up on potential discrepancies 12

13 Key Controls Ordering & Receiving Ordering & Receiving Authorized Purchasers Risk: Unauthorized employees purchase controlled drugs Audit Procedures: Review Power of Attorney forms for designated purchasers, validate recent orders have only been made by authorized purchasers Questions to Consider: o Do designated purchasers have a current Power of Attorney form authorizing purchase of Schedule I and II controlled drugs? o Are all controlled drug orders made by authorized purchasers? o Are controlled drugs electronically ordered through the secure DEA Controlled Substance Ordering System (CSOS)? o Is the paper DEA Form 222 (controlled substance order form) used for Schedule I or II controlled drug orders? How are blank DEA 222 forms secured? 13

14 Ordering & Receiving Segregation of Duties Risk: Responsibilities for purchasing and receiving of controlled drugs are not adequately segregated Audit Procedure: Perform observation of purchasing and receiving processes Questions to Consider: o Are different employees responsible for the following duties? Purchasing controlled drugs Receiving controlled drug deliveries Stocking controlled drugs Reconciling the vendor invoice to receiving documentation Case Study 2 Emory University Hospital At Emory University Hospital Midtown, two pharmacy technicians ordered and received controlled drugs without authorization and then sold those drugs for profit. Discussion Question: What controls were circumvented in order for this scheme to work? 14

15 Key Controls Physical Security Physical Security of Controlled Drugs Risk: Controlled drugs are not adequately secured prior to dispensing Audit Procedure: Perform observations at inpatient pharmacy, nursing units, procedural areas, operating rooms, and clinics where controlled drugs are stored Questions to Consider: o Where are controlled drugs stored at your hospital or institution? o Are controlled drugs stored in badge-access controlled areas? o Are security cameras in place? (pharmacy) o Are controlled drugs stored in automated dispensing cabinets? o Are controlled drugs stored in a safe? Who has access to the code or key? 15

16 Badge Access Risk: Badge access to areas where controlled drugs are stored is not restricted Audit Procedure: Review badge access reports from Public Safety Questions to Consider: o How is badge access restricted at pharmacy locations? Is badge access restricted only to staff with pharmacy roles? Are there additional restrictions to pharmacy locations with controlled drugs? How frequently are badge access user lists reviewed for pharmacy locations? Do terminated employees have badge access to pharmacy locations? Do pharmacy staff access times align with shift schedules? o How is badge access restricted within hospital units and procedural areas? Additional restrictions for designated med rooms where controlled drugs are stored? Omnicell Access Cabinet Type Profiled Automated Dispensing Cabinet Profiled cabinets are linked to a patient s Epic Administration Record (MAR). Users can only withdraw medications from the cabinet that are on the individual patient s MAR, which are medications that have been ordered by a physician and verified by a pharmacist. There is an override process that allows for a medication to be dispensed in emergency situations. Nonprofiled Automated Dispensing Cabinet - Nonprofiled cabinets allow a user to access and withdraw any medication for any patient as long as the medication is stocked in the cabinet. Nonprofiled cabinets are generally located in procedural areas where the type and quantity of medication may not be known in advance. Non-profiled cabinets may be set up to dispense only single doses of medications. 16

17 Omnicell Access Set Up Risk: Access to Omnicell cabinets where controlled drugs are stored is not restricted Audit Procedure: Review Omnicell access reports from Pharmacy Questions to Consider: o What department manages hospital Omnicell access? o Are users required to complete a training before being granted Omnicell access? o What approvals are required to be granted Omnicell access? o What user access controls have been implemented for Omnicell cabinets? Unique user ID and password? Biometric fingerprint scan? o Is access to Omnicell cabinets restricted by the provider type and unit area? o Are student nurses granted access to dispense controlled drugs? Omnicell Access - Updates Risk: Access to Omnicell cabinets is not updated timely for terminated or transferred employees Audit Procedure: Review Omnicell access reports from Pharmacy Questions to Consider: o How is Omnicell access removed for terminated employees? Is access removed in a timely manner? o How is Omnicell access updated for employees that transfer to a different unit? o Are Omnicell accounts set up to automatically expire due to inactivity? Are any users exempt from inactivity aging? 17

18 Key Controls Inventory Counts Inventory Counts at Pharmacy Risk: Biennial controlled drug inventory counts are not performed for controlled drugs stored in Pharmacy locations Audit Procedure: Observe inventory count procedures, review inventory count records Questions to Consider: o How frequently are controlled drugs counted? o Are inventory counts performed with a witness? o What documentation is maintained for inventory counts? 18

19 Inventory Counts at Omnicell Units Risk: Biennial controlled drug inventory counts are not performed for controlled drugs stored in Omnicell cabinets within hospital units, procedural areas, and operating rooms Audit Procedures: Observe inventory count procedures, review Omnicell cycle count data Questions to Consider: o Who is responsible in the unit for performing cycle counts? o How frequently are cycle counts performed? o Are cycle counts performed with a witness? o What happens if a cycle count isn t completed? o Who monitors to ensure cycle counts occur as expected? o How are discrepancies in cycle counts resolved and reported? Inventory Counts at Clinics Risk: Biennial controlled drug inventory counts are not performed for controlled drugs stored at clinic locations without Omnicell cabinets Audit Procedures: Observe inventory count procedures, review Record of Controlled Substances for documentation of inventory counts Questions to Consider: o Who in the clinic is responsible for performing inventory counts? o How frequently are inventory counts performed? o Are inventory counts performed with a witness? o How are inventory counts documented? o Who monitors to ensure inventory counts occur as expected? o How are discrepancies in inventory counts resolved and reported? 19

20 Record of Controlled Subtances Key Controls Waste 20

21 Regulations for Waste 21 CFR Methods of Destruction: All controlled substances to be destroyed by a registrant, or caused to be destroyed by a registrant pursuant to (c), shall be destroyed in compliance with applicable Federal, State, tribal, and local laws and regulations and shall be rendered non-retrievable. DEA Final Rule on Disposal of Controlled Substance (September 9, 2014): o Regulations will not specify recommended methods of destruction o Controlled substances must be permanently rendered to an unusable state o Statement that sewering (disposal by flushing down a toilet or sink) and landfill disposal (mixing controlled substances with undesirable items such as kitty litter or coffee grounds and depositing in a garbage collection) are examples of current methods of disposal that do not meet the nonretrievable standard (Discussion of Comments section page 53548) Waste at Pharmacy Risk: Unused controlled drugs are not properly wasted or returned Audit Procedure: Observe wasting and expired drug procedures at pharmacy Questions to Consider: o How are controlled drugs wasted in the pharmacy? o Is a reverse distributor used for wasted or expired drugs? o Where are wasted or expired drugs stored prior to disposal? o How frequently does the reverse distributor pick up? o Does a pharmacy staff member observe the pick-up and sign off on the reverse distributor s pick-up report? 21

22 Waste at Omnicell Units Risk: Unused controlled drugs are not properly wasted or returned Audit Procedure: Observe drug wasting procedures at hospital units with Omnicell cabinets Questions to Consider: o Is a witness required for waste transactions at Omnicell cabinets? o Are units required to waste within a certain time after dispensing? o Where are drugs physically wasted? o Are sharps containers adequately secured and disposed of? Returned Drugs at Omnicell Units Risk: Unused controlled drugs are not properly wasted or returned Audit Procedure: Observe drug return and expired drug procedures at hospital units with Omnicell cabinets Questions to Consider: o What is done with unused drugs that were dispensed but not administered? o Is a witness required to return unused dispensed drugs at Omnicell cabinets? o What is the process for emptying the Omnicell cabinet return bins? o How are expired drugs identified and disposed of? 22

23 Waste at Clinics Risk: Unused controlled drugs are not properly wasted or returned Audit Procedure: Observe drug wasting procedures at clinics without Omnicell cabinets Questions to Consider: o Are dispensed and wasted amounts documented? o Is a witness required to observe and sign-off on the waste? o Where are drugs physically wasted? o Are sharps containers adequately secured and disposed of? o How is waste secured until pickup? Waste in Operating Rooms Risk: Unused controlled drugs are not properly wasted or returned Audit Procedure: Observe drug wasting procedures at operating rooms Questions to Consider: o How do anesthesiology providers secure drugs prior to wasting? o Do anesthesiology providers waste drugs with a witness? o How do anesthesiology providers document waste? o Does pharmacy reconcile anesthesiology waste? o Are anesthesiology providers allowed to hand-off dispensed drugs during a case? How are hand-offs documented? 23

24 Key Controls Reporting Reporting Diversion Risk: Instances of controlled drug theft or significant loss are not reported as required Audit Procedure: Review reporting procedures, review DEA Form 106 reports Questions to Consider: o Are employees trained on their responsibility to report? o What are the reporting guidelines for each clinical area? o Is pharmacy notified of all cases of diversion? o Is proper notification made to all required parties? DEA, Board of Pharmacy, Public Safety (Clery Act reporting), medical licensing boards o Are reports made within required timeframes? (DEA = within 1 business day of discovery) o Are reviews of patient charts and billing records performed for confirmed diversion cases? 24

25 Case Study 3 Ball Memorial Hospital At Indiana University Ball Memorial Hospital, an anesthesiologist diverted narcotics and provided anesthesia during surgeries while under the influence. Discussion Question: What signs/symptoms of diversion were observed by staff members? Data Analysis 25

26 Data Analysis Overview Data Scope: All controlled drug transactions that occurred at all Omnicell cabinets Data Time Period: 4 months of data Data Fields: Cabinet ID/Name, Date, Time, Item ID/Name, Transaction Type, Transaction Sub-Type, Quantity Issued, Quantity Wasted, Strength/Units, Patient ID, Patient Name, User Name, Witness Name Summary Results: o 519,534 transactions o 103 Omnicell cabinets o 2,515 users Data Analysis Common Transaction Types Transaction Type Issue Waste Null Discrepancy Cycle Count Restock Return Expired Transaction Description A drug was dispensed A dispensed drug was partially or entirely wasted A bin was opened but no drug was removed (transaction cancelled) There was a difference between the Omnicell quantity of a controlled drug and the quantity entered by the user The user performed a cycle count (blind count) of a bin The bin was replenished with additional medication A dispensed unopened drug was placed in the Omnicell return bin A dispensed expired drug was placed in the Omnicell return bin 26

27 Data Analysis Tests to Consider Transaction Type Null Discrepancy Waste Cycle Count Post-Discharge Override Analysis Identify users with frequent null (cancelled) transactions for potential tampering and substitution Identify users/clinics with frequent or unresolved count discrepancies Identify users with high waste volumes or wasting complete doses, users with a frequent buddy witness, or users witnessing their own waste Identify units that are not performing cycle counts Identify users that are issuing drugs for patients who have already been discharged Identify users that remove a medication without an order Null Transactions Risk: A high number of null (cancelled) transactions without a related discrepancy (possible tampering and substitution) Location # of Null Transactions Unit #1 2,740 Unit #2 796 Unit #3 768 Unit #4 697 Unit #5 532 User Name # of Null Transactions User #1 431 User #2 404 User #3 328 (blank user) 268 User #

28 Discrepancy Resolution Risk: A high number discrepancy transactions or unresolved discrepancies Location Transaction Type # of Transactions Discrepancy 238 Unit #1 Discrepancy Resolution 238 Unit #2 Discrepancy 117 Discrepancy Resolution 116 Unit #3 Discrepancy 103 Discrepancy Resolution 76 User Name # of Discrepancies User #1 79 User #2 52 User #3 52 User #4 50 User #5 46 Waste Risk: Frequent wasting, user/witness waste patterns, same user/witness User # of Waste Transactions User #1 289 User #2 267 User #3 261 User #4 243 User #5 220 User Witness # of Waste Transactions User #1 Witness #1 57 User #2 Witness #2 53 User #3 Witness #3 51 User #4 Witness #4 44 User #5 Witness #5 44 User Witness # of Waste Transactions User #1 User #1 288 User #2 User #2 267 User #3 User #3 240 User #4 User #4 220 User #5 User #

29 Cycle Counts Risk: Counts of controlled drugs are not in compliance with policy requirements (weekly at unit Omnicell cabinets, monthly at pharmacy Omnicell cabinets), missing drugs are undetected Omnicell Cabinet # of Cycle Counts Cabinet #1 18 Cabinet #2 15 Cabinet #3 13 Total number of cabinets = 103 Cabinets with all cycle counts completed = 47 (46%) Cabinets that missed one cycle count = 26 (25%) Cabinets that missed 2 or more cycle counts = 21 (20%) No cycle counts performed at one unit due to staff transition Cabinets with no cycle counts (not in use, no controlled drugs) = 9 (9%) Post-Discharge Transactions Risk: Drugs issued to patients that have already been discharged Transaction Type # of Post-Discharge Transactions Waste 435 Return 146 Issue 27 Modify Bin 16 Expired 10 User Name # of Post- Discharge Issues User #1 1 User #2 2 User #3 1 User #4 1 User #5 2 No user with more than 2 issues that occurred after a patient was discharged 29

30 Override Medication List Medications are approved for emergency overrides by the Medication Safety Committee Overrides are approved for each medication, strength, and use at individual units Overrides Risk: Frequent removal of drugs without an order (override) in non-emergent areas Location # of Overrides Unit #1 3,470 Unit #2 618 Unit #3 589 Unit #4 442 Unit #5 333 User Name # of Overrides User #1 396 User #2 385 User #3 228 User #4 88 User #

31 Overrides Risk: Removal of drugs that have not been approved for override Finding Medication was approved by the committee as an override medication, but was not added to the Override Medication List Medication type and strength was not approved for the location of the Omnicell # of Medications # of Transactions Case Study 4 Massachusetts General Hospital Massachusetts General Hospital (MGH), Harvard s largest teaching hospital, paid a record $2.3 million settlement after it was discovered that two nurses stole nearly 16,000 pills. Discussion Question: What methods were used to divert drugs from the automated dispensing machines (ADMs)? 31

32 Training and Monitoring Education and Training Risk: Healthcare employees are not educated on the risks and signs of drug diversion Audit Procedure: Review training materials provided to healthcare employees, ask staff about training received during observations Questions to Consider: o What trainings are available, by clinical area, that address drug diversion in the healthcare setting? o Pharmacy, nursing, anesthesiology, other healthcare employees o Does training cover signs and symptoms of diversion? o Does training cover employee responsibility and procedures for reporting? o Is training mandatory or recurring? 32

33 Monitoring Discrepancy Resolution Risk: Controlled drug discrepancies are not resolved timely Audit Procedure: Review discrepancy resolution reports Questions to Consider: o How are discrepancies resolved within each clinical area? o Pharmacy discrepancies between delivery and receipt o Nursing cycle and bin count discrepancies o Clinics daily inventory count discrepancies o Anesthesiology waste reconciliation discrepancies o Is there an expected timeframe for resolving discrepancies? o How are discrepancies monitored and tracked? o What happens if a discrepancy cannot be resolved? Monitoring User Activity Reports Usage reports sent out monthly to nurse managers and division directors by unit for all controlled substances Pharmacy performs 100% transaction audits of any nurse above 3 standard deviations relative to peers 33

34 Monitoring Medication Administration Records Risk: Controlled drug administrations are not properly documented Audit Procedure: Review pharmacy medication administration record audits, trace a sample of dispensed medications to medication administration records Questions to Consider: o Does pharmacy have a manual or electronic process to audit dispensed medications to medication administration records? Automated electronic reconciliation between Omnicell dispensing/wasting records and Epic medication administration records Manual comparison of Record of Controlled Substances to Epic medication administration records Manual reconciliation of anesthesiology waste to Omnicell dispensing and Epic anesthesia records Monitoring Prescriptions Self and family prescribing o Match prescribing provider s emergency contact information to patient information o Match prescribing provider name and patient name Printed prescriptions o Identify printed prescription orders that were cancelled within a short timeframe (24 hours) Note: Electronic prescriptions require two-factor authentication from a DEA registered practitioner 34

35 Case Study 5 UConn Student Health Services A pharmacy supervisor at University of Connecticut Student Health Services fraudulently filled prescriptions and ordered controlled drugs to sell to known associates. Discussion Question: What controls would have prevented or detected the diversion? Questions? 35

36 Contact Information Tim Marshall, Director o marshalt@ohsu.edu o (503) Meaghan Smith, Lead Auditor o smimea@ohsu.edu o (503) Useful Resources Drug Enforcement Administration Diversion Control Division o DEA Title 21 Code of Federal Regulations, Part o DEA Practitioner s Manual and Pharmacist s Manual o DEA Final Rule on Disposal of Controlled Substances CMS Conditions of Participation: Pharmaceutical Services Centers for Disease Control and Prevention Opioid Epidemic Massachusetts General Hospital (MGH) Settlement Agreement Omnicell Drug Diversion Central Minnesota Hospital Association Drug Diversion Resources 36

37 Auditing Human Resources: A Look at HR within the Audit Organization Presenter Rachel Snell Audit Director Coast Community College District

38 About the Presenter Experienced in public & private industry, operations & audit Published in professional journals MPA CIA, CRMA, CFE, CICA Served in leadership and committee roles for professional organizations A Sun Devil (Go ASU!) Chief Audit Executive in Higher Education, Director of Internal Audit

39 Learning Objectives Review the added value of auditing HR Discuss the human capital conundrum Evaluate examples of HR in action & inaction Explore common HR risks and Audit Plan relevance

40 Human Capital Conundrum Without humans, there is nobody around to operate a business that means there is no business Human Resources revolves around Human Capital Things cannot be made, shipped, or sold Vendors/people cannot be paid Buildings we work in cannot be built Humans have direct impact on business operations Nobody is hired or around to do the hiring

41 Human Capital Conundrum Layoffs often the first go to when trying to cut costs Needing human resources is unavoidable, but there is a business and interpersonal cost that should be balanced Recruitment, hiring, retention, background checks, facilities Health care, pensions, safety, professional development

42 Human Capital Conundrum Inability to manage human capital leads to barriers to productivity, morale, lawsuits, negative media attention (reputation barriers) ADA, FMLA, Workers Comp, Harassment, Non- Discrimination, FLSA Personality conflicts, diverse communication styles

43 Human Capital Conundrum Although some may argue, aren t auditors HUMAN too? We are recruited, hired, retained, trained We use FMLA, require an ADA reasonable accommodation We work in a company owned facility We get injured on the job Do we want/need to add value to the organization? Audits cannot get done without people We recruit, hire, and train employees We contribute to workplace diversity We encounter interpersonal conflict

44 Economist warns Legislature: Arizona could lose up to $100 million after laying off 26 tax auditors Layoffs to reduce budget by $7 million; Could lead to decreased oversight; Agency reports: Decreases in corporate income tax and technological improvements to flag potentially questionable returns a) reduces likelihood of revenue loss and b) decreases need for back-end auditing. Deputy Director stated We hope they would not take this as a signal to start cheating. Auditors/collectors bring in between $1-$2 million each, according to annual reports. Ronald J. Hansen, The Republic azcentral.com Published 6:40 p.m. MT Oct. 5, 2016 Updated 11:48 p.m. MT Oct. 5, 2016;

45 Human Capital Conundrum Wrap Up HR= capital Auditors = human capital No HR capital, no business All departments need to demonstrate value Auditors add value by helping others maximize their value Ineffective HR management increases risk of higher costs across operational areas Audit departments are no different from the other business units within the organization

46 Common HR Risks-Discrimination Examples of Conduct Organization Audit Department Inequity in hiring, discipline, promotion, job duties Race/culture/beliefs or opinions for personnel decisions/ job duties Get a job because of who you know within the organization Peer files grievance stating co-worker s job better suited for different department Job interview Appearance better suited for a different department Management policy you have to be related to work at the business Hiring manager wants easy name to pronounce Hiring manager favors graduates from a program/ university Hiring Manager knew the employee s sister.

47 Common HR Risks-Fraud, Waste, Abuse Examples of Conduct Organization Audit Department Filing false insurance or worker s compensation claims Calling out sick, but not really sick Using leave to work secondary employment Claims examiner Colluded with third parties to file fraudulent insurance claims Employee called out sick, but was observed at the airport for vacation Manager operates own business outside of primary employment Peer Filed worker s compensation claim during time under new supervisor Employee called out sick, but was observed dining with another employee Employee used vacation time to work at a special establishment

48 Common HR Risks-Harassment, Bullying, Constructive Discharge Examples of Conduct Organization Audit Department Insults/intimidation, use other employees to gather information on each other Inappropriate advances or other inappropriate material Forcing an employee to resign (constructive discharge) Employees not attending meetings, send other employees to check up Inappropriate photographs circulated via Move work location far from home; change to inconvenient work hours Peer confronted in restroom. Repeated told, I hope you fail in front of staff Comments about attire, jewelry, physical appearance. Elevator eyes Remove assignments and ability to maintain professional connections

49 Common HR Risks- Background Checks Background Checks Organization Audit Department Criminal History Employment and reference verification Hiring an employee with criminal history to work in purchasing Employee hired with false documents indicating education that was inaccurate Employee had unresolved issues in another state, albeit false allegations Employee had great reference checks but was unable to perform the job duties.

50 City failed to do background checks on hundreds of Rikers employees Department of Correction No criminal background checks on hundreds of healthcare workers since Took department 8 months to catch up. Fingerprint cards provided by medical contractor piled up on a desk in HR. Contract employee with kidnapping record brought razor into the prison; Another employee also caught bringing contraband into the jail system. Medical contractor blamed for poor vetting, but contractor blames department for not doing the background checks as per contract. DOC HR Director retired; medical contractor might lose contract. By Yoav Gonen June 6, :41am The New York Post

51 Common HR Risks-Effect Examples of Potential Risk Organization Audit Department Lawsuits/employee turnover increase costs to recruit, hire, train new employees hinders productivity and morale Reputation-bad place to work, poor management, lack of leadership Overall challenges to meet mission and operate efficiently, effectively, and economically Financial strain, resources pulled from other buckets to meet demand Difficulty in recruiting and hiring quality candidates Yes Credibility, decrease productivity, potential for decrease quality of work. Difficulty in recruiting and hiring quality candidates Yes

52 Common HR Risks-Audit Plan Likelihood of HR issue occurring # of employees $ spent responding to human capital events $ spent on human capital investments Internal HR review should be part of our own continuous improvement. Perform more HR related analytics during audits.

53 HR Risks Wrap Up HR= risky business HR analytics untapped market Audit plan should include HR self-assessment, but also identify business-wide HR issues to review. Cost to address issues correlates to employee # and $ spent on human capital Audit entities encounter same challenges as all business units

54 HR in Action and Inaction: Case Studies Real Case Scenario 1 Action or Inaction? Are you just thumbing your nose at me? You re a loser. Where you re going they ll figure out they need to contract out for an auditor. We need your help cleaning up some personnel issues. You re not a superstar. Stop making everyone look bad. I don t care about audit standards, and neither will anyone else when I m done with you.

55 HR in Action and Inaction: Case Studies Real Case Scenario 2 Action or Inaction? Eyewitness News KABC7 March 25, 2014 Fullerton firefighters concerned over hazards, respiratory issues Firefighters complain of respiratory problems, runny eyes/noses, coughing at three stations, and claim officials knew about the health hazards, but nothing has been done. Black debris from air vent tested positive for fiberglass among the dirt. At one station, documents show officials knew about asbestos in Another station posted a warning "not to enter the attic." It says "the department will deal with the situation as soon as possible." Tests at another station show mold and asbestos. The Fullerton Firefighters Association filed a complaint with Cal/OSHA.

56 HR in Action and Inaction: Case Studies Real Case Scenario 3 Action or Inaction? (07/25/17) World-class ophthalmologist runs medical school; hopes to transform U.S.C. s image from party/football school for children of the wealthy, mostly white, elite, into a major academic research institution. Dr. Carmen A. Puliafito raised ranking and hundreds of millions of dollars. Kind of bon vivant at glittery parties, grinning for the camera alongside celebrities like Pierce Brosnan, Martin Short and Jay Leno while bringing in as much as $9 million in a single night. However, LA Times detailed how he associated with criminals, used drugs on campus, some escapades captured in videos. University under scrutiny Did it deliberately turn a blind eye? Pasadena hotel a woman apparently overdosed in front of Dr. Puliafito. Police found meth, but no report filed for months. No criminal charges. City manager said the episode reflected poorly on the city and police department.

57 HR in Action or Inaction Wrap Up Common issues face public and private industry Inappropriate behavior occurs in all departments and organizations, including audit News Reputation/ Credibility Tone at the Top Cost of Doing Something v. Nothing

58 Value of Auditing Audit Opportunity for CAE to demonstrate leadership and serve as an example of Tone at the Top Encourage internal reflection of work environment without fear of retribution Opportunity to improve internal culture and processes Train staff in policies that may be misunderstood, and reinforce expectations Hold management accountable for developing and implementing improvement strategies

59 Value of Auditing Audit Opportunity for internal audit to lead by example and serve as an a model of Tone at the Top Conduct HR analytics and audits that show results that include the audit department. Opportunity to demonstrate the audit department is secure in itself to acknowledge it can also improve. Perform reviews of itself in the same manner as other business units. Hold management accountable for developing and implementing improvement strategies.

60 Value of Auditing Audit Opportunity for internal audit to review its approach to audit planning and the risk elements that make up the Plan Conduct HR analytics and separate into prioritized cost centers so that can be compared to other risk centers of the organization Maintain commitment to continuous improvement and risk-based approach to audit project selection Continue to support professional/personal development, that is not only inclusive of audit certifications, but other degree programs and audit plan subjects Hold management accountable for developing and implementing improvement strategies

61 Value of Auditing Audit HR Wrap Up Human capital is the foundation of any entity, including the audit function. Audit has same HR challenges as other business units Commit to creating a positive work culture while showing stakeholders that auditors hold themselves just as accountable, which builds credibility Include HR audits and continuous improvement projects in the audit plan. These are value-adding steps to mitigate risk and lead by example

62 Questions

63 Case Study 1 Exeter Hospital David M. Kwiatkowski worked as a traveling radiology technician at 19 hospitals in eight different states. Kwiatkowski diverted syringes of Fentanyl intended for patients, despite knowing he was infected with Hepatitis C. Kwiatkowski would take syringes filled with fentanyl from a procedure or operating room, inject himself in a bathroom, refill the syringes with water, and then return those syringes to the procedure room for use on patients undergoing procedures. Instead of receiving their prescribed doses of fentanyl, those patients actually received saline tainted with Hepatitis C virus. Kwiatkowski also stole vials of leftover drugs which were tossed into trash cans after procedures. Kwiatkowski was discovered after multiple unexplained cases of Hepatitis C occurred at Exeter Hospital in New Hampshire, one of the hospitals where he had worked. This led to a public health investigation across several states and investigation by the CDC. The investigation determined that many healthcare facilities, employees, and staffing agencies did not report concerns about Kwiatkowski s conduct to licensing boards and other employers during reference checks. For example, after being fired from one hospital, a staffing agency declared Kwiatkowski drug-free after he passed a urine drug test; however, fentanyl only shows up in blood tests. The staffing agency also did not report he had been fired and put him back on its list of radiology technicians available for hospitals. The hospital that had fired him had performed a blood test that showed his blood was full of fentanyl; however, this information was not provided to the staffing agency nor did the staffing agency ask for the results of the blood test. As a result of the investigation, the CDC recommended that more than 12,000 patients seek testing for Hepatitis C. 45 patients to date have been confirmed to carry a strain of Hepatitis C that is linked to the strain Kwiatkowski is infected with, one of the largest hepatitis outbreaks in decades. Exeter Hospital was later sued by 33 former patients infected with the virus, as well as another 188 patients who tested negative but claimed emotional distress for undergoing testing. The settlement amounts were not made public. Exeter Hospital is now suing the staffing agency that placed Kwiatkowski at the hospital to be reimbursed for the settlement amounts. Sources: 1. Former Employee of Exeter Hospital Sentenced to 39 Years in Connection with Widespread Hepatitis C Outbreak. U.S. Attorney s Office District of New Hampshire. December 2, Schreiber, Jason. Exeter Hospital settles with more than 200 patients in hepatitis C case. New Hampshire Union Leader. April 6, /Exeter-Hospital-settles-with-more-than-200- patients-in-hepatitis-c-case 3. Eichenwald, Kurt. When Drug Addicts Work in Hospitals, No One is Safe. Newsweek.com. June 18, Pierce, Jenelle Marie. Exeter Hospital Challenges Partial Dismissal of 2012 HCV Outbreak Lawsuit. HepatitisC.net. February 13,

64 Case Study 2 Emory University Midtown Hospital Emory University Midtown Hospital lost more than 2 million doses of prescription drugs after two pharmacy techs illegally diverted the drugs in a scheme that lasted from 2008 to The diverted drugs included: 1.2 million doses of hydrocodone with acetaminophen 110 gallons of promethazine with codeine (a cough syrup) More than 420,000 doses of alprazolam (Xanax) After the hospital placed a legitimate order with its wholesaler, the pharmacy technicians used a misappropriated pharmacist s password to make an illegal purchase. Once the wholesaler approved it, the techs erased the second order from the computer system. Both orders would arrive at the same time with separate receipts. The technicians would hide the paperwork from their second order and cart it away. Security video showed them rolling cardboard cases of drugs on carts down the street. Both pharmacy techs were hourly employees and were driving a Mercedes Benz or BMW. The scheme may have gone on longer had Emory Midtown not changed its financial accounting system. Within a month, hospital administrators became aware of a suspicious unauthorized purchase by one of the pharmacy technicians of Schedule III, IV, and V drugs. The incident was reported to the Georgia Drug and Narcotics Agency and U.S. Drug Enforcement Administration. The drug scheme that ran from Emory University Hospital Midtown s pharmacy was reported as the biggest that state investigators had ever seen at a hospital. The operation put an estimated $20 million to $40 million of the most addictive prescription drugs on the streets, according to the Georgia Drugs and Narcotics Agency Executive Director Rick Allen. The Georgia State Board of Pharmacy placed the hospital s pharmacy license on probation for three years and ordered the hospital to pay a $200,000 fine. The registrations for three technicians were revoked by the state pharmacy board. Sources: 1. Mariano, Willoughby. How theft ring stole millions of drugs from Emory. The Atlanta Journal-Constitution. March 10, law/how-theft-ring-stole-millions-drugs-from-emory/0grb0srs2kcxx85ljmtbxi/ 2. Years of large-scale drug thefts reported at an Emory Hospital. Georgia Health News. March 8,

65 Case Study 3 Indiana University Ball Memorial Hospital An anesthesiologist named Jose Ramos working at IU Health Ball Memorial Hospital (BMH) stole narcotics and participated in medical procedures after ingesting the stolen drugs. On October 5, 2015, a nurse notified supervisors that Ramos appeared to be drugged or high while administering anesthesia during a procedure. She described the physician as drowsy, not making eye contact, and not answering questions or providing a report about the patient. Ramos was later found by a staff member in a restroom available only to operating staff with a hypodermic needle cap and what appeared to be blood. Further review found that Ramos had withdrawn more medication than necessary for two patients that day. Blood and urine samples taken that night showed that, when he provided anesthesia to two patients during surgeries that day, Ramos was under the influence of marijuana, morphine, Meperidine, Hydromorphine and Fentanyl. The director of pharmacy services contacted the DEA on October 6, 2015 to report records from Ramos surgical cases showed multiple instances in which controlled substances were not charted as being administered to a patient. Records also showed Ramos had not returned those drugs, nor had they been wasted. In addition, a nurse in the labor and delivery unit said she witnessed unusual wasting of Fentanyl by Ramos. Other nursing staff observed unusual behavior by Ramos while he worked at the Ball Outpatient Surgery Center, including going to the restroom between every case and reluctance to make eye contact by the end of a shift. Ramos took a leave of absence from BMH and entered into a physician addiction treatment program. After an 8 month investigation, he was arrested by U.S. Drug Enforcement Administration agents in July He was charged with four felony counts of possession of a narcotic drug, four misdemeanor counts of theft, and two counts of criminal recklessness. Ramos pleaded guilty and received two years probation. His medical license was placed on emergency suspension by the state s medical licensing board. Sources: 1. Walker, Douglas. Muncie anesthesiologist accused of stealing, using drugs on the job. The Star Press. July 7, /07/06/bmh-anesthesiologistaccused-stealing-using-drugs-job/ / 2. Walker, Douglas. Physician gets probation in Muncie drug case. The Star Press. March 23, physician-gets-probation-muncie-drug-case/ /

66 Case Study 4 Massachusetts General Hospital An investigation was launched in 2013 after Massachusetts General Hospital (MGH) reported to the Drug Enforcement Administration (DEA) that two of its nurses had stolen nearly 16,000 pills, mostly oxycodone, between October 2011 and April Both nurses stole from automated dispensing machines (ADMs) used to store and dispense prescription medications. Patient names remained active in the ADMs up to 72 hours postdischarge, allowing the nurses to dispense drugs for discharged patients. Drugs were also diverted using medication overrides and null transactions such as wrong bin opened. Pharmacy staff were not alerted to medication overrides in ADMs and had no monitoring process in place. In addition, nursing supervisors failed to regularly review ADM reports and in some cases were not aware how often they were expected to reports. The DEA s audit of MGH s controlled substances revealed pill count discrepancies totaling over 20,000, missing or incomplete medication inventories, and hundreds of missing drug records. In the largest settlement involving drug diversion at a hospital, MGH agreed to pay the United States $2.3 million to resolve allegations that lax controls enabled MGH employees to divert controlled substances for personal use. MGH also agreed to implement a corrective action plan which included: Establishment of an internal drug diversion team Creation of a full-time drug diversion compliance officer position Mandatory training of all staff with access to controlled substances, including how to identify the signs and symptoms of substance abuse Increased physical controls of controlled substances, including limiting and monitoring access to ADMs through fingerprint identification Enhanced diversion monitoring by supervisors and management Sources: 1. Anderson, Travis. Mass. General to pay $2.3 million over drug thefts. Boston Globe News. September 28, NNgyVznhbmJnRuc3W2dYOK/story.html 2. MGH to Pay $2.3 Million to Resolve Drug Diversion Allegations. Department of Justice, U.S. Attorney s Office District of Massachusetts. September 28,