Controlled Substances: DEA Should Take Additional Actions to Reduce Risks in Monitoring the Continued Eligibility of Its Registrants
Highlights
What GAO Found
The Drug Enforcement Administration (DEA) has established controls for determining registrant eligibility to handle and prescribe controlled substances. However, GAO found limitations in DEA's controls to help ensure that individual registrants are and remain eligible and do not present issues that may increase the risk of illicit diversion. GAO's examination of DEA's controlled substances database (CSA2) as of March 2014 (the most-current data available) revealed gaps and other issues pertaining to registrants' identifying information. For example, GAO's analysis identified 40,785 of about 1.4 million individual registrations that were registered using a business tax identification number instead of a Social Security number (SSN). According to DEA officials, DEA does not have legal authority to require SSNs for individuals applying as a business. For individuals registered with an SSN, GAO found 11,740 SSNs that could not be validated by the Social Security Administration (SSA) and 688 SSNs that were registered to multiple names or variations of names, which can be a risk indicator of potential fraud. SSNs are needed to identify and remove deceased registrants as well as identify any past adverse history that may affect registrant eligibility. Given that SSNs are critical to validating identities, implementing DEA's controls, and identifying registrants' past adverse history, obtaining legal authority to require SSNs for all individuals and developing policies and procedures to validate them would help ensure that registrants are and remain eligible.
GAO also found limitations in DEA's processes for verifying continued eligibility of its registrants. Of the approximately 1.4 million individual registrations in CSA2 as of March 2014, GAO found 764 registrants who were potentially ineligible because they were reported deceased by SSA, did not possess state-level controlled substance authority, or were incarcerated for felony offenses related to controlled substances. GAO also found 100 registrants who presented issues that may increase the risk of illicit diversion, such as registrants incarcerated for offenses unrelated to controlled substances, registrants with active or recent warrants, and registrants listed as sex offenders. DEA does not have processes in place to verify its registrants' state licenses or criminal background after initial registration, unless the registrant self-reports or the state notifies DEA of actions taken against its registrants. Developing processes to monitor registrant state licensure and disciplinary actions, such as verifying that registrants maintain appropriate state authority and assessing the cost and feasibility of monitoring registrants' criminal backgrounds, would help ensure that registrants maintain eligibility to handle and prescribe controlled substances and do not present issues that may increase the risk of illicit diversion.
Number of Drug Enforcement Administration Controlled Substance Registrants Who Were Potentially Ineligible or May Increase the Risk of Illicit Diversion, as of March 2014
|
Indicator |
Total number of registrations |
|
Registrants who were potentially ineligible because they were reported deceased, did not possess state-level controlled substance authority, or were incarcerated for felony offenses related to controlled substances |
764 |
|
Registrants who may increase the risk of illicit diversion because they were incarcerated for other offenses, had active or recent warrants, or were listed as sex offenders |
100 |
Source: GAO analysis of Department of Justice, Social Security Administration, and state licensing board data. | GAO-16-310
Why GAO Did This Study
DEA registers individuals and entities authorized to manufacture, distribute, or dispense controlled substances in accordance with the Controlled Substances Act, which seeks to ensure that only authorized individuals handle controlled substances. States also have a role in the registration process as they determine general licensing requirements for health-care professionals who are permitted to handle or prescribe controlled substances. Controlled substances include prescription pain relievers, such as OxyContin, stimulants, and sedatives.
GAO was asked to review DEA's processes for registering applicants, monitoring the eligibility of registrants, and managing CSA2 data. This report assesses the extent to which DEA's internal controls help ensure that individual registrants are and remain eligible and do not present issues that may increase the risk of illicit diversion, among other objectives. GAO reviewed relevant documents and interviewed DEA and state officials. GAO matched CSA2 data to several databases to identify potentially ineligible registrants.
Recommendations
GAO is making five recommendations to DEA to help ensure practitioners are and remain eligible and that those who pose an increased risk of illicit diversion are identified. DEA stated it appreciated the intent of GAO's recommendations, but raised concerns about its legal authority to take some of the actions. GAO's recommendations include having DEA seek legal authority as needed, and remain valid.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Drug Enforcement Administration | To help ensure that practitioners who may be ineligible do not possess a controlled substance registration and that practitioners who pose an increased risk of illicit diversion are identified, the Acting Administrator of DEA should take additional actions to strengthen verification controls. Specifically, the Acting Administrator of DEA should develop a legislative proposal requesting authority to require SSNs for all individuals, regardless of whether they hold an individual or business registration. |
Closed – Implemented
In June 2020, DEA provided us with copies of correspondence indicating it held a meeting with Congressional staff to discuss DEA's authority to require SSN information for all individual registrants. While legislative action was not subsequently pursued, by requesting this authority, DEA has taken steps to better ensure that the ineligible practitioners do not possess controlled substance registrations and those who pose an increased risk of illicit diversion are identified.
|
| Drug Enforcement Administration | To help ensure that practitioners who may be ineligible do not possess a controlled substance registration and that practitioners who pose an increased risk of illicit diversion are identified, the Acting Administrator of DEA should take additional actions to strengthen verification controls. Specifically, the Acting Administrator of DEA should develop policies and procedures to validate SSNs and apply the policies and procedures to all new and existing SSNs in the CSA2; such an approach could involve collaborating with SSA to assess the feasibility of checking registrants' SSNs against the Enumeration Verification System. |
Closed – Implemented
In April 2018, DEA told us that it assessed the feasibility of directly collaborating with SSA to check registrants' SSNs against any SSA systems, including the Enumeration Verification System (EVS), and is unable to implement a data verification process to validate SSNs against EVS without legislative authority. Specifically, DEA said that access to SSA's systems would require passage of new legislation to authorize DEA to fully participate in a data exchange agreement with SSA, which DEA said was also confirmed by Senate staff. In June 2020, DEA provided documentation of SSA's response to DEA's request to access EVS which stated that SSA was unable to enter into a data exchange under the conditions DEA initially proposed. However, it also stated that SSA would explore granting DEA access if DEA requested number-holder's consent. Therefore, while we continue to believe there is a possible path forward in using SSA's service, in June 2021, DEA told us it decided not to pursue SSA's service. In addition, DEA told us that it would use information from the Federation of State Medical Boards (FSMB) to validate SSNs. However, in June 2021, DEA told us that it explored the feasibility of using this method but was ultimately unable to implement it. Further, as noted in our report, FSMB is limited to information for medical doctors, osteopathic doctors and some physician assistants, which make up only a portion of DEA's registrants. In July 2021, DEA issued a memorandum instructing Registrant Program Specialists to verify SSN and tax identification numbers using three investigative databases. While this policy does not apply to existing SSNs in CSA2, we believe that it substantially addresses the intent of our recommendation for new registrants moving forward. Taking additional steps to validate new applicants' SSNs will help establish registrants' identities and better ensure DEA has the information necessary to implement its existing controls and to identify other registrations held by each individual, including past adverse actions taken against previous registrations.
|
| Drug Enforcement Administration | To help ensure that practitioners who may be ineligible do not possess a controlled substance registration and that practitioners who pose an increased risk of illicit diversion are identified, the Acting Administrator of DEA should take additional actions to strengthen verification controls. Specifically, the Acting Administrator of DEA should develop a legislative proposal to request access to SSA's full death file. |
Closed – Implemented
In July 2018, DEA provided us copies of draft legislation and correspondence with Congressional staff discussing the development of draft legislation that would give DEA the authority to access SSA's full death file, which was subsequently introduced in the Senate as S.2374 or Stopping Improper Payments to Deceased People Act. By taking steps to request authority to access SSA's full death file, DEA can better ensure that the controlled substance registry maintains current registration information and to prevent others from potentially utilizing the registration information of deceased registrants.
|
| Drug Enforcement Administration | To help ensure that practitioners who may be ineligible do not possess a controlled substance registration and that practitioners who pose an increased risk of illicit diversion are identified, the Acting Administrator of DEA should take additional actions to strengthen verification controls. Specifically, the Acting Administrator of DEA should identify and implement a cost-effective approach to monitor state licensure and disciplinary actions taken against its registrants; such an approach could include using data sources that contain this information, such as the National Practitioner Data Bank or the Federation of State Medical Boards. |
Closed – Implemented
In response to our recommendation in April 2016, DEA stated it had met with the Federation of State Medical Boards (FSMB) officials and was exploring the use of FSMB service to verify registrants' licensure status and identify disciplinary information for those registrants contained within FSMB. In April 2018, DEA also said it was exploring how to establish a cost-effective system to obtain National Practitioner Data Bank (NPDB) information and will reevaluate the need to obtain NPDB information after DEA has had the opportunity to process the FSMB information it planned to obtain. In July 2018, DEA provided a copy of its purchase order award to FSMB. In June 2020, DEA stated it will not be taking additional action on obtaining NPDB. In June 2021, DEA told us it implemented its first FSMB record into the controlled substances database, CSA2, in December 2020. DEA provided a screenshot example of how FSMB has been integrated into CSA2 by creating a workload for review and action by a DEA Diversion Investigator or a Registration Program Specialist. As we reported, FSMB is one tool to help DEA monitor registrants' state licensure and disciplinary actions for the types of practitioners included in FSMB's services, such as medical doctors and osteopathic doctors. While FSMB does not include information on other types of individual practitioners, such as pharmacists, dentists, and veterinarians, among others, we believe that DEA's use of FSMB substantively addresses the intent of our recommendation as it covers a large proportion of DEA practitioner registrants. Developing procedures to verify that registrants maintain appropriate state authority and have not been subject to disciplinary actions that may affect their eligibility helps ensure that its registrants maintain eligibility to handle and prescribe controlled substances.
|
| Drug Enforcement Administration | To help ensure that practitioners who may be ineligible do not possess a controlled substance registration and that practitioners who pose an increased risk of illicit diversion are identified, the Acting Administrator of DEA should take additional actions to strengthen verification controls. Specifically, the Acting Administrator of DEA should assess the cost and feasibility of developing procedures for monitoring registrants' criminal backgrounds, such as conducting matches against federal law-enforcement databases, and document decisions about the approach chosen. |
Closed – Implemented
In August 2017, DEA told us it was working toward entering into a Memorandum of Understanding to exchange data with the Bureau of Prisons. Further, in April 2018, DEA told us that it reviewed and implemented several cost-effective procedures to obtain and monitor registrants' criminal backgrounds. Specifically, DEA stated that in 2016, it subscribed to the Federal Bureau of Investigation's electronic press releases. In December 2017, DEA added the U.S. Attorneys and the Department of Justice notices. DEA stated that it reviews these notices on a weekly basis for information on criminal actions involving medical professionals; and derogatory information about DEA registrants is forwarded to the responsible Diversion group for action. The responsible Diversion group then investigates further and takes any action on the registration it deems appropriate to address the situation fully. In June 2020, DEA provided us with a memo issued in December 2019 that requires its registration staff to conduct additional criminal history checks for all new applicants using two external databases in addition to its existing policy to check DEA's own Narcotics and Dangerous Drugs Information System. By taking these steps, DEA can better identify ineligible applicants and registrants whose criminal background may pose a risk of illicit diversion.
|