Abstract
Objectives
Drug theft by healthcare workers is a recognized problem in emergency departments (EDs) that can lead to patient, healthcare worker, and organization harm. Diversion takes various forms, including tampering with syringes, pilfering from waste containers and falsely documenting drug administration. Before implementing risk-mitigating interventions, we need a detailed understanding of the vulnerabilities in ED medication-use processes. This study sought to identify the critical failure modes (CFMs) within EDs that increase diversion risk and characterize the system factors contributing to CFMs.
Methods
Between June 2018 and February 2019, we conducted observations in two Ontario EDs. Observers recorded tasks carried out by nurses, pharmacists, and physicians. We performed a Healthcare Failure Mode and Effect Analysis, informed by the observation data, to proactively identify CFMs in the medication-use processes. Failure modes were coded for their effects on diversion risk and the contributing system factors.
Results
We identified 28 CFMs that increase diversion risk by enabling inappropriate access to controlled substances or compromising documentation. CFMs are multifactorial, stemming primarily from factors related to person (e.g., intent to divert) and tools/technology (e.g., limited automatic reconciliation of records), followed by organization (e.g., practices that diffuse accountability), environment (e.g., workspaces that obscure illicit behaviours), and task (e.g., unstructured processes leading to lapses).
Conclusion
The study findings inform opportunities to revise vulnerable processes and bolster safeguards, decreasing diversion risk and protecting patients and healthcare workers.
Introduction
Diversion is the term used to describe the transfer of drugs from legitimate medical use to unlawful personal substance use or trafficking. 1 Diversion or theft of controlled substances by healthcare workers is increasingly recognized as a serious problem facing emergency departments (EDs) and other healthcare systems globally.2–6 High rates of pilferage and unexplained losses have been reported from hospitals, 7 suggesting weaknesses not only in the security of controlled substances but also in the ability of hospitals to investigate losses.
There are complex multiple system factors (e.g., tools/technologies, environment, and tasks) that contribute to diversion vulnerabilities in medication-use processes (MUPs; which include ordering, dispensing, preparing, administering, wasting, or returning unused medications). 8 Examples include using electronic ordering, dispensing, and administering record systems that do not automatically identify discrepancies (tool/technology factor)9,10; stocking medications in unit dose packages larger than the doses that are typically ordered resulting in the accumulation of drug waste that is prone to diversion (organization factor)8,11; placing the medication preparation area in a dimly lit low traffic location where tampering can occur hidden from view (environment factor) 12 ; and having one healthcare provider retrieve and prepare medications that are administered by another provider which obscures the chain of custody (task factor).1,12,13 Guidelines and recommendations to mitigate diversion risk have focused on person-based interventions (e.g., remedial training and policy/protocol reinforcement).1,12 Identification of more effective multifaceted system-based interventions, such as environmental redesigns, technological solutions, and organization-wide commitment to diversion, 3 requires an understanding of the underlying workflow and the environmental, technological, organizational, and other system factors contributing to diversion risk.
Diversion risks within hospitals vary between clinical areas, and several characteristics place EDs at high risk for diversion,1,12 including rapid turnover of patients, frequent ordering and administration of controlled substances, and complex time-sensitive workflows.8,14 The high volume of medication transactions taking place in the presence of non-admitted patients, under the care of a wide variety of health care workers, makes it difficult to physically secure every dose withdrawn from stock and can lead to gaps in documentation. These unique characteristics of the ED can obscure various forms of diversion, including stealing vials, tampering with syringes, and pilfering from waste containers. For example, diversion was discovered within a hospital ED when a worker died from inadvertently injecting a neuromuscular blocking agent she assumed was an opioid in an unlabelled discarded syringe.14,15 An investigation uncovered that she had been pillaging from hospital waste bins for at least a year before she died. Although hospitals cannot identify and prevent every way that an individual may divert, they can identify vulnerabilities and implement safeguards. For the example above, the use of waste containers that neutralize substances and make them irretrievable (a tool/technology safeguard), the placement of waste containers in locations where they are under surveillance (an environment safeguard), and availability of smaller volume doses stocked on the unit (an organization safeguard) could address different vulnerabilities and mitigate diversion risk. We currently lack a holistic understanding of system factors leading to vulnerabilities within high-risk clinical areas like the ED.
Human factors is the discipline concerned with understanding the interactions among humans and system factors. The System's Engineering Initiative for Patient Safety (SEIPS) is a human factors framework that defines five components of a work system (i.e., person, tool/technology, organization, environment, and task) and describes their interactions. 16 Characterizing diversion vulnerabilities using the SEIPS framework will strengthen our understanding of the system factors at play and align interventions to those specific system factors.
The study objectives were to (a) proactively identify vulnerabilities in the current processes for handling and documenting controlled substances in EDs and (b) characterize system factors that contribute to these vulnerabilities.
Methods
A multimethod study design was used whereby clinical observations informed a Healthcare Failure Mode and Effect Analysis (HFMEA). Research ethics board approval was granted through Clinical Trials Ontario (REB #1354). Further information about our study rationale and design as well as details on specific methodologies is provided in our published protocol. 17
Clinical observations
Study setting and participants
Observations were conducted in the EDs of two hospitals in Toronto, Ontario (see Table 1 for hospital demographics and observation details). Automated dispensing cabinets (ADCs) were used in both sites for controlled substances. Orders and medication administration were recorded using paper charts for non-admitted patients and an electronic health record (EHR) system for admitted patients. The EHR systems in both EDs integrate patient information and clinical documentation with computerized provider order entry systems, medication administration records, and pharmacy medication management systems.
Characteristics of the hospitals and observation sessions in two emergency department (ED) sites.
ADC: automated dispensing cabinet.
Purposive sampling was used to recruit participants who had a role in at least one component of the MUPs in the ED (i.e., nurses, physicians, pharmacists). Participants provided written informed consent prior to being observed.
Data collection
Observations were conducted for four weeks at each site (Site 1: June 17–July 14, 2018; Site 2: November 11–17, 2018 and January 20–February 9, 2019). Each observation session lasted 1–4 h, depending on participants’ availability and the task(s) being observed. A pair of trained observers (i.e., one with experience as a hospital pharmacist and one with expertise in human factors) took free-form notes and photographs of the environment, technology, and supplies. Observations continued until data saturation was reached, wherein new variation in task performance was not observed.
Notes were transcribed into Word© and uploaded onto a secure SharePoint© site. Observation data were uploaded into MAXQDA© version 2018.1 data management and analysis software. The data were organized by coding for role, technology, context, setting, process, medication, and other (e.g., documentation, handling, vulnerability, and safeguard). The list of codes is available in Table A1 in the supplemental material. This created a structured dataset for analysis in the HFMEA.
Healthcare failure mode and effect analysis
We followed the HFMEA approach outlined by DeRosier and colleagues 18 to identify critical failure modes (CFMs). First, the study team created process maps describing the MUPs observed in each ED. The observation notes and structured dataset were then used to list the tasks and subtasks that make up each MUP. Any discrepancies that arose during the mapping process were resolved through discussion amongst the team members who conducted the observations or by seeking clarification from study participants. Second, for each subtask, two study team members independently brainstormed potential failure modes and their effects. The data collected during the observations informed the brainstorming process to identify the ways in which the work system (person, tools/technology, organization, environment, and task) 16 may be vulnerable to diversion. If any discrepancies in the potential failure modes existed after combining the list, consensus was achieved through discussion with a third team member. Third, two study team members independently scored the failure modes on how often the failure could occur (probability) and the severity of its effect. A third team member helped resolve any discrepancy in scores. As per the HFMEA protocol, the probability and severity scores were multiplied to obtain the hazard score of each failure mode. Fourth, CFMs were identified using the HFMEA decision tree analysis to prioritize the list of potential failure modes. The decision tree considers a failure mode's hazard score, whether it is a single-point weakness, whether a control is already in place to stop the failure from occurring or if the failure is so readily apparent and immediately detectable that a control measure would not be warranted. Two team members independently conducted the decision tree analysis and then met to discuss and reach an agreement on the set of CFMs.
Two study team members coded each CFM as (a) compromised access (e.g., inappropriately gaining access or accessing increased amounts of controlled substances), (b) compromised documentation (e.g., falsification of clinical or inventory documentation), (c) or both, based on the categorizations previously described in the literature review by Fan et al. (2019). Similarly, two study team members identified the system factor(s) involved in each CFM based on the SEIPS work system components (i.e., person, tool/technology, organization, environment, or task). 16 The study team met to reach consensus on the CFM categorizations and provide descriptions of the work system factors that enable or contribute to each CFM (e.g., clinician intent, limitations of a tool, existence of policies, layout of the space, and sequence of a task).
Results
We observed six MUPs: ordering, dispensing, preparing, administering, wasting, and returning controlled substances. Figure 1 depicts the MUPs and enumerates the tasks contained within each process. The tasks and failure modes were similar at the two ED sites; therefore, we combined the HFMEA results and present a summary of the findings observed at both sites. For a detailed description at the subtask level, see Table A2 in the supplemental material.

The medication-use processes (MUPs) and tasks observed in both emergency departments. Numerical values reflect the general chronological order; however, not all MUPs or tasks occur for every medication interaction. ADC: automated dispensing cabinet; CS: controlled substance.
Critical failure modes
We identified 101 potential failure modes that introduce vulnerabilities for diversion. Of these, 28 met the criteria for CFMs. Table 2 lists each of the CFMs, provides where they occur in the MUPs and whether they impact access, documentation, or both. For further description of the CFMs and their effects on diversion risk, see Table A3 in the supplemental material. CFMs were identified in every MUP: eight CFMs were identified in ordering, five in dispensing, five in preparing, four in administering, five in wasting, and five in returning. Table A2 in the supplemental material indicates the detailed tasks and subtasks within the MUPs and shows where each CFM occurs.
Critical failure modes (CFMs), their location in the medication-use processes (MUPs) and the categorization of their effect on access and/or documentation.
*Access, CFMs that effect access to controlled substances; Documentation, CFMs that effect integrity of documentation. ADC: automated dispensing cabinet; CS: controlled substance(s); EHR: electronic health record.
As shown in Table 2, 29% (8/28) are CFMs that both enable inappropriate access to controlled substances and compromise documentation. Thirty-two percent (9/28) of CFMs are failures that exclusively enable inappropriate access through unauthorized access or access to an increased amount of controlled substances which could be pilfered (e.g., dispensing a larger quantity or substituting the medication with saline before administering). The remaining 39% (11/28) are failures that exclusively compromise the integrity of documentation which impairs the ability to trace the inventory or chain of custody of controlled substances and obscures the detection or investigation of diversion incidents (e.g., forging orders or falsifying the amount administered).
System factors involved in the CFMs
Person, tools/technology, organization, environment, and task-related factors characterize the CFMs within each of the MUPs (Table 3). Person factors, including intention to divert, using insider knowledge, and unintentional actions of individuals, were involved in 100% of CFMs; tools/technology factors were involved in 86%; task factors in 64%; organization factors in 57%; and environment factors in 39%. Regardless of whether the CFMs compromise access or compromise documentation, the distribution of system factors involved is similar. The tools/technology factors are mainly related to either a limitation of a tool/technology (e.g., cannot perform or enforce an action) or the absence of a tool/technology (e.g., lack of secure bins to transport medications). Several of the task factors relate to how the unstructured nature of a task or its sequence (e.g., interruptions when transporting medications to address patient needs) or timing in relation to other tasks (e.g., delay in wasting while waiting for a witness to become available) contributes to the vulnerability of the system. Organization factors describe certain established practices and resource limitations (e.g., availability of tamper-evident packaging) or decisions (e.g., procurement of amount of drug in unit-dose packaging) which increase diversion risk. The environment factors include how characteristics of the ED can obscure illicit behaviours (e.g., dimly lit medication preparation areas) or encourage the use of shortcuts and workarounds (e.g., long distances between ADCs and patient care areas discourage timely wasting of excess medication). Further descriptions and examples of system factors within each MUP are available in Table A4 in the supplemental material.
System factors involved in the critical failure modes (n = 28).
Discussion
Diversion stems from individuals seeking to divert; however, intent alone is insufficient to successfully divert. 19 Our results suggest that modifications to other system factors, which interact with person factors, are required to substantially mitigate diversion risk.
Configurations of system factors can precipitate increased risk for diversion in the ED by either (1) facilitating inappropriate access to controlled substances and/or (2) violating the integrity of documentation. CFMs that compromise documentation of orders and dispenses can enable individuals to gain unsanctioned access to controlled substances, access a greater quantity, or access a different form (e.g., intravenous vs oral formulations). Improper administration, wasting, or returning records can then hinder detection of the unapproved access.
In some cases, a CFM may be addressed by a single intervention. An example where a tool-related intervention addresses a tool-related factor would be to address pilfering controlled substance waste from unlocked waste containers by installing containers with one-way locked systems or replacing containers with faulty locking lids. Moreover, interventions can be made more robust by considering the other factors involved in a CFM. In this example, also addressing the policies and procedures for maintenance of waste containers (i.e., organization) and placement of locked containers on the unit (i.e., environment) would bolster efforts to prevent pilfering from waste containers. It is often the case that addressing a diversion factor from one SEIPS category requires an intervention related to another SEIPS category. 16 For example, installing surveillance cameras (i.e., a technological safeguard) modifies the environment making it harder to obscure diversion in those areas. In this way, cameras can act as deterrents as well as provide recordings when an investigation is required. 20
Although a single intervention is sufficient in some cases, a broader program of diversion mitigation is likely required for most institutions. Since each CFM stems from diverse system factors, implementation of a single safeguard will often have a limited effect. 21 Instead, a suite of complementary interventions is needed. For example, both of the sites we observed used ADCs, which act as locked storage systems and increase the ability to trace medication transactions. Although ADCs are a critically important tool for tracking who has accessed what medications and at what time, they are insufficient to independently and comprehensively prevent or detect diversion. The use of ADCs for detecting diversion requires additional complementary safeguards, such as the ability to integrate its data to electronic ordering and administration records (i.e., technological safeguard), policies to dictate when and what kinds of analyses to run (i.e., organizational safeguard), and what to do when discrepancies are found (i.e., task safeguard). An interlocking set of interventions across system factors should be considered for all diversion mitigating strategies.
Our observational findings provide detailed analysis of the tasks, procedures, equipment, and environment. This level of granularity is critically important for the development of effective diversion mitigation strategies as it is based on how clinical workflows actually occur in day-to-day work rather than how the processes “should” occur (e.g., based on policies or managerial expectations). One limitation of our study is that staff may behave differently from their usual practice when being observed. Such an effect, however, would likely bias our observations to the most accepted ways of performing tasks and would not interfere with our ability to brainstorm potential failure modes. Another limitation is that we may not have hypothesized all strategies for diversion but having multiple team members with clinical and human factors expertise participate in the HFMEA enhanced our ability to identify potential failures. Conducting the study at two sites similar in their location, size, use of ADCs and mix of paper-based and electronic patient records enabled us to compare and triangulate our findings. The same CFMs were identified at both sites, thus these findings are likely most relevant to EDs with similar processes.
Conclusion
Mitigation of diversion risks in the ED requires addressing vulnerabilities stemming not only from individual actions, but from the interaction between person, tools/technology, environment, organization, and task factors. Our study provides an understanding of the systemic vulnerabilities that increase diversion risk in the ED that can be adapted by organizations to revise vulnerable processes and bolster safeguards and can inform broader efforts to develop guidelines and technological solutions to decrease diversion risk.
Supplemental Material
sj-pdf-1-cri-10.1177_25160435231174309 - Supplemental material for Critical vulnerabilities for diversion of controlled substances in the emergency department: Observations and healthcare failure mode and effect analysis
Supplemental material, sj-pdf-1-cri-10.1177_25160435231174309 for Critical vulnerabilities for diversion of controlled substances in the emergency department: Observations and healthcare failure mode and effect analysis by Maaike de Vries, Mark Fan, Dorothy Tscheng, Michael Hamilton and Patricia Trbovich in Journal of Patient Safety and Risk Management
Supplemental Material
sj-pdf-2-cri-10.1177_25160435231174309 - Supplemental material for Critical vulnerabilities for diversion of controlled substances in the emergency department: Observations and healthcare failure mode and effect analysis
Supplemental material, sj-pdf-2-cri-10.1177_25160435231174309 for Critical vulnerabilities for diversion of controlled substances in the emergency department: Observations and healthcare failure mode and effect analysis by Maaike de Vries, Mark Fan, Dorothy Tscheng, Michael Hamilton and Patricia Trbovich in Journal of Patient Safety and Risk Management
Supplemental Material
sj-pdf-3-cri-10.1177_25160435231174309 - Supplemental material for Critical vulnerabilities for diversion of controlled substances in the emergency department: Observations and healthcare failure mode and effect analysis
Supplemental material, sj-pdf-3-cri-10.1177_25160435231174309 for Critical vulnerabilities for diversion of controlled substances in the emergency department: Observations and healthcare failure mode and effect analysis by Maaike de Vries, Mark Fan, Dorothy Tscheng, Michael Hamilton and Patricia Trbovich in Journal of Patient Safety and Risk Management
Supplemental Material
sj-pdf-4-cri-10.1177_25160435231174309 - Supplemental material for Critical vulnerabilities for diversion of controlled substances in the emergency department: Observations and healthcare failure mode and effect analysis
Supplemental material, sj-pdf-4-cri-10.1177_25160435231174309 for Critical vulnerabilities for diversion of controlled substances in the emergency department: Observations and healthcare failure mode and effect analysis by Maaike de Vries, Mark Fan, Dorothy Tscheng, Michael Hamilton and Patricia Trbovich in Journal of Patient Safety and Risk Management
Footnotes
Acknowledgements
The authors thank Devika Jain and Adrian Ragobar for supporting research ethics board applications, Rachel Reding and Jessica Tomasi for conducting and documenting observations, and Lesley Graham for her support in brainstorming failure modes and scoring the probability and severity of the failure modes. The authors offer their gratitude and thanks to the emergency department staff who allowed them to conduct observations and willingly supported this research and provided clarification and context to this analysis.
Declaration of conflicting interests
The author(s) declared the following potential conflicts of interest with respect to the research, authorship, and/or publication of this article: MDV, MF, and PT have received honoraria from BD – Canada for presenting at BD-sponsored events. BD – Canada was not involved in the design of the study, or in the collection, analysis, or interpretation of data, nor was BD – Canada involved in the writing of this article or the decision to submit the article for publication.
Funding
The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: This work was supported by BD – Canada (Becton Dickinson Canada Inc) [grant number ROR2017-04260JH-NYGH].
Supplemental material
Supplemental material for this article is available online.
References
Supplementary Material
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
