Drug Control: Actions Needed to Ensure Usefulness of Data on Suspicious Opioid Orders

Since 1999, more than 700,000 people have died of a drug overdose in the United States, with about 48,000 dying of an opioid overdose in 2017 alone. The DEA administers and enforces the Controlled Substances Act as it pertains to ensuring the availability of controlled substances, including certain prescription drugs, for legitimate use while limiting their availability for abuse and diversion.

The Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act, enacted in 2018 included a provision for GAO to study the reporting of suspicious opioid orders on a real-time basis nationally using computer algorithms. This report examines, among other things, how DEA obtains and uses industry-reported data to identify and address suspicious opioid orders and opportunities for DEA to improve these efforts, such as using computer algorithms or real-time reporting. GAO analyzed program documentation and DEA data, and interviewed DEA and industry officials as well as officials from national associations representing distributors, investigators, state boards of pharmacy, and other federal and state agencies.

The Drug Enforcement Administration (DEA) collects industry-reported data on the sale and purchase of controlled substances and prescription drugs, including opioids. It uses these data to support ongoing investigations into the diversion of such substances into the illegal market place and to identify investigative leads for its field division offices.

GAO identified deficiencies associated with DEA's drug diversion efforts, including the following:

Limited proactive and robust analysis of industry-reported data. While DEA's current data systems are not designed to conduct real-time analysis, and it conducts some analyses of industry-reported data, such as in response to requests from its field division offices, DEA could conduct more analyses using automated computer algorithms to help identify questionable patterns in the data. For example, DEA could analyze data to identify unusual volumes of deleted transactions or unusual volumes of drugs that were disposed of rather than sold. It could also analyze data to identify trends in distribution or drug purchases in a given geographic area. Other analysis DEA could perform is to look for unusual patterns when comparing drug orders in one geographic area with other nearby areas. These analyses could potentially help DEA proactively identify suspicious activities or registrants that may warrant investigation.

No data governance structure to manage all drug transaction data. Although DEA has guidance, policies and procedures for the use of some information systems, it has not established a formal data governance structure to manage all data it collects and maintains, which are integral to its diversion control activities. A data governance structure is defined as an institutionalized set of policies and procedures for providing data governance throughout the life cycle of developing and implementing data standards. Industry and technology councils, domestic and international standards-setting organizations, and federal entities endorse the use of a governance structure to oversee the development, management, and implementation of data standards, digital content, and other data assets. While DEA began efforts to develop a governance structure, it is in the early stages of development and does not have additional details or documentation of its efforts. An effective data governance structure could help DEA ensure its important data assets are consistently and fully utilized.

GAO is making four recommendations related to DEA's collection and use of industry-reported data. DEA agreed with three of the four recommendations, and neither agreed nor disagreed with the fourth.

Since 1999, more than 700,000 people have died from a drug overdose in  the United States, with over 70,000 of those deaths occurring just in  2017, according to the Centers for Disease Control and Prevention  (CDC). About 48,000 of the 2017 overdose deaths involved an opioid,  including prescription opioids and illegal opioids like heroin and illicitly  manufactured fentanyl. Both the President’s Commission on Combating  Drug Addiction and the Opioid Crisis as well as the CDC noted that the  number of opioid overdose deaths has reached epidemic proportions in  the United States. The Department of Justice’s (DOJ) Drug Enforcement  Administration (DEA) plays a key role in addressing the diversion of  controlled substances as well as certain prescription drugs, including  opioids. Diversion occurs when legally produced controlled  pharmaceuticals are illegally obtained for non-medical use.

The prescription drug supply chain provides a means for controlled  substances to be distributed for useful and legitimate medical purposes,  but may also present opportunities for the drugs to be abused and  diverted into the illegal marketplace. Pursuant to the Controlled  Substances Act (CSA), as amended, registrants, such as distributors,  are subject to various recordkeeping and reporting requirements   including detecting and reporting to DEA any identified “suspicious  orders” for controlled substances. A “suspicious order” may include, but  is not limited to, an order of a controlled substance of unusual size, an  order of a controlled substance deviating substantially from a normal  pattern, and orders of controlled substances of unusual frequency.

DEA enforces the CSA enacted to regulate and facilitate the use of  controlled substances for legitimate purposes while preventing them from  being diverted for illegal ones. In about 2005, DEA began focusing its  attention on wholesale distributors of prescription opioids, which ship the  drugs from drug manufacturers to pharmacies, according to DEA  Diversion Control Division officials.

The Substance Use-Disorder Prevention that Promotes Opioid Recovery  and Treatment for Patients and Communities Act of 2018 (SUPPORT  Act) includes a provision for us to study the reporting of suspicious  orders, including evaluating real-time reporting on a national level using  computer algorithms and the extent to which that reporting could help  identify issues with orders before they are filled or reduce the length of a  drug diversion investigation. This report examines the following  questions:(1) To what extent does DEA obtain and use industry-reported  data to identify and address suspicious opioid orders and what  opportunities exist, if any, for DEA to improve these efforts, such as using  computer algorithms or real-time reporting? (2) To what extent does DEA  collaborate with industry stakeholders to combat opioid diversion?

To address our first objective, we reviewed relevant federal laws,  regulations, program guidance, and relevant reports and conducted  interviews with DEA headquarters offices, including the Diversion Control  Division and a non-generalizable sample of eight DEA field division  offices. This included interviewing DEA officials at these field division  offices to learn about how diversion investigators use industry-reported  data and what, if any, improvements might be needed. To identify which  of the 23 DEA field division offices to interview, we prioritized our  selection based on criteria such as the controlled prescription drug  availability rate in their geographic area, whether the office was the  location of a DOJ opioid-related task force, and whether the office was in  a top ten state for controlled prescription drug prescribing rates, based on  data from CDC. In addition, we reviewed DEA documentation of  procedures for conducting drug-related investigations, information system  manuals for data and information systems used by DEA, written  communications from DEA to registrants, and DEA forms registrants use  to report prescription drug transactions to DEA. We also interviewed  officials from other federal, state, and local entities with opioid diversion  prevention responsibilities, such as state level Prescription Drug  Monitoring Programs, the Department of Health and Human Services,  including the Centers for Medicare and Medicaid Services, and the DOJ  U.S. Attorney’s Office Opioid Fraud and Abuse Detection Unit. We also  conducted interviews with industry associations and private sector  industry members to gather their perspectives and experiences with  efforts to detect and report suspicious opioid orders.

To determine what opportunities exist, if any, for DEA to improve data use  efforts, such as using computer algorithms or real-time reporting, we  analyzed the data DEA collects to identify possible types of analyses DEA  could conduct to identify unusual patterns of distribution using computer  algorithms.

In addition, we reviewed key data governance practices identified through  our past work, to determine the extent to which DEA applied select  practices to manage how it collects and uses data to support diversion  control efforts. Furthermore, we reviewed the extent to which DEA  defined objectives and outcome-oriented goals and established  measurable performance targets to evaluate the effectiveness of how it  obtains and uses data for diversion control purposes and compared them  to Government Performance and Results Act (GPRA) and GPRA  Modernization Act (GPRAMA) of 2010 requirements, which may serve as  leading practices for DEA.

To determine how DEA collaborates with industry stakeholders on  combatting opioid diversion, we examined DEA agency-wide directives  and guidance, and component management policies and procedures for  providing information to industry stakeholders related to industry’s  suspicious order reporting requirements. In addition, DEA officials  provided us with a demonstration of relevant information systems,  including the Suspicious Orders Reporting System (SORS), Automation  of Reports and Consolidated Orders System (ARCOS), and the ARCOS  Enhanced Lookup Buyer Statistic Tool – available to distributors to help  them identify and report suspicious opioid orders. We interviewed opioid  distributors of varying sizes, including some of the largest opioid  distributors, based on DEA-provided ARCOS data of opioid-related  transactions, for their perspectives on the information and tools DEA  provides to them, including the Lookup Buyer Statistics Tool and the  ARCOS enhanced lookup Buyer Statistic Tool. We also spoke with trade  organizations that represent distributors to gather their perspectives  regarding industry interaction and coordination with DEA related to  diversion efforts and data sharing. We interviewed DEA officials about  current or future initiatives to address industry concerns regarding the  data DEA provides them and the status of those initiatives. Appendix I  contains a more detailed discussion of our scope and methodology.

We conducted this performance audit from January 2019 through January  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

The Controlled Substances Act (CSA) was enacted in 1970 to regulate  and facilitate the use of controlled substances, including certain  prescription drugs such as opioid pain relievers, for legitimate medical,  scientific, research, and industrial purposes while preventing them from  being diverted for illegal uses.

According to DEA, the CSA requires DEA to maintain a “closed system”  of distribution, which includes limiting the amount of certain controlled  substances that are available in the marketplace by setting quotas.  Various CSA provisions also require persons who handle controlled  substances to register with the DEA. This includes businesses that  import, export, manufacture, or distribute controlled substances; certain  health care practitioners, such as physicians, licensed to dispense,  administer, or prescribe them; and pharmacies authorized to fill  prescriptions, referred to as “registrants.” The registration mechanism  creates a “closed system” of distribution in which distribution may lawfully  occur among the registrants. The closed system of distribution, along with  registrant compliance with the CSA’s regulatory requirements, helps to  ensure that a particular controlled substance is always accounted for by a  DEA-registered entity, from its creation until it is dispensed to a patient or  is destroyed.

The CSA places controlled substances in one of five schedules based  generally on findings related to the substance, including whether the  substance has a currently accepted medical use in treatment in the  United States, its relative potential for abuse, and the degree of  dependence the drug or other substance may cause.  For further  information on this and other legal requirements, please see appendix II.

Legitimate Use of Prescription Drugs, Drug Supply Chain, and Opportunities for Opioid Abuse and Diversion

The prescription drug supply chain is the means through which  prescription drugs are ultimately delivered to patients with legitimate  medical needs. Although there can be many variations in the flow of  prescription drugs through the supply chain, in a common example,  prescription drugs are produced by manufacturers; are purchased and  stored by distributors, who take orders and deliver them to customers  such as pharmacies; and ultimately are dispensed by pharmacies to  patients who have a prescription from a practitioner, as shown in figure 1.  Although prescription drugs are intended for legitimate medical uses, the  prescription drug supply chain may present opportunities for the drugs to  be diverted and abused as the drugs move through the various  components of the supply chain. For example, an individual may visit  multiple practitioners posing as a legitimate patient, referred to as a  doctor shopper, to obtain prescriptions for drugs for themselves or others,  or criminal enterprises may rob distributors and pharmacies of  prescription drugs to sell to others.

Roles and Responsibilities Related to Controlled Substances

DEA, through its Diversion Control Division, is responsible for preventing,  detecting and investigating the diversion of controlled substances from  legitimate sources while ensuring an adequate and uninterrupted supply  is available for legitimate medical, commercial, and scientific needs. The  division is responsible for enforcing the CSA and its regulations pertaining  to pharmaceutical controlled substances and listed chemicals. In doing  so, it conducts domestic investigations, among other things, in DEA’s 23  field division offices.

By law, generally, manufacturers, distributors, and reverse distributors  are required to report to DEA every sale, delivery, or other disposal of any  controlled substance. As we previously reported, manufacturers and  distributors of schedules I and II drugs and schedule III narcotics must file  reports with DEA through ARCOS, a drug reporting system that allows  the agency to monitor the flow of DEA controlled substances from their  point of manufacture through commercial distribution channels to point of  sale or distribution at the dispensing/retail level. In addition, certain  schedule III non-narcotics and some schedule IV narcotics are also  covered by the ARCOS reporting requirements. DEA implemented the  ARCOS database in 1997, and approximately 1,250 distributors,  manufacturers, and reverse distributors report more than 72 million  transactions into ARCOS each year, according to DEA. Generally, certain  registrants must report certain data at least quarterly and they have the  option to report voluntarily on a monthly basis.

By law, each registrant, such as manufacturers and distributors of  controlled substances, is required (1) to design and operate a system that  is compliant with applicable federal and state privacy laws to identify  suspicious orders of controlled substances, and (2) upon discovering a  suspicious order or series of orders, notify the DEA Administrator and the  special agent in charge of the appropriate DEA field division office.

The SUPPORT Act, which amended the CSA in part, also includes  requirements related to preventing drug diversion. The SUPPORT Act  provisions require the DEA Administrator to establish a centralized  database for collecting suspicious orders reports, which is discussed in  more detail below. In addition, the SUPPORT Act requires the Attorney  General to make certain data available to registered manufacturers and  distributors through ARCOS. The SUPPORT Act also requires the  Attorney General to submit to Congress a report that provides information  about how the Attorney General is using ARCOS data to identify and stop  suspicious activity no later than one year after the date of enactment of  the SUPPORT Act.

DEA operates and maintains various information systems containing  registrant information, transaction data, and suspicious drug orders that  support its efforts to prevent, detect, and investigate the diversion of  pharmaceutical controlled substances. These include

Controlled Substance Ordering System (CSOS). This system is used  primarily by manufacturers and distributors, as well as pharmacies  and hospitals to place orders for controlled substances in a secure  electronic environment, and includes information such as the number  of packages, size of packages and name of items ordered, according  to DEA.

ARCOS. As discussed above, ARCOS monitors the flow of  transactions of schedule I, II, III and select schedule IV controlled  substances from their point of manufacture to their point of sale or  distribution at the dispensing or retail level (such as hospitals, retail  pharmacies, practitioners, and teaching institutions). The data in  ARCOS are used to, among other things, track regulatory compliance  in the pharmaceutical drug industry and to detect abuse of legally  manufactured pharmaceuticals that are diverted to illegal markets,  according to DEA Diversion Control Division officials.

Suspicious Order Reporting System (SORS). DEA developed SORS  to receive and store suspicious order reports. To date, DEA has  developed three versions of SORS as described below.

SORS Online version. In late October 2019, DEA launched the  Suspicious Orders Report System (SORS) Online, a centralized  database required by the SUPPORT Act, for registrants that  distribute controlled substances to report suspicious orders to  DEA. Reporting a suspicious order to SORS Online constitutes  compliance with the reporting requirement that registrants notify  the Administrator of the Drug Enforcement Administration and the  Special Agent in Charge of the Division Office of the Drug  Enforcement Administration for the area in which the registrant is  located or conducts business. SORS online is the third version  of DEA’s SORS system that was originally developed in 2008.  Unlike earlier SORS versions, SORS Online requires users to  provide a reason an order is suspicious. At the time of our study,  the use of SORS Online was voluntary. Registrants who are under  active MOAs with DEA are reporting to the new SORS Online  system, according to DEA.

Follow-up version. Suspicious order reports reported by  registrants since March 2017 operating under an active  memorandum of agreement (MOA) with the DEA that required  them to submit their reports electronically to DEA headquarters as  opposed to their local DEA field division office using the SORS  Follow-up version, according to DEA Diversion Control Division  officials.

Initial version. The initial version of SORS stores suspicious  order reports for registrants with an expired MOA but who elected  to voluntarily continue to report suspicious orders in the same way  as under the MOA, according to DEA Diversion Control Division  officials. The initial version of SORS was established in 2008.

Figure 2 provides an overview of the information DEA obtains and uses to  support its diversion control efforts.

State Prescription Drug Monitoring Programs (PDMP)

A PDMP is an electronic database that tracks controlled substance  prescriptions, managed within and at the state level. State PDMPs can  provide health care providers and authorities timely information about  prescribing and patient behaviors that may indicate drug abuse or  diversion and facilitate a response. Authorized users, such as  practitioners and pharmacists, may access information submitted to  PDMPs by dispensers. A state’s PDMP is housed by a specified  statewide regulatory, administrative or law enforcement agency. The  PDMP distributes data from the database to individuals who are  authorized under state law to receive the data for purposes of their  profession. PDMP data can assist law enforcement and health care  providers such as practitioners and pharmacists in identifying patterns of  prescribing, dispensing, or receiving controlled substances that may  indicate abuse or diversion.

PDMPs vary in numerous ways across states, including what data they  collect; what drugs they cover; who has access to, or who is required to  use, the prescription drug monitoring program; and which state agency  oversees and administers the program. DEA may request state PDMP  data through submitting requests or subpoenas to the state official  operating the PDMP database, for example, to support diversion control  investigations. The requirements on requesting and accessing state  PDMP vary from state to state according to DEA Diversion Control  Division officials. Officials noted that the different state-by-state  requirements create difficulties for federal law enforcement during a multi- state or national case as law enforcements’ requests for data have to be  addressed at the state level.

Data-analytics activities can include a variety of techniques to prevent  and detect diversion, including data matching and data mining. Data  matching is the large scale comparison of records and files to detect  errors or incorrect information. It can be used to verify information  provided by recipients or detect unreported changes. Data mining is the  use of automated computer algorithms to detect patterns, including  those that are otherwise not obvious, correlations, or anomalies within  large data sets indicative of potential diversion. Entities may identify many  types of analytics techniques that can be used to address improper  transactions, such as

Rules based – Identify suspicious orders with rules, such as orders  that go above a threshold;

Anomaly – Detect individual and aggregated abnormal patterns  versus peer group, for example, the orders from one pharmacy  compared to other pharmacies in the same geographic area; and

Predictive – Assess against known diversion. A provider that has  characteristics similar to those of known bad actors.

DEA Collects Industry-Reported Data to Help Address Opioid Diversion, but Opportunities Exist to Improve its Management and Use of Data

DEA Uses Self-Reported Industry Purchase Data to Help Identify and Address Opioid Diversion Activities

DEA uses industry-reported ARCOS data to help generate leads, support  enforcement actions, and allocate resources. The agency uses these  data in a number of ways, including supporting field diversion control  activities and developing analytical products.

Field-Based requests for data analysis. DEA’s Diversion Control  Division’s ARCOS Unit responds to requests for data analysis from its  field division offices in support of diversion control enforcement  activities. According to DEA officials, this unit is responsible for the  collection, maintenance, and analysis of ARCOS data. For example,  DEA said this unit conducts analysis on controlled substances that are  bought and sold in a particular timeframe between a seller and a  buyer. The ARCOS Unit also obtains information on the quantity,  dosage units, grams, and ingredients of the drugs in the sale and  conducts analyses in response to specific requests from field-based  investigators who send their requests to the unit. For example, DEA  officials said that out of the 800 field division office requests for  analysis sent to the DEA ARCOS Unit in calendar year 2018, about  60 percent of those were for “enhanced” validations. This process  includes a controlled substance report which the unit provides to field  investigators for their use during scheduled drug investigations, and  contains a summary of, among other things, an ARCOS registrant’s  reported sales and purchases compared against what other  registrants report was sold to them. This process uses both automatic  and manual checks. According to DEA officials, they received  approximately 480 requests for enhanced validations from DEA field  investigators in 2018. While DEA officials noted that DEA’s enhanced  validation procedures are not documented, they acknowledged that  the ARCOS Unit is in the process of developing standard operating  procedures for ARCOS data quality control, including the enhanced  validation process. All requests for validations submitted to the  ARCOS Unit are analyzed and compiled, and sent to field-based  investigators to support scheduled investigations. Although validations  are primarily requested for scheduled investigations, field offices can  request these reports pursuant to any scheduled or non-scheduled  investigation.

DEA Analytic Product - Drug Profiles. Using ARCOS data, DEA  creates drug profiles for suspected bad actors at the retail level (such  as certain pharmacies), who have irregular transactions–also known  as outliers, according to DEA officials–in a specific area or zip code  and provides this information to its field division offices. The ARCOS  Unit compares this suspected “bad actor” with other area competitors.

DEA Analytic Product – Annual Threat Assessments. DEA’s ARCOS  Unit also uses ARCOS data to develop threat assessments annually  to aid field investigators. The threat assessments use ARCOS data to  provide drug-related transaction trends and patterns related to a given  DEA field division office area of operations to help establish priorities  and allocate resources. DEA officials noted that field division office  staff use these assessments to develop work plans identifying which  registrants will be subject to the office’s routine regulatory  investigation that year.

Field Querying of ARCOS Data. – Field division offices may also use  ARCOS querying tools to analyze ARCOS data to proactively identify  diversion targets, such as reviewing ARCOS data to identify  information on top purchasers of controlled substances. In a written  response to our questions, DEA officials told us that several ARCOS  drug profiles they developed have contributed to state and federal  administrative, criminal and regulatory investigations.

DEA officials recently informed us that as part of a reorganization, it  established the Targeting and Special Projects Section whose goal is to  focus on leveraging DEA’s data capabilities. Specifically, this section is  composed of two units, including the Reports Analytics Unit and the  Targeting and Special Projects Unit, which was established in March  2019 and is responsible for conducting data analytics on ARCOS and  other data, according to DEA Diversion Control Division officials. DEA is  currently working to determine the types of analysis these units will  conduct.

DEA Conducts Limited Analysis of Industry- Reported Data Using Automated Computer Algorithms

We found that while DEA uses ARCOS data to support ongoing  investigations and conducts analysis on this data to identify investigative  leads for its field division offices, it could conduct more robust analysis  using automated computer algorithms to help identify questionable  patterns in the data. This analysis in turn could be used to identify  registrants that need to be investigated.

According to DEA officials, most of the analysis DEA currently conducts  on ARCOS data is used by the field division offices. For example, upon  receiving information on pharmacies that have a high frequency of  reporting stolen or lost-in-transit drugs a field division office may contact  DEA’s ARCOS Unit to request ARCOS information. DEA then analyzes  the ARCOS data to produce the requested reports to support the field’s  ongoing investigations. DEA also conducts routine analysis of ARCOS  data to identify high volumes of drugs sold by a distributor to a single purchaser, high volumes of drugs purchased by a single purchaser, and  trends in drugs sold or purchased in a given geographic area  compared to similar nearby areas.

DEA officials also identified one type of analysis it conducts using a  computer algorithm. Specifically, DEA uses a computer algorithm when  comparing large volumes of drugs purchased in a given geographic area  to the area’s population data. According to DEA officials, DEA conducts  this analysis quarterly. However, DEA did not report conducting active  and recurring monitoring of transactions using algorithms to detect and  flag transactions that indicate potential diversion, either on a real-time or  near real-time basis.

We identified several additional opportunities for DEA to proactively  analyze ARCOS data using computer algorithms to identify unusual  patterns of drug distribution on a more routine basis. Such analyses could  be used to proactively support or generate leads for investigations of  potential drug diversion. For example, DEA could

Analyze ARCOS data to identify unusual volumes of drugs that were  disposed of rather than sold.

Conduct analysis of ARCOS data to identify unusual numbers of  deleted transactions or deletions of transactions of high volumes of  drugs.

Analyze ARCOS data by comparing the amount of drugs being  acquired by a registrant to the amount of drugs accounted for, through  being sold or disposed of, among other things, by each registrant to  determine any differences.

Analyze ARCOS data to identify trends in distribution or purchases of  drugs in a given geographic area. DEA could look for unusual patterns  when comparing such activity in an area with that of other nearby  areas; or analyze volumes of drugs purchased in a geographic area  when adjusted by the area population.

In addition to the analysis noted above using ARCOS data, we also  identified further analysis that DEA could perform using ARCOS data and  additional available data to help identify potentially suspicious purchase  or distribution patterns. Specifically, in our review and analysis of ARCOS  data and information about PDMP data, we identified an opportunity for  DEA to analyze ARCOS and PDMP data together for a more complete  picture of drug transactions from distribution to retailers through  dispensation to patients. We determined this could help in assessing  whether the amount of drugs being prescribed is consistent with the  amount of drugs being purchased or distributed in a given geographic  area. For example, in areas where the number of prescriptions increases,  a subsequent increase in drug orders and distribution to that area could  be considered understandable. However, where the number of  prescriptions in an area remains the same, or decreases, a significant  increase in drug orders and distribution to that area could be considered  unusual, especially if this pattern persists over several reporting periods.  DEA stated that it occasionally performs such analysis manually, noting  however that its access to PDMP data is contingent upon each state’s  requirements and willingness to share its PDMP data with federal law  enforcement.

In July 2019, DEA officials responsible for overseeing the use and  analysis of ARCOS data expressed an interest in improving DEA’s  ARCOS data analytic capabilities but stated that they needed more staff  and resources. Specifically, they noted they would like to hire additional  staff, such as data scientists, to conduct analysis on ARCOS data using,  for example, additional computer algorithms. DEA also noted that it was  considering automation of additional types of analyses, but did not  provide a start date or estimate as to when it would move forward on that  consideration.

While DEA created the new Targeting and Special Projects Section in  March 2019 to enhance DEA’s data analytics and set aside some  positions for program analysts and subject matter experts, among other  positions, as of October 2019, DEA officials did not have any details or  documentation about the data analysis efforts the new division plans to  undertake. We have previously reported that new approaches to  combining and “making sense of” large amounts of varied data—methods  referred to as advanced analytics—are helpful to uncover patterns,  identify anomalies, and provide insights not suggested by assumed  hypotheses. In addition, other federal entities responsible for detecting  diversion and abuse of controlled substances utilize computer algorithms  as part of their analysis of available data in order to flag and prioritize  potential instances of diversion for further investigation. For example, the  Centers for Medicare & Medicaid Services and its National Benefit  Integrity Medicare Drug Integrity contractor use proactive data analysis to  detect aberrant patterns and potential diversion in drug prescribing. As a  result, the contractor is able to produce “prescriber risk assessments,”  which provide a comparison of controlled substance prescribing patterns  across peers. The Centers for Medicare & Medicaid Services also uses  proactive data analysis to identify providers with potentially inappropriate  prescribing patterns, especially as it concerns opioids. Similarly, some  opioid drug distributors use computer algorithms to identify suspicious  orders that are the basis for the suspicious order reports they are required  to provide to DEA.

The establishment of this new section within DEA focused on its data  analytics capabilities presents an opportunity for DEA to more proactively  use data analytics with regard to its ARCOS and other data. In doing so,  DEA could more effectively identify possible diversion activities or  unusual activity to aid its ongoing efforts to prevent, detect, and  investigate diversion more quickly and assist it in reporting on how it is  using ARCOS data to identify suspicious activities.

DEA Recently Developed a Centralized Database to Collect Suspicious Opioid Order Data but Lacks an Overall Structure to Manage all of its Data

DEA Recently Created the Required Centralized Database for Suspicious Order Reports

In October 2019, DEA established the Suspicious Orders Report System  (SORS) Online, a centralized database for collecting suspicious order  reports, which is required by the SUPPORT Act to be established by  October 24, 2019. The SORS Online data fields include a requirement  for registrants to note their reasons for identifying an order as suspicious,  drug quantity, and dosage strength.

The successful implementation of the centralized database is important  because it could address the fragmented way in which suspicious order  reports are currently submitted. However, reporting to the centralized  database is currently voluntary. Registrants may notify DEA of a  suspicious order using other means, including email, facsimile, or  telephone. The systems and reports are not currently integrated, and  investigators must query each system or office separately in order to find,  for example, information related to a lead they are investigating.  Currently, registrants are required upon discovery of a suspicious order or  series of orders, to notify the Administrator of the DEA and the Special  Agent in Charge of the division office of the DEA for the area in which the  registrant is located or conducts business.

Prior to DEA establishing the SORS Online centralized database,  registrants with an existing or a prior MOA also have reported suspicious  orders into one of two SORS databases when reporting to headquarters.  The new SORS Online is the only electronic mechanism for reporting  suspicious orders now, according to DEA. Registrants who are under  active MOAs with DEA are reporting to the new SORS Online system,  according to DEA. Registrants that are not under an MOA may also use  SORS Online, but are not required to do so. Registrants not under an  MOA may also use a paper-based process, among others, when  reporting to the field division offices and DEA headquarters. However, no  integration exists across headquarters’ and field division offices’ various  electronic- and paper-based systems. DEA officials we met with said that  some of the suspicious order reports received at the field division office  level are stored in hard copy in accordion file folders, instead of being  digitized or entered into a searchable database. Reporting to SORS  Online satisfies the requirement to report such orders to the Administrator  of the DEA and the Special Agent in Charge of the Division Office of the  DEA for the area in which the registrant is located or conducts business.  Successfully managing the SORS Online database could lead to needed  efficiency improvements and more effective use of the suspicious order  report data.

DEA Lacks a Data Governance Structure to Manage its Data on Opioid Orders

Although DEA has guidance, policies and procedures regarding the use  of some of its information systems, it has not established a formalized  data governance structure to manage its collection and use of data used  to support the Diversion Control Division’s mission. DEA specifically has  not institutionalized and clearly documented policies and procedures that  describe division staff’s roles and responsibilities for collecting and  analyzing data nor has it provided a structure that describes the agency’s  approach to establishing and maintaining such a program. We have  identified a number of issues with DEA’s management of data. For  example, DEA does not have any documentation on their process for  ensuring the quality of data registrants submit to its ARCOS database— the main system that enables DEA to monitor the flow of controlled  substances. As a result, it is difficult to understand the controls they have  over this important data.

A data governance structure is defined as an institutionalized set of  policies and procedures for providing data governance throughout the life  cycle of developing and implementing data standards.  A data  governance structure also helps to ensure important data assets are  formally managed and fully utilized, and can also provide consistent data  management. We previously reported on key practices based on several  data governance models, including developing and approving data  standards, managing, controlling, monitoring, and enforcing consistent  application of data standards, and delineating roles and responsibilities  for decision making and accountability.  Additionally, in June 2019, the  Office of Management and Budget established a Federal Data Strategy  (Strategy) as a framework of operational principles and practices to help  agencies use and manage data.

We found several areas where DEA’s current practices do not reflect  select leading data governance practices.

Agencies should identify data needs to answer key agency  questions: We found that DEA does not have a governance structure  to determine and prioritize its data requirements for either suspicious  order reports it receives or data reported into its ARCOS systems. For  example, DEA has not established standard requirements for the  information required in a suspicious order report. As a result,  distributors’ suspicious order reports vary and may contain  inconsistent and insufficient data for DEA to make investigative  decisions. In addition, DEA does not have a governance structure to  identify agency and industry stakeholder data needs to help inform its  opioid diversion control efforts.

Agencies should provide resources explicitly to leverage data  assets: Agencies should ensure that sufficient human and financial  resources are available to support data driven agency decision- making, and accountability. As mentioned earlier, while DEA created  the new Targeting and Special Projects Section in March 2019 to  enhance DEA’s data analytics, as of October 2019, DEA officials did  not have details or documentation about the data analysis efforts the  new division plans to undertake or the resources they plan to provide  for those efforts. As a result, DEA is unable to conduct the analysis  that would enable it to more effectively use its existing data in making  decisions about diversion related efforts.

Agencies should prioritize data governance: Agencies should  ensure there are sufficient authorities, roles, organizational structures,  policies, and resources in place to transparently support the  management, maintenance, and use of strategic data assets.  Similarly, leading practices for data governance includes delineating  roles and responsibilities for decision-making and accountability,  including roles and responsibilities for stakeholder input on key  decisions. As mentioned earlier, DEA established the Targeting and  Special Projects Section in March 2019 whose goal is to focus on  leveraging DEA’s data capabilities and conducting data analytics on  ARCOS and other data, according to Diversion Control Division  officials. While the new section appears to hold promise, DEA has not  clearly defined and adopted the new section’s roles and  responsibilities for managing and analyzing data across the DEA or  how the new section will communicate and collaborate with other  Diversion Control Division headquarters and field staff. As a result, the  new division may not operate in a predictable, repeatable, and  accountable way.

Agencies should support non-federal stakeholders: Agencies  should engage with industry, academic, and other nonfederal users of  data to share expert knowledge of data assets, promote wider use,  improve usability and quality, and advance innovation and  commercialization. Later in this report, we identify an opportunity for  DEA to collaborate with industry stakeholders and seek their input for  an initiative that is supposed to assist industry stakeholders in their  responsibilities to report suspicious orders to DEA.

Although DEA has not incorporated these data governance practices, it is  in the early stages of developing a data governance structure. As of  September 2019, DEA officials told us that its Office of Information  Systems’ Chief Data Officer just recently started to work with DOJ and  other components to develop a data strategy in response to the recently  released department wide strategy, and therefore does not have any  additional documentation or information related to timelines and  deliverables for formally implementing a DEA data governance or other  data structure for the agency. Without additional details, such as a  timeframe for developing the structure or more information about what it  would entail, it is unclear how or if these efforts will incorporate leading  practices for data governance and if they will be effective.

Data governance processes are important for DEA given it works with an  extensive and complex network of stakeholders to manage opioid  diversion risks and uses industry-reported data to help it identify patterns  that might indicate potential diversion. An effective data governance  structure could help DEA ensure its important data assets are formally  managed and fully utilized, and can also help ensure consistent data  management. Industry and technology councils, domestic and  international standards-setting organizations, and entities within the  federal government endorse the establishment and use of a governance  structure to oversee the development, management and implementation  of data standards, digital content and other data assets.

While DEA’s Systems Do Not Provide Complete, Real-Time Data on Suspicious Orders, Most Industry Stakeholders Said Adding Such Capabilities Would Not Provide Extensive Value

DEA does not have an existing mechanism or a comprehensive database  of orders before they are filled that it can analyze, on a real-time basis, to  identify potentially suspicious orders. However, most industry  stakeholders we spoke with on the usefulness of real-time data noted that  such a mechanism would not add extensive value to diversion detection.

DEA’s current data systems either contain historical, not real-time, data or  do not contain all drug order data that could be reported.

ARCOS. The data in the ARCOS database is historical, rather than real- time, on orders that have been filled. Every registered manufacturer is  required, at such time or times and in such form as required by the  Attorney General, to make periodic reports to the Attorney General of  every sale, delivery or other disposal of any controlled substance. Each  distributor is required to make such reports with respect to narcotic  controlled substances. For example, as part of the reporting to ARCOS,  acquisition and distribution transaction reports are required, by regulation,  to be filed every quarter, except that a registrant may be given permission  to file more frequently, but not more frequently than monthly, depending  on the number of transactions being reported each time by that  registrant. In addition, manufacturing transaction reports are required to  be filed annually, except that a registrant may be given permission to file  more frequently, but not more frequently than quarterly.

CSOS. DEA does not require registrants to use CSOS and thus it is not  used by all registrants. As previously discussed, CSOS is an electronic  ordering system which allows registrants to place orders for controlled  substances. Shipments of all ARCOS-reportable controlled substances,  ordered through CSOS, are included in registrant’s periodic ARCOS  reporting.

Suspicious Order Reports. Suspicious order reports are intended to  identify orders of unusual size, orders deviating substantially from a  normal pattern, and orders of unusual frequency before they are filled. By  law, each registrant is required to design and operate a system to identify  suspicious orders that it receives. Registrants identify, then report, to  DEA using their own systems to determine suspicious orders. As discussed previously in this report, registrants can report these orders  into DEA’s newly launched SORS Online database, but reporting into this  database is voluntary and registrants have an option to report in other  ways, so this database does not capture all suspicious orders and is  therefore not comprehensive. Suspicious orders are likely identified in  close to a “real-time” basis. Orders that have been identified and reported  as suspicious by the registrants, are orders that have not yet been filled.

While two individual drug distribution companies we interviewed said they  saw some value in real-time reporting, most industry stakeholders we  spoke with on the usefulness of real-time data, including a broad cross- section of associations representing pharmacies and drug distribution  companies, said that real time dissemination of suspicious orders by DEA  would not add extensive value to efforts to detect possible diversion.  Instead, some industry stakeholders suggested that a focus on data that  provide trends over time might be more useful. As discussed earlier in  this report, we provide examples of data analysis DEA currently performs  and could perform on its existing data that could potentially help DEA  determine or identify possible patterns of aberrant behavior in drug order  information. Others we spoke with raised concerns about the varying  ways companies determine what is suspicious and that using real-time  data reported from DEA on these orders could be like comparing apples  to oranges.

Most of the associations that represent pharmacies and drug distributors  that we met with indicated they did not see much value in either reporting,  or receiving reports, of suspicious orders in “real-time.” For example, a  representative from an association representing pharmacists told us that  rarely would there be a case where a single order was so egregious that  stopping it would have a significant impact on public health. This  representative also noted that it would be more important to focus on  historical trends, given “trends don’t happen in a day.”

Other stakeholders we spoke with said that while there may be utility in  real-time reporting of suspicious orders, they also had concerns about its  feasibility, given current available data. They noted it would be difficult to  compare suspicious order data as reported by registrants because  companies rely on their own methods to determine a suspicious order.  For example,

Officials from an association that represents a large number of drug  distributors indicated that receiving more real-time data might allow  their members to have an additional check on orders that a wholesale  distributor receives, but this utility would largely be contingent on the  distributors’ ability to compare suspicious order reports across one  another. Distributors use different criteria for determining whether an  order is suspicious; there is no continuity across them; and they  experience varying order volumes and patterns across their  customers and over time as patient needs change. Thus, such  analyses would be difficult to conduct, if they could be done at all, and  would not necessarily result in useful comparisons.

A representative from one drug distribution company told us that  having knowledge of other distribution companies’ suspicious orders  is not helpful because the company would not know how the other  distributor made a determination on the suspicious order.

Another representative stated that distributors are operating  proprietary systems that may or may not vary substantially from each  other depending on a large number of varying circumstances, and  may be operating “wildly different” systems for identifying suspicious  orders and therefore the information would not be valuable.

Representatives from two drug distribution companies identified  additional challenges to real-time reporting of suspicious orders if the  determination of whether an order was suspicious or not was made by  DEA. First, they did not believe DEA had sufficient resources or  knowledge to identify suspicious orders. One representative said DEA  does not know the history and market dynamics in the pharmaceutical  industry to help inform decisions it would need to make on an order.  Second, identifying an order as suspicious before it is filled would add  a tremendous burden on DEA. According to one of the  representatives, their company typically ships orders on the same day  the order is received, consistent with “just-in-time” inventory  management practices. If DEA were expected to make suspicious  order determinations without the risk of disrupting patient care needs,  it would be imperative for DEA to act quickly to identify suspicious  orders. These distribution companies did not believe DEA would be  able to identify them rapidly as needed. As noted above, DEA’s  current systems are not designed for real-time reporting, and it does  not have an existing mechanism or a comprehensive and complete  database of orders before they are filled that it can analyze, on a real- time basis, to identify potentially suspicious orders.

Officials from the association that represents a large number of drug  distributors were careful to point out, however, that systems sometimes  differ intentionally due, for example, to varying customer bases, service  requirements and patient care needs.  Thus, a certain amount of  variability in suspicious order systems, criteria and decisions may be  warranted, and even desirable.

DEA Does Not Have Outcome-Oriented Goals and Performance Measures for its Opioid Diversion Activities

While DEA has developed some performance measures to track and  publicly report the progress and results of its efforts in reducing diversion,  DEA has not developed objectives, outcome-oriented goals, or  measurable performance targets to assess the effectiveness of its opioid  diversion control data analysis efforts and the link between DEA’s use of  data and progress toward its diversion goals and strategies. DEA does  have performance measures including the number of civil penalties and  administrative actions it has undertaken, planned or scheduled  investigations completed, and community outreach events completed.  While these measures are useful, they do not account for outcomes of  these actions, such as their potential impact on the volume of opioids  being improperly sold or purchased.

DEA officials noted that it adheres to goals established through the Office  of National Drug Control Policy’s National Drug Control Strategy, such as  reducing the prescription opioid rate by one-third within three years,  reducing overdose deaths, and within five years, ensuring all health care  providers have adopted best practices for opioid prescribing. However,  those goals involve a multitude of federal agencies, and are not directly  related to DEA’s use of industry-reported data, nor linked specifically to  DEA diversion control efforts. DEA also noted that they have a number of  goals across strategies such as DEA’s 360 strategy in addition to the  goals in DOJ’s strategic plan; a performance measure with a measurable  target for its agency-wide objective related to dismantling drug trafficking  organizations—maximizing the monetary value of currency, property,  and drugs seized; and a measure for curbing opioid and other illicit drug  use.

GPRAMA directs agencies to develop and document goals, as well as  performance measures to assess progress towards their goals.  Agencies can use performance measurement to make various types of  management decisions to improve programs and results, such as  developing strategies and allocating resources, including identifying  problems and taking corrective action when appropriate. Additionally,  GPRA as amended by GPRAMA states that management should define  outcome-oriented objectives in specific and measurable terms.  Measurable targets help decision makers conduct assessments of  whether program goals were achieved, and linkages between an  organization’s goals and performance measures create a line of sight so  that everyone understands how program activities contribute to the  organization’s goals.

DEA officials view their existing performance goals as sufficient overall.  However, without defining objectives in specific measurable terms, DEA  is likely not able to adequately assess whether its respective investments  and efforts are helping it to limit the availability of and better respond to  the opioid prescription diversion threat. Until program officials can review  the effectiveness of these systems based on quantifiable benefits and  measurable performance targets, they are not well-positioned to  determine the extent to which suspicious order reports or ARCOS data  and systems are enhancing the effectiveness of the agency’s opioid  related regulatory and criminal diversion investigations, prosecutions and  civil actions. Documenting program goals and developing measurable  performance targets and linkage to program goals could provide DEA  with the information it needs to assess progress and make informed  decisions about current and future operations.

DEA Has Taken Some Steps to Help Industry Report Suspicious Orders, but Has Not Addressed Identified Limitations with the Data it Shares or Receives

DEA Has Developed a Tool to Share Some Drug Purchase Data with Industry, but the Tool Has Limitations

DEA developed an ARCOS query option for registrants to use, called the  ARCOS Enhanced Lookup Buyer Statistic Tool, in February 2019 to  better support registrants’ efforts to identify and report suspicious  orders. This tool allows registrants to query certain ARCOS data  maintained by DEA. Although this tool was supposed to be an  improvement upon a prior iteration of the lookup tool DEA had developed,  distributors and an industry association representing distributors identified  several limitations with the tool. Specifically:

Single query challenges and no bulk downloads. The distributor  can only query the tool one pharmacy at a time, even though some  distributors supply thousands of pharmacies on a daily basis. Thus, if  certain distributors were to query all of its pharmacies for possible  suspicious order patterns, the process could be time-consuming or  not feasible. DEA noted it was working on this limitation.

Limited login credentials. DEA only provides each distributor with  one set of login credentials, so only one employee can log in at a time  to query the tool. DEA noted it was working on this limitation.

Data provided in the tool are not detailed enough. The tool does  not provide detailed enough information to be useful to facilitate the  identification of suspicious orders. For example, when a distributor  queries the tool, the search results will list the total dosage units for a  particular opioid for the past six months at the pharmacy. Because  some opioid drug dosages are more commonly abused than others,  distributors told us that simply having the total number of dosage units  is not as helpful as seeing the breakdown of the different dosage  units. In another instance, the data provided to distributors does not  include critical details about the number of suppliers. One distributor  might have multiple warehouses and distribution centers that it uses  to package and ship pharmaceutical products. In the ARCOS data  that DEA provides to distributors, these individual warehouses are  counted as distinct suppliers in the total supplier count data provided  to the distributors. Therefore, the number of suppliers may appear  inflated to the distributors, even though it is only a single company  providing the products.

According to DEA, the ARCOS lookup tool is meant to be a pointer  and assist distributors in conducting due diligence so they can “know  their customer.” Regardless if a distributor is shipping from multiple  distribution centers and therefore showing as multiple suppliers in the  lookup tool, these are all unique DEA registration numbers and are  therefore unique suppliers to the customer. According to DEA, the  important part here is that distributors can see quantity and gram  totals per registrant (such as, a pharmacy customer) that they query.

When evaluating whether an order is suspicious, a distributor uses its  own internal transaction data to evaluate a buyer’s ordering patterns.  However, purchasers of controlled substances, such as pharmacies and  medical practices, may use multiple distributors for their purchases.  Distributors have previously raised concerns that they did not have  access to additional transaction data, such as whether the purchaser is  also buying controlled substances from additional suppliers. They have  noted that this additional data would be useful when making decisions  about whether an order is suspicious, and specifically, that ARCOS data  would be useful in helping them evaluate whether an order was  suspicious. For example, in 2018, one distributor testified that, given  DEA’s access to the controlled substance transaction data that  distributors report, “nly DEA has visibility over the entire landscape and  can track and analyze aggregate data on the distribution of controlled  substances in particular jurisdictions.” In addition, an industry  organization we met with provided comments to DOJ in 2017 that certain  data could provide more context for them to identify problematic orders.  Specifically, the organization noted that if DEA could provide ARCOS  data in aggregate form without identifying individual distributors’  competitors, the distributor could consider a pharmacy’s orders in the  context of the pharmacy’s overall ordering from all distributors.

An industry association representing distributors, and two of the  distributors that we interviewed stated that the Enhanced Lookup Buyer  Statistic Tool is a step in the right direction. However, the industry  association and four distributors that we interviewed stated that the tool  remains limited in helping distributors improve how they identify  suspicious orders, as noted above. DEA officials told us that distributors  have brought some of these concerns about the ARCOS Enhanced  Lookup Buyer Statistic Tool’s usability to their attention. For example, in  May 2019, an industry association representing distributors sent a letter  to DEA, outlining a consolidated list of industry’s concerns about the tool.

In recent discussions in June 2019, DEA officials acknowledged some of  these limitations and stated that some industry concerns would be easier  to fix than others, but that they had not established a timeframe for when  the changes would be implemented. For example, DEA officials noted it  might be easier to provide additional login credentials to distributors and  make the data available to be downloaded in a more functional way for  distributors. For some of the other limitations industry stakeholders  identified, such as providing more detailed ARCOS data to the  distributors, DEA officials raised concerns. For example, DEA officials  noted that distributors could use the additional detailed data as a market  research tool in order for distributors to gain unfair market advantages or  to learn more about their competitor’s business contracts with  pharmacies.

In September 2019, DEA officials told us that it was not currently  addressing changes to the ARCOS Enhanced Lookup Buyer Statistic  Tool, due to competing priorities within DEA. Specifically, DEA officials  noted that it is focused on existing priorities related to meeting upcoming  requirements mandated in the SUPPORT Act, including establishing a  suspicious order centralized database, as discussed previously in this  report. While we recognize that agencies need to determine and set  priorities, it is important for DEA to continue to work with industry in  ensuring that the tool it created to address the SUPPORT Act  requirement will help industry in addressing its suspicious order reporting  requirement under the CSA, as amended.

The SUPPORT Act requires DEA to provide distributors with access to  ARCOS data to help the distributors identify, report, and stop suspicious  orders of opioids and reduce diversion rates. By identifying solutions –  in consultation with industry stakeholders – to address the limitations of  the ARCOS Enhanced Lookup Buyer Statistic Tool, DEA could better  ensure registrants have more useful information at their disposal when  evaluating whether an order is suspicious.

DEA Identified Extensive Limitations with Suspicious Order Reports it Received

DEA officials and DEA field division offices we interviewed identified a  number of limitations with suspicious order reports they received, and,  due to these limitations, they rarely use suspicious order reports to  generate potential investigative leads. The issues DEA identified  included:

Threshold-based algorithm triggers. Several DEA headquarters  and field division officials told us that some distributors used fixed  thresholds to identify suspicious orders, which DEA officials stated are  not helpful or useful because the information is often not actionable.

Lack of documented rationale. During the course of our review,  DEA officials told us that many suspicious order reports do not include  the rationale for why the registrant decided the order was suspicious,  making it difficult to determine which suspicious order reports might  contain actionable intelligence. In September 2019, the DOJ Office of  the Inspector General reported that the current regulatory language  governing industry suspicious order reporting does not require  manufacturers and distributors to state why they believe an order is  suspicious. In October 2019, DEA launched a new centralized  database of suspicious order reports, as required by the SUPPORT  Act. DEA’s new reporting format of suspicious order reports includes  a required field for “Reason,” for registrants to provide an explanation  of why the order is suspicious. However, currently reporting to the  new centralized database is voluntary.

Differing methodologies. As discussed earlier in this report, the  definition of a “suspicious order” may include, but is not limited to, an  order of a controlled substance of unusual size, an order of a  controlled substance deviating substantially from a normal pattern,  and orders of controlled substances of unusual frequency.   However, it is up to the individual distributor companies to decide the  more specific metrics, according to DEA Diversion Control Division  officials. Each distributor must design and operate a system to identify suspicious orders. Therefore, distributors utilize different methods to  flag customer orders as suspicious.

According to our analysis of DEA data, it has collected at least 1.5 million  suspicious order reports since 2014, and these reports may contain data  on attempted purchases that were denied, based on indicators of  suspicious patterns. These data could help with DEA’s efforts to  prevent, detect, and investigate diversion. Officials from six DEA field  division offices we interviewed said they refer to suspicious order reports  when conducting their routine regulatory investigations of registrants.  DEA field division officials also stated that, while suspicious order reports  are generally not used as the primary or sole impetus to initiate an  investigation, officials will infrequently refer to related suspicious order  reports when there is an ongoing criminal investigation that is initiated  through other means. However, of the DEA field division offices we  interviewed, officials from two offices told us that they had used a  suspicious order report as the sole or primary impetus for initiating a  criminal investigation in the past year – one stating that it happened once,  and another estimating that it happened one to three times. Another  field division told us that they had two convictions “in recent memory” that  began with a suspicious order report. Three offices told us that they had  not used suspicious order reports as the sole or primary impetus for a  criminal investigation in the past year, and one told us they did not know if  a suspicious order report had been used in that way.

DEA field division offices we interviewed also identified reasons why  suspicious order reports may not be as useful as they could be in helping  to identify investigative leads. For example, one DEA field division office  characterized the suspicious order reports they received from one  particular registrant as being “spot on” and always warranting a DEA  follow-up investigation, given the amount of detail and evidence of the  registrant conducting its own on-site investigation into the customer.

However, the same DEA office reported that other suspicious order  reports were based on industry-developed thresholds that were not useful  because the resultant reports did not indicate why the order was  suspicious. Of the five DEA field division offices that we asked to  characterize the quality of suspicious order reports, three of them  reported that suspicious order reports were either “moderately” or  “somewhat” useful. Officials from one field division office said that  suspicious order reports are “very useful,” while officials from another  DEA field division office reported that suspicious order reports are “not at  all useful.”

We have previously reported on these issues, including DEA  communication with registrants, and in June 2015, we found that  additional guidance from and additional communication with DEA was  needed about registrants’ roles and responsibilities under the CSA, as  amended. We recommended that DEA develop additional guidance for  distributors for suspicious order monitoring and reporting. DEA did not  expressly agree or disagree with our recommendation, but raised  concerns about the recommendation, stating that “short of providing  arbitrary thresholds to distributors, it cannot provide more specific  suspicious orders guidance because the variables that indicate a  suspicious order differ among distributors and their customers.” In  responding to this recommendation, DEA officials told us that the agency  had refocused its efforts on revising draft regulations in line with the  SUPPORT Act, and that the revised draft was undergoing internal DEA  and DOJ review. The agency noted that it expected the rule to codify  existing legal obligations related to due diligence and suspicious order  reporting and provide additional guidance regarding the nature and timing  of the suspicious order reporting requirement, but also indicated that it  was not possible to be certain of the precise nature of the draft rule. The  2015 recommendation remains relevant and important, and while DEA  has reported taking some actions to address it, as noted above, DEA has  not taken all the necessary steps to address the recommendation. We will  continue to monitor DEA’s progress in addressing our recommendation.

Given the extensive and complex network of stakeholders DEA works  with to manage opioid diversion risks and the agency’s use of a large  amount of industry-reported data, DEA could do more to use proactive,  automated computer algorithms to analyze its data sources in detecting  questionable patterns in industry-reported drug transaction data. It is  missing opportunities to more effectively identify questionable ordering  patterns and possible diversion activities than through its current analysis  methods. Using more automated analyses, similar to other federal entities  that use computer algorithms as part of their analysis of available data to  help flag instances of diversion, DEA could enhance its ongoing efforts to  prevent, detect, and investigate diversion more quickly and assist it in  reporting on how it is using ARCOS data to identify suspicious activities.

Furthermore, because DEA does not have a documented data  governance structure in place to manage its data, it risks challenges  related to quality, availability, and integrity of the data it uses to support  opioid diversion. Although DEA has started to explore developing a data  governance structure, it is important for DEA to document and define its  process about what the structure would entail. This would help the  agency determine the effectiveness of its structure, an important  consideration given the large amounts of varied data DEA receives from  industry stakeholders. Also, while DEA does have some performance  goals related to opioid diversion, it lacks outcome-oriented goals and  measurable performance targets to assess the extent to which the  industry-reported data it obtains and uses support the agency’s diversion  control activities. Defining these targets could help DEA adequately  assess whether its respective investments and efforts are helping it to  limit the availability of and better respond to the opioid prescription  diversion threat.

DEA’s efforts to provide registrants with additional information to facilitate  the identification of suspicious orders is promising, but has limitations.  Due to these limitations, registrants, such as distributors, might not have  complete information when they are identifying suspicious orders. By  identifying solutions – in consultation with industry stakeholders – to  address the limitations of the ARCOS Enhanced Lookup Buyer Statistic  Tool, such as the need for additional login credentials or the ability to bulk  download data, DEA could better ensure registrants have more useful  information at their disposal when evaluating whether an order is  suspicious.

Finally, we continue to monitor implementation of our 2015  recommendation that DEA provide additional guidance to distributors  related to suspicious orders, and we believe that it remains relevant and  important.

We are making the following four recommendations:

The DEA Administrator should develop and implement additional  ways to use algorithms in analyzing ARCOS and other data to more  proactively identify problematic drug transaction patterns.  (Recommendation 1)

The DEA Administrator, in coordination with the department-wide  efforts on data strategy, should establish and document a data  governance structure to ensure DEA is maximizing its management of  industry-reported drug transaction data. (Recommendation 2)

The DEA Administrator should establish outcome-oriented goals and  associated measurable performance targets related to opioid  diversion activities, using data it collects, to assess how the data it  obtains and uses supports its diversion control activities.  (Recommendation 3)

The DEA Administrator, in consultation with industry stakeholders,  should identify solutions to address the limitations of the ARCOS  Enhanced Lookup Buyer Statistic Tool, to ensure registrants have the  most useful information possible to assist them in identifying and  reporting suspicious orders to DEA. (Recommendation 4)

We provided a draft of this report to DOJ, including DEA, for review and  comment. In its comments, reproduced in appendix III, DEA agreed with  three of the four recommendations, and neither agreed or disagreed with  the fourth. DEA also provided technical comments, which we incorporated  as appropriate.

In response to our first recommendation that DEA should develop and  implement additional ways to use algorithms in analyzing ARCOS and  other data to more proactively identify problematic drug transaction  patterns, DEA concurred and stated it will continue to examine a variety  of technologies to analyze ARCOS and other data and implement  additional ways to use algorithms to more proactively identify problematic  drug transaction patterns. If these and other actions to expand the  agency’s analytic capabilities are effectively implemented, DEA would  address the intent of our recommendation.

DEA also concurred with our second recommendation that DEA, in  coordination with the department-wide efforts on data strategy, should  establish and document a data governance structure to ensure DEA is  maximizing its management of industry-reported drug transaction data. In  its response, DEA stated it is currently implementing this recommendation  and will continue to mature its data governance structure. The intent of  this recommendation is for DEA to establish a formalized data  governance structure to manage its collection and use of data used to  support the Diversion Control Division’s mission. By establishing such a  structure, DEA could better ensure its important data assets are formally  managed and fully utilized, and could also help ensure consistent data  management across the Diversion Control Division.

DEA neither agreed nor disagreed with our third recommendation that  DEA should establish outcome-oriented goals and associated  measurable performance targets related to opioid diversion activities,  using data it collects, to assess how the data it obtains and uses supports  its diversion control activities. In its response, DEA stated it recognizes  that measurable performance targets related to opioid diversion activities  can serve as leading practices at different organizational levels including  the program, project, or activity level. However, DEA stated it needs  additional clarification on the specific actions needed to fulfill this  recommendation. Our recommendation is intended to ensure that DEA  can demonstrate the usefulness of the data it collects and uses to support  its opioid diversion control activities. We will continue to work with DEA to  address the specific actions needed to assess how the data it obtains and  uses support its diversion control activities to fully address the intent of  this recommendation. Based on our review of DEA’s existing performance  goals and targets for its opioid diversion efforts, as well as our previous  work on performance measurement, we believe that further development  of related performance goals and targets is warranted and could  potentially improve the usefulness of the data DEA collects and uses in  support of its diversion control program.

DEA also stated in its comments that the limited timeframe did not allow  GAO to meet with DEA officials responsible for performance metrics for  opioid diversion. However, in our interviews with DEA regarding its  performance metrics for opioid diversion, we submitted our questions in  advance of meeting with DEA officials to allow time for the questions to  be reviewed by relevant officials. DEA stated in its comments that it will  ensure that GAO meets with the appropriate officials to address metrics.  As stated earlier, we will continue to work with DEA to address the  specific actions needed to meet the intent our recommendation.

DEA concurred with our fourth recommendation that DEA, in consultation  with industry stakeholders, should identify solutions to address the  limitations of the ARCOS Enhanced Lookup Buyer Statistic Tool, to  ensure registrants have the most useful information possible to assist  them in identifying and reporting suspicious orders to DEA. DEA stated it  has consulted with industry stakeholders and has identified solutions to  address the limitations of the tool. We believe such consultation will be  beneficial for DEA to understand its industry stakeholders’ needs and that  identifying solutions for addressing these needs would help ensure  registrants have the information necessary to help identify and report  suspicious opioid orders.

We are sending copies of this report to the appropriate congressional  committees, the Attorney General, the DEA Administrator and the  Secretary of Health and Human Services, and other interested parties. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-6691 or McneilT@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix IV.

To understand the extent to which DEA obtains and uses industry- reported data, and the opportunities that exist to improve how that data  are obtained and used, including the feasibility of real-time reporting, we  reviewed applicable laws, regulations, court cases, and DEA internal  documentation. We also conducted interviews with DEA headquarters  offices, including the Diversion Control Division and DEA field division  offices. To determine DEA registrant legal reporting requirements related  to prescription drug orders and the meaning of suspicious orders, we  reviewed applicable laws and regulations, including the CSA and its  subsequent amendments and related DEA regulations and guidance. In  addition, we reviewed the recently enacted SUPPORT Act. To identify  policies and guidelines DEA uses to obtain and review registrant-reported  data, we reviewed DEA procedures for conducting drug-related  investigations, information system manuals for data and information  systems used by DEA, and DEA written communications to registrants  and DEA forms registrants use to report prescription drug transactions to  DEA. As part of our work examining the information systems used to  obtain and analyze data reported by registrants, we interviewed officials  who oversee the management of DEA information systems, such as  Automation of Reports and Consolidated Orders System (ARCOS),  Controlled Substances Ordering System (CSOS), Registrant Information  Consolidated System, and the Suspicious Orders Reporting System  (SORS) systems used to obtain and store suspicious order reports at  DEA headquarters. We interviewed DEA officials in headquarters and  field division offices to determine how information that industry members  report to DEA is obtained and used to detect and identify potential  diversion activities. The perspectives we gathered from field division  offices cannot be generalizable to the entire population of field division  offices, but did provide us with insights into the agency’s diversion efforts  and use of industry-reported data.

To identify what opportunities exist, if any, for DEA to improve these  efforts, such as using computer algorithms or real-time reporting, we also  interviewed DEA officials responsible for developing analytical products  based on industry-reported data. In addition, we interviewed DEA officials  at eight field division offices to learn about how diversion investigators  use industry-reported data and what, if any, improvements might be  needed. To identify which of the 23 DEA field division offices to interview,  we prioritized our selection based on four primary criteria: 1) the  controlled prescription drug availability rate in their geographic area,  according to a 2017 DEA threat assessment report, indicating whether  the field division office had a “high” or “moderate” rate of availability; 2)  whether the office was within the location of a DOJ Opioid Fraud and  Detection Unit task force location; 3) whether the office was located within  top ten state with high controlled prescription drug prescribing rate, as  identified by the CDC; and 4) whether the office was located within a state  that the CDC identified as having a high ER visit rate for opioid  overdoses. We also ensured that the DEA field division offices we  interviewed represented different geographic areas within the United  States.

We also conducted interviews with four pharmaceutical distributors and  one trade organization whose membership includes wholesale  distributors. We interviewed three organizations representing pharmacies,  pharmacists, and drug diversion professionals to gather their perspectives  and experiences with efforts to detect and report suspicious opioid orders.  We based our initial interview selection of distributors based on DEA- provided ARCOS data of opioid-related transactions, which indicated the  three largest distributors for opioids. To identify smaller distributors to  gather their perspectives, we contacted an industry association  representing distributors to facilitate our efforts to arrange for an  interview, resulting in an interview with one additional distributor.

In addition, we interviewed officials from a state prescription drug  monitoring program (PDMP) that collects real-time data, a Bureau of  Justice Assistance grant program that supports PDMPs, and a company  that operates 44 of the 53 state PDMPs to gain insights on the data they  collect. The views of these organizations cannot be generalized to the  entire population, but provided important insights and perspectives about  suspicious order detection and reporting. We reviewed the data DEA  collects to identify possible types of analyses DEA could conduct using  ARCOS data to identify unusual patterns. In addition, we reviewed key  data governance practices used by organizations and identified through  our past work to determine the extent to which DEA has a governance  structure in place to manage how it collects and uses data to support  diversion control efforts. Additionally, we reviewed the June 2019 Office  of Management and Budget Federal Data Strategy which provides a  framework of operational principles and practices to help agencies use  and manage data. The key practices we identified to compare DEA’s  data governance efforts against were: identify data needs to answer key  agency questions; provide resources explicitly to leverage assets;  prioritize data governance; and support non-federal stakeholders. We  selected these practices because they are important to early development  of a data governance structure. We also reviewed the February 2019  Data Strategy, released by DOJ, that is to serve as a roadmap for DOJ  components to manage their data assets.

To understand the extent to which DEA assesses the results of the data it  obtains and uses from its ARCOS system and through suspicious order  reporting, we reviewed DEA’s performance measures and applicable laws  governing performance reporting in the federal government, including the  Government Performance and Results Act of 1993 (GPRA), as updated  and expanded by the GPRA Modernization Act of 2010 (GPRAMA).  Although GPRA and GPRAMA requirements apply to those goals  reported by departments (e.g., DOJ), we have previously reported that  they can serve as leading practices at other organizational levels, such as  component agencies for performance management. We also reviewed  related national, DOJ, and DEA strategy documents that are used to  communicate diversion control goals and performance. These documents  included the 2018 National Drug Threat Assessment and 2019 National  Drug Control Strategy, DOJ’s department-wide strategic plan, DOJ  Annual Performance Report, DEA’s 360 strategy guide, and DEA  congressional budget justification documents. In addition, we evaluated  DEA’s performance measures against criteria in Standards for Internal  Control in the Federal Government. Furthermore, we reviewed the extent  to which DEA defined objectives and outcome-oriented goals, or  established measurable performance targets to evaluate the  effectiveness of how it obtains and uses data and compared them to  GPRAMA requirements, which may serve as leading practices for DEA.

To determine what opportunities exist, if any, for DEA to improve its use  and collection of industry-reported data, such as using computer  algorithms or real-time reporting, we interviewed DEA officials to  determine what analytics, if any, DEA is using to detect and identify  potential opioid diversion activities. In our interviews with field division  offices, we requested information regarding how investigators received  suspicious order reports from registrants and how the investigators  requested and used ARCOS and other system analysis to conduct or  support their investigative work. We also interviewed officials from other  entities with opioid diversion prevention responsibilities, such as state  level Prescription Drug Monitoring Programs, the Department of Health  and Human Services, including the Centers for Medicare and Medicaid  Services, and the Department of Justice (DOJ) U.S. Attorney’s Office  Opioid Fraud and Abuse Detection Unit.

To obtain perspectives of industry stakeholders on how data, such as  suspicious orders may be better reported to DEA, we interviewed four  industry associations whose memberships include industry stakeholders.  We selected these associations based on their roles in representing  various DEA registrant communities, such as pharmacists, pharmacies,  and distributors. We also reviewed documentation describing the data  available to DEA via its ARCOS database, as well as documentation that  described examples of unusual patterns of orders. Based on such  information, two GAO specialists identified methods that could be  implemented using computer algorithms to analyze ARCOS data to  identify patterns that might indicate unusual activity. Additionally, these  specialists identified related opportunities that DEA could use to analyze  ARCOS data combined with data from other sources, such as  prescription rate information, to identify these patterns.

To address the extent to which DEA collaborates with industry  stakeholders to combat opioid diversion, we examined DEA policies and  procedures, and interviewed relevant DEA officials, industry associations,  and private sector industry members. Specifically, we examined DEA  agency-wide directives and guidance, and component management  policies and procedures for providing information to industry stakeholders  related to industry’s suspicious order reporting requirements, including  written communication DEA sent to industry stakeholders related to  suspicious order reporting. In addition, DEA officials provided us with a  demonstration of SORS, ARCOS, and the ARCOS Enhanced Lookup  Buyer Statistic Tool – available to distributors to help them identify and  report suspicious opioid orders.

We interviewed DEA officials in eight field division offices who interact  with industry stakeholders on, among other things, identifying and  reporting suspicious orders. These officials provided their perspectives on  the usefulness of suspicious order reports to their investigations as well  as other industry self-reported data collected in DEA information systems.  We interviewed opioid distributors of varying sizes, as noted above,  including some of the largest opioid distributors, based on DEA-provided  ARCOS data of opioid-related transactions, for their perspectives on the  information and tools DEA provides to them, including the Lookup Buyer  Statistics Tool and the ARCOS Enhanced Lookup Buyer Statistic Tool.  The views of these distributors are not generalizable to the entire  population, but provide insights and information on how industry detects  and reports suspicious orders through use of ARCOS data and other  tools.

We conducted this performance audit from January 2019 through January  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Timeline of Selected Events and Legislation Impacting or Related to Industry- Reported Data on Prescription Opioids

Appendix II: Timeline of Selected Events and  Legislation Impacting or Related to Industry- Reported Data on Prescription Opioids Pub. L. No. 91-513, 84 Stat. 1242 (Title II of the Comprehensive Drug Abuse Prevention and Control  Act of 1970, Pub. L. No. 91-513, 84 Stat. 1236).

Appendix III: Comments from the Department of Justice

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the contact above, Tonnye’ Conner-White (Assistant  Director), Gary M. Malavenda (Analyst in Charge), David Bruno, Jill  Center, Billy Commons, Peter DelToro, Kathleen Drennan, Melissa  Hargy, Will Horowitz, Hayden Huang, Eric Hauswirth, Susan Hsu, Nicole  Jarvis, Benjamin T. Licht, Amanda Miller, and Jan Montgomery all made  key contributions to this report.

The Drug Enforcement Administration collects industry-reported data on the sale and purchase of controlled substances and prescription drugs, including opioids. The data supports DEA’s investigations into whether drugs have been diverted to the illegal marketplace.

DEA’s systems don’t provide real-time analysis, but more robust analysis is possible. For example, DEA could use computer algorithms to proactively identify patterns and trends in drug distribution—e.g., to see when unusual volumes of drugs are disposed of vs. sold.

Better using algorithms to analyze and identify patterns in drug transaction data is among our recommendations to DEA.