Background

The CSA places various plants, drugs, and chemicals such as narcotics,  stimulants, depressants, hallucinogens, and anabolic steroids into one of  five schedules based on the substance’s medical use or lack thereof,  potential for abuse, and safety or potential for dependence. The act  requires persons and entities who manufacture, distribute, or dispense  controlled substances or listed chemicals to register with DEA, which by  delegation from the U.S. Attorney General is responsible for administering  and enforcing the CSA and its implementing regulations.
Within DEA, the Office of Diversion Control (OD) is directly responsible  for enforcing the provisions of the CSA as they pertain to ensuring the  availability of substances—such as prescription drugs and listed  chemicals—for legitimate uses while preventing their diversion. Given this  overall mission, OD is responsible for preventing, detecting, and  investigating the diversion of controlled substances.
The CSA requires DEA to maintain a closed system of distribution of  controlled substances in the United States from the point of import or  manufacture through dispensing to patients or disposal. Under this  system, most legitimate handlers of controlled substances— manufacturers, distributors, physicians, pharmacies, researchers, and  others—must be registered with DEA and account for all controlled  substances distributions. DEA registrants must renew their registration  every year or every 3 years, depending on the type of registration. Table  1 presents the number and type of individuals and entities that are  registered with DEA to manufacture, distribute, or dispense controlled  substances.
DEA maintains the list of registrants in the controlled substances  database (i.e., CSA2), which includes registrants’ identifying information,  such as first and last name, date of birth, and Social Security number  (SSN) for individuals; and name and employer identification number (EIN)  for businesses. As of March 2014, and as highlighted in table 1, the CSA2  consisted of records of more than 1.5 million registrations under the act,  of which 93 percent were practitioners. The database is used to register  practitioners as well as to certify a practitioner’s CSA status and is useful  to health-maintenance organizations, clinics, health-insurance  companies, pharmaceutical and medical-services firms, and others who  must verify that a practitioner is registered to handle controlled  substances. Registrants may only engage in those activities that are  authorized under state law for the jurisdiction in which the practice is  located. The CSA requires a separate DEA registration for each principal  place of business or professional practice where controlled substances  are manufactured, distributed, or dispensed. However, a practitioner who  is registered at one location, but also practices at other locations, is not  required to register separately for any other location within the same state  at which controlled substances are only prescribed.
States also play a role in overseeing the entities that handle controlled  substances. All practitioner applicants to DEA must first demonstrate that  they have received applicable licenses from their state. Further, according  to DEA, 26 states and U.S. territories register practitioners wanting to  handle controlled substances at the state level. Forty-nine states also  have developed Prescription Drug Monitoring Programs (PDMP).  PDMPs are statewide programs that collect data on prescriptions for  controlled substances and enable prescribers, pharmacists, regulatory  boards, and law-enforcement agencies (under certain restrictions) to  access this information pursuant to applicable state laws and guidelines.  PDMPs may aid the care of those patients with chronic, untreated pain or  chemical dependency by providing patient prescription-history reports or  electronic alerts to prescribers and dispensers to bring patients of  concern to their attention. PDMP data can be also used to help identify  patients and practitioners engaged in prescription drug abuse and  diversion. For example, PDMP data can be used to identify individuals  who have obtained controlled substances from multiple physicians  without the prescribers’ knowledge of the other prescriptions (i.e., “doctor  shopping”) and can be used to identify practitioners with patterns of  inappropriate high levels of prescribing and dispensing. The manner and  conditions of access to PDMP data vary from state to state depending on  the laws that implement PDMP programs. Laws in each state determine  which users are authorized to access PDMP data and provide the specific  purposes that are allowed for this access.
Each state determines which health-care occupations may prescribe or  dispense controlled substances, as well as an occupation’s licensure  requirements. To administer state licensure laws, depending on the state  and occupation, legislatures create agencies, boards, or other entities to  carry out licensing processes. See table 2 for an example of the variety  of professions eligible to prescribe controlled substances in two different  states and the relationship between the professions and licensing  authorities.
The CSA requires DEA to register a practitioner if the applicant is  authorized to dispense controlled substances in the state in which he or  she practices. DEA may deny an application if it determines that issuance  of the registration would be “inconsistent with the public interest.”  According to the CSA, DEA must consider several factors in determining  whether such a registration would be inconsistent with the public interest,  such as the recommendation of the appropriate state licensing board or  disciplinary authority, the applicant’s compliance with applicable state,  federal, or local laws relating to controlled substances, and such other  conduct by the applicant that may threaten the public health and safety.
Figure 1 below provides an overview of how state and DEA processes  interconnect for controlled substance registration.
Further, under the CSA, DEA has the authority to deny, suspend, or  revoke an existing controlled substance registration for several reasons,  including if a registrant has had a state license revoked, been convicted  of a felony related to controlled substances, or been excluded or directed  to be excluded from participating in federal health-care programs, such as  Medicaid or Medicare, due to certain types of criminal convictions. If DEA  decides to revoke, suspend, or deny a registration, it must serve upon the  applicant or registrant an order to show cause why the action should not  be taken. If continued registration poses an imminent danger to public  health or safety, DEA can issue an immediate suspension order, which  immediately deprives the registrant of the authority to handle controlled  substances. Orders to show cause and immediate suspension orders,  along with other adverse actions, are collectively known as registrant  actions. DEA also has the authority to take a number of administrative  actions against practitioners, including placing restrictions on the type of  scheduled drugs practitioners can handle. Other administrative actions  include issuing a letter of admonition to advise the registrant of any  violations and necessary corrective actions, and developing a  memorandum of agreement that outlines specific actions to be taken by  the registrant and subsequent DEA actions if not corrected. Although  DEA can issue these registrant actions and impose sanctions, a denial or  revocation of a practitioner’s registration cannot be finalized until the  practitioner has been given the opportunity to have an administrative  hearing. Table 3 below provides the number and type of actions taken  against controlled substances practitioner applicants and registrants from  fiscal years 2011 to 2015.
The Department of Justice (DOJ) Office of the Inspector General (OIG)  reviewed the timeliness of DEA’s process for issuing final decisions on  registrant adverse actions and, in May 2014, reported that the overall time  it takes DEA to adjudicate all registrant adverse actions continues to be  very lengthy. The OIG reviewed overall registrant adverse action  processing for the period 2008 through 2012 and found that the average  time for DEA to adjudicate registrant adverse actions, from initiation to  final decision, was almost 2 years in 2009. By 2012, the time frame to  complete adjudication of adverse actions had declined, but it still took 1  year, on average, for DEA to issue a final decision on any given registrant  adverse action. According to the OIG, delays in adjudicating registrant  adverse actions can have harmful effects on the general public,  registrants, and DEA. The OIG reported that delays can create risks to  public health and safety by allowing noncompliant registrants to operate  their business or practice while the registrant adverse action is being  adjudicated. For example, if a doctor is issued an order to show cause,  that doctor can keep writing prescriptions until DEA makes a final  decision.

	Selected States and DEA Have Established Controls to Ensure the Eligibility of Individuals to Handle Controlled Substances, Including Checks on Licenses and Legal Violations

		State Controls Include Verifying Identity and Licensure Information, and Some States Conduct Criminal-Background Checks

Each of the five states we examined has established several controls,  with some common features for physician licensing and monitoring, as  illustrated in figure 2 below.
As reflected in the figure above, all five states we examined utilize a  number of the same controls for issuing and renewing medical licenses,  and for monitoring licensees. For example, according to our interviews  with state officials and, where available, documentation on state  processes, all five states had processes to confirm the identifying  information for an applicant and for verifying the professional credentials  of applicants. Also, all five states review disciplinary actions taken by  other state medical licensing authorities by requiring applicants to arrange  for one of three national clearinghouses to send this information to the  state licensing authority for review.
Officials in the five states we examined had established controls to renew  and monitor physicians’ licenses. For example, officials from the five  state medical boards said that they track disciplinary actions imposed on  their licensees by receiving reports from the FSMB. This includes  disciplinary actions that may have been implemented by a medical board  in another state.
Although all five states use some common controls, we found differences  in how each state employs other key checks in the initial licensing  process. For example, variations exist among the five states in how they  conduct state and federal criminal-background checks for applicants.  While all five states require applicants to answer one or more questions  about a criminal record to which they must self-attest,  two state authorities—in Connecticut and Vermont—accept the self- attestations and investigate only affirmative responses by applicants;  in contrast, three state authorities—in Arizona, New Mexico, and  Texas—conduct both state and federal criminal-background checks,  regardless of the applicant’s attestation; and additionally, four of the five states—Arizona, Connecticut, Texas, and  Vermont—review medical malpractice judgements for all medical  license applicants, while one state—New Mexico—reviews medical  malpractice judgements only for medical license applicants that have  self-reported on their application.
Additionally, the extent of reviewing the criminal backgrounds of licensees  after initial licensure differs by state. Upon license renewal, licensees are  again asked similar questions about their criminal record. Two states  (Connecticut and Vermont) accept the renewing licensee’s self-attestation  and investigate only affirmative responses. One state (Arizona) does not  conduct any subsequent checks against state or federal criminal  databases after initial licensure, while two states (Texas and New Mexico)  regularly monitor state or federal criminal databases. For example, New  Mexico contracts with a vendor that continuously monitors the state’s  licensed physicians’ interactions with law-enforcement agencies  nationwide using the FBI’s national database and other law-enforcement  databases. In addition, at the time of our review, Texas was in the  process of working on an agreement with the FBI to allow the board to  monitor federal criminal backgrounds of licensees, in addition to the  already-implemented quarterly state criminal-background checks.
There are also differences among the five states in how prescription data  are used to monitor top prescribers of controlled substances. Of the five  states we examined, three states (Connecticut, New Mexico, and Texas)  use data from the state’s PDMP to identify physicians with high  incidences of prescribing controlled substances in order to initiate a  follow-up with the physicians. The follow-ups are meant to determine the  reasons for the high rate of prescriptions. For example, New Mexico  Medical Board officials told us they monitor prescriber patterns by  reviewing quarterly PDMP report cards. The board will send out letters to  physicians who appear to have high-risk prescribing practices, and may  issue formal complaints if the patterns continue. However, the extent to  which the states have implemented their PDMP can vary. For example,  Texas officials estimated that about 25 percent of the state’s controlled  substance prescribers are registered in the program, while New Mexico  requires every physician to register with the PDMP as a prerequisite to  obtaining their state-level controlled substance license and mandates that  physicians regularly use the state’s PDMP.

		DEA Controls Include Verifying Current Licensures for Initial Practitioner Applications and Renewals, and Monitoring the Public Death Master File

Through its practitioner application and renewal processes, DEA employs  several controls to assess whether an individual applicant is eligible for a  controlled substance registration. These controls include comparing  applicant identifying information for consistency with state licensure  information and confirming that applicant medical licenses are current;  confirming status of state controlled substance registration, if applicable;  and determining whether an applicant has any drug-related offenses. In  addition, DEA OD officials said they compare registrants to SSA’s public  Death Master File (DMF) on a weekly basis to identify registrants who  have died. DEA also receives information from state entities, other law- enforcement agencies, private citizens, former patients, and health  practitioners on adverse actions related to professional health-care  licenses or other issues that could call into question a registrant’s  continued suitability to prescribe or handle controlled substances.  However, according to DEA OD officials, the amount of communication  with state entities varies significantly from state to state. See figure 3 for  an overview of the process and controls DEA uses to register, renew, and  monitor practitioners of controlled substances.
DEA officials known as Registration Program Specialists hold primary  responsibility for reviewing and processing applications of practitioners  seeking to handle controlled substances. Registration specialists use  several controls to verify information provided on a new application to  determine applicant eligibility. These controls include the following:
Comparing DEA applicant information to state licensing board  information for inconsistencies. According to DEA OD officials,  registration specialists are to compare identifying information on  applications to identifying information maintained by the appropriate  state licensing board. They perform this comparison by accessing  public websites maintained by the state licensing boards that can be  searched, for instance using the applicant’s license number or other  identifying information. Registration specialists are to verify the name  of licensee, type of license, license number, and expiration date and  are to look for differences between the information associated with the  state license and what the applicant put on the DEA registration  application. Any differences could indicate potential fraud or other  risks.
Confirming that an applicant’s professional health-care license is  current. Registration specialists are to use the state licensing board  websites to verify licensure status with the respective state boards  (medical, pharmacy, nursing, etc.). According to DEA OD officials, the  registration specialists are not required to review administrative  complaints or disciplinary actions taken by state licensing boards. If  there are any conflicting data, the application is to be referred to a  Diversion Investigator (DI) for further review.
For states with a controlled substance registration, confirming  applicant’s status. DEA’s CSA2 will notify the registration specialist if  a separate state controlled substance registration is required.  According to DEA OD officials, when applicants are from states that  have their own CS registration requirement, the registration specialist  is to review the state controlled substance authority’s website to  determine whether the applicant’s name and state registration number  match the information on the DEA application. The specialist is to also  check to be sure that the state registration has not expired and that  the registration is not restricted in any way. If there are any conflicting  data, the application is to be referred to a DI for further review.
Checking for any drug-related offenses or suspect associations.
Registration specialists are to check the names of anyone listed on  each initial application against DEA’s Narcotics and Dangerous Drugs  Information System (NADDIS). This system contains information  about drug offenders, alleged drug offenders, persons suspected of  conspiring to commit, aid, or abet the commission of a drug offense,  and other individuals related to, or associated with, DEA’s law- enforcement investigations and intelligence operation, among other  things. If the registration specialists identify any inconsistency  between the information in the application and any of the sources  used for validation, the registration specialists will refer the application  to a DI for further investigation.
Reviewing applicant responses to liability questions. Applicants  are also asked to answer four liability questions and to explain any  affirmative responses. Questions include whether the applicant has  ever been convicted of a crime in connection with controlled  substances under state or federal law, or ever had a state  professional license revoked, suspended, restricted, denied, or placed  on probation. For any affirmative responses, the application will be  forwarded to a DI for further investigation.
Practitioners who have received authorization to handle controlled  substances must renew their registrations every 3 years, and DEA uses  some of the controls for the renewal process that are used for an initial  registration. For example, registrants must again respond to the same  liability questions that appear on the initial application concerning criminal  activity and changes to their professional or legal status and are to report  any criminal convictions related to controlled substances, or whether their  state license or controlled substance registration has been revoked,  suspended, or otherwise restricted. If the registrant does not self-report  any liabilities and there are no changes to the information contained in the  registrant’s record (such as changes to the registrant’s name, address, or  state license number), then the renewal is automatically approved without  further checks against state licensure websites. In addition, at renewal,  the registration specialist is to review the historical records from the  registrant’s initial application. DEA OD officials told us that the registration  specialists do not conduct subsequent checks against NADDIS for  renewals unless the applicant self-reports a criminal conviction related to  controlled substances.
DEA OD officials told us that they perform one systematic form of  monitoring of registrants’ eligibility between renewal periods by  conducting weekly checks of the public DMF. Specifically, DEA OD staff  have established an automated process to compare the DEA registrants’  database against SSA’s public DMF every week to find possible matches,  which can indicate that an individual registrant has died. Names and  SSNs from the registrants’ database are compared to names and SSNs  contained in the DMF. Registrations that match to DMF names and SSN  are automatically retired in the system. A report of partial matches is  generated by the system, and any partial matches will be researched  further. On the basis of this research, registrations will be manually  retired, if appropriate.
DEA OD officials indicated that other monitoring activities may include  states communicating directly with DEA to provide information and  allegations of wrongdoing by registrants. For example, state medical  licensing boards and state controlled substance authorities may provide  practitioner complaint and disciplinary action or sanction information to  DEA. Also, many of the investigations that DEA initiates are conducted  pursuant to tips and complaints received from other law-enforcement  agencies, private citizens, former patients, and health practitioners.

	Limitations Exist in DEA’s Controls to Collect and Validate Identifying Information and Verify Continued Eligibility of Its Controlled Substance Registrants

DEA has established controls to aid in determining registrant eligibility.  However, we found limitations in DEA’s processes to collect and validate  registrants’ identifying information and verify continued registrants’  eligibility. These limitations include issues related to identifying registrants  who were deceased, did not possess state-level controlled substance  authority, or had criminal backgrounds that may have provided a sufficient  basis to deny or revoke a registration.

		Missing, Potentially Invalid, and Duplicative SSNs in DEA’s Registrants Data Reduce the Effectiveness of Key Controls

DEA’s controlled substance registration process involves applicants  submitting key identifying information, some of which DEA staff are to  verify. Specifically, individual applicants are required to provide DEA with  key identifying information, such as first and last name and date of birth.  Additionally, applicants must provide a taxpayer identification number,  such as an SSN for individuals or an EIN for businesses, unless the  applicant is fee-exempt. DEA’s system for processing applications has  edit checks in place to ensure that SSNs entered are in the appropriate  format (9-digit, numeric) and do not contain all repeating numbers (e.g.,  999-99-9999). DEA’s CSA2 system recognizes and flags SSNs that are  already in its system. This system control was designed to alert the  registration specialist that an applicant has (or had) another DEA  registration and to prevent reregistering individuals who may not be  eligible based on actions taken against their previous or current  registrations. According to DEA OD officials, this system control was  established after a registrant who had been prosecuted by DEA reapplied  and was approved for a new registration under a different address. Once  the application information is submitted, DEA’s registration specialists are  to compare the applicant’s name and state licensure information to the  information maintained by the appropriate state licensing board.
Our examination of DEA’s CSA2 data revealed gaps and other issues  pertaining to registrants’ SSNs, as described below.
Individuals registered using EINs instead of SSNs. As described  above, DEA must collect taxpayer identification numbers for all non- fee-exempt individuals for the purpose of collecting and reporting on  any delinquent amounts arising out of the individual’s relationship with  DEA, pursuant to the Debt Collection Improvement Act of 1996.  Instructions on DEA’s application form state that SSNs are required  for individual registrations, and tax identification numbers (such as an  EIN) are required for business registrations.
Our analysis of DEA’s CSA2 data identified 41,909 of about 1.4  million individual registrations (about 3 percent) who were registered  using an EIN instead of an SSN. We reviewed these results and  identified 1,124 of the 41,909 records that contained text suggesting  they were registered under official government capacity (e.g., “Limited  to Official Federal Duties Only”), and therefore, not required to provide  either an EIN or SSN. The remaining 40,785 records did not contain  such text. However, depending on how an individual has structured  his or her professional business activities, it may be appropriate for  the individual to apply to DEA as a business instead of as an  individual. Because DEA is required to collect taxpayer identification  numbers for debt collection purposes, according to officials in DEA’s  Office of Chief Counsel, DEA only has the legal authority to collect  EINs, and not SSNs, from those individuals who apply as a business.  As a result, DEA would have to obtain additional legal authority in  order to require SSNs for all individuals. As discussed later,  registering individuals with an SSN is essential to DEA’s use of the  public Death Master File (DMF) as a control, in that SSNs (and not  EINs) are needed to identify and retire deceased registrants. EINs do  not allow DEA to use the DMF as a control mechanism. In addition,  allowing EINs in place of SSNs limits DEA’s ability to identify other  registrations for the same individual, particularly those with past  adverse history.
Potentially invalid SSNs. We identified 11,740 out of about 1.3  million SSNs associated with individual registrations whose SSN or  date of birth (or both) could not be validated by SSA’s EVS.  Specifically, we compared DEA registrants’ names, dates of birth, and  SSNs to SSA’s records using EVS. EVS flags SSNs in which the  name or date of birth (or both) do not match its records for the SSN,  as well as SSNs that have never been issued. Specifically, of the  11,740 SSNs, we found 8,235 SSNs that did not match the name  identified, 3,441 SSNs that did not match the date of birth, and 64  SSNs that had never been issued by SSA. Mismatches in names,  SSNs, or dates of birth could be a potential identity fraud indicator but  could also be due to data-entry errors or unreported name changes.  As previously mentioned, DEA has procedures in place to compare  identifying information, such as first and last names, from registrant  applications to license information maintained by state professional  licensing boards. In contrast, however, DEA does not have  procedures to verify other identifying information, such as SSNs or  dates of birth. For example, DEA does not have an agreement with  SSA to access EVS as one possible option to verify the SSNs  provided by DEA registrants. DEA officials said that while they had not  previously considered strategies to validate SSNs and dates of birth,  they were open to exploring options to do so. In our discussions, SSA  officials said they would be open to the option of providing DEA with  access to EVS, although it would require a legal review based on  DEA’s intended use.
Multiple individuals registered using same SSN. We identified 688  SSNs associated with multiple individuals, which is a risk indicator for  potential fraud. Of the 688 SSNs, we identified 268 SSNs  associated with names that reasonably appeared to be the same  person, but whose names did not match due to possible typos (e.g.,  “Sally Simpson” and “Sally Simpsen”), name cognates (e.g.,  “Jonathan Smith” and “Jon Smith”), name inversions (e.g., “Jon Smith”  and “Smith Jon”), or additional first or last names (e.g., “Mary Lynn  Smith” and “Mary Smith,” or “Jane Smith Johnson” and “Jane  Johnson”). However, the remaining 420 SSNs were associated with  first or last names (or both) that reasonably appeared to be distinctly  different. Different names registered with the same SSN could be a  potential identity fraud indicator but could also be due to data-entry  errors or individual name changes.
We provided a list of these individuals to DEA for further investigation.  DEA OD officials reviewed 449 of the 688 SSNs and provided several  reasons why there were multiple names registered using the same  SSN. DEA OD officials indicated that one reason this occurred was  because some SSNs associated with these registrations were entered  into the system prior to the implementation of the multiple SSN  system flag. The system flags are generated when a new  application is entered into the system. Therefore, according to DEA  OD officials, the system would not have recognized duplicate SSNs  among the existing registrations. Additionally, DEA OD officials told us  that some of the names did not match due to individual name  changes, data-entry errors, and other reasons that would require  further DEA review. Because DEA did not review every SSN, it is  unclear whether there are any other reasons this may have occurred.
According to the Standards for Internal Control in the Federal  Government, agencies should design processes that use the agency’s  objectives and related risks to identify the information requirements  needed to achieve the objectives and address the risks. In addition,  agencies are to design controls to help ensure the completeness,  accuracy, and validity of their data in order to help the agency achieve its  objectives and respond to risk. These standards also require agencies to  have appropriate control activities in place to ensure that the data used by  the agency are accurate.
As demonstrated by our analyses, DEA has an opportunity to enhance  the integrity of its database by developing policies and procedures to  collect and validate registrants’ SSNs. By not collecting and validating  SSNs for all of its individual registrants, DEA is missing key information  required to establish registrant identity and monitor eligibility. In particular,  missing, invalid, or incorrect SSNs will reduce the effectiveness of DEA’s  use of the public DMF to identify decedents because SSNs are needed  for the matching process. Further, not having complete and accurate  SSNs would limit DEA’s ability to identify other registrations held by the  same individual and any past adverse history that may affect the eligibility  of the registrant. By not requiring SSNs for all individual registrants,  regardless of whether they apply as a business, and not taking steps to  verify the SSNs, DEA is not well positioned to ensure the identities of its  registrants. Additionally, not requiring SSNs for all individual registrants  limits DEA’s ability to conduct any other potential data matching, which  could improve the integrity of its registrants’ data and reduce the risk of  potential misrepresentation or fraud.

		Some Registrants Were Potentially Ineligible Because They Were Reported as Deceased, Did Not Have a Current State License, or Had Criminal Violations Related to Controlled Substances

Of the approximately 1.4 million individual registrations in DEA’s CSA2,  we found 764 registrants that may have been ineligible to have controlled  substance registrations because the registrants were reported deceased  by SSA, did not possess state-level controlled substance authority, or  were incarcerated for felony offenses related to controlled substances.  Each of these issues may adversely affect an individual’s registration. In  addition, we also found 100 registrants who presented issues that may  increase the risk of illicit diversion of controlled substances, such as  registrants with active or recent warrants for offenses related to controlled  substances, registrants incarcerated or with active or recent warrants for  offenses unrelated to controlled substances, and registrants listed in the  NSOR. We note that the numbers of potentially ineligible registrants, as  well as registrants who may pose an increased risk of illicit diversion, may  be more than the total number of registrants we identified because  missing or incorrect SSNs reduced our ability to identify matches between  the registrants’ data and other data we used. Table 4 shows a summary  of DEA registrants we identified that may be ineligible or may pose an  increased risk of controlled substance diversion.
According to federal regulations, a DEA registration legally terminates  immediately upon death of a registrant. To identify such individuals,  DEA matches its database weekly against SSA’s public DMF, which is a  publicly available subset of the death records that SSA maintains on  deceased SSN-holders. According to DEA officials, registrants matching  on SSN and name are automatically retired in CSA2. DEA officials also  told us that the DEA OD Registration and Program Support Section Chief  is to manually review any partial matches (e.g., instances in which the  SSN matches, but name does not match) to determine whether additional  actions are necessary.
Removing deceased registrants from its database and retiring their  registration can reduce the risk of someone obtaining and misusing the  deceased registrant’s authority to handle, dispense, or prescribe  controlled substances, thus limiting opportunities for the diversion of  these substances. While DEA’s control is designed to identify and remove  deceased registrants, our analysis identified 705 registrants that were  reported deceased by SSA as of March 2014 (the most-current DEA data  available at the time of our review). We identified these deceased  registrants by comparing DEA’s CSA2 data of about 1.4 million individual  registrations with SSA’s full death file, which lists all SSNs of people for  whom SSA has received a record of death. Specifically, of the 705  reportedly deceased registrants, 420 had been deceased for 6 months or  longer, including 236 who had been deceased over a year.
Under current law, DEA is not eligible to access SSA’s full death file, the  database we used to conduct our analysis. According to SSA officials, the  public DMF contained about 16 million fewer records than the full death  file as of March 2016. We previously reported that SSA officials expect  that the proportion of state-reported death records that must be excluded  from the public version will continue to increase over time. For example,  for deaths reported in 2012 alone, the public DMF included about 40  percent fewer death records than the full death file. According to the  Standards for Internal Control in the Federal Government, agencies  should design procedures using information necessary to achieve their  objectives and respond to risks. Because of the differences in the death  databases, DEA may not have been alerted to the reportedly deceased  individuals that we identified. In our discussions, DEA officials were open  to the idea of exploring legislative options to obtain the full death file.
By not identifying deceased registrants and not subsequently deactivating  their registrations, DEA’s registry may be vulnerable to potential fraud  leading to diversion of controlled substances. To better ensure that DEA’s  registry maintains current registration information and to prevent others  from potentially utilizing the registration information of deceased  registrants, DEA could take additional steps by developing a legislative  proposal to gain access to the more comprehensive full death file.

			Limitations Exist in Monitoring State Licensure Information

As described previously, the CSA requires DEA to register a practitioner if  the applicant is authorized to dispense controlled substances in the state  in which he or she practices. DEA may deny an application if it  determines that the registration would be inconsistent with the public  interest. Two of the factors DEA must consider in this determination are  the recommendation of the appropriate state licensing board or  disciplinary authority and the applicant’s compliance with applicable state,  federal, and local laws relating to controlled substances. Additionally,  DEA also has the authority to suspend or revoke an existing controlled  substance registration if a registrant has had a state license suspended or  revoked, among other reasons.
We found at least 57 individuals associated with 58 registrations who may  have been ineligible for a controlled substance registration based on our  analysis of actions taken against their respective state licenses, such as  revocations of medical license or controlled substance privileges. We  compared data from the FSMB on physician license information and  disciplinary actions to data from CSA2. The FSMB maintains a central  repository database for licensure information and disciplinary sanctions  provided by all medical boards within the 50 states, Puerto Rico, and the  District of Columbia, among other sources. By matching registrants’  information to information contained in the FSMB data, we were able to  review an individual’s entire licensure history, including revocations and  suspensions, for all medical licenses, across all U.S. states, Puerto Rico,  and the District of Columbia, among others. We then reviewed supporting  documentation for each of the actions identified in FSMB data using state  medical board websites. To help identify revocations, surrenders, or  suspensions occurring without reinstatement prior to March 6, 2014 (the  most-current DEA data available at the time of our review), we limited our  review of FSMB data to the most-recent action taken against the  registrant prior to March 6, 2014. Therefore, the number of individuals  with disciplinary actions we identified represents a minimum number.
Our analysis of FSMB data identified 57 individuals who did not appear to  possess active state-level controlled substance authority in the states  where they held active DEA registrations, as of March 6, 2014.  Specifically, of the 57 individuals, we identified 41 who had disciplinary  actions that resulted in the revocation or surrender of their medical  licenses, and 16 whose medical licenses were not revoked, but the state  licensing board restricted the individuals’ controlled substance authority.  These actions occurred between June 2011 and February 2014. For  example:
We identified a physician whose Ohio medical license was revoked in  October 2011 for prescription drug–related crimes. In January 2012,  the physician pled guilty in an Ohio county court to one count of  engaging in a pattern of corrupt activity, six counts of trafficking in  drugs, and one count of theft. The physician was sentenced to 3 years  of imprisonment in February 2012 and was still actively registered with  DEA as of March 2014. According to DEA OD officials, DEA was  unaware that the registrant no longer possessed state-level controlled  substance authority and therefore it did not initiate any action against  the registration. The DEA registration subsequently expired in May  2014, approximately 2-½ years after the state authority was revoked.
We identified a physician whose controlled substance registration  from the District of Columbia was placed on immediate suspension for  risk to public health and safety in April 2012 and later revoked in June  2013 after a patient died due to excessive and inappropriate  controlled substances prescribing, according to a District of Columbia  board action report. The physician was still actively registered with  DEA as of March 2014. According to DEA OD officials, DEA was  unaware that the registrant no longer possessed state-level controlled  substance authority and therefore it did not initiate any action against  the registration. The DEA registration subsequently expired in  February 2015, almost 3 years after authority in the District of  Columbia was inactivated.
We provided information on these 57 individuals to DEA for further  investigation. DEA OD officials provided information indicating the status  of each registration, whether any action was taken against the  registration, and whether there was knowledge of the state disciplinary  action. In 36 of the 57 cases, CSA2 did not contain information on these  individuals’ state licensure status or disciplinary actions, which meant that  DEA OD staff could not make an informed decision on the eligibility of  these registrants to continue to handle or prescribe controlled  substances. According to DEA OD officials, DEA took action against 3  of the 36 registrations. However, the bases for these actions were  unclear, and there was no indication that they were based on the loss of  state-level controlled substance authority.
As described earlier, DEA verifies an applicant’s state licensure  information upon initial application by checking the relevant state board  websites to ensure the applicant is appropriately licensed. However, DEA  does not verify practitioners’ state licenses after initial registration to  ensure they are still actively licensed by the state. Instead, it relies on the  practitioner to self-report any disciplinary actions related to controlled  substances at renewal every 3 years, or the individual state licensing  boards to notify DEA of any actions taken against its registrants that may  affect their controlled substance eligibility. According to DEA OD officials,  the amount of communication between DEA and the state licensing  boards varies significantly, so not all state licensing boards may notify  DEA that the state has taken action against a DEA registrant.  Furthermore, DEA is not required to and has not chosen to make use of  perpetual vetting techniques; that is, regularly matching its database of  registrants against databases containing medical sanctions, such as the  database we used in this analysis. Therefore, DEA may not have been  alerted to the information on the disciplinary actions that we identified.  When asked why DEA does not monitor state licensure information after  initial registration, agency officials said that they had not considered  monitoring state licensure information, but would be open to exploring  options to do so.
As previously noted, the Standards for Internal Control in the Federal  Government state that agencies should design procedures using  information necessary to achieve their objectives and respond to risks.  DEA’s reliance on state boards to alert them of any actions, complaints,  or criminal offenses against one of its registrants could result in delays in  receiving pertinent information about the eligibility of its registrants. In  addition, if a state fails to notify DEA of an action against one of its  registrants or the applicant does not self-report a disciplinary action, then  DEA may not discover that the registrant is no longer eligible.
By not making use of available resources to monitor the state licensure  and disciplinary actions taken against its registrants, such as databases  containing information on medical sanctions, DEA is not well-positioned to  ensure the continued eligibility of its registrants. For example, databases  containing information on medical sanctions, such as those maintained by  the FSMB or the National Practitioner Data Bank (NPDB), capture  information on multiple types of practitioners from many different sources,  such as adverse actions taken by state boards, federal agencies, and  professional societies. In addition, these data also include information on  actions taken due to controlled substance violations, criminal offenses,  and exclusions from federal health-care programs reported by the  Department of Health and Human Services (HHS). One database, NPDB,  also captures information from state law-enforcement and Medicaid fraud- control agencies. Utilizing these types of databases would allow DEA to  regularly monitor adverse actions taken against its registrants across a  broad spectrum of sources. Furthermore, utilizing these types of  databases would allow DEA to monitor its registrants’ licenses and  disciplinary actions across all states, not just the state in which they hold  a DEA registration. Disciplinary actions occurring in other states could be  relevant to DEA’s assessment of whether registering an individual would  be inconsistent with the public interest. However, using these databases  may have costs. Therefore, it would be important for DEA to balance the  cost and benefit to using such databases with developing other  approaches for monitoring its registrants’ state authority. Regardless of  the approach used, without taking steps to verify registrants’ continued  eligibility, DEA may not have complete or timely information about the  continued eligibility of its registrants, thereby weakening the integrity of its  registry.

			Limitations Exist in Monitoring Criminal Backgrounds

In furtherance of its mission to enforce the closed system of controlled  substance distribution, DEA has promulgated regulations that require all  applicants and registrants to provide effective controls and procedures to  guard against theft and diversion of controlled substances. DEA has also  published the Controlled Substances Security Manual (Manual), which  clarifies the regulations and provides additional guidance to assist  handlers of controlled substances in safeguarding them. For example, the  Manual instructs practitioners to keep blank prescription forms and  unused DEA Order Forms in a secure location to prevent against theft.  The Manual also emphasizes that applicants and registrants who hire  employees to work in or around areas where controlled substances are  handled must carefully screen these employees, identifying this process  as “a critical first step in diversion prevention,” “vital to fairly assess  the likelihood of an employee committing a drug security breach,” and  “essential to overall controlled substances security.” According to DEA, as  part of the screening process, criminal-background checks with local law- enforcement authorities should be performed by the employer, and each  potential employee should be required to answer the question, “Within the  past five years, have you been convicted of a felony, or within the past  two years, of any misdemeanor, or are you presently charged (formally)  with committing a criminal offence?” Given DEA’s guidance to registrants  that their employees with criminal convictions, or pending charges, may  pose an increased risk of illicit diversion of controlled substances, we  assessed the extent to which DEA’s internal controls help ensure  individual registrants do not present similar issues that may increase the  risk of illicit diversion of controlled substances.
Our analysis of DOJ’s BOP SENTRY data, USMS’s warrant data, and the  FBI’s NSOR data identified one individual who may have been ineligible  to have controlled substance registrations because of crimes related to  controlled substances. In addition, we found 94 individuals associated  with 100 DEA registrations that presented issues that may increase the  risk of illicit diversion of controlled substances, such as registrants with  active or recent warrants for offenses related to controlled substances,  registrants incarcerated or with active or recent warrants for offenses  unrelated to controlled substances, and registrants listed in the NSOR for  crimes such as sexual assault and exploitation of minors.
Incarcerated registrants. We found 28 individuals associated with 32  DEA registrations who may have been either ineligible for a controlled  substance registration or presented issues that may increase the risk  of illicit diversion of controlled substances because they were  incarcerated in federal prisons for crimes related to controlled  substances, health-care fraud, or other crimes. Of the 28  incarcerated individuals, 1 was incarcerated for crimes related to  controlled substances. In this case, the individual was convicted of  possession of approximately 535 pounds of marijuana with the intent  to distribute in September 2013, required to undergo treatment for  substance abuse, and subsequently imprisoned in December 2013.  The registrant surrendered her state-level authority in February 2014.  According to DEA OD officials, the registrant’s CSA2 record did not  contain any notes indicating awareness of the crime and DEA did not  initiate any action against the registrant. The registration subsequently  expired in May 2015.
In addition, 18 of the 28 individuals were incarcerated for crimes  related to health-care fraud, of which 10 had been excluded from  participating in federal health-care programs due to criminal  convictions that may have provided a sufficient basis to deny or  revoke a registration, while maintaining DEA registrations. One such  registrant was convicted of defrauding Medicare in June 2013  following an investigation by the FBI and HHS OIG. The registrant  was subsequently excluded from participating in federal health-care  programs in April 2014. According to DEA OD officials, the registrant’s  CSA2 record did not contain any notes indicating awareness of the  crime, nor did DEA initiate any action against the registrant. The  individual was still actively registered with DEA as of January 2016.
Furthermore, we identified an additional 9 individuals who were  incarcerated for other crimes, such as sexual abuse and illicit acts as  well as fraud, including bank, wire, and tax fraud. One such individual,  a former doctor for DOJ’s BOP, was convicted in November 2012 and  sentenced to federal prison in February 2013 for sexually abusing  three inmates in the course of his employment with DOJ. Another  individual was serving 8 years in federal prison after being convicted  of attempting to travel to Canada to engage in illicit sexual conduct  with a minor. According to DEA OD officials, the registrants’ CSA2  records did not contain any notes indicating awareness of the crime.  The registrations subsequently expired in December 2014 and June  2014, respectively.
Registrants with active or recent warrants. We identified five  individuals associated with six DEA registrations who were listed in  USMS warrant data, of which three possessed outstanding  warrants. Of the five individuals with active or recent warrants, three  individuals had warrants for offenses related to controlled  substances. For example, we identified a physician with an active  warrant who was indicted in October 2013 on multiple felony counts  for knowingly and intentionally distributing controlled substances  outside the scope of professional practice, health-care fraud, and  making false statements in health-care matters, among others. The  indictment alleged that the physician convinced patients to undergo  medically unnecessary spinal surgeries, and then billed private and  public health-care benefit programs, deriving significant profits for the  fraudulent services. Additionally, according to Kentucky and Ohio  medical board orders, the physician was presigning blank  prescriptions so his employees (who lacked lawful authority) could  issue prescriptions for controlled substances in his absence. In  October 2013, the Kentucky medical board issued an emergency  suspension due to immediate danger to public health and safety,  followed by an Ohio medical board suspension in November 2013.  Both medical boards later revoked the physician’s license in 2014.  According to DEA OD officials, the registrant’s CSA2 record did not  contain any notes indicating awareness of the criminal allegations.  The physician was still actively registered with DEA as of January  2016.
Registered Sex Offenders. We identified 62 individuals associated  with 63 DEA registrations who were also registered with the FBI’s  NSOR for convictions involving sexual offenses. Types of offenses  included actions such as sexual assault against patients and  exploitation of a minor, among others. For example, we identified a  physician who was convicted of four felony counts of gross sexual  imposition and two misdemeanor counts of sexual imposition involving  patients. The conviction led to an automatic suspension of the  physician’s medical license in November 2012, and the license was  subsequently revoked in January 2014. According to DEA OD  officials, the registrant’s CSA2 record did not contain any notes  indicating awareness of the crime. The physician’s registration expired  in April 2014. We identified another physician who pled guilty to two  felony counts of sexual exploitation of a minor in October 2012 and  subsequently surrendered his medical license and state-level  controlled substance registration in February 2013. According to DEA  OD officials, the registrant’s CSA2 record did not contain any notes  indicating awareness of the crime. The DEA registration expired in  May 2015.
DEA is not required to and has not chosen to regularly match its database  of registrants against databases containing criminal background, such as  the databases we used in this analysis. Further, according to DEA OD  officials, DEA only considers crimes related to controlled substances  when evaluating whether to take action against an individual’s registration  based on criminal activity. Therefore, DEA may not have been alerted to  the criminal offenses, such as health-care fraud and sexual assault, we  identified.
We provided DEA with a list of the 95 individuals that matched these  databases to determine whether it was aware of the criminal background,  and what, if any, action it took against these individuals’ registrations. In  response, DEA OD officials compiled a list indicating the status of each  registration, whether any action was taken against the registration, and  whether the registrant’s CSA2 record contained any notes indicating  knowledge of the crime. In 43 of the 95 cases, CSA2 did not contain  information on these individuals’ criminal history, which meant that DEA  was not aware of the presence of issues that may have increased the risk  of illicit diversion of controlled substances.
DEA has controls in place to check for drug-related offenses, such as  checking initial applicants against NADDIS; however, DEA does not  conduct ongoing or subsequent checks against NADDIS for renewals  unless the applicant self-reports a criminal conviction related to controlled  substances. Additionally, while DEA receives information from state  licensing boards about the criminal activity of its registrants, the extent  and frequency to which the states monitor varies by state as do the  sources that the states use for such monitoring. For example, as  described earlier, two of the five states we visited only conduct criminal- background investigations if the state applicant self-reports a criminal  offense. In addition, some states only monitor criminal activity occurring  within the state, while others monitor criminal reports from states across  the nation. Therefore, states without strong criminal-background controls  may not have known to take action against the individual and, therefore,  could not have notified DEA. In our discussions, DEA OD officials said  they had not considered monitoring criminal backgrounds but were open  to doing so.
By relying on the applicant to self-report a criminal conviction or the states  to notify DEA of actions taken against its registrants, DEA may be missing  opportunities to develop a more-complete assessment of the continued  eligibility of its registrants and risks to the closed system of controlled  substance distribution. Additional criminal background controls and  regular monitoring would allow DEA to promptly identify registrants with  criminal backgrounds. By promptly identifying such registrants, DEA  would obtain better assurance of the integrity of its registry and better  identification of potential risks of illicit diversion.
Although such monitoring could improve the integrity of the registry, such  actions may have costs, and, given the relatively low number of  individuals with unidentified criminal backgrounds, weighing those costs  with the risks would be important. The Standards for Internal Control in  the Federal Government state that agencies should identify and analyze  relevant risks to achieve their objectives and form a basis for determining  how risks should be managed. Additionally, GAO’s Fraud Risk  Management Framework identified as a leading practice considering the  benefits and costs to address identified risks when designing and  implementing specific controls to prevent and detect fraud. Until DEA  explores options that would balance the risk posed by individuals having  criminal backgrounds with the cost of identifying those individuals and  documenting associated decisions, DEA is not well-positioned to make an  informed decision on how best to use its resources.

	Conclusions

As part of an overall effort to prevent the diversion of controlled  substances for nonmedical use, having effective controls to ensure that  only those who are authorized and eligible handle and prescribe  controlled substances is essential. While many stakeholders are involved  in making this determination, DEA plays a key role because it administers  and enforces the Controlled Substances Act (CSA) and, in doing so, is  responsible for ensuring that registering an individual to handle or  prescribe controlled substances is not inconsistent with the public  interest.
DEA has implemented controls to register individuals to handle or  prescribe controlled substances. However, as demonstrated by our  analyses, DEA has the opportunity to enhance the integrity of its  controlled substances registry by taking additional steps to collect and  validate registrants’ identifying information and verify the continued  eligibility of its registrants. Given that unique identifying information, such  as SSNs, is critical to validating the identities and implementing controls  to identify deceased registrants, obtaining legal authority to require such  information and developing policies and procedures to validate this  information would help ensure that DEA’s registrants are and remain  eligible to prescribe and handle controlled substances. In addition, having  complete and valid SSNs for all individual registrants would enhance  DEA’s ability to identify other registrations held by each individual,  including any past adverse actions taken against previous registrations,  as it evaluates whether registering the individual would be inconsistent  with the public interest.
Furthermore, while DEA has taken steps to identify and retire deceased  registrants in its database by using SSA’s public Death Master File  (DMF), obtaining legal authority to access that agency’s more  comprehensive full death file would help ensure that DEA is using the  most-complete information available. This would better ensure that DEA  maintains current information on the eligibility of its registrants and  prevents others from potentially using the registration information of  deceased registrants.
Similarly, developing procedures to verify the continued eligibility of its  registrants in other areas, such as verifying that registrants maintain  appropriate state authority and have not been subject to disciplinary  actions that may affect their eligibility, would help ensure that its  registrants maintain eligibility to handle and prescribe controlled  substances. Additionally, exploring options that weigh the risks posed by  registrants with criminal backgrounds with the costs of identifying these  individuals could better inform DEA about the potential for illicit diversion  of controlled substances. Given DEA’s guidance to registrants that their  employees with criminal convictions or pending charges may pose an  increased risk of illicit diversion, taking steps to monitor its own  registrants’ criminal backgrounds would help ensure that these registrants  do not present similar issues that may increase the risk of illicit diversion  of controlled substances.

	Recommendations for Executive Action

To help ensure that practitioners who may be ineligible do not possess a  controlled substance registration and that practitioners who pose an  increased risk of illicit diversion are identified, we recommend the Acting  Administrator of DEA take additional actions to strengthen verification  controls. Specifically, we recommend that the Acting Administrator of  DEA take the following five actions: develop a legislative proposal requesting authority to require SSNs for  all individuals, regardless of whether they hold an individual or  business registration; develop policies and procedures to validate SSNs and apply the  policies and procedures to all new and existing SSNs in the CSA2;  such an approach could involve collaborating with SSA to assess the  feasibility of checking registrants’ SSNs against EVS; develop a legislative proposal to request access to SSA’s full death  identify and implement a cost-effective approach to monitor state  licensure and disciplinary actions taken against its registrants; such  an approach could include using data sources that contain this  information, such as NPDB or FSMB; and assess the cost and feasibility of developing procedures for  monitoring registrants’ criminal backgrounds, such as conducting  matches against federal law-enforcement databases, and document  decisions about the approach chosen.

	Agency Comments, Third-Party Views, and Our Evaluation

We provided a draft of this report to DOJ for its review, and DEA’s Office  of Inspections provided written comments, which are reproduced in full in  appendix II. We also provided relevant sections of a draft of this report to  SSA and the appropriate licensing boards in the five states we visited— Arizona, Connecticut, New Mexico, Texas, and Vermont—to obtain their  views and verify the accuracy of the information provided.
In its written comments, DEA stated that it appreciates the intent of our  recommendations, but raised concerns about its legal authority to take  some of the actions we recommended. It also raised concerns about  technical and fiscal challenges that it stated would make compliance with  the recommendations burdensome. Despite these limitations, DEA stated  that it is in the process of determining the feasibility of implementing  actions that would permit it to comply with the recommendations utilizing  the current legal framework and within reasonable cost parameters. DEA  specifically agreed with our recommendation to identify and implement a  cost-effective approach to monitor state licensure and disciplinary actions  taken against its registrants, dependent on its determination that these  actions are allowable under the authority of the CSA. DEA neither agreed  nor disagreed with the remaining four recommendations. Instead, DEA  described actions it has taken or plans to take in response to each  recommendation.
Regarding our first recommendation that DEA develop a legislative  proposal requesting authority to require SSNs for all individuals  regardless of whether they hold an individual or business registration,  DEA stated that it is exploring the possibility and practicality of  implementing changes to require SSNs for practitioners and mid-level  practitioners and will pursue the actions necessary to legally authorize  DEA to require such information. DEA further stated that, if new  legislative authority is required, it defers to GAO to recommend legislative  action to Congress. As we noted in the report, officials in DEA’s Office of  Chief Counsel told us that they do not have legal authority to collect SSNs  for individuals who apply as a business. We also noted that collecting  SSNs is critical to validating identities and carrying out DEA’s existing  controls to identify and remove deceased registrants and to identify other  registrations held by each individual, including past adverse actions taken  against previous registrations. We agree that DEA’s plans to pursue  actions necessary to legally authorize DEA to require SSNs is a good first  step and we continue to believe that DEA should develop a legislative  proposal to request authority to require SSNs for all individuals. DEA  developing its own legislative proposal would ensure the proposal is  drafted in a way that addresses the actions necessary to legally authorize  DEA to require SSNs for all individuals.
Regarding our second recommendation to develop policies and  procedures to validate SSNs and apply these to all new and existing  SSNs in the CSA2, DEA said that it has initiated discussions with SSA to  determine the legality and feasibility of using EVS to verify SSNs and  outlined the issues that its review will focus on. We agree that these  actions are good first steps in developing an approach to validate SSNs in  the CSA2 and further agree that use of EVS is one possible approach to  validate SSNs. As we noted in the report, validating SSNs will help  establish registrants’ identities and help ensure that DEA has the  information necessary to implement its existing controls and to identify  other registrations held by each individual, including past adverse actions  taken against previous registrations.
Regarding our third recommendation to develop a legislative proposal to  request access to SSA’s full death file, DEA stated that it is preparing a  proposal to SSA to request access to the full death file. If SSA determines  it cannot provide access to this data to DEA under existing law, DEA  stated that it defers to GAO to advise the appropriate congressional  representatives to seek legislative changes for DEA. As we noted in the  report, DEA is not eligible under current law to access SSA’s full death  file. We also noted that having access to the more comprehensive full  death file would ensure that DEA is using the most-complete information  available. As a result, this would better ensure it maintains current  information on the eligibility of its registrants and prevent others from  potentially using the registration information of deceased registrants. We  continue to believe that DEA should develop a legislative proposal to  request access to SSA’s full death file. DEA developing its own legislative  proposal would ensure the proposal is drafted in a way that addresses the  requirements necessary to grant DEA access to this information.
With regard to our fourth recommendation to identify and implement a  cost-effective approach to monitor state licensure and disciplinary actions  taken against its registrants, DEA stated that it does not specifically have  authority to access state medical licensing boards’ databases. However,  our recommendation does not specifically require the use of state medical  licensing boards’ databases and allows DEA flexibility in an approach for  monitoring the information that it needs to help ensure the continued  eligibility of its registrants. DEA concurred with our recommendation,  dependent upon a determination that these actions are allowable under  the authority of the CSA. DEA stated that it has met with FSMB  representatives and is currently exploring the use of FSMB’s services to  verify the existence and status of state licenses and to identify disciplinary  information from the medical boards. We agree that use of FSMB’s  services can be beneficial for validating the types of practitioners included  in FSMB’s services, such as medical doctors, osteopathic doctors, and  some physician assistants. However, these actions do not include other  types of individual practitioners for which DEA should also develop  processes to monitor state licensure and disciplinary actions, such as  dentists, veterinarians, and pharmacists, among others. While these  individuals represent a smaller percentage of DEA’s registrants, we  believe it is important for DEA to monitor state licensure and disciplinary  actions for these individuals as well to better ensure that its registrants  are and remain eligible.
Lastly, in response to our fifth recommendation that DEA assess the cost  and feasibility of developing procedures for monitoring registrants’  criminal backgrounds, DEA stated that it has started discussions with  BOP about effective ways of comparing DEA’s registrant data to BOP’s  inmate data. DEA also stated that it is exploring the technical and  financial feasibility of adding an additional query of NADDIS for renewal  applications since this query is currently done only for new applications.  We believe that developing procedures to monitor registrants’ criminal  backgrounds using these databases would be beneficial for DEA to help  ensure that its registrants are and remain eligible and do not possess an  increased risk of illicit diversion.
DOJ, SSA, and the New Mexico Medical Board also provided technical  comments that were incorporated into the report, as appropriate. The  Connecticut Departments of Public Health and Consumer Protection and  the Texas Medical Board reported that they had no comments. The  Arizona Medical Board, New Mexico Board of Pharmacy, Texas  Department of Public Safety, and the Vermont Board of Medical Practice  did not respond to our request for comments.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the Attorney  General, the Acting Commissioner of SSA, and other interested parties.  In addition, the report will be available at no charge on the GAO website  at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

This report (1) identifies and describes the internal controls that selected  states and the Drug Enforcement Administration (DEA) use to help  ensure the eligibility of individuals to handle controlled substances, and  (2) assesses the extent to which DEA’s internal controls help ensure that  individuals listed in the controlled substances database are and remain  eligible and do not present issues that may increase the risk of illicit  diversion of controlled substances.
To identify and describe the internal controls that selected states use to  help ensure the eligibility of individuals to handle controlled substances,  we conducted site visits to five states—Arizona, Connecticut, New  Mexico, Texas, and Vermont. We developed site visit selection criteria  and selected states to ensure a mix of states with state-level controlled  substance registrations and those without; states with a high number of  DEA adverse actions per 1,000 registrants; states with a low and high  incidence rate of accidental deaths from prescription opioid and  benzodiazepine drugs in 2012 (the most recently available data at the  time of our review), per 100,000 people; and states with large increases  and large decreases in the rate of change in accidental opioid and  benzodiazepine drug overdose per 100,000 people. We also prioritized  states that were located near a DEA field division office. Because each  state determines the internal controls used to ensure the eligibility of  individuals to handle controlled substances, the internal controls may vary  by state. Our selection of states is not a generalizable sample. Therefore,  our findings are only applicable to these five states and cannot be used to  make inferences about other states.
Prior to making our state selections, we convened several discussion  groups at the National Association of State Controlled Substances  Authorities Conference held in October 2014 in order to gain an overall  understanding of how state agencies and health-care industry companies  interact with DEA to prevent controlled substance diversion and abuse,  and communicate and share information with DEA regarding registrants.  We also obtained the state agency and industry representatives’ views  about DEA’s controlled substances screening, registration, and  enforcement processes for individuals and entities.
Because each state determines which health-care occupations may  prescribe or dispense controlled substances, as well as an occupation’s  licensure requirements, the number of state licensing boards and the  individuals they license varies by state. For consistency in the types of  state licensing boards we met with and as a means for comparison, we  visited medical and pharmacy boards, or their equivalents, in the five  states because physicians are the largest category of individual  practitioners that DEA registers and pharmacies are the largest category  of registered entities. We also reviewed applicable state statutes and  administrative rules, agency and board websites, as well as forms and  application instructions for new and renewing licensees for each of the  five states. For each of the selected states, we interviewed state officials  about validating information submitted on physician licensure applications  initially and at renewal, information sharing with other state or federal  agencies, and procedures for handling complaints and for matching  licensure data with other state or federal databases. We also met with  officials in three of our five states (Connecticut, New Mexico, and Texas)  who were responsible for administering their respective programs for  state-level controlled substance registration.
To identify and describe the internal controls that DEA uses to help  ensure the eligibility of individuals to handle controlled substances, we  reviewed federal statutes and DEA regulations and interviewed DEA  officials from headquarters and four field division offices about their  interactions with other federal, state, and local agencies, as well as their  interactions with registrants. We focused on how DEA officials carry out  registration activities, validate information submitted on the registration  applications, share information with state agencies, and follow their  processes for receiving and investigating complaints. Additionally, our  review focuses on individuals who were practitioners, such as physicians,  dentists, and veterinarians, and mid-level practitioners, such as nurse  practitioners, physician assistants, and pharmacists. These groups  represent about 1.4 million (93 percent) of the 1.5 million DEA  registrations. To identify and describe DEA’s requirements and processes  for registration, renewal, and monitoring of individual handlers of  controlled substances, we reviewed applicable statutes, regulations and  federal guidance, DEA’s annual budget submissions, DEA’s website, the  controlled substances registrant database user manual, and forms and  instructions for new and renewing applicants. We also interviewed  relevant DEA officials to identify DEA’s processes for registrants’ initial  registration, renewal, and monitoring.
To assess the extent to which DEA’s internal controls help ensure that  individuals listed in the controlled substances database (CSA2) are and  remain eligible and do not present issues that may increase the risk of  illicit diversion of controlled substances, we identified vulnerabilities for  potential fraud and then identified the associated internal control  weaknesses that led to the vulnerability. To accomplish this, we reviewed  federal statutes and regulations, decisions from DEA administrative  hearings and federal courts, and DEA policies and guidance, and  interviewed DEA officials responsible for controlled substance registration  functions. We used federal standards for internal control, GAO’s Fraud  Risk Management Framework, federal statutes, and DEA policies to  evaluate these functions. To identify vulnerabilities for potential fraud in  DEA’s internal controls, we analyzed registrants’ identifying information  contained in CSA2 as of March 6, 2014 (the most-current CSA2 data  available at the time of our review) and matched CSA2 data to the  following five databases (1) the Social Security Administration’s (SSA) full  death file, as of February 2014; (2) Federation of State Medical Boards  (FSMB) physician-licensure data, as of the 2014 census, and disciplinary- action data, as of April 2015; (3) Federal Bureau of Prisons’ (BOP)
SENTRY data, as of March 2014; (4) U.S. Marshals Service (USMS)  warrant data, as of February 2014; and (5) the Federal Bureau of  Investigation’s (FBI) National Sex Offender Registry (NSOR), as of  February 2014. We also compared DEA registrants’ identity information  to the identity information from SSA’s official records using the  Enumeration Verification System (EVS). We then identified the related  internal control weaknesses that led to these vulnerabilities to help us  assess the extent to which DEA’s internal controls help ensure that  individuals are and remain eligible and do not present issues that may  increase the risk of illicit diversion of controlled substances. For the  purposes of our review, we selected only individuals who were  practitioners, such as physicians, dentists, and veterinarians, and mid- level practitioners, such as nurse practitioners, physician assistants, and  pharmacists. These groups represent about 1.4 million (93 percent) of  the 1.5 million DEA registrations. We excluded businesses, such as  pharmacies, hospitals, and manufacturers, from our analysis.
To identify individuals with missing, duplicative, or potentially inaccurate  or invalid Social Security numbers (SSN), we analyzed registrants’  identifying information contained in CSA2 and compared this information  to SSA’s records. Specifically, we identified instances where individuals  were registered using employer identification numbers (EIN) instead of  SSNs. We reviewed these results and identified instances where  records contained text suggesting they were registered under official  government capacity (e.g., “Limited to Official Federal Duties Only”) and,  therefore, not required to provide either an EIN or SSN. We then  reviewed a nongeneralizable sample of 20 records, matching the  registrant’s name and address to the registrant’s website to confirm that  the individual’s registration appeared to be associated with a private  employer and not a government entity.
We also identified instances where the SSN matched multiple  registrations, but the names associated with those registrations did not  match each other. We reviewed the results to determine the extent to  which the names did not match. For example, we identified instances  where the names reasonably appeared to be the same person, but whose  names did not match due to possible typos (e.g., “Sally Simpson” and  “Sally Simpsen”), name cognates (e.g., “Jonathan Smith” and “Jon  Smith”), name inversions (e.g., “Jon Smith” and “Smith Jon”), or additional  first or last names (e.g., “Mary Lynn Smith” and “Mary Smith,” or “Jane  Smith Johnson” and “Jane Johnson”). We also identified instances  where the SSNs were associated with first or last names (or both) that  reasonably appeared to be distinctly different. We provided a list of all of  these individuals to DEA to determine the reason this occurred.
To identify whether any registrants had potentially inaccurate or invalid  SSNs or dates of birth, we submitted this information for individuals for  verification to SSA’s EVS. EVS provides information on invalid (never  issued) SSNs and instances where there are mismatches between SSN,  name, and date of birth. EVS flags SSNs in which the name or date of  birth (or both) do not match its records for the SSN, as well as SSNs that  have never been issued by SSA.
To identify whether any registrants were potentially ineligible or presented  issues that may increase the risk of illicit diversion of controlled  substances, we matched DEA’s CSA2 data of approximately 1.5 million  registrants, as of March 6, 2014 (the most-current CSA2 data available at  the time of our review), to the five databases listed below.  1.  SSA’s full death file. To identify registrants who were reported  deceased by SSA, we matched the CSA2 data to SSA’s full death file  by SSN, name, and date of birth, as of February 28, 2014. The full  death file contains all of SSA’s death records, including state-reported  death information. We included only those individuals who had dates  of death prior to March 1, 2014.  2.  FSMB licensure and disciplinary action data. To identify registrants  who did not possess active state-level controlled substance authority,  we matched CSA2 to FSMB licensure and disciplinary action data  based on the FSMB’s 2014 physician census and disciplinary action  data dated through April 20, 2015. We matched the CSA2 data to  FSMB data by SSN and name to identify physicians with disciplinary  actions related to the suspension, revocation, or surrender of their  medical license or controlled substance privileges. To better identify  suspensions, revocations, or surrenders occurring without  reinstatement prior to March 6, 2014, we limited our review of FSMB  data to the most-recent disciplinary action taken against the registrant  prior to March 6, 2014. Therefore, the number we identified may not  include all suspended, revoked, or surrendered licenses and  represents a minimum number. For each of the disciplinary actions  identified in the FSMB data, we reviewed supporting documentation,  such as medical board actions, using the applicable state medical  board website. We provided a list of potentially ineligible registrants  based on our review of state disciplinary actions to DEA to determine  whether DEA was aware of these disciplinary actions and what action,  if any, DEA took against their respective registrations.  3.  BOP SENTRY data. To identify registrants incarcerated while actively  registered with DEA, we matched CSA2 data to federal prisoner data  provided by BOP as of March 2014 by SSN, name, and date of birth.  We conducted a second match using name and date of birth to  identify any additional matches where the SSN field may have been  missing or inaccurate. We identified two individuals who matched by  name and date of birth, but whose SSNs were missing in at least one  of the data files. For these two individuals, we reviewed state licensing  board action documentation to determine whether the offenses in the  board actions matched the offenses identified in the BOP data and to  confirm that they were likely matches.
We provided a list of the DEA registrants that matched by SSN or  name and date of birth to BOP to obtain the incarceration dates for  these registrants to determine whether they were incarcerated as of  March 6, 2014. We then categorized offenses that were related to  controlled substances, health-care fraud, or contained other attributes,  such as bank fraud or sexual abuse. We provided a list of registrants  who matched this database to DEA to determine whether DEA was  aware of the criminal offenses and what action, if any, DEA took  against their respective registrations.  4.  USMS warrant data. To identify registrants with active or recent  warrants, we matched the CSA2 data to warrant data provided by  USMS as of February 2014. We identified records for which the  registrant’s SSN and name matched that of an individual (or an  individual’s alias) who was listed in the warrant data. We provided a  list of DEA registrants who matched USMS warrant data to USMS to  obtain the warrant issued and warrant closed dates, among other  information, to determine whether these registrants had active or  recent warrants as of March 6, 2014. We then determined which  matches had open or recently closed warrants. We then categorized  offenses that were related to controlled substances, health-care fraud,  or contained certain other attributes. We provided a list of registrants  who matched this database to DEA to determine whether DEA was  aware of the criminal offenses and what action, if any, DEA took  against their respective registrations.  5.  FBI NSOR data. To identify registrants who were listed as registered  sex offenders, we matched the CSA2 data to the FBI’s NSOR data, as  of February 2014. We identified records for which the registrant’s  SSN, name, and date of birth matched that of an actively registered  sex offender (or an associated alias). We provided a list of DEA  registrants who matched NSOR to the FBI to obtain the NSOR  registration start and end dates, among other information, to  determine whether these individuals were registered in the NSOR as  of March 6, 2014. We then provided a list of registrants who matched  this database to DEA to determine whether DEA was aware of the  criminal offenses and what action, if any, DEA took against their  respective registrations.
Because we matched CSA2 data to these datasets using two or more  identifiers—SSN, name, date of birth—we are generally confident in the  accuracy of our results. However, in some cases, our matches may  include registrants who were not deceased, sanctioned by their  respective states, incarcerated, the subject of an active or recent warrant,  or registered sex offenders. This can occur when a DEA registrant has an  SSN, name, and date of birth that are identical to an individual listed in  one of the other databases or when the registrant is listed in the other  database erroneously. In addition, our matches may be understated  because we may not have detected registrants whose identifying  information in the CSA2 data differed from the identifying information in  other databases, or was missing.
We assessed the reliability of DEA’s CSA2 data, SSA’s full death file,  FSMB physician licensure and disciplinary action data, BOP SENTRY  data, USMS warrant data, and the FBI NSOR data by reviewing relevant  documentation, interviewing knowledgeable agency officials, and  performing electronic testing for duplicate records and valid or missing  values to determine the completeness and accuracy of specific data  elements in the databases. We assessed the reliability of SSA’s EVS by  reviewing relevant documentation. We determined that the data elements  we used from these databases were sufficiently reliable for the purposes  of matching DEA registrants to these datasets to identify potentially  ineligible registrants.
We conducted this performance audit from November 2014 through May  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Justice

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the contact named above, the following staff members  made significant contributions to this report: Gabrielle M. Fagan and Joah  G. Iannotta, Assistant Directors; Tracy Abdo; Melinda Cordero; Carrie J.  Davidson; Colin J. Fallon; Dennis Fauber; Maria McMullen; James  Murphy; Joy Myers; and Shana Wallace.

Summary:
Why GAO Did This Study

DEA registers individuals and entities authorized to manufacture, distribute, or dispense controlled substances in accordance with the Controlled Substances Act, which seeks to ensure that only authorized individuals handle controlled substances. States also have a role in the registration process as they determine general licensing requirements for health-care professionals who are permitted to handle or prescribe controlled substances. Controlled substances include prescription pain relievers, such as OxyContin, stimulants, and sedatives.
GAO was asked to review DEA's processes for registering applicants, monitoring the eligibility of registrants, and managing CSA2 data. This report assesses the extent to which DEA's internal controls help ensure that individual registrants are and remain eligible and do not present issues that may increase the risk of illicit diversion, among other objectives. GAO reviewed relevant documents and interviewed DEA and state officials. GAO matched CSA2 data to several databases to identify potentially ineligible registrants.

What GAO Found

The Drug Enforcement Administration (DEA) has established controls for determining registrant eligibility to handle and prescribe controlled substances. However, GAO found limitations in DEA's controls to help ensure that individual registrants are and remain eligible and do not present issues that may increase the risk of illicit diversion. GAO's examination of DEA's controlled substances database (CSA2) as of March 2014 (the most-current data available) revealed gaps and other issues pertaining to registrants' identifying information. For example, GAO's analysis identified 40,785 of about 1.4 million individual registrations that were registered using a business tax identification number instead of a Social Security number (SSN). According to DEA officials, DEA does not have legal authority to require SSNs for individuals applying as a business. For individuals registered with an SSN, GAO found 11,740 SSNs that could not be validated by the Social Security Administration (SSA) and 688 SSNs that were registered to multiple names or variations of names, which can be a risk indicator of potential fraud. SSNs are needed to identify and remove deceased registrants as well as identify any past adverse history that may affect registrant eligibility. Given that SSNs are critical to validating identities, implementing DEA's controls, and identifying registrants' past adverse history, obtaining legal authority to require SSNs for all individuals and developing policies and procedures to validate them would help ensure that registrants are and remain eligible.
GAO also found limitations in DEA's processes for verifying continued eligibility of its registrants. Of the approximately 1.4 million individual registrations in CSA2 as of March 2014, GAO found 764 registrants who were potentially ineligible because they were reported deceased by SSA, did not possess state-level controlled substance authority, or were incarcerated for felony offenses related to controlled substances. GAO also found 100 registrants who presented issues that may increase the risk of illicit diversion, such as registrants incarcerated for offenses unrelated to controlled substances, registrants with active or recent warrants, and registrants listed as sex offenders. DEA does not have processes in place to verify its registrants' state licenses or criminal background after initial registration, unless the registrant self-reports or the state notifies DEA of actions taken against its registrants. Developing processes to monitor registrant state licensure and disciplinary actions, such as verifying that registrants maintain appropriate state authority and assessing the cost and feasibility of monitoring registrants' criminal backgrounds, would help ensure that registrants maintain eligibility to handle and prescribe controlled substances and do not present issues that may increase the risk of illicit diversion.

What GAO Recommends

GAO is making five recommendations to DEA to help ensure practitioners are and remain eligible and that those who pose an increased risk of illicit diversion are identified. DEA stated it appreciated the intent of GAO's recommendations, but raised concerns about its legal authority to take some of the actions. GAO's recommendations include having DEA seek legal authority as needed, and remain valid.