The CSA places various plants, drugs, and chemicals such as narcotics, stimulants, depressants, hallucinogens, and anabolic steroids into one of five schedules based on the substance’s medical use or lack thereof, potential for abuse, and safety or potential for dependence. The act requires persons and entities who manufacture, distribute, or dispense controlled substances or listed chemicals to register with DEA, which by delegation from the U.S. Attorney General is responsible for administering and enforcing the CSA and its implementing regulations. Within DEA, the Office of Diversion Control (OD) is directly responsible for enforcing the provisions of the CSA as they pertain to ensuring the availability of substances—such as prescription drugs and listed chemicals—for legitimate uses while preventing their diversion. Given this overall mission, OD is responsible for preventing, detecting, and investigating the diversion of controlled substances. The CSA requires DEA to maintain a closed system of distribution of controlled substances in the United States from the point of import or manufacture through dispensing to patients or disposal. Under this system, most legitimate handlers of controlled substances— manufacturers, distributors, physicians, pharmacies, researchers, and others—must be registered with DEA and account for all controlled substances distributions. DEA registrants must renew their registration every year or every 3 years, depending on the type of registration. Table 1 presents the number and type of individuals and entities that are registered with DEA to manufacture, distribute, or dispense controlled substances. DEA maintains the list of registrants in the controlled substances database (i.e., CSA2), which includes registrants’ identifying information, such as first and last name, date of birth, and Social Security number (SSN) for individuals; and name and employer identification number (EIN) for businesses. As of March 2014, and as highlighted in table 1, the CSA2 consisted of records of more than 1.5 million registrations under the act, of which 93 percent were practitioners. The database is used to register practitioners as well as to certify a practitioner’s CSA status and is useful to health-maintenance organizations, clinics, health-insurance companies, pharmaceutical and medical-services firms, and others who must verify that a practitioner is registered to handle controlled substances. Registrants may only engage in those activities that are authorized under state law for the jurisdiction in which the practice is located. The CSA requires a separate DEA registration for each principal place of business or professional practice where controlled substances are manufactured, distributed, or dispensed. However, a practitioner who is registered at one location, but also practices at other locations, is not required to register separately for any other location within the same state at which controlled substances are only prescribed. States also play a role in overseeing the entities that handle controlled substances. All practitioner applicants to DEA must first demonstrate that they have received applicable licenses from their state. Further, according to DEA, 26 states and U.S. territories register practitioners wanting to handle controlled substances at the state level. Forty-nine states also have developed Prescription Drug Monitoring Programs (PDMP). PDMPs are statewide programs that collect data on prescriptions for controlled substances and enable prescribers, pharmacists, regulatory boards, and law-enforcement agencies (under certain restrictions) to access this information pursuant to applicable state laws and guidelines. PDMPs may aid the care of those patients with chronic, untreated pain or chemical dependency by providing patient prescription-history reports or electronic alerts to prescribers and dispensers to bring patients of concern to their attention. PDMP data can be also used to help identify patients and practitioners engaged in prescription drug abuse and diversion. For example, PDMP data can be used to identify individuals who have obtained controlled substances from multiple physicians without the prescribers’ knowledge of the other prescriptions (i.e., “doctor shopping”) and can be used to identify practitioners with patterns of inappropriate high levels of prescribing and dispensing. The manner and conditions of access to PDMP data vary from state to state depending on the laws that implement PDMP programs. Laws in each state determine which users are authorized to access PDMP data and provide the specific purposes that are allowed for this access. Each state determines which health-care occupations may prescribe or dispense controlled substances, as well as an occupation’s licensure requirements. To administer state licensure laws, depending on the state and occupation, legislatures create agencies, boards, or other entities to carry out licensing processes. See table 2 for an example of the variety of professions eligible to prescribe controlled substances in two different states and the relationship between the professions and licensing authorities. The CSA requires DEA to register a practitioner if the applicant is authorized to dispense controlled substances in the state in which he or she practices. DEA may deny an application if it determines that issuance of the registration would be “inconsistent with the public interest.” According to the CSA, DEA must consider several factors in determining whether such a registration would be inconsistent with the public interest, such as the recommendation of the appropriate state licensing board or disciplinary authority, the applicant’s compliance with applicable state, federal, or local laws relating to controlled substances, and such other conduct by the applicant that may threaten the public health and safety. Figure 1 below provides an overview of how state and DEA processes interconnect for controlled substance registration. Further, under the CSA, DEA has the authority to deny, suspend, or revoke an existing controlled substance registration for several reasons, including if a registrant has had a state license revoked, been convicted of a felony related to controlled substances, or been excluded or directed to be excluded from participating in federal health-care programs, such as Medicaid or Medicare, due to certain types of criminal convictions. If DEA decides to revoke, suspend, or deny a registration, it must serve upon the applicant or registrant an order to show cause why the action should not be taken. If continued registration poses an imminent danger to public health or safety, DEA can issue an immediate suspension order, which immediately deprives the registrant of the authority to handle controlled substances. Orders to show cause and immediate suspension orders, along with other adverse actions, are collectively known as registrant actions. DEA also has the authority to take a number of administrative actions against practitioners, including placing restrictions on the type of scheduled drugs practitioners can handle. Other administrative actions include issuing a letter of admonition to advise the registrant of any violations and necessary corrective actions, and developing a memorandum of agreement that outlines specific actions to be taken by the registrant and subsequent DEA actions if not corrected. Although DEA can issue these registrant actions and impose sanctions, a denial or revocation of a practitioner’s registration cannot be finalized until the practitioner has been given the opportunity to have an administrative hearing. Table 3 below provides the number and type of actions taken against controlled substances practitioner applicants and registrants from fiscal years 2011 to 2015. The Department of Justice (DOJ) Office of the Inspector General (OIG) reviewed the timeliness of DEA’s process for issuing final decisions on registrant adverse actions and, in May 2014, reported that the overall time it takes DEA to adjudicate all registrant adverse actions continues to be very lengthy. The OIG reviewed overall registrant adverse action processing for the period 2008 through 2012 and found that the average time for DEA to adjudicate registrant adverse actions, from initiation to final decision, was almost 2 years in 2009. By 2012, the time frame to complete adjudication of adverse actions had declined, but it still took 1 year, on average, for DEA to issue a final decision on any given registrant adverse action. According to the OIG, delays in adjudicating registrant adverse actions can have harmful effects on the general public, registrants, and DEA. The OIG reported that delays can create risks to public health and safety by allowing noncompliant registrants to operate their business or practice while the registrant adverse action is being adjudicated. For example, if a doctor is issued an order to show cause, that doctor can keep writing prescriptions until DEA makes a final decision. Each of the five states we examined has established several controls, with some common features for physician licensing and monitoring, as illustrated in figure 2 below. As reflected in the figure above, all five states we examined utilize a number of the same controls for issuing and renewing medical licenses, and for monitoring licensees. For example, according to our interviews with state officials and, where available, documentation on state processes, all five states had processes to confirm the identifying information for an applicant and for verifying the professional credentials of applicants. Also, all five states review disciplinary actions taken by other state medical licensing authorities by requiring applicants to arrange for one of three national clearinghouses to send this information to the state licensing authority for review. Officials in the five states we examined had established controls to renew and monitor physicians’ licenses. For example, officials from the five state medical boards said that they track disciplinary actions imposed on their licensees by receiving reports from the FSMB. This includes disciplinary actions that may have been implemented by a medical board in another state. Although all five states use some common controls, we found differences in how each state employs other key checks in the initial licensing process. For example, variations exist among the five states in how they conduct state and federal criminal-background checks for applicants. While all five states require applicants to answer one or more questions about a criminal record to which they must self-attest, two state authorities—in Connecticut and Vermont—accept the self- attestations and investigate only affirmative responses by applicants; in contrast, three state authorities—in Arizona, New Mexico, and Texas—conduct both state and federal criminal-background checks, regardless of the applicant’s attestation; and additionally, four of the five states—Arizona, Connecticut, Texas, and Vermont—review medical malpractice judgements for all medical license applicants, while one state—New Mexico—reviews medical malpractice judgements only for medical license applicants that have self-reported on their application. Additionally, the extent of reviewing the criminal backgrounds of licensees after initial licensure differs by state. Upon license renewal, licensees are again asked similar questions about their criminal record. Two states (Connecticut and Vermont) accept the renewing licensee’s self-attestation and investigate only affirmative responses. One state (Arizona) does not conduct any subsequent checks against state or federal criminal databases after initial licensure, while two states (Texas and New Mexico) regularly monitor state or federal criminal databases. For example, New Mexico contracts with a vendor that continuously monitors the state’s licensed physicians’ interactions with law-enforcement agencies nationwide using the FBI’s national database and other law-enforcement databases. In addition, at the time of our review, Texas was in the process of working on an agreement with the FBI to allow the board to monitor federal criminal backgrounds of licensees, in addition to the already-implemented quarterly state criminal-background checks. There are also differences among the five states in how prescription data are used to monitor top prescribers of controlled substances. Of the five states we examined, three states (Connecticut, New Mexico, and Texas) use data from the state’s PDMP to identify physicians with high incidences of prescribing controlled substances in order to initiate a follow-up with the physicians. The follow-ups are meant to determine the reasons for the high rate of prescriptions. For example, New Mexico Medical Board officials told us they monitor prescriber patterns by reviewing quarterly PDMP report cards. The board will send out letters to physicians who appear to have high-risk prescribing practices, and may issue formal complaints if the patterns continue. However, the extent to which the states have implemented their PDMP can vary. For example, Texas officials estimated that about 25 percent of the state’s controlled substance prescribers are registered in the program, while New Mexico requires every physician to register with the PDMP as a prerequisite to obtaining their state-level controlled substance license and mandates that physicians regularly use the state’s PDMP. Through its practitioner application and renewal processes, DEA employs several controls to assess whether an individual applicant is eligible for a controlled substance registration. These controls include comparing applicant identifying information for consistency with state licensure information and confirming that applicant medical licenses are current; confirming status of state controlled substance registration, if applicable; and determining whether an applicant has any drug-related offenses. In addition, DEA OD officials said they compare registrants to SSA’s public Death Master File (DMF) on a weekly basis to identify registrants who have died. DEA also receives information from state entities, other law- enforcement agencies, private citizens, former patients, and health practitioners on adverse actions related to professional health-care licenses or other issues that could call into question a registrant’s continued suitability to prescribe or handle controlled substances. However, according to DEA OD officials, the amount of communication with state entities varies significantly from state to state. See figure 3 for an overview of the process and controls DEA uses to register, renew, and monitor practitioners of controlled substances. DEA officials known as Registration Program Specialists hold primary responsibility for reviewing and processing applications of practitioners seeking to handle controlled substances. Registration specialists use several controls to verify information provided on a new application to determine applicant eligibility. These controls include the following: Comparing DEA applicant information to state licensing board information for inconsistencies. According to DEA OD officials, registration specialists are to compare identifying information on applications to identifying information maintained by the appropriate state licensing board. They perform this comparison by accessing public websites maintained by the state licensing boards that can be searched, for instance using the applicant’s license number or other identifying information. Registration specialists are to verify the name of licensee, type of license, license number, and expiration date and are to look for differences between the information associated with the state license and what the applicant put on the DEA registration application. Any differences could indicate potential fraud or other risks. Confirming that an applicant’s professional health-care license is current. Registration specialists are to use the state licensing board websites to verify licensure status with the respective state boards (medical, pharmacy, nursing, etc.). According to DEA OD officials, the registration specialists are not required to review administrative complaints or disciplinary actions taken by state licensing boards. If there are any conflicting data, the application is to be referred to a Diversion Investigator (DI) for further review. For states with a controlled substance registration, confirming applicant’s status. DEA’s CSA2 will notify the registration specialist if a separate state controlled substance registration is required. According to DEA OD officials, when applicants are from states that have their own CS registration requirement, the registration specialist is to review the state controlled substance authority’s website to determine whether the applicant’s name and state registration number match the information on the DEA application. The specialist is to also check to be sure that the state registration has not expired and that the registration is not restricted in any way. If there are any conflicting data, the application is to be referred to a DI for further review. Checking for any drug-related offenses or suspect associations. Registration specialists are to check the names of anyone listed on each initial application against DEA’s Narcotics and Dangerous Drugs Information System (NADDIS). This system contains information about drug offenders, alleged drug offenders, persons suspected of conspiring to commit, aid, or abet the commission of a drug offense, and other individuals related to, or associated with, DEA’s law- enforcement investigations and intelligence operation, among other things. If the registration specialists identify any inconsistency between the information in the application and any of the sources used for validation, the registration specialists will refer the application to a DI for further investigation. Reviewing applicant responses to liability questions. Applicants are also asked to answer four liability questions and to explain any affirmative responses. Questions include whether the applicant has ever been convicted of a crime in connection with controlled substances under state or federal law, or ever had a state professional license revoked, suspended, restricted, denied, or placed on probation. For any affirmative responses, the application will be forwarded to a DI for further investigation. Practitioners who have received authorization to handle controlled substances must renew their registrations every 3 years, and DEA uses some of the controls for the renewal process that are used for an initial registration. For example, registrants must again respond to the same liability questions that appear on the initial application concerning criminal activity and changes to their professional or legal status and are to report any criminal convictions related to controlled substances, or whether their state license or controlled substance registration has been revoked, suspended, or otherwise restricted. If the registrant does not self-report any liabilities and there are no changes to the information contained in the registrant’s record (such as changes to the registrant’s name, address, or state license number), then the renewal is automatically approved without further checks against state licensure websites. In addition, at renewal, the registration specialist is to review the historical records from the registrant’s initial application. DEA OD officials told us that the registration specialists do not conduct subsequent checks against NADDIS for renewals unless the applicant self-reports a criminal conviction related to controlled substances. DEA OD officials told us that they perform one systematic form of monitoring of registrants’ eligibility between renewal periods by conducting weekly checks of the public DMF. Specifically, DEA OD staff have established an automated process to compare the DEA registrants’ database against SSA’s public DMF every week to find possible matches, which can indicate that an individual registrant has died. Names and SSNs from the registrants’ database are compared to names and SSNs contained in the DMF. Registrations that match to DMF names and SSN are automatically retired in the system. A report of partial matches is generated by the system, and any partial matches will be researched further. On the basis of this research, registrations will be manually retired, if appropriate. DEA OD officials indicated that other monitoring activities may include states communicating directly with DEA to provide information and allegations of wrongdoing by registrants. For example, state medical licensing boards and state controlled substance authorities may provide practitioner complaint and disciplinary action or sanction information to DEA. Also, many of the investigations that DEA initiates are conducted pursuant to tips and complaints received from other law-enforcement agencies, private citizens, former patients, and health practitioners. DEA has established controls to aid in determining registrant eligibility. However, we found limitations in DEA’s processes to collect and validate registrants’ identifying information and verify continued registrants’ eligibility. These limitations include issues related to identifying registrants who were deceased, did not possess state-level controlled substance authority, or had criminal backgrounds that may have provided a sufficient basis to deny or revoke a registration. DEA’s controlled substance registration process involves applicants submitting key identifying information, some of which DEA staff are to verify. Specifically, individual applicants are required to provide DEA with key identifying information, such as first and last name and date of birth. Additionally, applicants must provide a taxpayer identification number, such as an SSN for individuals or an EIN for businesses, unless the applicant is fee-exempt. DEA’s system for processing applications has edit checks in place to ensure that SSNs entered are in the appropriate format (9-digit, numeric) and do not contain all repeating numbers (e.g., 999-99-9999). DEA’s CSA2 system recognizes and flags SSNs that are already in its system. This system control was designed to alert the registration specialist that an applicant has (or had) another DEA registration and to prevent reregistering individuals who may not be eligible based on actions taken against their previous or current registrations. According to DEA OD officials, this system control was established after a registrant who had been prosecuted by DEA reapplied and was approved for a new registration under a different address. Once the application information is submitted, DEA’s registration specialists are to compare the applicant’s name and state licensure information to the information maintained by the appropriate state licensing board. Our examination of DEA’s CSA2 data revealed gaps and other issues pertaining to registrants’ SSNs, as described below. Individuals registered using EINs instead of SSNs. As described above, DEA must collect taxpayer identification numbers for all non- fee-exempt individuals for the purpose of collecting and reporting on any delinquent amounts arising out of the individual’s relationship with DEA, pursuant to the Debt Collection Improvement Act of 1996. Instructions on DEA’s application form state that SSNs are required for individual registrations, and tax identification numbers (such as an EIN) are required for business registrations. Our analysis of DEA’s CSA2 data identified 41,909 of about 1.4 million individual registrations (about 3 percent) who were registered using an EIN instead of an SSN. We reviewed these results and identified 1,124 of the 41,909 records that contained text suggesting they were registered under official government capacity (e.g., “Limited to Official Federal Duties Only”), and therefore, not required to provide either an EIN or SSN. The remaining 40,785 records did not contain such text. However, depending on how an individual has structured his or her professional business activities, it may be appropriate for the individual to apply to DEA as a business instead of as an individual. Because DEA is required to collect taxpayer identification numbers for debt collection purposes, according to officials in DEA’s Office of Chief Counsel, DEA only has the legal authority to collect EINs, and not SSNs, from those individuals who apply as a business. As a result, DEA would have to obtain additional legal authority in order to require SSNs for all individuals. As discussed later, registering individuals with an SSN is essential to DEA’s use of the public Death Master File (DMF) as a control, in that SSNs (and not EINs) are needed to identify and retire deceased registrants. EINs do not allow DEA to use the DMF as a control mechanism. In addition, allowing EINs in place of SSNs limits DEA’s ability to identify other registrations for the same individual, particularly those with past adverse history. Potentially invalid SSNs. We identified 11,740 out of about 1.3 million SSNs associated with individual registrations whose SSN or date of birth (or both) could not be validated by SSA’s EVS. Specifically, we compared DEA registrants’ names, dates of birth, and SSNs to SSA’s records using EVS. EVS flags SSNs in which the name or date of birth (or both) do not match its records for the SSN, as well as SSNs that have never been issued. Specifically, of the 11,740 SSNs, we found 8,235 SSNs that did not match the name identified, 3,441 SSNs that did not match the date of birth, and 64 SSNs that had never been issued by SSA. Mismatches in names, SSNs, or dates of birth could be a potential identity fraud indicator but could also be due to data-entry errors or unreported name changes. As previously mentioned, DEA has procedures in place to compare identifying information, such as first and last names, from registrant applications to license information maintained by state professional licensing boards. In contrast, however, DEA does not have procedures to verify other identifying information, such as SSNs or dates of birth. For example, DEA does not have an agreement with SSA to access EVS as one possible option to verify the SSNs provided by DEA registrants. DEA officials said that while they had not previously considered strategies to validate SSNs and dates of birth, they were open to exploring options to do so. In our discussions, SSA officials said they would be open to the option of providing DEA with access to EVS, although it would require a legal review based on DEA’s intended use. Multiple individuals registered using same SSN. We identified 688 SSNs associated with multiple individuals, which is a risk indicator for potential fraud. Of the 688 SSNs, we identified 268 SSNs associated with names that reasonably appeared to be the same person, but whose names did not match due to possible typos (e.g., “Sally Simpson” and “Sally Simpsen”), name cognates (e.g., “Jonathan Smith” and “Jon Smith”), name inversions (e.g., “Jon Smith” and “Smith Jon”), or additional first or last names (e.g., “Mary Lynn Smith” and “Mary Smith,” or “Jane Smith Johnson” and “Jane Johnson”). However, the remaining 420 SSNs were associated with first or last names (or both) that reasonably appeared to be distinctly different. Different names registered with the same SSN could be a potential identity fraud indicator but could also be due to data-entry errors or individual name changes. We provided a list of these individuals to DEA for further investigation. DEA OD officials reviewed 449 of the 688 SSNs and provided several reasons why there were multiple names registered using the same SSN. DEA OD officials indicated that one reason this occurred was because some SSNs associated with these registrations were entered into the system prior to the implementation of the multiple SSN system flag. The system flags are generated when a new application is entered into the system. Therefore, according to DEA OD officials, the system would not have recognized duplicate SSNs among the existing registrations. Additionally, DEA OD officials told us that some of the names did not match due to individual name changes, data-entry errors, and other reasons that would require further DEA review. Because DEA did not review every SSN, it is unclear whether there are any other reasons this may have occurred. According to the Standards for Internal Control in the Federal Government, agencies should design processes that use the agency’s objectives and related risks to identify the information requirements needed to achieve the objectives and address the risks. In addition, agencies are to design controls to help ensure the completeness, accuracy, and validity of their data in order to help the agency achieve its objectives and respond to risk. These standards also require agencies to have appropriate control activities in place to ensure that the data used by the agency are accurate. As demonstrated by our analyses, DEA has an opportunity to enhance the integrity of its database by developing policies and procedures to collect and validate registrants’ SSNs. By not collecting and validating SSNs for all of its individual registrants, DEA is missing key information required to establish registrant identity and monitor eligibility. In particular, missing, invalid, or incorrect SSNs will reduce the effectiveness of DEA’s use of the public DMF to identify decedents because SSNs are needed for the matching process. Further, not having complete and accurate SSNs would limit DEA’s ability to identify other registrations held by the same individual and any past adverse history that may affect the eligibility of the registrant. By not requiring SSNs for all individual registrants, regardless of whether they apply as a business, and not taking steps to verify the SSNs, DEA is not well positioned to ensure the identities of its registrants. Additionally, not requiring SSNs for all individual registrants limits DEA’s ability to conduct any other potential data matching, which could improve the integrity of its registrants’ data and reduce the risk of potential misrepresentation or fraud. Of the approximately 1.4 million individual registrations in DEA’s CSA2, we found 764 registrants that may have been ineligible to have controlled substance registrations because the registrants were reported deceased by SSA, did not possess state-level controlled substance authority, or were incarcerated for felony offenses related to controlled substances. Each of these issues may adversely affect an individual’s registration. In addition, we also found 100 registrants who presented issues that may increase the risk of illicit diversion of controlled substances, such as registrants with active or recent warrants for offenses related to controlled substances, registrants incarcerated or with active or recent warrants for offenses unrelated to controlled substances, and registrants listed in the NSOR. We note that the numbers of potentially ineligible registrants, as well as registrants who may pose an increased risk of illicit diversion, may be more than the total number of registrants we identified because missing or incorrect SSNs reduced our ability to identify matches between the registrants’ data and other data we used. Table 4 shows a summary of DEA registrants we identified that may be ineligible or may pose an increased risk of controlled substance diversion. According to federal regulations, a DEA registration legally terminates immediately upon death of a registrant. To identify such individuals, DEA matches its database weekly against SSA’s public DMF, which is a publicly available subset of the death records that SSA maintains on deceased SSN-holders. According to DEA officials, registrants matching on SSN and name are automatically retired in CSA2. DEA officials also told us that the DEA OD Registration and Program Support Section Chief is to manually review any partial matches (e.g., instances in which the SSN matches, but name does not match) to determine whether additional actions are necessary. Removing deceased registrants from its database and retiring their registration can reduce the risk of someone obtaining and misusing the deceased registrant’s authority to handle, dispense, or prescribe controlled substances, thus limiting opportunities for the diversion of these substances. While DEA’s control is designed to identify and remove deceased registrants, our analysis identified 705 registrants that were reported deceased by SSA as of March 2014 (the most-current DEA data available at the time of our review). We identified these deceased registrants by comparing DEA’s CSA2 data of about 1.4 million individual registrations with SSA’s full death file, which lists all SSNs of people for whom SSA has received a record of death. Specifically, of the 705 reportedly deceased registrants, 420 had been deceased for 6 months or longer, including 236 who had been deceased over a year. Under current law, DEA is not eligible to access SSA’s full death file, the database we used to conduct our analysis. According to SSA officials, the public DMF contained about 16 million fewer records than the full death file as of March 2016. We previously reported that SSA officials expect that the proportion of state-reported death records that must be excluded from the public version will continue to increase over time. For example, for deaths reported in 2012 alone, the public DMF included about 40 percent fewer death records than the full death file. According to the Standards for Internal Control in the Federal Government, agencies should design procedures using information necessary to achieve their objectives and respond to risks. Because of the differences in the death databases, DEA may not have been alerted to the reportedly deceased individuals that we identified. In our discussions, DEA officials were open to the idea of exploring legislative options to obtain the full death file. By not identifying deceased registrants and not subsequently deactivating their registrations, DEA’s registry may be vulnerable to potential fraud leading to diversion of controlled substances. To better ensure that DEA’s registry maintains current registration information and to prevent others from potentially utilizing the registration information of deceased registrants, DEA could take additional steps by developing a legislative proposal to gain access to the more comprehensive full death file. As described previously, the CSA requires DEA to register a practitioner if the applicant is authorized to dispense controlled substances in the state in which he or she practices. DEA may deny an application if it determines that the registration would be inconsistent with the public interest. Two of the factors DEA must consider in this determination are the recommendation of the appropriate state licensing board or disciplinary authority and the applicant’s compliance with applicable state, federal, and local laws relating to controlled substances. Additionally, DEA also has the authority to suspend or revoke an existing controlled substance registration if a registrant has had a state license suspended or revoked, among other reasons. We found at least 57 individuals associated with 58 registrations who may have been ineligible for a controlled substance registration based on our analysis of actions taken against their respective state licenses, such as revocations of medical license or controlled substance privileges. We compared data from the FSMB on physician license information and disciplinary actions to data from CSA2. The FSMB maintains a central repository database for licensure information and disciplinary sanctions provided by all medical boards within the 50 states, Puerto Rico, and the District of Columbia, among other sources. By matching registrants’ information to information contained in the FSMB data, we were able to review an individual’s entire licensure history, including revocations and suspensions, for all medical licenses, across all U.S. states, Puerto Rico, and the District of Columbia, among others. We then reviewed supporting documentation for each of the actions identified in FSMB data using state medical board websites. To help identify revocations, surrenders, or suspensions occurring without reinstatement prior to March 6, 2014 (the most-current DEA data available at the time of our review), we limited our review of FSMB data to the most-recent action taken against the registrant prior to March 6, 2014. Therefore, the number of individuals with disciplinary actions we identified represents a minimum number. Our analysis of FSMB data identified 57 individuals who did not appear to possess active state-level controlled substance authority in the states where they held active DEA registrations, as of March 6, 2014. Specifically, of the 57 individuals, we identified 41 who had disciplinary actions that resulted in the revocation or surrender of their medical licenses, and 16 whose medical licenses were not revoked, but the state licensing board restricted the individuals’ controlled substance authority. These actions occurred between June 2011 and February 2014. For example: We identified a physician whose Ohio medical license was revoked in October 2011 for prescription drug–related crimes. In January 2012, the physician pled guilty in an Ohio county court to one count of engaging in a pattern of corrupt activity, six counts of trafficking in drugs, and one count of theft. The physician was sentenced to 3 years of imprisonment in February 2012 and was still actively registered with DEA as of March 2014. According to DEA OD officials, DEA was unaware that the registrant no longer possessed state-level controlled substance authority and therefore it did not initiate any action against the registration. The DEA registration subsequently expired in May 2014, approximately 2-½ years after the state authority was revoked. We identified a physician whose controlled substance registration from the District of Columbia was placed on immediate suspension for risk to public health and safety in April 2012 and later revoked in June 2013 after a patient died due to excessive and inappropriate controlled substances prescribing, according to a District of Columbia board action report. The physician was still actively registered with DEA as of March 2014. According to DEA OD officials, DEA was unaware that the registrant no longer possessed state-level controlled substance authority and therefore it did not initiate any action against the registration. The DEA registration subsequently expired in February 2015, almost 3 years after authority in the District of Columbia was inactivated. We provided information on these 57 individuals to DEA for further investigation. DEA OD officials provided information indicating the status of each registration, whether any action was taken against the registration, and whether there was knowledge of the state disciplinary action. In 36 of the 57 cases, CSA2 did not contain information on these individuals’ state licensure status or disciplinary actions, which meant that DEA OD staff could not make an informed decision on the eligibility of these registrants to continue to handle or prescribe controlled substances. According to DEA OD officials, DEA took action against 3 of the 36 registrations. However, the bases for these actions were unclear, and there was no indication that they were based on the loss of state-level controlled substance authority. As described earlier, DEA verifies an applicant’s state licensure information upon initial application by checking the relevant state board websites to ensure the applicant is appropriately licensed. However, DEA does not verify practitioners’ state licenses after initial registration to ensure they are still actively licensed by the state. Instead, it relies on the practitioner to self-report any disciplinary actions related to controlled substances at renewal every 3 years, or the individual state licensing boards to notify DEA of any actions taken against its registrants that may affect their controlled substance eligibility. According to DEA OD officials, the amount of communication between DEA and the state licensing boards varies significantly, so not all state licensing boards may notify DEA that the state has taken action against a DEA registrant. Furthermore, DEA is not required to and has not chosen to make use of perpetual vetting techniques; that is, regularly matching its database of registrants against databases containing medical sanctions, such as the database we used in this analysis. Therefore, DEA may not have been alerted to the information on the disciplinary actions that we identified. When asked why DEA does not monitor state licensure information after initial registration, agency officials said that they had not considered monitoring state licensure information, but would be open to exploring options to do so. As previously noted, the Standards for Internal Control in the Federal Government state that agencies should design procedures using information necessary to achieve their objectives and respond to risks. DEA’s reliance on state boards to alert them of any actions, complaints, or criminal offenses against one of its registrants could result in delays in receiving pertinent information about the eligibility of its registrants. In addition, if a state fails to notify DEA of an action against one of its registrants or the applicant does not self-report a disciplinary action, then DEA may not discover that the registrant is no longer eligible. By not making use of available resources to monitor the state licensure and disciplinary actions taken against its registrants, such as databases containing information on medical sanctions, DEA is not well-positioned to ensure the continued eligibility of its registrants. For example, databases containing information on medical sanctions, such as those maintained by the FSMB or the National Practitioner Data Bank (NPDB), capture information on multiple types of practitioners from many different sources, such as adverse actions taken by state boards, federal agencies, and professional societies. In addition, these data also include information on actions taken due to controlled substance violations, criminal offenses, and exclusions from federal health-care programs reported by the Department of Health and Human Services (HHS). One database, NPDB, also captures information from state law-enforcement and Medicaid fraud- control agencies. Utilizing these types of databases would allow DEA to regularly monitor adverse actions taken against its registrants across a broad spectrum of sources. Furthermore, utilizing these types of databases would allow DEA to monitor its registrants’ licenses and disciplinary actions across all states, not just the state in which they hold a DEA registration. Disciplinary actions occurring in other states could be relevant to DEA’s assessment of whether registering an individual would be inconsistent with the public interest. However, using these databases may have costs. Therefore, it would be important for DEA to balance the cost and benefit to using such databases with developing other approaches for monitoring its registrants’ state authority. Regardless of the approach used, without taking steps to verify registrants’ continued eligibility, DEA may not have complete or timely information about the continued eligibility of its registrants, thereby weakening the integrity of its registry. In furtherance of its mission to enforce the closed system of controlled substance distribution, DEA has promulgated regulations that require all applicants and registrants to provide effective controls and procedures to guard against theft and diversion of controlled substances. DEA has also published the Controlled Substances Security Manual (Manual), which clarifies the regulations and provides additional guidance to assist handlers of controlled substances in safeguarding them. For example, the Manual instructs practitioners to keep blank prescription forms and unused DEA Order Forms in a secure location to prevent against theft. The Manual also emphasizes that applicants and registrants who hire employees to work in or around areas where controlled substances are handled must carefully screen these employees, identifying this process as “a critical first step in diversion prevention,” “vital to fairly assess the likelihood of an employee committing a drug security breach,” and “essential to overall controlled substances security.” According to DEA, as part of the screening process, criminal-background checks with local law- enforcement authorities should be performed by the employer, and each potential employee should be required to answer the question, “Within the past five years, have you been convicted of a felony, or within the past two years, of any misdemeanor, or are you presently charged (formally) with committing a criminal offence?” Given DEA’s guidance to registrants that their employees with criminal convictions, or pending charges, may pose an increased risk of illicit diversion of controlled substances, we assessed the extent to which DEA’s internal controls help ensure individual registrants do not present similar issues that may increase the risk of illicit diversion of controlled substances. Our analysis of DOJ’s BOP SENTRY data, USMS’s warrant data, and the FBI’s NSOR data identified one individual who may have been ineligible to have controlled substance registrations because of crimes related to controlled substances. In addition, we found 94 individuals associated with 100 DEA registrations that presented issues that may increase the risk of illicit diversion of controlled substances, such as registrants with active or recent warrants for offenses related to controlled substances, registrants incarcerated or with active or recent warrants for offenses unrelated to controlled substances, and registrants listed in the NSOR for crimes such as sexual assault and exploitation of minors. Incarcerated registrants. We found 28 individuals associated with 32 DEA registrations who may have been either ineligible for a controlled substance registration or presented issues that may increase the risk of illicit diversion of controlled substances because they were incarcerated in federal prisons for crimes related to controlled substances, health-care fraud, or other crimes. Of the 28 incarcerated individuals, 1 was incarcerated for crimes related to controlled substances. In this case, the individual was convicted of possession of approximately 535 pounds of marijuana with the intent to distribute in September 2013, required to undergo treatment for substance abuse, and subsequently imprisoned in December 2013. The registrant surrendered her state-level authority in February 2014. According to DEA OD officials, the registrant’s CSA2 record did not contain any notes indicating awareness of the crime and DEA did not initiate any action against the registrant. The registration subsequently expired in May 2015. In addition, 18 of the 28 individuals were incarcerated for crimes related to health-care fraud, of which 10 had been excluded from participating in federal health-care programs due to criminal convictions that may have provided a sufficient basis to deny or revoke a registration, while maintaining DEA registrations. One such registrant was convicted of defrauding Medicare in June 2013 following an investigation by the FBI and HHS OIG. The registrant was subsequently excluded from participating in federal health-care programs in April 2014. According to DEA OD officials, the registrant’s CSA2 record did not contain any notes indicating awareness of the crime, nor did DEA initiate any action against the registrant. The individual was still actively registered with DEA as of January 2016. Furthermore, we identified an additional 9 individuals who were incarcerated for other crimes, such as sexual abuse and illicit acts as well as fraud, including bank, wire, and tax fraud. One such individual, a former doctor for DOJ’s BOP, was convicted in November 2012 and sentenced to federal prison in February 2013 for sexually abusing three inmates in the course of his employment with DOJ. Another individual was serving 8 years in federal prison after being convicted of attempting to travel to Canada to engage in illicit sexual conduct with a minor. According to DEA OD officials, the registrants’ CSA2 records did not contain any notes indicating awareness of the crime. The registrations subsequently expired in December 2014 and June 2014, respectively. Registrants with active or recent warrants. We identified five individuals associated with six DEA registrations who were listed in USMS warrant data, of which three possessed outstanding warrants. Of the five individuals with active or recent warrants, three individuals had warrants for offenses related to controlled substances. For example, we identified a physician with an active warrant who was indicted in October 2013 on multiple felony counts for knowingly and intentionally distributing controlled substances outside the scope of professional practice, health-care fraud, and making false statements in health-care matters, among others. The indictment alleged that the physician convinced patients to undergo medically unnecessary spinal surgeries, and then billed private and public health-care benefit programs, deriving significant profits for the fraudulent services. Additionally, according to Kentucky and Ohio medical board orders, the physician was presigning blank prescriptions so his employees (who lacked lawful authority) could issue prescriptions for controlled substances in his absence. In October 2013, the Kentucky medical board issued an emergency suspension due to immediate danger to public health and safety, followed by an Ohio medical board suspension in November 2013. Both medical boards later revoked the physician’s license in 2014. According to DEA OD officials, the registrant’s CSA2 record did not contain any notes indicating awareness of the criminal allegations. The physician was still actively registered with DEA as of January 2016. Registered Sex Offenders. We identified 62 individuals associated with 63 DEA registrations who were also registered with the FBI’s NSOR for convictions involving sexual offenses. Types of offenses included actions such as sexual assault against patients and exploitation of a minor, among others. For example, we identified a physician who was convicted of four felony counts of gross sexual imposition and two misdemeanor counts of sexual imposition involving patients. The conviction led to an automatic suspension of the physician’s medical license in November 2012, and the license was subsequently revoked in January 2014. According to DEA OD officials, the registrant’s CSA2 record did not contain any notes indicating awareness of the crime. The physician’s registration expired in April 2014. We identified another physician who pled guilty to two felony counts of sexual exploitation of a minor in October 2012 and subsequently surrendered his medical license and state-level controlled substance registration in February 2013. According to DEA OD officials, the registrant’s CSA2 record did not contain any notes indicating awareness of the crime. The DEA registration expired in May 2015. DEA is not required to and has not chosen to regularly match its database of registrants against databases containing criminal background, such as the databases we used in this analysis. Further, according to DEA OD officials, DEA only considers crimes related to controlled substances when evaluating whether to take action against an individual’s registration based on criminal activity. Therefore, DEA may not have been alerted to the criminal offenses, such as health-care fraud and sexual assault, we identified. We provided DEA with a list of the 95 individuals that matched these databases to determine whether it was aware of the criminal background, and what, if any, action it took against these individuals’ registrations. In response, DEA OD officials compiled a list indicating the status of each registration, whether any action was taken against the registration, and whether the registrant’s CSA2 record contained any notes indicating knowledge of the crime. In 43 of the 95 cases, CSA2 did not contain information on these individuals’ criminal history, which meant that DEA was not aware of the presence of issues that may have increased the risk of illicit diversion of controlled substances. DEA has controls in place to check for drug-related offenses, such as checking initial applicants against NADDIS; however, DEA does not conduct ongoing or subsequent checks against NADDIS for renewals unless the applicant self-reports a criminal conviction related to controlled substances. Additionally, while DEA receives information from state licensing boards about the criminal activity of its registrants, the extent and frequency to which the states monitor varies by state as do the sources that the states use for such monitoring. For example, as described earlier, two of the five states we visited only conduct criminal- background investigations if the state applicant self-reports a criminal offense. In addition, some states only monitor criminal activity occurring within the state, while others monitor criminal reports from states across the nation. Therefore, states without strong criminal-background controls may not have known to take action against the individual and, therefore, could not have notified DEA. In our discussions, DEA OD officials said they had not considered monitoring criminal backgrounds but were open to doing so. By relying on the applicant to self-report a criminal conviction or the states to notify DEA of actions taken against its registrants, DEA may be missing opportunities to develop a more-complete assessment of the continued eligibility of its registrants and risks to the closed system of controlled substance distribution. Additional criminal background controls and regular monitoring would allow DEA to promptly identify registrants with criminal backgrounds. By promptly identifying such registrants, DEA would obtain better assurance of the integrity of its registry and better identification of potential risks of illicit diversion. Although such monitoring could improve the integrity of the registry, such actions may have costs, and, given the relatively low number of individuals with unidentified criminal backgrounds, weighing those costs with the risks would be important. The Standards for Internal Control in the Federal Government state that agencies should identify and analyze relevant risks to achieve their objectives and form a basis for determining how risks should be managed. Additionally, GAO’s Fraud Risk Management Framework identified as a leading practice considering the benefits and costs to address identified risks when designing and implementing specific controls to prevent and detect fraud. Until DEA explores options that would balance the risk posed by individuals having criminal backgrounds with the cost of identifying those individuals and documenting associated decisions, DEA is not well-positioned to make an informed decision on how best to use its resources. As part of an overall effort to prevent the diversion of controlled substances for nonmedical use, having effective controls to ensure that only those who are authorized and eligible handle and prescribe controlled substances is essential. While many stakeholders are involved in making this determination, DEA plays a key role because it administers and enforces the Controlled Substances Act (CSA) and, in doing so, is responsible for ensuring that registering an individual to handle or prescribe controlled substances is not inconsistent with the public interest. DEA has implemented controls to register individuals to handle or prescribe controlled substances. However, as demonstrated by our analyses, DEA has the opportunity to enhance the integrity of its controlled substances registry by taking additional steps to collect and validate registrants’ identifying information and verify the continued eligibility of its registrants. Given that unique identifying information, such as SSNs, is critical to validating the identities and implementing controls to identify deceased registrants, obtaining legal authority to require such information and developing policies and procedures to validate this information would help ensure that DEA’s registrants are and remain eligible to prescribe and handle controlled substances. In addition, having complete and valid SSNs for all individual registrants would enhance DEA’s ability to identify other registrations held by each individual, including any past adverse actions taken against previous registrations, as it evaluates whether registering the individual would be inconsistent with the public interest. Furthermore, while DEA has taken steps to identify and retire deceased registrants in its database by using SSA’s public Death Master File (DMF), obtaining legal authority to access that agency’s more comprehensive full death file would help ensure that DEA is using the most-complete information available. This would better ensure that DEA maintains current information on the eligibility of its registrants and prevents others from potentially using the registration information of deceased registrants. Similarly, developing procedures to verify the continued eligibility of its registrants in other areas, such as verifying that registrants maintain appropriate state authority and have not been subject to disciplinary actions that may affect their eligibility, would help ensure that its registrants maintain eligibility to handle and prescribe controlled substances. Additionally, exploring options that weigh the risks posed by registrants with criminal backgrounds with the costs of identifying these individuals could better inform DEA about the potential for illicit diversion of controlled substances. Given DEA’s guidance to registrants that their employees with criminal convictions or pending charges may pose an increased risk of illicit diversion, taking steps to monitor its own registrants’ criminal backgrounds would help ensure that these registrants do not present similar issues that may increase the risk of illicit diversion of controlled substances. To help ensure that practitioners who may be ineligible do not possess a controlled substance registration and that practitioners who pose an increased risk of illicit diversion are identified, we recommend the Acting Administrator of DEA take additional actions to strengthen verification controls. Specifically, we recommend that the Acting Administrator of DEA take the following five actions: develop a legislative proposal requesting authority to require SSNs for all individuals, regardless of whether they hold an individual or business registration; develop policies and procedures to validate SSNs and apply the policies and procedures to all new and existing SSNs in the CSA2; such an approach could involve collaborating with SSA to assess the feasibility of checking registrants’ SSNs against EVS; develop a legislative proposal to request access to SSA’s full death identify and implement a cost-effective approach to monitor state licensure and disciplinary actions taken against its registrants; such an approach could include using data sources that contain this information, such as NPDB or FSMB; and assess the cost and feasibility of developing procedures for monitoring registrants’ criminal backgrounds, such as conducting matches against federal law-enforcement databases, and document decisions about the approach chosen. We provided a draft of this report to DOJ for its review, and DEA’s Office of Inspections provided written comments, which are reproduced in full in appendix II. We also provided relevant sections of a draft of this report to SSA and the appropriate licensing boards in the five states we visited— Arizona, Connecticut, New Mexico, Texas, and Vermont—to obtain their views and verify the accuracy of the information provided. In its written comments, DEA stated that it appreciates the intent of our recommendations, but raised concerns about its legal authority to take some of the actions we recommended. It also raised concerns about technical and fiscal challenges that it stated would make compliance with the recommendations burdensome. Despite these limitations, DEA stated that it is in the process of determining the feasibility of implementing actions that would permit it to comply with the recommendations utilizing the current legal framework and within reasonable cost parameters. DEA specifically agreed with our recommendation to identify and implement a cost-effective approach to monitor state licensure and disciplinary actions taken against its registrants, dependent on its determination that these actions are allowable under the authority of the CSA. DEA neither agreed nor disagreed with the remaining four recommendations. Instead, DEA described actions it has taken or plans to take in response to each recommendation. Regarding our first recommendation that DEA develop a legislative proposal requesting authority to require SSNs for all individuals regardless of whether they hold an individual or business registration, DEA stated that it is exploring the possibility and practicality of implementing changes to require SSNs for practitioners and mid-level practitioners and will pursue the actions necessary to legally authorize DEA to require such information. DEA further stated that, if new legislative authority is required, it defers to GAO to recommend legislative action to Congress. As we noted in the report, officials in DEA’s Office of Chief Counsel told us that they do not have legal authority to collect SSNs for individuals who apply as a business. We also noted that collecting SSNs is critical to validating identities and carrying out DEA’s existing controls to identify and remove deceased registrants and to identify other registrations held by each individual, including past adverse actions taken against previous registrations. We agree that DEA’s plans to pursue actions necessary to legally authorize DEA to require SSNs is a good first step and we continue to believe that DEA should develop a legislative proposal to request authority to require SSNs for all individuals. DEA developing its own legislative proposal would ensure the proposal is drafted in a way that addresses the actions necessary to legally authorize DEA to require SSNs for all individuals. Regarding our second recommendation to develop policies and procedures to validate SSNs and apply these to all new and existing SSNs in the CSA2, DEA said that it has initiated discussions with SSA to determine the legality and feasibility of using EVS to verify SSNs and outlined the issues that its review will focus on. We agree that these actions are good first steps in developing an approach to validate SSNs in the CSA2 and further agree that use of EVS is one possible approach to validate SSNs. As we noted in the report, validating SSNs will help establish registrants’ identities and help ensure that DEA has the information necessary to implement its existing controls and to identify other registrations held by each individual, including past adverse actions taken against previous registrations. Regarding our third recommendation to develop a legislative proposal to request access to SSA’s full death file, DEA stated that it is preparing a proposal to SSA to request access to the full death file. If SSA determines it cannot provide access to this data to DEA under existing law, DEA stated that it defers to GAO to advise the appropriate congressional representatives to seek legislative changes for DEA. As we noted in the report, DEA is not eligible under current law to access SSA’s full death file. We also noted that having access to the more comprehensive full death file would ensure that DEA is using the most-complete information available. As a result, this would better ensure it maintains current information on the eligibility of its registrants and prevent others from potentially using the registration information of deceased registrants. We continue to believe that DEA should develop a legislative proposal to request access to SSA’s full death file. DEA developing its own legislative proposal would ensure the proposal is drafted in a way that addresses the requirements necessary to grant DEA access to this information. With regard to our fourth recommendation to identify and implement a cost-effective approach to monitor state licensure and disciplinary actions taken against its registrants, DEA stated that it does not specifically have authority to access state medical licensing boards’ databases. However, our recommendation does not specifically require the use of state medical licensing boards’ databases and allows DEA flexibility in an approach for monitoring the information that it needs to help ensure the continued eligibility of its registrants. DEA concurred with our recommendation, dependent upon a determination that these actions are allowable under the authority of the CSA. DEA stated that it has met with FSMB representatives and is currently exploring the use of FSMB’s services to verify the existence and status of state licenses and to identify disciplinary information from the medical boards. We agree that use of FSMB’s services can be beneficial for validating the types of practitioners included in FSMB’s services, such as medical doctors, osteopathic doctors, and some physician assistants. However, these actions do not include other types of individual practitioners for which DEA should also develop processes to monitor state licensure and disciplinary actions, such as dentists, veterinarians, and pharmacists, among others. While these individuals represent a smaller percentage of DEA’s registrants, we believe it is important for DEA to monitor state licensure and disciplinary actions for these individuals as well to better ensure that its registrants are and remain eligible. Lastly, in response to our fifth recommendation that DEA assess the cost and feasibility of developing procedures for monitoring registrants’ criminal backgrounds, DEA stated that it has started discussions with BOP about effective ways of comparing DEA’s registrant data to BOP’s inmate data. DEA also stated that it is exploring the technical and financial feasibility of adding an additional query of NADDIS for renewal applications since this query is currently done only for new applications. We believe that developing procedures to monitor registrants’ criminal backgrounds using these databases would be beneficial for DEA to help ensure that its registrants are and remain eligible and do not possess an increased risk of illicit diversion. DOJ, SSA, and the New Mexico Medical Board also provided technical comments that were incorporated into the report, as appropriate. The Connecticut Departments of Public Health and Consumer Protection and the Texas Medical Board reported that they had no comments. The Arizona Medical Board, New Mexico Board of Pharmacy, Texas Department of Public Safety, and the Vermont Board of Medical Practice did not respond to our request for comments. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Attorney General, the Acting Commissioner of SSA, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. This report (1) identifies and describes the internal controls that selected states and the Drug Enforcement Administration (DEA) use to help ensure the eligibility of individuals to handle controlled substances, and (2) assesses the extent to which DEA’s internal controls help ensure that individuals listed in the controlled substances database are and remain eligible and do not present issues that may increase the risk of illicit diversion of controlled substances. To identify and describe the internal controls that selected states use to help ensure the eligibility of individuals to handle controlled substances, we conducted site visits to five states—Arizona, Connecticut, New Mexico, Texas, and Vermont. We developed site visit selection criteria and selected states to ensure a mix of states with state-level controlled substance registrations and those without; states with a high number of DEA adverse actions per 1,000 registrants; states with a low and high incidence rate of accidental deaths from prescription opioid and benzodiazepine drugs in 2012 (the most recently available data at the time of our review), per 100,000 people; and states with large increases and large decreases in the rate of change in accidental opioid and benzodiazepine drug overdose per 100,000 people. We also prioritized states that were located near a DEA field division office. Because each state determines the internal controls used to ensure the eligibility of individuals to handle controlled substances, the internal controls may vary by state. Our selection of states is not a generalizable sample. Therefore, our findings are only applicable to these five states and cannot be used to make inferences about other states. Prior to making our state selections, we convened several discussion groups at the National Association of State Controlled Substances Authorities Conference held in October 2014 in order to gain an overall understanding of how state agencies and health-care industry companies interact with DEA to prevent controlled substance diversion and abuse, and communicate and share information with DEA regarding registrants. We also obtained the state agency and industry representatives’ views about DEA’s controlled substances screening, registration, and enforcement processes for individuals and entities. Because each state determines which health-care occupations may prescribe or dispense controlled substances, as well as an occupation’s licensure requirements, the number of state licensing boards and the individuals they license varies by state. For consistency in the types of state licensing boards we met with and as a means for comparison, we visited medical and pharmacy boards, or their equivalents, in the five states because physicians are the largest category of individual practitioners that DEA registers and pharmacies are the largest category of registered entities. We also reviewed applicable state statutes and administrative rules, agency and board websites, as well as forms and application instructions for new and renewing licensees for each of the five states. For each of the selected states, we interviewed state officials about validating information submitted on physician licensure applications initially and at renewal, information sharing with other state or federal agencies, and procedures for handling complaints and for matching licensure data with other state or federal databases. We also met with officials in three of our five states (Connecticut, New Mexico, and Texas) who were responsible for administering their respective programs for state-level controlled substance registration. To identify and describe the internal controls that DEA uses to help ensure the eligibility of individuals to handle controlled substances, we reviewed federal statutes and DEA regulations and interviewed DEA officials from headquarters and four field division offices about their interactions with other federal, state, and local agencies, as well as their interactions with registrants. We focused on how DEA officials carry out registration activities, validate information submitted on the registration applications, share information with state agencies, and follow their processes for receiving and investigating complaints. Additionally, our review focuses on individuals who were practitioners, such as physicians, dentists, and veterinarians, and mid-level practitioners, such as nurse practitioners, physician assistants, and pharmacists. These groups represent about 1.4 million (93 percent) of the 1.5 million DEA registrations. To identify and describe DEA’s requirements and processes for registration, renewal, and monitoring of individual handlers of controlled substances, we reviewed applicable statutes, regulations and federal guidance, DEA’s annual budget submissions, DEA’s website, the controlled substances registrant database user manual, and forms and instructions for new and renewing applicants. We also interviewed relevant DEA officials to identify DEA’s processes for registrants’ initial registration, renewal, and monitoring. To assess the extent to which DEA’s internal controls help ensure that individuals listed in the controlled substances database (CSA2) are and remain eligible and do not present issues that may increase the risk of illicit diversion of controlled substances, we identified vulnerabilities for potential fraud and then identified the associated internal control weaknesses that led to the vulnerability. To accomplish this, we reviewed federal statutes and regulations, decisions from DEA administrative hearings and federal courts, and DEA policies and guidance, and interviewed DEA officials responsible for controlled substance registration functions. We used federal standards for internal control, GAO’s Fraud Risk Management Framework, federal statutes, and DEA policies to evaluate these functions. To identify vulnerabilities for potential fraud in DEA’s internal controls, we analyzed registrants’ identifying information contained in CSA2 as of March 6, 2014 (the most-current CSA2 data available at the time of our review) and matched CSA2 data to the following five databases (1) the Social Security Administration’s (SSA) full death file, as of February 2014; (2) Federation of State Medical Boards (FSMB) physician-licensure data, as of the 2014 census, and disciplinary- action data, as of April 2015; (3) Federal Bureau of Prisons’ (BOP) SENTRY data, as of March 2014; (4) U.S. Marshals Service (USMS) warrant data, as of February 2014; and (5) the Federal Bureau of Investigation’s (FBI) National Sex Offender Registry (NSOR), as of February 2014. We also compared DEA registrants’ identity information to the identity information from SSA’s official records using the Enumeration Verification System (EVS). We then identified the related internal control weaknesses that led to these vulnerabilities to help us assess the extent to which DEA’s internal controls help ensure that individuals are and remain eligible and do not present issues that may increase the risk of illicit diversion of controlled substances. For the purposes of our review, we selected only individuals who were practitioners, such as physicians, dentists, and veterinarians, and mid- level practitioners, such as nurse practitioners, physician assistants, and pharmacists. These groups represent about 1.4 million (93 percent) of the 1.5 million DEA registrations. We excluded businesses, such as pharmacies, hospitals, and manufacturers, from our analysis. To identify individuals with missing, duplicative, or potentially inaccurate or invalid Social Security numbers (SSN), we analyzed registrants’ identifying information contained in CSA2 and compared this information to SSA’s records. Specifically, we identified instances where individuals were registered using employer identification numbers (EIN) instead of SSNs. We reviewed these results and identified instances where records contained text suggesting they were registered under official government capacity (e.g., “Limited to Official Federal Duties Only”) and, therefore, not required to provide either an EIN or SSN. We then reviewed a nongeneralizable sample of 20 records, matching the registrant’s name and address to the registrant’s website to confirm that the individual’s registration appeared to be associated with a private employer and not a government entity. We also identified instances where the SSN matched multiple registrations, but the names associated with those registrations did not match each other. We reviewed the results to determine the extent to which the names did not match. For example, we identified instances where the names reasonably appeared to be the same person, but whose names did not match due to possible typos (e.g., “Sally Simpson” and “Sally Simpsen”), name cognates (e.g., “Jonathan Smith” and “Jon Smith”), name inversions (e.g., “Jon Smith” and “Smith Jon”), or additional first or last names (e.g., “Mary Lynn Smith” and “Mary Smith,” or “Jane Smith Johnson” and “Jane Johnson”). We also identified instances where the SSNs were associated with first or last names (or both) that reasonably appeared to be distinctly different. We provided a list of all of these individuals to DEA to determine the reason this occurred. To identify whether any registrants had potentially inaccurate or invalid SSNs or dates of birth, we submitted this information for individuals for verification to SSA’s EVS. EVS provides information on invalid (never issued) SSNs and instances where there are mismatches between SSN, name, and date of birth. EVS flags SSNs in which the name or date of birth (or both) do not match its records for the SSN, as well as SSNs that have never been issued by SSA. To identify whether any registrants were potentially ineligible or presented issues that may increase the risk of illicit diversion of controlled substances, we matched DEA’s CSA2 data of approximately 1.5 million registrants, as of March 6, 2014 (the most-current CSA2 data available at the time of our review), to the five databases listed below. 1. SSA’s full death file. To identify registrants who were reported deceased by SSA, we matched the CSA2 data to SSA’s full death file by SSN, name, and date of birth, as of February 28, 2014. The full death file contains all of SSA’s death records, including state-reported death information. We included only those individuals who had dates of death prior to March 1, 2014. 2. FSMB licensure and disciplinary action data. To identify registrants who did not possess active state-level controlled substance authority, we matched CSA2 to FSMB licensure and disciplinary action data based on the FSMB’s 2014 physician census and disciplinary action data dated through April 20, 2015. We matched the CSA2 data to FSMB data by SSN and name to identify physicians with disciplinary actions related to the suspension, revocation, or surrender of their medical license or controlled substance privileges. To better identify suspensions, revocations, or surrenders occurring without reinstatement prior to March 6, 2014, we limited our review of FSMB data to the most-recent disciplinary action taken against the registrant prior to March 6, 2014. Therefore, the number we identified may not include all suspended, revoked, or surrendered licenses and represents a minimum number. For each of the disciplinary actions identified in the FSMB data, we reviewed supporting documentation, such as medical board actions, using the applicable state medical board website. We provided a list of potentially ineligible registrants based on our review of state disciplinary actions to DEA to determine whether DEA was aware of these disciplinary actions and what action, if any, DEA took against their respective registrations. 3. BOP SENTRY data. To identify registrants incarcerated while actively registered with DEA, we matched CSA2 data to federal prisoner data provided by BOP as of March 2014 by SSN, name, and date of birth. We conducted a second match using name and date of birth to identify any additional matches where the SSN field may have been missing or inaccurate. We identified two individuals who matched by name and date of birth, but whose SSNs were missing in at least one of the data files. For these two individuals, we reviewed state licensing board action documentation to determine whether the offenses in the board actions matched the offenses identified in the BOP data and to confirm that they were likely matches. We provided a list of the DEA registrants that matched by SSN or name and date of birth to BOP to obtain the incarceration dates for these registrants to determine whether they were incarcerated as of March 6, 2014. We then categorized offenses that were related to controlled substances, health-care fraud, or contained other attributes, such as bank fraud or sexual abuse. We provided a list of registrants who matched this database to DEA to determine whether DEA was aware of the criminal offenses and what action, if any, DEA took against their respective registrations. 4. USMS warrant data. To identify registrants with active or recent warrants, we matched the CSA2 data to warrant data provided by USMS as of February 2014. We identified records for which the registrant’s SSN and name matched that of an individual (or an individual’s alias) who was listed in the warrant data. We provided a list of DEA registrants who matched USMS warrant data to USMS to obtain the warrant issued and warrant closed dates, among other information, to determine whether these registrants had active or recent warrants as of March 6, 2014. We then determined which matches had open or recently closed warrants. We then categorized offenses that were related to controlled substances, health-care fraud, or contained certain other attributes. We provided a list of registrants who matched this database to DEA to determine whether DEA was aware of the criminal offenses and what action, if any, DEA took against their respective registrations. 5. FBI NSOR data. To identify registrants who were listed as registered sex offenders, we matched the CSA2 data to the FBI’s NSOR data, as of February 2014. We identified records for which the registrant’s SSN, name, and date of birth matched that of an actively registered sex offender (or an associated alias). We provided a list of DEA registrants who matched NSOR to the FBI to obtain the NSOR registration start and end dates, among other information, to determine whether these individuals were registered in the NSOR as of March 6, 2014. We then provided a list of registrants who matched this database to DEA to determine whether DEA was aware of the criminal offenses and what action, if any, DEA took against their respective registrations. Because we matched CSA2 data to these datasets using two or more identifiers—SSN, name, date of birth—we are generally confident in the accuracy of our results. However, in some cases, our matches may include registrants who were not deceased, sanctioned by their respective states, incarcerated, the subject of an active or recent warrant, or registered sex offenders. This can occur when a DEA registrant has an SSN, name, and date of birth that are identical to an individual listed in one of the other databases or when the registrant is listed in the other database erroneously. In addition, our matches may be understated because we may not have detected registrants whose identifying information in the CSA2 data differed from the identifying information in other databases, or was missing. We assessed the reliability of DEA’s CSA2 data, SSA’s full death file, FSMB physician licensure and disciplinary action data, BOP SENTRY data, USMS warrant data, and the FBI NSOR data by reviewing relevant documentation, interviewing knowledgeable agency officials, and performing electronic testing for duplicate records and valid or missing values to determine the completeness and accuracy of specific data elements in the databases. We assessed the reliability of SSA’s EVS by reviewing relevant documentation. We determined that the data elements we used from these databases were sufficiently reliable for the purposes of matching DEA registrants to these datasets to identify potentially ineligible registrants. We conducted this performance audit from November 2014 through May 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, the following staff members made significant contributions to this report: Gabrielle M. Fagan and Joah G. Iannotta, Assistant Directors; Tracy Abdo; Melinda Cordero; Carrie J. Davidson; Colin J. Fallon; Dennis Fauber; Maria McMullen; James Murphy; Joy Myers; and Shana Wallace.

Summary: DEA registers individuals and entities authorized to manufacture, distribute, or dispense controlled substances in accordance with the Controlled Substances Act, which seeks to ensure that only authorized individuals handle controlled substances. States also have a role in the registration process as they determine general licensing requirements for health-care professionals who are permitted to handle or prescribe controlled substances. Controlled substances include prescription pain relievers, such as OxyContin, stimulants, and sedatives. GAO was asked to review DEA's processes for registering applicants, monitoring the eligibility of registrants, and managing CSA2 data. This report assesses the extent to which DEA's internal controls help ensure that individual registrants are and remain eligible and do not present issues that may increase the risk of illicit diversion, among other objectives. GAO reviewed relevant documents and interviewed DEA and state officials. GAO matched CSA2 data to several databases to identify potentially ineligible registrants. The Drug Enforcement Administration (DEA) has established controls for determining registrant eligibility to handle and prescribe controlled substances. However, GAO found limitations in DEA's controls to help ensure that individual registrants are and remain eligible and do not present issues that may increase the risk of illicit diversion. GAO's examination of DEA's controlled substances database (CSA2) as of March 2014 (the most-current data available) revealed gaps and other issues pertaining to registrants' identifying information. For example, GAO's analysis identified 40,785 of about 1.4 million individual registrations that were registered using a business tax identification number instead of a Social Security number (SSN). According to DEA officials, DEA does not have legal authority to require SSNs for individuals applying as a business. For individuals registered with an SSN, GAO found 11,740 SSNs that could not be validated by the Social Security Administration (SSA) and 688 SSNs that were registered to multiple names or variations of names, which can be a risk indicator of potential fraud. SSNs are needed to identify and remove deceased registrants as well as identify any past adverse history that may affect registrant eligibility. Given that SSNs are critical to validating identities, implementing DEA's controls, and identifying registrants' past adverse history, obtaining legal authority to require SSNs for all individuals and developing policies and procedures to validate them would help ensure that registrants are and remain eligible. GAO also found limitations in DEA's processes for verifying continued eligibility of its registrants. Of the approximately 1.4 million individual registrations in CSA2 as of March 2014, GAO found 764 registrants who were potentially ineligible because they were reported deceased by SSA, did not possess state-level controlled substance authority, or were incarcerated for felony offenses related to controlled substances. GAO also found 100 registrants who presented issues that may increase the risk of illicit diversion, such as registrants incarcerated for offenses unrelated to controlled substances, registrants with active or recent warrants, and registrants listed as sex offenders. DEA does not have processes in place to verify its registrants' state licenses or criminal background after initial registration, unless the registrant self-reports or the state notifies DEA of actions taken against its registrants. Developing processes to monitor registrant state licensure and disciplinary actions, such as verifying that registrants maintain appropriate state authority and assessing the cost and feasibility of monitoring registrants' criminal backgrounds, would help ensure that registrants maintain eligibility to handle and prescribe controlled substances and do not present issues that may increase the risk of illicit diversion. GAO is making five recommendations to DEA to help ensure practitioners are and remain eligible and that those who pose an increased risk of illicit diversion are identified. DEA stated it appreciated the intent of GAO's recommendations, but raised concerns about its legal authority to take some of the actions. GAO's recommendations include having DEA seek legal authority as needed, and remain valid.