What Is the Opioid Crisis and the Risk of Diversion?
In 2018, Congress declared that prescription opioids have created the “worst drug crisis in America’s history.”[2] It is a complex crisis of staggering proportions. According to recent statistics from the Centers for Disease Control and Prevention (CDC), the opioid crisis has claimed nearly 841,000 lives during the 10-year period from 1999 to 2019, with no end in sight.[3]
At the heart of the crisis is the use and misuse of legal (i.e., prescription) opioid products. It includes both naturally derived compounds (e.g., morphine) and synthetic compounds (e.g., fentanyl). The uses of these products include legitimate medical use by patients as a treatment regimen for chronic pain as well as nonmedical (i.e., illegitimate) use by individuals with substance-abuse disorders (i.e., addiction). The misuse of prescription opioids often culminates in overdose injuries or death. It affects rural and urban communities in every state, ultimately costing taxpayers billions of dollars.[4] Therefore, Dan Aaron Polster, senior US district judge of the Northern District of Ohio, who presides over the Opioid Multidistrict Litigation (MDL), stated it is “accurate to describe the opioid epidemic as a man-made plague.”[5][6]
Opioid abuse in the US, however, is not a new public health issue. In the late 1860s and 1870s, the country experienced an opioid epidemic fueled largely by the ravages of the American Civil War, and by “1870, opium was more available in the United States than tobacco was in 1970.”[7] Therefore, according to contemporary accounts, that epidemic “was probably more widespread, if far less intense, than today’s.”[8] However, from 1840 to 1915, the use of opium and opiates was legal in the United States, and opiates were included in mainstream medicinal products such as cough suppressants until restricted under the Harrison Narcotics Act of 1914.[9] Consequently, American opioid abuse is not a new phenomenon.
The Modern-Day Opioid Abuse Crisis
The United States is unique for the volume of opioid medicinal products used. A report by the International Narcotics Control Board (the independent, quasi-judicial body charged with supporting and monitoring government compliance with international drug control treaties) noted that in “2016, the country with the highest consumption of hydrocodone continued to be the United States, with 33.4 tons, equivalent to 99.1 percent of total global consumption.”[10] During that same period, the United States accounted for 72.9% of the world’s total consumption of oxycodone.[11]
“The poppy’s power, in fact, is greater than ever. The molecules derived from it have effectively conquered contemporary America. Opium, heroin, morphine, and a universe of synthetic opioids, including the superpowerful painkiller fentanyl, are its proliferating offspring. More than 2 million Americans are now hooked on some kind of opioid . . . ”[12]
—Author Andrew Sullivan
The rapid onset and pervasiveness of the current crisis are illustrated by National Institute on Drug Abuse (NIDA) statistics that show a precipitous rise in prescription opioid abuse beginning in 1999 (see Figure 1. National Drug-Involved Overdose Deaths, Number Among All Ages, 1999-2019).[13] NIDA is a federal scientific research institute under the National Institutes of Health (NIH).
Figure 1. National Drug-Involved Overdose Deaths, Number Among All Ages, 1999-2019 [14]

This rapid onset of the current opioid crisis corresponds with Purdue Pharma’s introduction of OxyContin (a controlled-release formulation of oxycodone), although the company disputes the connection. OxyContin was originally approved by the U.S. Food and Drug Administration (FDA) in 1995 to treat “moderate-to-severe pain lasting more than a few days.”[15] Following OxyContin’s launch in 1996, product sales grew rapidly, and by 2001, “sales had exceeded one billion [dollars] annually, and OxyContin had become the most frequently prescribed brand-name narcotic medication for treating moderate-to-severe pain in the United States.”[16] This growth was fueled by Purdue Pharma’s aggressive marketing campaign that used “an expanded sales force and multiple promotional approaches to encourage physicians, including primary care specialists, to prescribe OxyContin as an initial opioid treatment for noncancer pain.”[17]
However, since 2010, the nature of the epidemic has shifted dramatically. From 2010 to 2019, prescription opioid deaths declined by 4.5%, but deaths from synthetics opioids, such as fentanyl and heroin, increased by 1040% and 461% respectively.[18] More detailed research indicates that prescription opioid deaths increasingly involve opioid use in combination with other dangerous substances such as heroin, fentanyl, cocaine, barbiturates, benzodiazepines, and even alcohol.[19]
The current epidemic is also unique in its pervasiveness. It is a seemingly boundless public health crisis exacerbated by the rise of modern technology (e.g., automobiles and the internet). Thus, the purchase of opioid products may be tied to one location, while consumption may be tied to another city, county, or state, otherwise known as “opioid diversion.” Consequently, opioid diversion in one location can have an impact on jurisdictions many miles or even states away and resembling Prohibition-era bootlegging.
Like alcohol bootlegging before it, opioid diversion follows a risk-mitigation approach of moving from areas with strong enforcement to areas with weaker controls. Consequently, while Florida started out as “ground zero” for diversionary pharmacies, the problem ultimately spread to pharmacies in other states such as Kentucky, West Virginia, and Ohio.[20] This phenomenon, known as the “oxy express,” describes the frequent trips made by thousands of individuals to states like Florida to purchase opioids easily and take them back to the states where they reside.[21][22] As a result during a five-year period (2007–2012), 780 million dosage units of hydrocodone and oxycodone were distributed to West Virginia, a state of 1.8 million residents.[23]
Risk Area Governance
Before diving into specific requirements and risk areas, there is the need to address an ongoing misconception that somehow the risks associated with controlled substances do not fall within the holistic risk universe of an effective compliance program, and thus, the well-established compliance elements outlined by the United States Sentencing Commission do not apply.[24] While it is difficult to pinpoint the basis for this misconception, it appears in part due to the fact that the Drug Enforcement Administration (DEA), unlike the FDA, does not think in terms of the Federal Sentencing Guidelines’ ubiquitous compliance framework. However, the pervasiveness of the epidemic, its impact on public health, and magnitude of the risks for noncompliance all suggest that organizations involved with controlled substances need to incorporate this risk area into their corporate compliance program and closely monitor it.
The Controlled Substances Act, 21 U.S.C. § 801, et seq.
Enacted in 1970 near the end of the Vietnam War, the Controlled Substances Act (CSA) is the primary federal statute governing controlled substances, which include opioids.[25] The primary goal of the CSA is preventing the diversion of controlled substances “while also ensuring access to controlled substances for legitimate purposes.”[26]
The Chemical Diversion and Trafficking Act of 1988 (CDTA) amended the CSA to encompass the regulation of controlled substance analogs and listed chemicals (i.e., controlled substances precursors).[27] In 2018, the SUPPORT for Patients and Communities Act (SUPPORT Act) was enacted.[28] While the act addressed a wide variety of issues across multiple statutes, for CSA purposes, it clarified the all-important definition of suspicious orders and prescribed new civil and criminal penalties for ignoring the most recent DEA data when evaluating opioid orders.[29]
Under the CSA, enforcement authority was vested in the U.S. attorney general who, in turn, delegated it to the Bureau of Narcotics and Dangerous Drugs (BNDD), the predecessor of the DEA.[30] Less than a year after passage of the CSA, the BNDD finalized regulations to implement the statutory requirements.[31] Two years later, in 1973, following several high-profile heroin seizures in France (the so-called French Connection), President Richard M. Nixon declared “an all-out global war on the drug menace,” that resulted in the formation of today’s DEA.[32]
Scheduling
The classification system is the foundation of the CSA’s regulatory framework and, therefore, “nearly all the obligations and penalties that the act establishes flow from” it.[33] Under that foundation, controlled substances are classified into one of five schedules based on three criteria: (a) medical use, (b) psychological or physical dependence, and (c) the potential for abuse.[34] Regardless of which schedule applies, scheduling of a medicinal product means that the DEA has concluded that additional controls regarding the manufacture, distribution, dispensing, and prescribing of the drug are necessary to safeguard public health.[35] These DEA controls are in addition to the usual drug approval process and general controls (e.g., Current Good Manufacturing Practices) under the Federal Food, Drug, and Cosmetic Act (FFDC). [36]
Schedule I drugs are those drugs having no currently accepted medical use and a high potential for abuse.[37] Possession or use of these so-called “illicit or street drugs” is illegal under all circumstances, and healthcare practitioners may not prescribe them.
Schedule II drugs are those drugs with an accepted medical use that have a high potential for abuse that can lead to severe psychological or physical dependence.[38] The primary difference between a Schedule I and II drug is whether a medically acceptable use exists for the drug.
Schedule III drugs have a medium potential for abuse and a moderate potential for physical or psychological dependence.[39] Schedule IV and V drugs have a low risk of abuse relative to the immediately preceding schedule, and, if abused, may cause limited physical or psychological dependence.[40]
Applying the classification system to opioids, the CSA defines an opiate as “any drug or other substance having an addiction-forming or addiction-sustaining liability similar to morphine or being capable of conversion into a drug having such addiction-forming or addiction-sustaining liability.”[41] Apart from Tramadol, the main opioids making headlines in the current crisis are either Schedule II or III drugs (see Table 1. Opioids Involved in the Current Crisis).
Table 1. Opioids Involved in the Current Crisis
Family |
Schedule |
Products |
---|---|---|
Heroin |
I |
N/A |
Morphine |
II |
Morphine Sulfate Dilaudid (hydromorphone) MS Contin (controlled-release morphine) |
Oxycodone |
II |
OxyContin (controlled-release oxycodone) Percocet (oxycodone + acetaminophen) Percodan (oxycodone + aspirin) |
Hydrocodone |
II |
Vicodin (hydrocodone + acetaminophen) |
Fentanyl |
II |
Duragesic Sublimaze |
Methadone |
II |
Dolophine |
Buprenorphine |
III |
Suboxone |
Codeine |
III |
Tylenol #3 and #4 (codeine + acetaminophen) |
Tramadol |
IV |
Ultram, Ultram ER, Ryzolt, ConZip |
[Note: This is not an exhaustive list.]
The five schedules also are updated and published on an annual basis.[42] When updating the schedules, the DEA can shift a drug from one schedule to another depending on new information.[43][44] In the opioid crisis context, in October 2014, the DEA rescheduled hydrocodone combination products moving them from Schedule III to Schedule II based on data showing significant product abuse.[45]
Registration
The statute also requires all major participants in the controlled-substance supply chain (manufacturers, distributors, dispensers (i.e., pharmacies), and prescribers to register with and receive a license from the DEA to handle controlled substances.[46] This series of interlocking registrations creates what is known as the “closed loop” system, which has as its goal ensuring that only authorized users handle controlled substances (see Figure 2. The DEA “Closed Loop” System).[47]
Figure 2. The DEA “Closed Loop” System

Types of Registrants
The DEA separates registrants into two broad segments—the Retail Level and Wholesale Level. The Retail Level includes retail pharmacies, hospitals, clinics, practitioners, teaching institutions, and mid-level practitioners.[50] Manufacturers, distributors, researchers, analytical laboratories, importers/exporters, reverse distributors, and narcotic treatment programs comprise the Wholesale Level. Based on DEA statistics, the Retail Level contains, by far, the most registrants (see Table 2. DEA Summary of Registrants as of September 2021).
Table 2. DEA Summary of Registrants as of September 2021 [51]
Retail Level |
Wholesale Level | ||
---|---|---|---|
Retail Pharmacy |
70,177 |
Manufacturer |
581 |
Hospital/Clinic |
18,667 |
Distributor |
785 |
Practitioner |
1,364,699 |
Researcher |
11,755 |
Teaching Institute |
254 |
Analytical Labs |
1,526 |
Mid-Level Practitioner |
474,639 |
Importer |
261 |
Exporter |
266 | ||
Reverse Distributor |
72 | ||
Narcotic Treatment Program |
1,900 | ||
Total |
1,928,436 |
Total |
17,146 |
Within the Retail Level, the retail pharmacy segment not only includes large, national pharmacy chains (e.g., CVS, Walgreens, Rite-Aid, and Walmart), but also smaller, regional chains (e.g., Giant Eagle), as well as local, independently owned pharmacies. Putting it into perspective, in 2020, CVS, Walgreens, Walmart, and Rite-Aid controlled 51.1% all prescription drugs dispensed in the US through a network of more than 26,000 individual pharmacy locations. [52]
The large national and some regional pharmacy chains operated their own internal distribution centers for opioids prior to the rescheduling of hydrocodone in 2014. During that time, they simultaneously fell under both the Retail Level (retail pharmacy) and Wholesale Level (distributor). After 2014, the large pharmacy chains shifted from self-distributing opioids to using independent distributors (e.g., McKesson, Cardinal Health, AmerisourceBergen, etc.).
Registrant Obligations
The closed loop system imposes certain basic obligations on controlled-substances registrants. The basics include recordkeeping, reporting, and physical security requirements.[54]
However, there also are more specific requirements depending on the type of registrant. For example, pharmacies are allowed to dispense controlled substances only upon receiving a valid prescription from a practitioner.[55] Schedule II substances (e.g., morphine, oxycodone, and hydrocodone) require a written prescription except in emergency situations.[56] However, Schedule III or IV substances (e.g., codeine and tramadol) may be dispensed via a written or an oral prescription.[57]