In a period of three months, two chief compliance officers have been charged for their individual roles in the opioid epidemic—a clear indication the Department of Justice continues to expand the scope of prosecutions against not just pharmaceutical manufacturers and distributors, but also against those who fail in their compliance responsibilities.

In February 2018, then-Attorney General Jeff Sessions announced the creation of the Prescription Interdiction & Litigation (PIL) Task Force, with the intended focus to “aggressively deploy and coordinate all available criminal and civil law enforcement tools to fight the opioid crisis,” particularly against opioid manufacturers and distributors. The recent prosecutions of individuals appear to represent the next phase of those enforcement priorities.

Compliance officers in the pharmaceutical industry should heed the warning. “When the Attorney General says, ‘We are going to focus on a particular identified issue or problem,’ compliance officers need to pay attention,” says Jennifer Freel, counsel at law firm Vinson & Elkins. “Usually when statements like that are made publicly, the government does put resources behind those initiatives.”

In the most recent case, the Justice Department on July 18 announced charges of “conspiring to distribute controlled substances” against pharmaceutical distributor Miami-Luken; two of its former executives—former president Anthony Rattini and compliance officer James Barclay—and two pharmacists.

According to court documents, Miami-Luken, Rattini, and Barclay “unlawfully enriched themselves” by profiting from the distribution and dispensing of controlled substances; distributing and dispensing large amounts of opioids to known pill mills; and facilitating the diversion of certain controlled substances for illicit use. Miami-Luken, Rattini, and Barclay further failed to maintain effective controls against the diversion of controlled substances; failed to report suspicious orders to the U.S. Drug Enforcement Administration (DEA); and continued to ship controlled substances to pharmacies “where the opioid epidemic was at its peak,” according to court documents.

“When the Attorney General says, ‘We are going to focus on a particular identified issue or problem,’ compliance officers need to pay attention. Usually when statements like that are made publicly, the government does put resources behind those initiatives.”

Jennifer Freel, Counsel, Vinson & Elkins

In one instance, Miami-Luken distributed more than 3.7 million hydrocodone pills to a single pharmacy from 2008 through 2011 in a town of just 400 people. In another example, the company distributed more than 2.3 million oxycodone pills and 2.6 million hydrocodone pills to a single pharmacy in a town of approximately 1,394 people. Another instance saw Miami-Luken provide 2.2 million pills from 2012 through 2014 to a pharmacy that had been cut off from other wholesalers.

The vast amount of suspicious drug sales shoved Miami-Luken into the national spotlight in May 2018, when it testified before Congress as to why it ignored its responsibilities as a wholesaler to report suspicious drug orders to the DEA. Testimony during that hearing revealed, among other things, that Rattini and Barclay failed to conduct adequate due diligence. For example, even knowing Miami-Luken was directly supplying a physician—the owner of a pill mill—with an excessive amount of controlled substances between November 2008 and August 2010, Rattini and Barclay “showed up to investigate on a day when the facility was closed and never returned to visit when it was open,” according to testimony.

Enforcement trend

Miami-Luken is now the second pharmaceutical distributor—and Rattini and Barclay are just the latest executives—to face charges for their role in perpetuating the opioid epidemic by ignoring red flags of abuse. The first-ever prosecution for similar criminal charges as those described in the Miami-Luken case were announced on April 23 against Rochester Drug Co-Operative (RDC), one of the 10 largest pharmaceutical distributors in the United States; Laurence Doud, the company’s former chief executive officer; and William Pietruszewski, the company’s former chief compliance officer.

According to the complaint, RDC “knowingly and intentionally” violated federal narcotics laws by distributing dangerous, highly addictive opioids to pharmacy customers that it knew were being sold and used illicitly.

In a statement, DEA Special Agent in Charge Ray Donovan said the charges “should send shockwaves throughout the pharmaceutical industry, reminding them of their role as gatekeepers. This historic investigation unveiled a criminal element of denial in RDC’s compliance practices and holds them accountable for their egregious non-compliance according to the law.”

Red flags

The indictment against Doud alleges he directed RDC to dispense controlled substances to customers that the company’s compliance department had “concluded displayed ‘red flags’ indicating that a pharmacy was dispensing controlled substances for other than legitimate medical purposes.”

Those red flags—which all pharmaceutical distributors and compliance officers in the industry should pay special attention to—include:

  • Dispensing highly abused controlled substances in large quantities;
  • Dispensing quantities of controlled substances in amounts consistently higher than accepted medical standards;
  • Purchasing only controlled substances;
  • Accepting a high percentage of cash for controlled substance prescriptions;
  • Dispensing to out-of-state patients;
  • Filling controlled substances prescriptions issued by practitioners acting outside the scope of their medical practice, under investigation by law enforcement, or on RDC’s “watch list;” and
  • Frequently accepting pharmacy customers that have been terminated by other distributors.

Doud also directed RDC’s compliance department—in particular, Pietruszewski—to report “red flags” concerning customers directly to him, and when compliance did so, “Doud dismissed the concerns and rarely authorized the termination of business with the customers,” according to the indictment.

The indictment further alleges that, from 2012 through March 2017, Doud and other members of RDC’s senior management “made the deliberate decision not to investigate, monitor, or report to the DEA pharmacy customers that it knew were diverting controlled substances for illegitimate use.”

The criminal information documents against Pietruszewski allege RDC identified 8,300 “orders of interest” that compliance “flagged as suspicious” but reported only four such orders to the DEA. Additionally, RDC opened new accounts for pharmacy customers without conducting due diligence as the company represented to the DEA had been done.

Compliance lessons

Pharmaceutical distributors and compliance officers should heed the following compliance lessons and warnings that both cases present:

Hire qualified compliance personnel. “That proved to be a major issue in the Rochester case,” says Callan Stein, a partner in the Health Sciences department at Pepper Hamilton. According to the complaint against RDC, at one point, “the primary individual responsible for managing compliance also performed a number of other time-consuming tasks, such as managing RDC’s warehouse and tracking inventory.”

Even when RDC expanded its compliance unit, it “hired unqualified personnel who lacked necessary qualifications and relevant experience,” the complaint stated. It cited one example of RDC hiring the “daughter of the company’s general manager to serve as a ‘compliance specialist,’ even though she lacked any prior pharmaceutical compliance experience.”

Implement adequate onboarding procedures. To assess whether prospective new customers might be engaging in diversion, compliance officers should conduct due diligence on the pharmacy’s operations, background, and recent dispensing patterns, for example. Moreover, ensure any sales staff involved in screening and approving new customers are not compensated for new customers enrolled, thus creating a financial incentive to ignore potential diversion activities. RDC failed in both these respects.

Compliance officers should consider the following other due-diligence best practices, as discussed in Miami-Luken’s testimony before Congress last year:

  • When considering whether to bring on a new pharmacy as a customer, do you verify whether that pharmacy was cut off from another distributor for suspected diversion?
  • What safeguards to you have in place to ensure your company is not bringing on a bad actor as a customer after they were dropped by a competitor?
  • Do the company’s systems have the capability to compare the number of pills it sends a pharmacy against the population of that region to spot red flags?

Conduct appropriate due diligence of existing pharmaceutical customers to guard against diversion. “A lot of it revolves around know-your-customer,” says Tom Gregory, global sector leader for Life Sciences and Health at EY.

Compliance officers may want to implement the due diligence best practices that are recommended in RDC’s civil settlement with the Department of Justice, including:

  • Conduct an on-site visit to the pharmacy and interview the pharmacist in charge;
  • Complete a report reflecting the findings based on this visit and interview and note any areas of concern;
  • Review recent dispensing activity data for the pharmacy to identify any red flags;
  • Determine whether the pharmacy or the pharmacist-in-charge has been subject to any disciplinary action, and, if so, the basis for the disciplinary action; and
  • Conduct a diligent inquiry to determine whether another distributor has previously suspended the pharmacy’s ability to purchase controlled substances, and, if so, the reason.

Enhance methodologies for calculating and establishing appropriate thresholds designed to detect potentially suspicious orders from pharmacy customers. Using RDC’s case as an example, thresholds should be based not only on the customer’s historical dispensing activity data, but also on the ordering patterns of comparable pharmacy customers.

Another best practice, as described in RDC’s settlement documents, is to “not fulfill any order that exceeds the customer’s threshold without conducting a thorough and diligent investigation to determine whether the order is suspicious and must be reported to DEA.” This investigation, which should be conducted by compliance personnel trained in detecting suspicious orders, should include “contacting the customer to obtain an explanation for the increase in ordering and obtaining and reviewing a report from the customer reflecting its most recent dispensing activity data.”

Do not ignore red flags. The allegations against RDC and Miami-Luken parallel each other in many important respects, particularly “actual knowledge of potential issues or suspicious behavior, coupled with a failure to act,” says Stein. In both cases, the issue was not that the companies did not have a DEA compliance program, but rather that they knowingly and willful ignored red flags that were identified, he says.

Generally, in healthcare fraud matters, prosecutors rarely go after compliance officers, Gregory says. In the rare instances when they do, it’s in cases where compliance officers didn’t just have a responsibility for the company’s compliance program, he says, “but that they somehow had a knowing hand in the conduct that is alleged.”

The high price pharmaceutical manufacturers and distributors are increasingly having to pay for their role in perpetuating the opioid epidemic cannot be overstated. After 50 years in business, Miami-Luken was forced to close its doors in January 2019 amid millions of dollars in mounting civil lawsuits.

For its part, RDC entered into a consent decree in which it agreed to accept responsibility for its conduct stipulating to an extensive Statement of Facts; pay a $20 million penalty; reform and enhance its Controlled Substances Act compliance program; and submit to supervision by an independent monitor. Assuming RDC’s continued compliance with the agreement, the government has agreed to defer prosecution for a period of five years, after which time the government will seek to dismiss the charges. The consent decree is subject to final approval by the court.