Dear CEO Letter: Thefts and Losses of Electronic Medical Record (EMR) Official New York State Prescription (ONYSP) Forms

October 31, 2011

Dear Chief Executive Officer:

This letter is written to advise you that the Department's Bureau of Narcotic Enforcement (BNE) has identified a significant number of thefts and losses of Electronic Medical Record (EMR) Official New York State Prescription (ONYSP) forms. ONYSP forms are being stolen primarily from New York City (NYC) Health and Hospitals Corporation (HHC), but other hospitals in the NYC metropolitan area have been affected as well. The forms are being used to illegally obtain controlled substances both in New York State and out of state, and may be part of an organized effort.

While the ONYSP forms contain security and tamper resistant features, once stolen, they are being distributed to organized groups who will print, using common computer software and printers, a facility's or practitioner's name on the form. These fraudulent prescriptions are then used to obtain controlled substances. The primary drug of choice for these counterfeit prescriptions has been oxycodone (e.g. Roxicodone, Oxycontin). The street value of a single Roxicodone 30 mg tablet ranges from $25 to $35 each. The forms themselves have a street value of $100-300 per prescription.

While hospitals have systems in place to assure the security of controlled substances, the Department strongly recommends that similar protections be applied to the security of the ONYSP forms to prevent theft or loss. The Department asks that each hospital take immediate steps to review policies and systems concerning ONYSP receipt, storage, security and distribution. In particular, hospitals should address the following common system weaknesses identified through the Department's investigative activities:

  1. Distribution: Theft is most likely to occur once the ONYSP forms leave secured areas (e.g. pharmacy) in the hospital and are distributed to patient care areas. Once delivered to inpatient floors or outpatient areas, security of the forms themselves is variable. Storage of the forms should be in a secure area or in locked printers that are monitored by personnel or video surveillance.
  2. Printer security: Locked printers are preferable, however, policies need to support routine manual checks of the printers to assure that they remain locked and/or have not been tampered with. Ideally, printers should be located in areas where they can be observed by staff and/or monitored by video surveillance.

Please refer to the complete list of vulnerabilities attached to this letter.

In accordance with 10 NYCRR Section Part 910.5(a)(2), reporting the loss or theft of ONYSP forms to the Department is required. The mechanism for reporting is to complete and submit the Department of Health form DOH-4387, available at the following link: http://www.health.ny.gov/forms/doh-4387.pdf. Once completed, the form may be mailed or faxed to the Bureau of Narcotic Enforcement using the following information:

  • Bureau of Narcotic Enforcement
    433 River Street, Suite 100
    Troy, NY 12180
    Phone (518) 402-0707
    Fax: (518) 402-1058 or (518) 473-2698

Thank you for your prompt attention to this serious matter. Should you have questions, please contact Thomas Behanna, Acting Director, Bureau of Narcotic Enforcement at (518) 402-0707.

Sincerely,

Richard M. Cook
Deputy Commissioner
Office of Health Systems Management


System Vulnerabilities

Please review the following list of common vulnerabilities as you review your hospital's receipt, storage, security and distribution policies and procedures. Staff should be aware of these policies to assure that the security of ONYSP forms is maintained.

  • Improper storage of prescription forms
    • Adequate safeguards are not in place;
    • Poor inventory control;
    • Lack of entry and departure records/access should be limited;
    • Unsecured printers.

Recommendation: Review and update current procedures as needed to assure that security is maintained at all times, but especially, once forms are distributed to patient care areas.

  • No centralized area/person for accountability.

Recommendation: Appoint a person who is responsible for maintaining the security of the forms.

  • Poor accountability when receiving or transferring prescriptions.
    • Lack of documentation of received serial numbers;
    • When transferred to off-site locations, serial numbers are not documented;
    • Poor accountability when distributing within the facilities;
    • Use of non-vetted employees as couriers of prescriptions;
    • Use of employees with criminal records.

Recommendation: Tighten procedures for the distribution of forms and for maintaining accurate logs of serial numbers. Once distributed, staff must ensure proper security when stored in a patient care area.

  • Written policies need to be created or enhanced.
    • Storage policies;
    • Inventory/reconciliation policies;
    • Safeguarding policies;
    • Loss/stolen polices.

Recommendation: Review and update policies regarding receipt, storage, security and distribution of forms in the hospital.

  • Excess ordering by facilities.
    • Stock piling should not occur. Inventory needs to be managed.

Recommendation: Avoid ordering excessive quantities of ONYSP forms. Greater inventory creates greater potential for theft and loss.

  • Lack of video surveillance.
    • When video surveillance is in place, there is often a lack of review by security personnel;
    • Lack of video maintenance past 30 days.

Recommendation: Routine maintenance of video equipment and review of video surveillance to assure adequate monitoring.

  • Poor loss reporting from hospitals to BNE.

Requirement: Prompt reporting of lost or stolen forms to the Bureau of Narcotic Enforcement via DOH-4387 is required.