Blog - Titan Group

AI Is Watching Every Prescription You Fill. You Need Your Own AI Fighting Back.

Written by Jack Teitelman | 11/12/26, 3:17 PM

It's Tuesday afternoon. You place your usual controlled substance order. Before any person looks at it, software compares it with your purchasing history and with thousands of pharmacies like yours. It flags the order, holds it and cancels it. Nobody calls you. Then a letter arrives from your wholesaler: your controlled substance ordering has been suspended.

I spent my career inside the Drug Enforcement Administration. Today I spend my days with independent pharmacy owners who are fighting to keep their doors open, and I tell every one of them the same thing: the most immediate threat to your business no longer arrives with a badge. It runs on a server.

DEA hasn't gone away. But every controlled substance you buy and dispense is now scored, continuously, by automated analytics your own suppliers are required to run. Those systems are faster than any investigator, they don't know your patients, and their verdicts follow you to every other supplier you call. Most owners don't fully understand how this review works, how fast it can turn against them, or how hard it is to undo. This article is my attempt to change that.

The auditor that never sleeps

In 2022, the three largest drug distributors, McKesson, Cardinal Health and AmerisourceBergen (now Cencora), finalized a national opioid settlement worth roughly $20 billion. For pharmacies, the part that matters is the injunctive relief: court-ordered rules for how these companies must monitor their customers. Those rules took effect on July 1, 2022, run for ten years, and turned your compliance into a data problem. Each distributor must:

  • Set a purchasing threshold for every customer, mostly using statistical models. Orders over the threshold are blocked, not shipped, and reported as suspicious.
  • Keep your threshold secret. Distributors can't share with you your thresholds, how they're calculated, or that you're getting close to one.
  • Run standardized red flag metrics against your purchasing and, where available, your dispensing data.
  • Collect updated pharmacy questionnaires every year, plus at onboarding, when you ask for a threshold increase, and whenever a concern comes up.
  • Report terminated pharmacies to an industry data clearinghouse and to their state within five business days.

Regulators are only starting to see how this works. In October 2024, Cardinal Health and the Healthcare Distribution Alliance explained it to California's Board of Pharmacy. When an order hits a threshold, it's held and cancelled, and the Board is notified. Board members were surprised that wholesalers can't even inform pharmacies how to raise a threshold.

What the machine sees when it looks at you

The settlement spells out the red flags distributors must apply to independent pharmacies. These are the inputs to the algorithm, and you should know them as well as their analysts do:

  • Ratio of highly diverted controlled substances to non-controlled prescriptions, overall and by drug family. The list includes oxycodone, hydrocodone, hydromorphone, tramadol, oxymorphone, morphine, methadone, carisoprodol, alprazolam and fentanyl. Gabapentin is treated as a controlled substance for these purposes.
  • Controlled substance growth that outpaces non-controlled growth.
  • High-risk formulations, such as hydrocodone 10 mg, hydromorphone 8 mg, alprazolam 2 mg and single-ingredient buprenorphine.
  • Out-of-area patients and prescribers, including top prescribers more than 50 miles away.
  • Cash payment rates for controlled versus non-controlled prescriptions.
  • Prescriber concentration, such as five or fewer prescribers writing more than half of your highly diverted prescriptions, or one prescriber writing the same high-dose script for many patients.
  • Disciplinary history of the pharmacy, its pharmacists or its top prescribers in the past five years.
  • Termination by another distributor.

Add the dispensing red flags DEA emphasizes in its own cases: early refills, "trinity" combinations of an opioid, a benzodiazepine and a muscle relaxant, patients traveling long distances, and multiple patients from the same address. Together, that's the profile the system builds of your pharmacy every time you place an order.

Why a machine is more dangerous than an investigator

A DEA investigator shows up, asks questions and listens to the answers. An algorithm does none of that.

  • It never stops. An inspection happens every few years. The algorithm reviews every order you place.
  • It has no context. It doesn't know a nearby chain store just closed or a hospice opened down the street. It sees a spike.
  • It's invisible. You can't see your threshold, and no one is allowed to warn you that you're getting close.
  • Its verdict travels. A flag becomes a suspicious order report to DEA and your state. A termination goes to a clearinghouse that every other distributor checks.
  • It doesn't forget. It takes one order to get restricted. Getting reinstated takes a new review you have to win.

The cascade: how one flag becomes many

Here is the sequence I see again and again.

  1. The algorithm trips. Maybe oxycodone orders jump after a nearby chain store closes and its patients come to you. Maybe a new pain prescriber opens in your area, or you see a cluster of cash patients. Your explanation may be completely legitimate. The analytics don't know that.
  2. Suspicious orders go to the government. Under the SUPPORT Act (21 U.S.C. 832) and 21 CFR 1301.74(b), distributors must report orders of unusual size, frequency or pattern to DEA's central suspicious order database. Under the settlement, those reports also go to the states.
  3. Termination goes to the clearinghouse. If the distributor decides you can't maintain effective controls against diversion, it cuts you off and reports you to the clearinghouse and your state within five business days.
  4. The other distributors take notice. Each of the other big-three distributors must consider terminating a customer that another distributor cut off for suspected diversion, and document why if they keep you. Every onboarding questionnaire also asks whether you've ever been terminated. One restriction follows you everywhere.
  5. Your backup supplier may not stay for the year. A secondary wholesaler suddenly sees your controlled substance volume shift onto it, which is exactly the abnormal pattern its own system is built to flag. A backup that says yes in month one can reassess in month three.
  6. The year ends, but reinstatement isn't automatic. Many owners assume ordering resumes when a one-year suspension is up. In practice, reinstatement is a new due diligence review you have to win: a drill-down into your ordering and dispensing, a written explanation for every unusual pattern, and often another inspection.

Where does DEA come in? Suspicious order reports, clearinghouse and state reports create a ready-made profile of your pharmacy. In my experience, a pharmacy that has just been terminated and is moving volume between suppliers can easily become a lead for investigators looking for their next case. The restriction is often the beginning of the problem, not the end of it.

Small gaps become big cases

I say this to every client, with respect: every pharmacy has small imperfections. A biennial inventory done a day late. A DEA Form 222 with a missing entry. A red flag your pharmacist resolved by phone with the prescriber but never wrote down. A prescription monitoring report filed after your state's deadline. These are paperwork gaps that any honest operation accumulates.

The danger is what happens when the algorithm flags you and those gaps meet a distributor review or an investigator. Under 21 CFR 1306.04, your pharmacist shares a "corresponding responsibility" with the prescriber to make sure each controlled substance prescription is for a legitimate medical purpose. If a red flag's resolution isn't documented, an investigator will treat it as if it never happened. An undocumented judgment call looks exactly like a pharmacist who didn't care.

The goal isn't perfection. The goal is defensibility: written protocols your staff actually follow, and a record showing that for every flagged prescription, someone noticed, asked, decided and wrote it down.

Chains have their own machines. You don't.

Since April 2025, Walgreens (up to $350 million), Walmart ($50 million) and CVS ($315 million) have settled federal allegations that they filled invalid controlled substance prescriptions. In the CVS case, DOJ cited excessive opioid quantities, early fills, trinity combinations and pill-mill prescribers: the same red flags your wholesaler is measuring you against right now. All three companies denied wrongdoing, and the settled claims remain allegations.

All three kept operating. Part of CVS's remedy was an agreement with DEA to monitor its own dispensing patterns. Meanwhile, the distributor settlement applies its red flag metrics "at a minimum" to independent pharmacies, while chain customers can have those metrics adjusted to fit their business model. An independent with one bad quarter can lose its controlled substance supply for a year, with no guarantee of getting it back.

The chains also have what you don't: their own data teams. And on the other side of the table, McKesson says its controlled substance monitoring team numbers about 90 people, including former DOJ lawyers, former DEA agents and investigators, data analytics experts and pharmacists. That's who is reviewing your pharmacy. Who is reviewing it for you? For most independents, the answer is the owner, at 9 p.m., after the store closes. That's not a fair fight.

Fight AI with AI: your Patriot missile defense

Inside TITAN Group, we describe the situation this way. Every independent pharmacy is under a constant barrage of incoming fire from automated analytics: statistical models and increasingly AI-driven systems that score your risk every time you place an order. Like hypersonic missiles, they move faster than any owner can track and arrive with almost no warning. By the time you see the impact, a suspension letter is already on your desk.

You can't stop the distributors from running these systems. The settlement requires them. But you can stop fighting machines with a clipboard. You need your own battery: analytics that see your pharmacy the way their system does, and experienced investigators who know what to do about what they find.

That's what TITAN Group and the SageComply Pharmacy Oversight Program provide together. SageComply brings the analytics. TITAN brings the DEA experience. You get:

  • A view of what their system sees, before it sees it. SageComply runs your purchasing and dispensing data against the same kinds of red flag logic distributors use: controlled-to-non-controlled ratios, high-risk formulations, prescriber concentration, cash rates, distance and growth trends.
  • Early warning on threshold risk. Distributors aren't allowed to warn you that you're approaching a threshold. SageComply helps you spot volume shifts in time to document the reason and request a threshold review the right way.
  • Corresponding responsibility documentation: structured records of how your pharmacists identified and resolved red flags, including prescriber contacts, turning undocumented judgment calls into a defensible record.
  • The human judgment the algorithm lacks. TITAN's former DEA professionals read your data the way a distributor's compliance team or an investigator would, then build defensible protocols and SOPs for how your pharmacy actually operates.
  • Independent third-party oversight. Quarterly oversight reports that can be delivered to your supplier, and to DEA where appropriate, as evidence of exactly what distributors are trying to verify: that you maintain effective controls against diversion.

How the program works

  1. Connect your data. Your controlled substance purchasing and dispensing data is brought into SageComply's analytics platform.
  2. Baseline deep dive. TITAN Group conducts a DEA-style mock audit, powered by SageComply reports, so you learn where your ratios, prescribers, payment mix and patient patterns stand, and what needs fixing.
  3. Fix the gaps. TITAN Group helps you put defensible protocols, SOPs and documentation practices in place.
  4. Ongoing monitoring. SageComply analytics track your controlled substance activity continuously, flagging threshold risk, unusual volume shifts and red flag patterns early enough to document and respond.
  5. Quarterly independent reports document your oversight for your supplier and, where appropriate, DEA.
  6. Ready for every review. When your annual KYC questionnaire, a threshold request or a distributor inquiry arrives, your data and documentation are already organized. And if a restriction does happen, TITAN Group already knows your pharmacy and can move immediately, working with your counsel toward reinstatement or a new supplier.

A Patriot battery doesn't wait for the missile to hit before it responds, and your compliance program shouldn't either. Their analytics are looking for reasons to cut you off. Yours should be building the record that shows why they shouldn't.

Dozens of pharmacies now subscribe. Some came to us after a restriction. Others signed up proactively, before anything went wrong. The proactive ones are the model I want every independent pharmacy in America to follow. It's far easier to show a distributor two years of clean, documented oversight than to rebuild your credibility after a termination letter.

I'll be direct. Subscribing doesn't guarantee that a distributor will never restrict you, and no honest consultant will promise that. But you're being measured by a machine every day. The only question is whether you're measuring yourself too.

What to do now: a checklist for pharmacy owners

  1. Know your numbers. Calculate your controlled-to-non-controlled ratio, top-prescriber concentration, cash percentage and out-of-area share for highly diverted drugs. Update them monthly.
  2. Document every red flag resolution. Who you called, what you learned, why you filled or refused. If it isn't written down, it didn't happen.
  3. Watch for volume shocks. Chain closures, new prescribers and drug shortages can push you over a threshold you can't see. Document the reason before the order is placed.
  4. Keep prescription monitoring reporting tight. Know your state PDMP's reporting deadline and meet it every time. Late reports are an easy finding.
  5. Prepare for your annual KYC review now. Have your top-ten prescriber list, specialties, payment mix and patient ZIP code data ready before the questionnaire arrives.
  6. Answer distributor requests completely and on time. Failing to provide data or cooperate is itself grounds for termination under the settlement.
  7. Line up a secondary supplier before you need it, knowing it will run its own due diligence.
  8. Put your own analytics and independent oversight in place before a restriction, not after.

Let's talk before the letter arrives

If you own or manage an independent pharmacy anywhere in the country, I'd like to hear from you. Whether your record is clean and you want to keep it that way, or you've already received a letter, the time to act is now.

The algorithms are already running, and the missiles are already in the air. The only question is whether your defenses are in place when they arrive.

Jack Teitelman Founder & CEO, TITAN Group jack@titangroupdea.com | 347-723-8019 | titangroupdea.com

 

About the author: Jack Teitelman is the Founder and CEO of TITAN Group, a regulatory compliance consultancy focused on DEA and controlled substance matters. A former DEA career professional, Jack advocates for independent pharmacies, helping them build defensible controlled substance programs, prepare for distributor KYC reviews and DEA inspections, and recover after supply restrictions. TITAN Group works with and recommends the SageComply Pharmacy Oversight Program for independent pharmacies nationwide.

Sources
View full post