Analyzing Opioid Abuse, Fusing Data, and Exposing Real World Patterns

Note: All results presented in this article are personal observations and interpretations based on the values contained in the available data and do not necessarily imply or implicate any person, business, or entity is involved in any wrongful or unlawful behavior or operation. All data is obtained from open-source and the quality is not guaranteed.

Introduction

Over the years, I’ve had the opportunity to analyze large numbers of data sets from a wide range of disciplines. Although I tend to favor discovering financial crimes (T.R.A.C.) and exposing money laundering activities (SAR/CTR/MSB) for investigating human trafficking, narcotics distribution, or terrorist operations, I also appreciate working on disclosing other types of “find-the-bad-guy” situations, especially dealing with fraud, waste, and abuse. This topic covers an extremely broad-spectrum including warranty/refund statements, insurance claims, and other improper payments, especially in Government agencies, programs, and entitlements such as Medicare, FEMA, SNAP, IRS, HUD, SSI, etc.

Although the COVID-19 pandemic currently dominates the mainstream media and the Paycheck Protection Program (PPP) already has numerous reported frauds and misrepresentations, another epidemic, the opioid epidemic, has been steadily growing for the past two decades. By one estimate (https://www.whitehouse.gov/articles/full-cost-opioid-crisis-2-5-trillion-four-years/) it cost $696 billion in 2018 ($2.5 trillion 2015-2018) with over 47,000 deaths. Since the late 1990s, prescription opioid pain drugs have steadily infiltrated our society and taken the lives of over 750,000 people, decimated families, ruined careers, and degraded our nation (https://www.cdc.gov/drugoverdose/data/index.html)

In the past, I’ve analyzed Prescription Drug Monitoring Programs (PDMP) data that tie together the doctor (provider/prescriber), pharmacy (fulfillment), and patient (member/consumer). These systems collect transactional-level data on all prescriptions for a Schedule II drug such as Amphetamine (Dexedrine, Adderall, Obetrol), Fentanyl (Duragesic, Oralet, Actiq), Methadone (Dolophine, Methadose, Amidone), Methamphetamine (Desoxyn, Crack, Speed), Opium, and Oxycodone (OxyContin,Percocet, Endocet, Roxicodone).

The PDMP analytics for a large mid-Atlantic state revealed, in a year’s span, people filling multiple prescriptions (one individual had over 350 prescriptions), others using multiple doctors (one used over 180 doctors) or multiple pharmacies, and various other patterns, commonalities, and collusions. Temporal analytics showed filling prescriptions multiple times in the same day or week. Spatial analytics revealed the long distances traveled by some patients (over 50 miles) from their home addresses to the doctor’s office/facility. There are many “red flag” indicators that are used by pharmacies and LEA to help spot abuses. Ref: https://www.chapmanlawgroup.com/dea-red-flags/

• The practice is cash only.
• It does not bill insurance.
• The practice has a high number of out-of-state patients.
• It has a high proportion of Schedule II and III narcotics relative to legend drugs.
• Patients travel long distances to fill prescriptions or receive treatment.
• There is a high number of family members in a pain management practice.
• It has a lack of interventional techniques or physical therapy.
• The practice has a high number of “doctor shoppers.”
• There’s a high number of patients per day (i.e., 30-40 versus 15-25).
• The office does not appear as a “typical” medical practice.
• Office does not have equipment such as exam tables or blood pressure monitors.
• The office is open during unusual hours.
• The practice has limited support staff - no nurses, medical assistants or NP on staff
• The provider is not board certified, or practices outside of his/her specialty (i.e., a general practitioner practicing pain management).

Other red-flags for pharmacies as identified by DEA include: https://www.deadiversion.usdoj.gov/mtgs/pharm_awareness/conf_2017/presentations_2017/carrion.pdf

• Prescriptions for large quantities of a “cocktail” or “holy trinity” of opioids, benzodiazepines, and carisoprodol
• Diagnosis of “lower lumbar pain” (90% of pill mill doctors use this diagnosis code)
• Pattern prescribing (prescriptions for same drugs and quantities coming from one prescriber)
• Shared addresses by customers presenting prescriptions on the same day
• Customers going to pharmacy counter with dilated pupils and difficulty concentrating
• Physical distance between the doctor, patient, and pharmacy
• Patients paying in cash or sometimes using insurance and other times cash
• Prescriptions done in “factory-like” manner—no reason to prescribe 15 mg AND 30 mg oxycodone because 30 mg tabs are scored down the middle
• Patient uses medicines from multiple physicians or filled at multiple pharmacies (from PDMP) Inordinately large quantity of controlled substances prescribed
• Prescriptions refilled at inconsistent intervals based on quantity
• Use of street drug name by patient or prescriber
• Suspicion of forged or altered prescriptions
• Suspicion of forged or altered ID, or refusal to provide

There is also a well-produced video that presents different situations and examples of these red-flags sponsored by the National Association of Boards of Pharmacy (NABP) and the Anti-Diversion Industry Working Group (ADIWG). Although some of these flags are physical observations (e.g., dilated eyes, use of street language, group activity, handwriting styles) the goal would be to automate all data-related contents into a reliable workflow to automatically identify high-risk behaviors.

Automation of Reports and Consolidated Orders System - ARCOS

More recently, and the focus of this post, deals with the data collected by the Drug Enforcement Administration (DEA) with an application on identifying opioid distribution abuses. DEA maintains a data collection system called ARCOS (Automation of Reports and Consolidated Orders System) where manufacturers and distributors report their controlled substances transactions to the buyers represented by pharmacies, hospitals, medical providers, practitioners, and nursing homes.

The information in ARCOS is collected on DEA Form 222 or using the Consolidated Substance Ordering System (CSOS) and includes the name, DEA number, address and business activity of every seller/manufacturer (reporter) and buyer of a controlled (Schedule I or II) substance in the United States. The database also includes drug codes, transaction dates, and total dosage units and grams of narcotics sold.

As a side note, DEA registration numbers, required to handle Schedule I/II drugs, have a specific structure and an “encoding” with an embedded “check digit” – similar to the Luhn formulas used for credit-card numbers. This provides another analytical checkpoint to validate the DEA number along with the registered owner to determine if there is match or an inconsistency. For an overview the DEA number, please review the Wiki entry: https://en.wikipedia.org/wiki/DEA_number. In the diagram below, a single DEA number is valid (check digit is correct) however, it is used by two different providers – which is the correct one? In this case, VOYTEK is the owner since the second digit (letter) of the number is a “V”

Normally, the ARCOS data is not available to the public, however, the Washington Post and HD Media (Charleston Gazette-Mail and The Herald-Dispatch in West Virginia) pursued access to this data based on an ongoing, multidistrict litigation against manufacturers and distributors of prescription opioids. They waged a year-long legal battle for access to documents and data and on July 15, 2019, U.S. District Judge Dan Polster lifted a protective order restricting access to the ARCOS database. The Washington Post published a large portion of this data so others could review, evaluate, and analyze its content. Initially, it covered 2006-2012 but was later expanded to include 2013 and 2014. The ARCOS data and several interactive visualizations are available on this site:

https://www.washingtonpost.com/graphics/2019/investigations/dea-pain-pill-database/

The initial download (2006-2012) contained 178,598,026 total records with:

• Reporter DEA numbers = 656
• Buyer DEA numbers = 148,588
• Order Numbers = 21,364,017

Just as banks are held accountable to report suspicious financial transactions via the Bank Secrecy Act (BSA) laws, the same holds true for those manufactures and distributors of Schedule I/II drugs; orders appearing suspicious due to the size or frequency must be reported to the DEA and the shipments should be held back until authorized. Although similar in context, the red-flag indicators previously discussed for PDMP don’t apply directly to ARCOS since it shows transactions among manufacturers and buyers. So, the question becomes what is important in the 200M records?

Before answering that question, I must state I’m not a medical doctor, healthcare practitioner, law enforcement professional, or lawyer. I do not have any oversight or regulation experience, prior case knowledge, or familiarity in regard to the prosecution of opioid distribution crimes, compliance, or misrepresentations. I am not familiar with the process for ordering opioids, the systems, the intricacies, or their nuances. I am not versed on the regulations and laws controlling opioids. The discussions and observations are made based on available data and a reasonable interpretation of their meaning in the context of the analysis. My findings are entirely subject to scrutiny, review, discussion, and of course, correction.

The following diagram, created by the Washington Post, shows the distribution of opioids-per -person for each county in the United States. The darker colors represent heavier concentrations clearly shown in certain regions including West Virginia, Kentucky, and Tennessee. These are reasonable starting-points to see any unique or distinct patterns of usage or abuse.

Opioid Analytics

The first step in analyzing the data is to get it loaded. All calculations, visualizations, charts, and outputs were generated using DataWalk (Version: 3.13.3.0). For this example, all the data for Tennessee, which consists of 10,490,850 unique records, was downloaded from the Washington Post site and loaded directly into DataWalk. Since there is no conversion or transformation required to load data (e.g., no proprietary formats or fixed ontologies), it took less than 5 minutes to ingest and process. From this load, there are 235 Reporters, 3,868 Buyers, and 619,558 Order-Forms and if new data is loaded/updated, the system automatically parses the different values into their respective sets.

DataWalk uses the “Universe Viewer” (UV) to present the structure of the data (sets/connections), the record counts, and allows the user to quickly filter the content on any of the original 46 fields. Thus, it is easy to search for a specific value (e.g., Buyer-Name = “ABC Pharmacy”) or be more proactive and discover activity related to a specific area, drug type, dosage strength, or any combination of values. From the UV, the use of histograms (e.g., facets) to display the breakdown of values for any field.

Shown below are representative examples where it is easy to see the “top” 4 or 8 or 12 values. Notice that that top Buyer-County of Shelby does not contain the top two Buyer City values (Knoxville or Nashville) – as Memphis is the largest city in Shelby County and ranked 3rd in the overall Buyer-City records. Also, for Reporter-State, most of the opioids are coming from distributors within Tennessee or from nearby states. Simply looking at these numbers can start to reveal certain trends, biases, and help guide the subsequent analytics.

The ARCOS data is fairly consistent and clean and without too many data quality issues. However, there are still several transformations and value-added calculations required for enhancing the data and improving results. The map previously shown correlates the volume of pills distributed for the individual buyers and then aggregated by county. However, to determine the number of pills-per-person requires the addition of external data, namely the population for the area of interest, To provide nationwide coverage, a search for Census data showing the population-by-zipcode returns ample results. Note: there are many demographic dimensions (income, education, etc.) one could utilize in the analyses to focus on specific patterns.

It should be noted that when the ARCOS data was loaded, it was geocoded through online services available within the DataWalk App Center. The App Center allows external calculations (statistics via R), federated queries to subscription services (Lexis/Nexis, TU/TLO, Whooster, ShadowDragon, DarkOwl), or call-outs to third party systems/libraries (Rosoka/NLP, TensorFlow/ML, or H20/AutoML). New apps are easily created to ensure the system remains extensible to meet a wide range of user needs.

The integration of the Census data is very straightforward. The file downloaded from the Internet is a basic CSV file with two fields: zipcode and population. It is dragged/dropped into the UV display (shown with a yellow-geomarker icon) and then connected to the buyer set by matching on the zipcode contained in its address. Once completed, the corresponding population value is available as a field for any buyer for use as a filter, label, or visual indicators. Also, this set can be “hidden” from the UV so it does not clutter the display with referential sets that may not be accessed directly.

Small Population / High Pill Count

Discovering patterns does not necessarily require high-end algorithms, supercomputers, or artificial intelligence. Many inconsistencies, anomalies, collusive networks, or suspicious behaviors are quickly exposed using “common sense” patterns. Users can try different “what if” scenarios and “look around” the data to identify situations that don’t make sense or are unusual. For example, the same DEA number being used by multiple providers, a common address among different pharmacies, or a shared phone number.

At this point, specific queries and filters are applied using the population data. For the 3,868 unique buyer names, the population histogram delivers the breakdown counts for the different clusters (10,000 is the default size) showing the majority of the zipcodes falling in the 10,000 to 49,000 range. Selecting the 0-9999 facet reduces the set down to 554 entities and the histogram regenerates to show the new distribution of the population for the selected range.

In parallel, all other histogram facets are being updated based on this selection. Of course, if specific values are required for the filters, verses the facet categories, the user has the option to enter a value using a built-in filter-command. Additionally, filters are easily changed, updated, or deleted to reflect the needs of the investigation. All applied filters are shown along the top of the UV as a sequence of breadcrumbs so the user knows exactly the status of their inquiry. The next step taken selects the number of pill distributed from the buyers. The Pill # histogram shows the before-population and after-population selections.

The demarcation level for distribution is set at 25,000 pills. Each facet is individually selected or the built-in filter set at >= 25,000. The net-net result is that 24 buyers match the conditions for having a small population (< 10,000) with a large pill distribution (>25,000). Keep in mind that the total pill count for each buyer is automatically calculated by the system when the data is loaded. So, these results will change as new records are introduced.

These 24 results are selected and presented in a Table View – basically, a widget that looks like a spreadsheet to display all of the field values and allows the user to move, sort, and filter the columns. It is also an interface to export the results into an Excel or CSV format if they are shared with external users. In the following screenshot, the top ten results, sorted by population, are shown.

What’s important to note, the grey colored column (BUYER_NAME) comes directly from the raw data and the blue colored columns are derived (calculated columns) generated directly by the system. PILL# represents the total aggregate of pills combined from all the individual ARCOS transactional data records. POPULATION is appended from an external set as previously described and used to sort these results. TOTAL-TRANS# is the number of distinct ARCOS records for the buyer. REPORTER# provides how many unique reporters (e.g., manufacturers and distributors) the buyer uses across all transactions.

There is a lot of content presented in these 5 columns and interpreting their meaning is critical to prioritizing the analyses. Different combinations of values produce different interpretations. Simple ratios and comparisons of pill#/population, trans#/population, or pill#/trans# provide various insights to yield alternative results and when fed into a machine learning module can help automate various reasoning and classification needs [to be addressed in a future article]. For our analytical purposes, low-population with high-pill distribution is a good start.

REPORTER# is an interesting field as it defines the number of unique and distinct distributors used by the BUYER to purchase their opioids. In much the same manner as a money launderer tries to layer/structure their ill-gotten proceeds across multiple banks in an attempt to hide their behaviors from detection, this concept also applies to opioid distribution. Why would a pharmacy or provider need to utilize 15, 20, or 25 different distributors to fulfill their opioid purchasing needs? It doesn’t make sense, and therefore, it is something that needs review.

In this example, the top 5 buyers operating in the lowest population areas are all pharmacies (vs nursing homes, individual practitioners, etc) with one representing a national chain. On a side note, many of the major chains like CVS, Walmart, Rite Aid, and Walgreens state they are legally fulfilling the prescriptions written by licensed physicians and healthcare practitioners and put much of the blame of the opioid crisis on independent pharmacies, pain management clinics (pill mills), and internet pharmacies. The remaining 4 entries are selected and presented in a link chart.

The icons, labels, and glyphs convey information to help understand the nature of the entity. The label shows the name, address, trans#, reporter#, pill#, and the DEA number. The orange exclamation-glyph is used to flag entities distributing over 25,000 pills and yellow if over 50,000 pills. These label-parameters are highly configurable and can present any data-values to the analyst. The next step is to expand the network to show their respective reporters/distributors.

Previously, it was disclosed there are a total of 656 reporter DEA numbers in the entire ARCOS set. Naturally, there is a finite number of manufacturer and wholesale distributors operating in this space and therefore we’d expect to see a reasonable amount of “commonality” in the reporters used within a defined geographic area. In this case, the two buyers (Jellico and Okies) with the largest number of reporters also have an unusually high level of overlap using the same reporters (highlighted in the diagram). Clearly, the national suppliers including Cardinal Health, ANDA Pharmaceuticals, and The Harvard Drug Group supply a lot of buyers across the country and are easily justified. However, based on the diagram below, there is common use of smaller distributors which may indicate some type of collusion. For example, Bloodworth Wholesale Drugs only has 17, SAJ Distributors has 74, and Generics Bidco has 112. Note, the red-icon glyph on The Harvard Drug Group indicates a match to an existing DEA Diversion case.

Location Insights

The next logical step is to view the buyer locations on a map, as all the addresses were geocoded using an App-Center plug-in. Coincidentally, the two most northern buyers, Jellico and Okies, are approximately an hour apart (60 miles as the crow flies) with Knoxville as the nearest major city; perhaps there are other non-ARCOS commonalities among these two buyers? Other important observations show two buyers are located on the border with other states (Jellico with Kentucky and R&K with Georgia and North Carolina); potentially providing opioids to out-of-state buyers. Additional information can be gleaned from other systems such as Dun & Bradstreet (DNB) using their business-directory lookups to find the owners, estimated revenues, incorporation dates, and other tangible details.

Here is a quick summary for each of these buyer pharmacies.

Jellico Drugs has 30,053 pills in 11,951 transactions with a population of 3,126. Across the street from Jellico is the Family Drug Center, a large retail pharmacy with 22,420 pills in 7,391 transactions.

Okies Pharmacy has 33,908 pills in 9,168 transactions with a population of 3,732. The building next to Okies is the Cumberland Gap Medical.

R&K Pharmacy – DBA Tallent Drugs has 48,132 pills in 18,665 transactions with a population of 2,403.

Mike’s Pharmacy has 33,065 pills in 7,980 transactions with a population of 3,323. Tracy Clinic is also in the same building complex.

In doing additional research on this business, there are several articles detailing recent activities ongoing at Mike’s Pharmacy and makes for some interesting reading.

https://www.knoxnews.com/story/news/crime/2020/03/12/undercover-drug-stings-grundy-county-included-bogus-arrests/4863709002/

https://dksale.net/2020/02/02/the-frame-job-of-candy-myers-what-was-it-for/

The following statements are from these articles:

“…there was a clinic next door which prescribed many of the prescriptions being filled, and while she as well as the other employees were being told it was a separate business, the phone on the counter which had more than five lines told a different story. Two were answered Tracy Clinic, two to Mike’s pharmacy”

“…?folks who would congregate out front of the pharmacy, and money changing hands”

“…?the owner would come in and take substantial amounts of pills to a northern location”

“…?filling orders from people who traveled far”

“…the rubber stamp for doctor’s signature”

Or perhaps the most explicit indicator is when the DEA came in to shut them down since they were “…the number five buyer of Oxycodone for the state of Tennessee”

Although this is a very basic pattern (low population / high pill distribution), it shows the potential to quickly identify suspicious activities and high-risk conditions in only a few clicks on the mouse. It shows pharmacies located along a state border may warrant additional scrutiny. It exposes using multiple reporters is highly unusual and irregular behavior. It reveals additional facilities operating in close geospatial proximity potentially in a collusive manner.

Correlating the ARCOS data with other databases, open-source, social-media, and subscription services will expose bigger and more complex patterns. Each source adds additional dimensions to help identify circumstances that may show opioid distribution issues. There are a wide range of sources to consider.

Adding External Sources

ARCOS data provides considerable insight into the distribution of opioids to help identify questionable situations, potential abuses, and suspicious activity. Supplementing ARCOS with other sources, such as population (per Zipcode), exposes additional patterns and trends. In this environment, several additional sources were identified and brought into the analytical model. The following represent some additional sources included in this basic model:

• https://www.deadiversion.usdoj.gov/fed_regs/index.html. Department of Justice: DEA Diversion Actions. Registrant Actions - Administrative Actions Against Registrants. Comprised of approximately 550 documents that were manually curated from each year referenced in this section. A spreadsheet was created listing the date, entity-name, registration number (e.g., DEA number), city, state, and the direct URL reference. Matches to REPORTERS and BUYERS using both the name and DEA number.
• https://oig.hhs.gov/exclusions/index.asp. Health & Human Services (HHS) – Office of Inspector General (OIG). List of Excluded Individuals/Entities (LEIE). Approximately 73,000 entries for individuals, businesses, or practices that are excluded from participating in Federally funded health care programs due to fraud, misrepresentation, or other reasons. This list also imparts civil monetary penalties to anyone that hires someone referenced on this list. It has basic info including the name (first/last/middle and DOB) or business name, along with their address (street/city/state/zip). Some records contain an associated NPI number. Matches to BUYERS using the name or address or indirectly through a DEA/NPI lookup.
• https://npiregistry.cms.hhs.gov/. Health & Human Services. CMS National Plan and Provider Enumeration System (NPPES). Approximately 6,411,000 records with a long record structure (over 300 fields) to accommodate multiple/repeating values. Contains both active and deactivated National Provider Identifier (NPI) numbers; a 10-digit number used to uniquely identify health-care providers delivering Medicare services and is also used by commercial healthcare insurers. The contents include the provider's name, specialty (taxonomy) and practice address.
• https://data.nber.org/data/npi-dea-crosswalk.html. National Bureau Of Economic Research. National Provider Identifier (NPI) to Drug Enforcement Agency Number (DEA) Crosswalk. Provides a mapping of NPI and DEA numbers along with some other parameters and fields (city, states, types). This crosswalk helps to map disparate sources when NPI and DEA numbers are interchangeably used. Matches BUYERS (via DEA #) to LEIE (via NPI #).

There are many more sources to consider depending on the baseline analytics required. Some additional sources might include:

• Medicare Provider Utilization and Payment Data: Part D Prescriber
• Open Payments Data – CMS Covered Recipient Physicians – NPPES data
• State pharmacy registrations and licensing systems
• Weather / Demographics
• Crime/arrests/discipline sets
• Social Security Death Master Index (SSDMI)
• Prescription Drug Monitoring Programs / MethCheck

Defining the Rules

In the previous example, the conditions used to identify the pharmacies relied on two basic parameters; Population < 10,000 and Pill # > 25,000. The conditions are tracked by the system and explicitly shown throughout the analysis. The evaluation of the four pharmacies (from the original 24) along with some open source (OSINT) research showed there could be reasonable concern regarding their operations.

These analytical query sequences, called workflows, are saved and used like “easy buttons” to generate reports, identify changes in the data, re-run analytics, share with other users, set-up alerts, and use in risk-scores. Over time, the system “gets smarter” as more workflows are created and saved. This builds-up a library of domain knowledge for situations and circumstances that might go unchecked using traditional reporting or manual analytical methods.

A workflow may span several data sets, filter on distinct values, and aggregate content, including imported or calculated data. Each workflow can contribute a value (positive or negative) to a risk score, presenting a list of the most active or suspicious entities, automatically. It can be based on the combination of dozens or hundreds of workflows that are customized to meet specific mission objectives. These are some workflow examples using the ARCOS and related sets:

• Is a DDS – Dentist
• Is a DVM – Veterinarian
• Uses out-of-state REPORTERS
• Is on the LEIE exclusion list
• Is matched with a DEA Diversion report
• Uses large number of REPORTERS > 10
• Has excessive pill distribution > 25,000

When used to create a risk-score, each selected workflow has an associated weight. For example, being a DDS might be weighted low with 5 points and being on the LEIE exclusion list might be weighted high at 25 points. The weights for any entity are aggregated to produce a composite score. As seen in the snapshot below for the top 10 Tennessee ranked buyers, Okies Pharmacy has a score of 60 based on the weights for each of the workflows it triggered and Jellico Drug Store has a score of 55 as a different set of workflows are triggered. Each column represents a workflow and a check-mark indicates the entity resulted in a positive response to the filters and conditions defined for that workflow. Any set can have multiple risk-scores created to address specific needs or requirements.

As new patterns are detected or as new types of data are integrated into the platform, the risk-scores are easily updated to accommodate these changes. Any set can have multiple risk-scores where each uses different weights or combinations of workflows. The results are updated anytime there is a change in the data and “alerts” are configured to trigger and generate notifications. Thus, a designated analyst is assigned the task of reviewing the highest, say 10%, of scores to validate their content and perform a triage for related data and results before committing to any follow-up investigation. All of this is tracked by the system or passed to external case-management tools (e.g., Avocette – Sohema) to ensure completeness and consistency in the overall process.

Network Anomalies

As previously discussed, the data collection for ARCOS comes from DEA Form 222 or online through the CSOS program, the only method for ordering Schedule I and II controlled substances electronically. The Form 222 provides for up to 10 line items while CSOS does not have any line item limit on a single order. https://www.deaecom.gov/csosmain.html. The available data was collected from 2006 through 2014 and for Tennessee, it provides 10,490,850 transactions (line items) which are derived from 619, 558 unique order forms. It was noticed that those order numbers with an “X” in their sequence are used by multiple distributor/buyer combinations [unsure why] and are excluded from these analysis therefore resulting in 569,692 orders. Finally, a filter is applied to the calculated column called TRANS# for the ORDER-FORM set to show only those orders exceeding 10 transactions.

This results in 1,475 orders that meet these conditions. Unfortunately, these results also expose some data-quality issues, namely blank/null order numbers or those with 000000000 or 999999999. Normally, these results are excluded, however, there are “thousands” of instances which means that DEA can’t accurately track these orders. This is a serious issue and should be evaluated to determine if it’s a bug/error in the database or collection instruments, a training issue for the buyer/sellers, or intentional misrepresentation. Selecting the top 50 (including 999999999) results generates the following diagram.

The goal of this analysis is to spot anomalies in the network based on those buyers and reporters having excessive numbers of orders where the line items exceed 10 transactions. If a single object is selected and expanded from this result, it will generate a considerable number of linkages (as shown below) since the ORDER-NO is directly linked to each ARCOS TRANSACTION which are linked to their respective BUYER and REPORTER objects. Using this approach, the charts get extremely busy and the patterns very difficult to discern.

Using a unique linking feature within the DataWalk system provides an effective way of working with transactional data without overwhelming the display. Creating “2nd Degree” connections, also referred to as flows, aggregate the transaction objects between two sets as a relationship. In the configuration menu, you simply select what sets to include, along with directions, colors, and arrowheads.

Using flows, the same diagram previously shown is now simplified and reflects a much easier to understand chart as depicted below. The REPORTER (Blenheim Pharmaceutical) has 22 transactions through ORDER-FORM (115933663) with BUYER (David Bowers, MD). The thickness of the links is relative within the chart (thicker=more connections).

Right clicking on either link (green or blue) allows you to drill down on these transactions and see the underlying detail. The sample below shows a several of the transactions for this ORDER-NO. All the columns for the 22 records are available for review including the strength, pill types, and other details. In this case, it is interesting to see all of the transactions have a correction reference as this might be something to further evaluate at a later time.

Expanding all of the initial 50 ORDER-NO (minus a few of the egregious data errors) results in a chart with only 8 discrete networks, as shown below. Simply looking at the structures of each of these networks conveys a considerable amount of details.

1. There are 2 small networks (bottom-center) comprised on a single ORDER-NO. These are low priority since they only happened once between the designated parties
2. The largest network in the center shows a single REPORTER (Cardinal Health) distributing to large pharmacies, primarily CVS and Kroger. There are some with multiple orders, but generally, the network shows consistency.
3. The network in the upper-left contains the thickest links (64) indicating an extremely high volume of orders between the REPORTER/BUYER. This is of interest since it is excessive, however, it also shows two REPORTERS connected to the same ORDER-NO (a valid number) – which is technically not allowed and should be reviewed.
4. The network to the right (top-center) shows a basic structure where a REPORTER is connected with two BUYERS – probably not high risk.

The network located on the left-center has the ORDER-NO = 999999999. Since this is created using bad-data, technically none of the connections using that ORDER-NO are valid and therefore, the network is invalid. In this case, the REPORTERS should not issue any orders using this number and each should be evaluated. Notice, The Harvard Drug Company (upper left) has 20 transactions under this number and is also flagged with a DEA Division action (glyph notification).

The network in the lower-left shows the Smith Drug Company conducting multiple high-volume orders to four primary BUYERS that are independent pharmacies. All but one has the orange glyph indicating at least 25,000 pills were purchased (from all REPORTERS in the ARCOS data). For two of these pharmacies, they’ve had multiple high-volume orders indicating a repetitive behavior. The entities in this network, both the REPORTER and all the BUYERS should be evaluated in more detail to determine if there is abusive activity.

The last network (upper-right) closely mirrors the last network in its structure and counts. All the BUYERS have excessive number of pills as indicated by the glyphs with the majority over 50,000 (yellow glyphs). The number of high-volume orders between Food City Pharmacy and AmerisourceBergen Drug Company (ABDC) shows a repeated behavior over a 2 year period when viewed on a timeline. Food City Pharmacy is only supplied by four REPORTERS and has purchased over 194,130 pills in a location with a population of 28,194. Some additional oversight and review should be performed to better understand these disproportionate circumstance.

The conditions used to find these networks, ORDER-NO with more than 10 TRANS, shows there is potential for detecting unusual activity. This sequence can be saved as an analytical workflow and then utilized for risk scoring or alerting. There are many more patterns waiting to be detected and evaluated within the ARCOS data. It is just a matter of time to make that happen.

Conclusion

There is no right answer. There is no wrong answer. Analysis is the interpretation of data in a specific context. The patterns presented in this article are subject to that interpretation and people with different perspectives may or may-not find value in these observations.?In fact, there may be different patterns containing even more valuable findings that I did not consider in these examples. Also, there are always exceptions to the patterns and without getting more information about the ground-truth and additional facts, it remains a simple interpretation until it is verified. Undoubtedly, there are many more patterns contain in AROCS along with the other sources – it’s just a matter of perspective to find them.