Spot checks leave windows open
Monthly report pulls and sample audits review a fraction of activity. People who divert or snoop learn when reviews happen and work in the gaps.
AIDrug diversion and patient privacy monitoring
Find the risks your audits never see
DetectRx and Haystack iS watch every medication event and every access to patient records, around the clock, and bring only the highest-risk activity to your team.
- Machine learning plus expert rules
- Built by iatricSystems
- An estimated80-93%Of drug diversion goes undetected
- Of diversion cases,95%Are never investigated
- A healthcare breach costs$9.77MOn average
- It takes258 daysTo identify and contain a breach
The gap
Why manual compliance programs miss most incidents
No team can read millions of access records and medication events by hand. The issue is coverage, and the people who divert or snoop know where it ends.
The evidence lives in separate systems
The EHR, dispensing cabinets, timekeeping, labs, and document systems each hold part of the story. Without correlating them, the pattern never appears.
Alert noise buries real cases
Rule-only tools flag everything unusual. Teams spend their week clearing legitimate access and following up on self-access cases that are not breaches.
The solutions
Two monitors, one standard of oversight
DetectRx covers controlled substances. Haystack iS covers patient records. Both combine machine learning with expert-written rules and automate follow-up with AVA.
Pharmacy, nursing, and compliance Drug diversion
DetectRx
Every medication event, scored for diversion risk
DetectRx combines EHR, dispensing cabinet, and timekeeping data, then applies machine learning and expert-written rules to score every flagged event as high, medium, or low risk.
- 28+ diversion and non-compliance risk types
- Activity timeline for each flagged risk
- Investigations with PDF export for HR and regulators
Privacy officers and compliance Patient privacy
Haystack iS
Every PHI access, in one audit
Haystack iS pulls audit trails from the EHR and every other system that touches PHI into one event list. Its Solomon Engines AI learns your access patterns and assigns each event a risk index.
- Unified audit across EHR, labs, PACS, and HR systems
- Forensics, watchlists, and a Manager's Portal
- OCR-compliant investigation records
Risk coverage
The patterns spot checks cannot connect
Most of these flags need data from more than one system. That is why these cases slip past single-report reviews.
What DetectRx flags
Drug diversion monitoring
- Dispense without a documented administration
- Waste, return, and dose totals that do not reconcile
- Activity by a user who is off shift or in another unit
- Medication activity on a discharged or expired patient
- Witness off shift or in the wrong location
- Insulin given with no matching glucose result
What Haystack iS flags
Patient privacy monitoring
- Co-worker access in the same facility or unit
- Employees opening their own records
- Same household or same street as the patient
- High-profile and confidential patients
- Access by employees after they leave
- Social media connections between staff and patients
AVA, the Advanced Virtual Assistant
Follow-up that happens every time, without the phone tag
Most compliance hours go to chasing answers: emailing managers, calling employees, logging what they said. AVA, built into both products, does that legwork the moment an event is flagged and documents every step.
At Renown Health, AVA took over self-access follow-up, so the team can focus on cases that could become an OCR-reportable breach.
When a high-risk event is flagged
Notify
A high-risk event triggers an email or SMS to the right manager or employee.
Ask
A short questionnaire gathers context, and the answers update the risk score.
Decide
AVA opens an investigation when needed, or closes the event when it is cleared.
Escalate
Unanswered questionnaires re-notify and escalate to a wider group automatically.
"The feature that's reduced our workload the most has been AVA."
Customer results
What changes when monitoring is continuous
Health systems moved from monthly reports and suspicion-based audits to full, continuous coverage.
Renown Health | DetectRx
Monthly pulls replaced by continuous monitoring
Diversion review used to run on manual monthly reports. Now every controlled substance event is in one platform.
5 to 24Diversion risk factors monitored
"DetectRx impressed us and gave us insight on technology that can make it easier for us to continue to meet our goals of patient safety and provide quality care."
Peterson Health | DetectRx
From spot checks to every outlier
Pharmacy and clinical teams review the same data together, and the program surfaced practices no one knew existed.
EveryOutlier transaction reviewed
"DetectRx has made it possible to review every transaction that may appear as an outlier, as opposed to what we were doing before, which was spotchecking."
WVU Medicine | Haystack iS
One audit instead of a report per system
West Virginia's largest health system moved from reactive, suspicion-based audits to proactive monitoring.
23Hospitals monitored from one platform
"With Haystack, we can run one audit for all our applications, which cuts down on the review and gives us a better picture of what's going on."
Results as reported by iatricSystems customers.
Integrations
Works with the systems you already run
Both products connect to your EHR, dispensing cabinets, timekeeping, HR, and ancillary systems. If a system writes an audit file, iatricSystems can bring it in.
- Epic
- Oracle Health (Cerner)
- MEDITECH
- athenahealth
- Allscripts
- Omnicell
- Pyxis
- Kronos
- Workday
- Active Directory
- Plus hundreds more
DetectRx security and compliance
- HIPAA-compliant deployment with BAA support
- Encrypted data in transit and at rest
- Role-based access and full audit logging
- Multi-factor authentication available
- Configurable data retention
Free consultation
Book a consultation for the product you need
Each product has its own 15-minute consultation, so the specialist you meet is ready for your questions. We cover:
- Where your diversion or privacy program has gaps
- Which systems and data feeds to connect first
- Whether the product fits, with a full demo if it does
Backed by iatricSystems
- Years in healthcare IT
- 35+
- Healthcare systems served
- 1,300+
- Vendor integrations
- 800+
- 20+ years focused on patient privacy monitoring
- Implementation teams configure it to your policies
FAQ
Compliance monitoring questions
Comparing options?
Book the consultation for the product you are evaluating. We will cover the other one too if it comes up.
Choose a consultationWhat is drug diversion monitoring software?
Drug diversion monitoring software analyzes controlled substance activity to find signs of theft, misuse, or policy non-compliance. DetectRx correlates EHR, automated dispensing cabinet, and timekeeping data and scores each flagged event for risk, around the clock.
Explore DetectRxWhat is patient privacy monitoring?
Patient privacy monitoring reviews who accessed protected health information and flags access that looks inappropriate, such as co-worker, family, or VIP lookups. Haystack iS does this across every connected clinical system and documents investigations to OCR standards.
Explore Haystack iSHow do these tools reduce false positives?
Both combine machine learning with expert-written rules. The AI learns your organization's normal patterns, so flagged events are scored by risk and the highest-risk activity rises to the top of the queue.
What is AVA?
AVA, the Advanced Virtual Assistant, is built into DetectRx and Haystack iS. It sends questionnaires to managers or employees when an event is flagged, records their answers, opens or closes investigations by your rules, and escalates when no one responds.
Which EHRs and systems do they integrate with?
DetectRx works with leading EHRs including Epic, Oracle Health (Cerner), MEDITECH, athenahealth, and Allscripts, plus dispensing cabinets and timekeeping. Haystack iS uses an open audit file import specification and iatricSystems has completed 800+ vendor integrations.
Choose a consultationAre they cloud-based?
DetectRx is cloud-hosted, so there is no on-premise infrastructure to manage, and it supports HIPAA-compliant deployment with a Business Associate Agreement. Haystack iS runs in any modern web browser. A consultation will confirm the right deployment for your organization.
Do we need both products?
They address different risks. DetectRx watches controlled substance activity, and Haystack iS watches access to patient records. Many health systems start with the larger gap and add the other later. A consultation will help you decide.
Choose a consultationWho makes DetectRx and Haystack iS?
Both are developed by iatricSystems, a healthcare IT company with more than 35 years of experience and over 1,300 healthcare systems using its solutions. Dictation Direct helps you evaluate, purchase, and roll them out.
Close the gap before an incident finds it
Book a 15-minute consultation for drug diversion monitoring, patient privacy monitoring, or both.