Omnicare Inc., a subsidiary of CVS Health, has agreed to pay a $15.3 million civil penalty to resolve allegations that it violated federal law by allowing opioids and other controlled substances to be dispensed without a valid prescription, U.S. Attorney McGregor W. Scott said Wednesday in Sacramento.

“Failure to control access to prescription drugs can lead to the diversion of medication that could fall into the wrong hands with potentially devastating consequences,” said DEA Special Agent in Charge Daniel C. Comeaux in a statement released Wednesday.

“Today’s settlement demonstrates DEA’s commitment in protecting the health and safety of the public by ensuring all entities involved in the distribution of controlled substances follow the law.”

Omnicare operates “closed-door” pharmacies, which are not open to the public, the U.S. Attorney’s Office said.

Omnicare Failed to Control Emergency Kits

The company delivers controlled substances to nursing homes and other long-term care facilities. In addition, it makes daily deliveries of prescription medications to residents of long-term care facilities. And, it pre-positions limited stockpiles of controlled substances at long-term care facilities in “emergency kits,” which are given to patients in emergencies.

These emergency kits, which often include opioids and other controlled substances that are commonly abused and diverted, remain part of Omnicare’s inventory and must be tightly controlled and tracked. The controlled substances may be dispensed only with a prescription.

“Omnicare failed in its responsibility to ensure proper controls of medications used to treat some of the most vulnerable among us,” said DEA Acting Administrator Uttam Dhillon.

The federal investigation found that Omnicare failed to control emergency kits by improperly permitting long-term care facilities to remove opioids and other controlled substances from emergency kits days before doctors wrote a prescription, prosecutors said. The investigation also revealed that Omnicare had repeated failures in its documentation and reporting.

Omnicare Didn’t Admit to Liability

In addition to paying the $15.3 million civil penalty, Omnicare entered into an agreement with DEA  requiring the company to increase its auditing and monitoring of emergency kits at long-term care facilities. However, Omnicare did not admit to liability.

The settlement agreement, which was completed on May 6, resolves Omnicare’s civil liability for the alleged Controlled Substances Act violations in the districts of five U.S. Attorney’s Offices: the Central District of California, the Eastern District of California, the District of Colorado, the District of Oregon, and the District of Utah.