A DEA settlement with a 53-registration hospital system shows that detection tools flagged diversion, but follow-through failed. What patients should know.