Stericycle has agreed to pay more than $56 million to resolve two related criminal and civil investigations from the Department of Justice and the U.S. Drug Enforcement Administration for improper handling of controlled substances that led to numerous prescription drug thefts.
The violations are related to operations between 2015 and 2020 at the former environmental solutions segment of Stericycle’s business, which was responsible for collecting, transporting and disposing of regulated waste. Stericycle is now operated by WM after the company purchased Stericycle in 2024 in a $7.2 billion deal.
The DEA and DOJ say Stericycle improperly stored controlled substances such as discarded prescription drugs, left the substances in unattended vehicles or in storage areas with broken security cameras and failed to report possible theft or “significant losses” of such substances on multiple occasions. Stericycle failed to put proper theft-prevention controls in place and didn’t adequately track shipments, according to the settlement agreement.
The DEA added that Stericycle in some cases intentionally avoided filing reports “that would have alerted the agency to thefts and significant losses of controlled substances in its care,” adding that “multiple Stericycle managers and executives were aware that the company lacked a reliable system for tracking packages across its transportation network or auditing packages received in Indianapolis, creating opportunities for diversion.”
Stericycle will pay a $19.08 million criminal penalty as part of a one‑year deferred prosecution agreement with the DOJ. Stericycle will pay a separate $37.81 million civil penalty for repeated violations of the Controlled Substances Act, according to the agencies.
“Stericycle has accepted responsibility for handling controlled substances in a manner that was insecure, unsafe, and unlawful,” said U.S. Attorney Eric Grant in a news release. “Despite being warned by the DEA that it needed to correct its deficient handling procedures, the company operated an insecure transportation network, relied on multiple unregistered facilities, and failed to notify the DEA of diversions and significant losses as required by law.”
According to court documents, Stericycle was registered with the DEA as a “reverse distributor,” allowing it to receive “unwanted, unusable, or expired controlled substances” including oxycodone, morphine and vicodin from places like hospitals and pharmacies.
Stericycle’s reverse distribution business, known as Strong-Pak, was part of its Environmental Solutions business unit. The environmental solutions division was later sold to Harsco, now known as Enviri, in 2020 for $462.5 million in cash. Harsco/Enviri was aware that search warrants were executed at Stericycle’s California and Indiana sites in early 2020 before the deal closed and was not financially involved in this agreement. Enviri’s environmental services business unit was recently sold to Veolia.
As part of the Strong-Pak services, Stericycle collected the controlled substances from across the country and temporarily stored them at a network of facilities Stericycle owned or operated. Stericycle had 44 locations that served as 10-day transfer facilities and about 13 treatment, storage and disposal facilities; five of which could handle controlled substances, court documents say.
The substances were eventually taken to a DEA-registered facility in Indianapolis. That facility served as another temporary storage location before the substances were finally transported to third-party destruction facilities, according to the settlement agreement.
As a reverse distributor, Stericycle was required to follow strict recordkeeping and reporting obligations, and it had to meet specific security requirements for the registered facilities where it temporarily stored the controlled substances before destruction. Those registered facilities were also subject to regular DEA inspections.
But Stericycle “repeatedly transported” controlled substances between more than 60 facilities that weren’t equipped with the right security or personnel measures and weren’t registered with the DEA, court documents say. In many instances, “packages of controlled substances were unlawfully transferred multiple times between unregistered Stericycle facilities before being transferred to a registered location,” the DOJ said in a news release.
DOJ says Stericycle admitted it “circumvented” such regulatory requirements to avoid regular DEA inspections.
The DEA and DOJ also said security at some Stericycle facilities was “inadequate,” particularly at a former facility in Rancho Cordova, California. Elsewhere, some Strong-PAK drivers stored the substances inside trucks parked at “personal residences and in public storage lots,” according to the settlement agreement. Some routes only scheduled one employee during transport, instead of the two required required by law for accountability purposes.
The DEA and DOJ also took issue with how Stericycle packaged some of the controlled substances it picked up from pharmacy customers. Some of those substances were stored in cardboard boxes that “lacked tamper-proof tape or security seals, which increased the possibility of theft and decreased the likelihood of detection thereof.”
Stericycle also routinely marked shipments of controlled substances with a hot pink-colored “Indy” sticker. The agencies say the easily visible sticker, which indicated the package was headed to the Indianapolis site, “made it obvious to unscrupulous employees which boxes likely contained drugs.”
The settlement agreement states that it’s “impossible to reliably determine the full extent of the thefts that may have occurred,” and noted that some incidents were properly reported, while others were not.
One incident in 2015 involved the “diversion” of what the agencies described as “hundreds of pills and patches” from an unregistered site in Alabama. In another incident in 2016, a Stericycle driver was charged with a DUI after causing a multi-vehicle car accident in Tennessee. Investigators recovered more than 1,000 pills from the cab and concealed on his person. That driver had “diverted controlled substances from pharmacies he was servicing,” according to court documents, but Stericycle ultimately decided not to report the theft.
In 2019, three boxes of controlled substances including oxycodone and hydrocodone were stolen from a trailer in Stericycle’s unregistered Denver facility “that had been left backed up to the facility’s dock over the weekend, with the trailer doors open.”
Later that year, more than 1,000 oxycodone and hydrocodone pills were stolen from an unregistered Stericycle facility in Georgia, “again after the drugs had been left unattended and poorly secured over a weekend.” Two security cameras at the facility were not functioning and had been broken for months, the settlement agreement states.
In an emailed statement, Stericycle said it was "pleased to resolve this legacy matter” from the business it sold in 2020. The company further stated it would “continue its focus on providing exceptional service to our customers and operational integrity in all aspects of our current and ongoing business operations.”
Stericycle has since implemented a compliance and ethics program meant to prevent thefts and other Controlled Substances Act violations, the agreement states. It also agreed to bolster its existing compliance program to improve its processes for training, internal investigations, compliance reporting to the DOJ and independent oversight improvements.
