Abstract: A method for detecting diversion may include identifying an activity pattern associated with a clinician as being an infrequent activity pattern that occurs below a threshold frequency. Whether the infrequent activity pattern corresponds to an anomalous behavior may be determined based at least on one or more data models. The infrequent activity pattern may include a series of transaction records, which may be matched to the reference transaction values included in each of the one or more data models. An investigative workflow may be triggered in response to the infrequent activity pattern being determined to correspond to the anomalous behavior. Related methods and articles of manufacture are also disclosed.

Abstract: A method may include receiving a first transaction record indicating a first interaction with a first raw quantity of a first medication and a second transaction record indicating a second interaction with a second raw quantity of a second medication. The first transaction record and the second transaction record may be normalized by generating, based on an equivalent unit, a first normalized quantity of the first medication and a second normalized quantity of the second medication. A machine learning model may be applied to the normalized first transaction record and second transaction record to detect, based on the first transaction record and the second transaction record, an anomalous behavior. An investigative workflow may be triggered in response to the machine learning model detecting the anomalous behavior. Related systems and articles of manufacture, including computer program products, are also provided.