Evan Schuman's StorefrontBacktalk

A misconfigured CVS computer system originally designed to limit excessive sales of pseudoephedrine (which can be used to make methamphetamine) ironically had the opposite effect. More generic pseudoephedrine was sold in the drugstore chain’s southern California pharmacies than in the rest of its U.S. stores combined. The culprit? Store associates who regularly overrode or bypassed the system and—more to the point—the IT system that made it easy to do.

It’s always a challenge to get employees to correctly use a computer system that stops them from selling—even when it’s enforcing the law. That’s the kind of conflict retailers increasingly face in cases where, for example, loyalty programs clash with privacy concerns. No manager is going to get a bonus for pushing customers away. As such, it may fall to IT to make sure employees don’t cut corners, especially when those shortcuts could result in an expensive legal bill. Trouble is, that can be an impossible task.

In CVS’ case, these problems resulted in the drugstore giant being fined $77.6 million by California officials, the state announced last Thursday (Oct. 14). When the system was finally configured correctly, pseudoephedrine sales dropped by 87 percent in some Los Angeles CVS stores.

For the chain, IT looked like an obvious point of failure. According to prosecutors, CVS is required by federal law to limit sales of pseudoephedrine to relatively small quantities and to log the names, addresses and birthdates of all customers buying the drug. CVS actually installed software called MethCheck to do that in 2007, and the system is capable of tracking sales to each customer across all the chain’s stores. What it wasn’t configured to do was stop sales that exceeded the federal limit.

As a result, generic pseudoephedrine sales at CVS pharmacies in the Los Angeles and Las Vegas areas skyrocketed. As California drug-enforcement agents learned in late 2008 from people arrested for possessing large quantities of the drug, CVS was their preferred place to buy. State officials notified the federal Drug Enforcement Administration (DEA), which reviewed CVS’ sales practices and discovered that teams of buyers working for meth labs would sometimes literally clear a pharmacy’s shelves of the drug—and the MethCheck software wouldn’t stop them.

That’s bad. What’s worse is that pharmacy employees, who knew what the software was there for, didn’t stop the drug buyers either. It was hard for them to have missed buyers who made up to a dozen purchases per day in a single store—in one case, a customer made 10 purchases in less than an hour. (According to prosecutors, many of the buyers even used CVS loyalty cards to get credit for their purchases.)

And those were the (relatively) honest employees. At the other of the spectrum, one CVS manager bought pseudoephedrine on his own, using 36 different fake IDs. When he was arrested, he had almost $3,000 worth of pills that were worth 10 times that amount on the black market, according to a California state investigator.