Government hospitals placed Native American patients at increased risk for opioid abuse and overdoses, failing to follow their own protocols for prescribing and dispensing the drugs, according to a federal audit released Monday.

The report by the U.S. Department of Health and Human Services’ Office of Inspector General doesn’t draw any conclusions about actual abuse or overdoses. But it said all five Indian Health Service hospitals it reviewed had patients who were given opioids in amounts that exceeded federal guidelines.

“There are vulnerabilities with this particular population in the opioid prescribing and dispensing practices,” said Carla Lewis, one of the auditors.

The overdose epidemic that has killed more people than any other drug epidemic in U.S. history has hit indigenous communities hard. Native Americans and Alaska Natives had the second-highest rate of opioid overdose out of all racial and ethnic groups in 2017, according to the federal Centers for Disease Control and Prevention.

The report made more than a dozen recommendations to the Indian Health Service to better track patients’ health records and pain management, ensure opioids are kept under tighter security and update its information technology systems. The agency agreed on every point and said changes are coming.

The Indian Health Service, the federal agency that administers primary health care for Native Americans, has put an increased focus on opioids lately with a new website and the creation of a committee focused on decreasing overdose deaths, promoting culturally appropriate treatments and ensuring that communities know how to respond.

The audit covered five of the 25 hospitals directly run by the Indian Health Service: the Phoenix Indian Medical Center in Phoenix; Northern Navajo Medical Center on the Navajo Nation in Shiprock, New Mexico; the Lawton Indian Hospital in Lawton, Oklahoma; the Cass Lake Indian Hospital on the Leech Lake reservation in Cass Lake, Minnesota; and the Fort Yates Hospital on the Standing Rock Sioux reservation in Fort Yates, North Dakota.

Auditors considered the amount of opioids each hospital dispensed and the percentage increase over three years when deciding which ones to review. They looked at 30 patient records at each hospital, visited the facilities and interviewed staff.

They found the hospitals strayed from the Indian Health Manual in reviewing treatment for patients and their causes of pain every three months. Patients also must sign a written consent form and an agreement to treat chronic pain with opioids so they know the risks and benefits, as well as the requirement for drug screenings. More than 100 patient records didn’t have informed consent, and dozens didn’t have evidence that providers adequately educated patients.

The Centers for Disease Control recommends that patients be prescribed no more than 90 morphine milligram equivalents per day, a measure used to compare an opioid dose with morphine. The audit found that each hospital met or exceeded that amount at times. At the Shiprock hospital, the daily dosage was more than four times as high. The auditors also found some patients were prescribed opioids and benzodiazepines — commonly used to treat anxiety and insomnia —at the same time, which “puts patients at a greater risk of a potentially fatal overdose.”

The Indian Health Service said it implemented a tool to track the dosages, and all of its facilities reported data in the first quarter of 2019.

Among the report’s other findings:

—More than two dozen records showed no evidence patients were screened for drugs with a urine test when they started opioid treatment and periodically after. Providers didn’t have an alert system to know when patients were due. The Phoenix hospital has since implemented one.

—Pharmacists are supposed to review patients’ files before filling prescriptions from an outside provider, but that wasn’t being done at four of the hospitals. In one case, Fort Yates filled a prescription from an outside provider despite the hospital discontinuing treatment because the patient violated a pain management agreement. The Indian Health Service said it would issue a directive in December for prescribers to track that information.

—Only the Lawton hospital had opioids secured in a storage cabinet that requires employee authentication to access. One photo attached to the report showed the combination to a safe on the safe itself. The Indian Health Service said it has revised its manual to require opioids awaiting pickup to be locked up.

—Agreements with their states require that hospitals report daily on opioid prescriptions that are filled so patients don’t seek the drugs from multiple providers at the same time. Fort Yates and Phoenix now are complying. The Indian Health Service said the reporting would be automated by June 2020.

At all hospitals, auditors noted that providers didn’t always review the data before seeing new patients or during the time they were taking opioids for chronic pain.

“Part of it is to ensure the holistic approach of providing care,” Lewis said.

Hospital officials and providers often said they were overwhelmed by the number of patients or couldn’t control how regularly they came in — sometimes due to the long distances between patients’ homes and the hospitals.

Lewis said auditors try to be reasonable in their requests. “We try to make recommendations that are going to be actionable and cost-effective for an organization,” she said.