A method for detecting diversion may include identifying an activity pattern associated with a clinician as being an infrequent activity pattern that occurs below a threshold frequency. Whether the infrequent activity pattern corresponds to an anomalous behavior may be determined based at least on one or more data models. The infrequent activity pattern may include a series of transaction records, which may be matched to the reference transaction values included in each of the one or more data models. An investigative workflow may be triggered in response to the infrequent activity pattern being determined to correspond to the anomalous behavior. Related methods and articles of manufacture are also disclosed.
展开▼