Tucked in the West Virginia Code of State Rules, you’ll find a three-sentence regulation designed to keep in check the flow of prescription pills into the state.

The rule directs wholesale distributors to set up systems to identify “suspicious” orders for highly addictive narcotics. It requires the wholesalers to report those questionable orders to the pharmacy board.

And the regulation spells out what orders should be flagged: those “of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency.”

But the rule, which has the force and effect of state law, wasn’t on the pharmacy board’s radar when the pain pills were pouring into Southern West Virginia. And the drug companies, for years, ignored it.

“It’s not been an item that’s ever been enforced by the board,” said David Potters, the pharmacy board’s executive director.

Between 2001 and June 2012, the pharmacy board received just two reports — both from Cardinal Health. Since then, more than 7,200 reports about suspicious drug orders have been faxed in.

What changed? On June 26, 2012, former Attorney General Darrell McGraw filed lawsuits against Cardinal Health, AmerisourceBergen and a dozen other wholesalers. The lawsuits alleged the companies shipped an excessive number of pain pills to West Virginia — and failed to report suspicious orders from pharmacies. The complaint put a spotlight on the reports.

Two days later, Cardinal Health started faxing a steady stream of reports — about 40 a month — to the pharmacy board. McKesson Corp. waited until March 2015 to start sending in its reports on drug orders it deemed suspicious — a year after West Virginia Attorney General Patrick Morrisey started investigating the drug company.

The rule about suspicious orders doesn’t dictate what the pharmacy board is supposed to do with the reports. So the board shelved them — every one.

The pharmacy board didn’t investigate. It never contacted the wholesalers or pharmacies. It didn’t pass the reports along to law enforcement authorities.

So pharmacies could order scores of powerful painkillers at will with no scrutiny — at least from state regulators.

At Tug Valley Pharmacy in Mingo County, for instance, sales orders for the painkiller hydrocodone jumped from 820,000 pills in 2007 to more than 2.4 million in 2008 and more than 3 million in 2009, U.S. Drug Enforcement Agency records show. But the increases didn’t prompt wholesalers to send a single suspicious order report about Tug Valley to the pharmacy board those years.

Two weeks ago, the Gazette-Mail inspected the reports, which are stored in two banker’s boxes at the board office. The agency doesn’t keep track of the number of suspicious order reports on file.

A hand count showed Cardinal Health submitted at least 2,428 reports, while McKesson identified 4,814 suspicious orders from West Virginia pharmacies. Masters Pharmaceuticals turned in 10 reports, and Smith Drug Co. filed one report.

Cardinal Health submits its reports monthly — a single page for every suspicious order. McKesson faxes in spreadsheets that list hundreds of suspicious orders from pharmacies across the state.

Nine months of Cardinal Health reports were missing from the board’s file.

“They were apparently never filed and lost,” Potters said in an email to the Gazette-Mail.

After paying scant attention to the rule for years, the pharmacy board voted unanimously last week to send letters to drug wholesalers, asking them to report suspicious orders. The board plans to forward the reports to Morrisey’s office.

“We need to work this,” said pharmacy board President Dennis Lewis. “We’re going to work on it hard.”

The board had never publicly discussed the reporting requirement until Monday. And there’s no record that the board ever notified the distributors of the suspicious order rule.

“For many years, the board didn’t really want suspicious order reports,” said Rebecca Betts, a lawyer for drug wholesaler H.D. Smith Drug Co., at last week’s meeting.

The DEA also requires drug wholesalers to report suspicious orders. The West Virginia rule was copied almost word for word from the DEA’s rule.

The rule doesn’t specifically name wholesale distributors. It refers to “registrants.” The DEA registers drug wholesalers and pharmacies. The pharmacy board licenses both.

“I think the rule was poorly written,” Potters said. “It should have said ‘wholesaler.’”

The drug companies have racked up huge fines for failing to report suspicious orders in other states.

In 2008, McKesson agreed to pay a $13.2 million fine to settle claims it failed to report hundreds of suspicious orders from internet pharmacies that sold drugs online to customers who didn’t have legal prescriptions.

During a corporate earnings call shortly after the company paid the fine, McKesson CEO John Hammergren said, “As you are probably aware, diversion of controlled substances has been an industry issue. Nothing is more important to our industry than the safety and integrity of our drug supply chain.”

But seven years later, with Hammergren still CEO, McKesson was back in hot water for the same offense. The drug company paid a $150 million fine and suspended operations at four warehouses to settle a federal investigation into McKesson’s suspicious order reporting practices.

The DEA also has sanctioned Cardinal Health for not reporting suspicious orders.

In 2008, the company paid a $34 million fine for failing to report suspicious sales of hydrocodone — sold under brand names like Lortab. In 2012, the DEA suspended Cardinal Health from shipping painkillers and other drugs from its Lakeland, Florida, warehouse for two years. The federal agency said Cardinal Health did not report suspect orders from four Florida pharmacies.

The distributors have denied any wrongdoing. Spokeswomen for McKesson, Cardinal Health and AmerisourceBergen declined to comment on the suspicious order reports last week.

In court cases, drug wholesalers have railed against the DEA.

The DEA won’t let the distributors see their competitors’ drug shipments to pharmacies — sales data that could identify drugstores that place painkiller orders from multiple suppliers.

The DEA also turned down a request to mask wholesalers’ names and release pill orders from pharmacies, according to the companies. Records about doctors who write prescriptions and patients who receive opioids also are off limits to distributors, even though the state pharmacy board tracks that information in a database.

“Wholesalers don’t know what other wholesalers are doing, so we’re getting multiple suspicious order reports from one pharmacy from multiple wholesalers,” said Vaughn Sizemore, a deputy attorney general who’s helping the pharmacy board figure out what to do with the reports.

At the meeting last week, Sizemore suggested the pharmacy board change its rules and require drug wholesalers to send suspicious order reports directly to the attorney general. State lawmakers would have to approve the change.

Morrisey, who represented Cardinal Health and lobbied for the drug wholesale industry in Washington, D.C., before taking office in 2013, has already put West Virginia pharmacies on notice about their role in the state’s prescription drug epidemic.

Earlier this month, Morrisey filed suit against Larry’s Drive-In Pharmacy in Boone County, alleging the store “blindly” filled suspicious prescriptions and dispensed an “extraordinary” number of pain pills — 10 million doses in 11 years.

McKesson has submitted 34 reports about drug orders at Larry’s to the pharmacy board this year, the Gazette-Mail found during its hand count. The pharmacy board has never asked wholesalers whether they fill drug orders they’ve reported as suspicious. Nor has the board checked with the pharmacies it regulates.

“We’ve never gotten that detail,” Lewis said.