Emory University Hospital Midtown faces sanctions after investigators uncovered a criminal scheme in which employees used its pharmacy to order more than a million doses of addictive prescription drugs for illegal use.

For five years, two pharmacy technicians secretly ordered controlled substances from Emory Midtown's wholesaler and sent the hospital the bills. The drugs included alprazolam, a frequently abused anti-anxiety drug, and potent painkillers such as hydrocodone and codeine, according to a recent public order issued by the Georgia State Board of Pharmacy. These drugs are among those the Centers for Disease Control cites as fueling a prescription drug abuse epidemic.

Emory Healthcare said in a written statement that it cooperated fully in the investigation and no patients were harmed. When hospital staff discovered suspicious orders in July 2013, they contacted the Georgia Drugs and Narcotics Agency, the law enforcement arm of the pharmacy board, and the U.S. Drug Enforcement Agency.

“Emory has conducted a full review of its pharmacy processes and has reinforced and added procedures to prevent this scheme from recurring,” the statement said.

The Drugs and Narcotics Agency could not be reached for comment. Through a spokesman, the DEA said the state agency lead the investigation.

Inadequate purchasing, receiving and recordkeeping safeguards kept Emory Midtown staff from detecting the illegal operation, but the hospital thinks its controls were sufficient, the order states. Emory denies all liability.

Emory Midtown must pay a $200,000 fine and its pharmacy license is under probation for three years. The consent order, which was approved late last month, bars technicians from approving orders of controlled substances. The pharmacy must also keep a running inventory of these kinds of drugs and submit to a GDNA review of their practices and policies.

The order allows discussion before the board over hospital compliance with the sanction to take place behind closed doors. Emory Midtown can petition to end its probation after 120 days.

Both technicians were fired. The board order did not disclose their names. Information was not immediately available on whether they were prosecuted.