WASHINGTON — A consultant hired by one of the country's largest opioid distributors told the firm in 2008 it was violating federal guidelines by filling large, potentially "suspicious" orders for drugs and failing to report them to the government, according to an internal corporate document viewed by NBC News.

The consultant found that instead of cancelling the orders and reporting them to the Drug Enforcement Administration, Cardinal Health was reducing the size of the orders and then filling them anyway, according to the document.

Nine years later, Cardinal Health would pay a $44 million fine to the DEA for failing to report outsize, or "suspicious," orders.

Cardinal Health is among the 10 opioid manufacturers and distributors facing more than 1,600 lawsuits blaming them for starting and sustaining the opioid epidemic that has killed more than 400,000 Americans. The lawsuits, in which plaintiffs seek billions in damages, have been consolidated in a federal courtroom in Cleveland, Ohio. The report prepared by the Cardinal consultant was unearthed during the discovery process for the suits.

Through its attorney, Cardinal hired a former DEA official as a consultant in 2007 to figure out if the company was following DEA guidelines and stopping "suspicious orders." The DEA defines "suspicious orders" as "orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency."

If Cardinal found any overly large or suspicious orders, DEA guidelines said it was supposed to notify the agency.

The consultant, former DEA chief compliance officer Ronald Buzzeo, found the company was not cancelling larger orders, but was instead reducing them to a self-imposed threshold — three times the size of any previous order from the same customer — and filling them anyway without notifying the DEA.

"Customer orders that are in excess of three times the average (which would be the threshold) would be held for further investigation," says a report from Buzzeo to a Cardinal attorney dated Jan. 23, 2008. "Orders that were held would be reduced to the threshold and sent to the customer. Delayed orders would be investigated. If the order was cleared of suspicion, the remainder of the order would be furnished to the customer. If the order was not cleared of the suspicion, the order would not be filled above the threshold limit; however, no report would be made to the DEA."

Buzzeo recommended that the company should "report all orders to the DEA that cannot be cleared of suspicion and cancel the entire order."

The document does not say whether Cardinal implemented these recommended changes, but the DEA later fined Cardinal $44 million for failing to report suspicious orders from 2009 to 2012 – a three-year period that began after Buzzeo made his recommendations. The company and DOJ negotiated the terms of the settlement for 6 years before it was finalized in 2017.

In a statement, Cardinal Health said that the report "captured a single moment in time" and was prepared as part of the company's transition, "based on significantly changing guidance from the Drug Enforcement Administration ... to a new system for identifying and reporting potential suspicious drug orders. ...The report ... assisted the company in implementing programmatic changes based on DEA's changing guidance. Cardinal Health complied with the Controlled Substances Act."

"Cardinal Health has learned from our experience and the threats the pharmaceutical supply chain faces, and as a result of the transition and a constantly adaptive approach, our anti-diversion program today is stronger and more effective as it continues to evolve.

"We report suspicious orders to the federal Drug Enforcement Administration and state regulators but we do not know what they do with those reports, if anything. ... Our people operate in good faith and our goal is to get it right, and we have stopped suspicious orders for the shipment of hundreds of millions of dosage units of controlled substances over the last decade.

"Cardinal Health cares deeply about the opioid epidemic and shares the judgment of top policymakers and many others that too many prescriptions have been written for too many opioid pills over the past decade. We take seriously our commitment ... to find and support solutions to this national challenge."

The 2017 settlement with the federal government did not preclude civil lawsuits by cities, counties and states that want companies like Cardinal to pay billions for the opioid crisis.

The state attorneys general who are suing Cardinal and the other firms allege that instead of stopping suspicious orders, Cardinal looked the other way.

Cardinal and the other drug distributor defendants filed a joint motion to dismiss the suit filed by the state of Ohio, which contains allegations similar to those in suits filed in dozens of other states. In the motion, the companies' lawyers argue the companies are not liable because the harm caused is "many steps removed from Distributors" and points instead to the "manufacturers that marketed the opioids, the doctors who prescribed (or mis-prescribed) them, the pharmacists who dispensed them and the pharmacy customers who misused or diverted them."