A Question about The PHP Plot Hole

So based on everything the show has told the audience so far, Langdon self-reported, but did not disclose that he was stealing meds from the ED. He stole meds in two ways: 1) prescribing pills to patients and then removing some before giving the patient their prescription and 2) removing an amount of meds from a vial, replacing the stolen amount with saline, and then re-sealing the vial.

The show (through Robby) also establishes that Robby did NOT report either of these, and given that Langdon did not acknowledge the harm caused by (2) to either Mel, Santos or Dr. Al, we can assume he also didn't self-report his theft.

A lot of discussion since the episode last night is calling this a plot-hole because Langdon is in a PHP program (Dr. Al confirms this, complimenting him on his commitment to recovery.) If I understand, in real life, if a doctor self-reported an addiction to meds he administers, an audit would be done by the hospital to make sure there were no liability issues and that the doctor didn't lie.

My question is... how would they catch that Langdon was lying? If he was careful to always remove pills from unhoused addicts (who are unlikely to report missing meds, and unlikely to be believed when they *do*), how would they be able to tell that pills were missing? And if the hospital isn't aware of him diluting meds, how would they know to audit the vials? How COULD they audit the vials?... Would they cross-reference anytime Langdon removed a vial with if it was used during a trauma, and then see if that same vial was used later but a higher dose was needed?