Nurses deal with drugs every day. Most do so professionally, safely, reliably. A very few abuse them, getting high or selling them for a profit, mostly opiates. And a tiny minority — a handful in the history of nursing — turn medicines into a murder weapon.

One such nurse was Charles Cullen, who is the subject of my book The Good Nurse. A former Navy electronics technician who used his technical acumen to enable his crimes and avoid detection, Cullen got away with medical murder in at least nine hospitals over the course of his 16-year career. (He was finally arrested in 2003; he’s currently serving life in Trenton Maximum Security Prison.) He eventually admitted to 40 murders, but experts familiar with the case believe that number is low, perhaps by several hundred. If they’re right, Charles Cullen is the most prolific serial killer in American history.

For a murderer, a hospital is a convenient place to work. Deaths occur there every day; people are sick and succumb to illness. It was difficult to sort out Cullen’s crimes from the usual stream of codes and crashes. But Cullen was especially good at what he did. And he was an expert at getting away with it. In essence, Cullen hacked the hospital systems that regulate medications.

Part of his secret lay in the drugs he used. Many hospitals strictly regulate drugs like ketamine, OxyContin, Vicodin, Percocet, Darvocet, Demerol, morphine — anything that can get you high and everything addictive. But Charles Cullen avoided these drugs, and committed murder using medications normally employed to save lives. Drugs like digoxin, which is commonly used to help regulate heart rhythm, became a weapon in Cullen’s hands when employed in large enough doses and injected into a port on their IVs. It was especially lethal to patients with a history of heart problems. Insulin was another drug Cullen frequently used, sending patients into spiraling diabetic comas and generally stressing their already fragile systems.

Not all of these patients died of course; sometimes, Cullen was the first to respond to the screaming “code blue” and start resuscitating a failing patient. Because he had administered the cocktail of drugs that sent the victim into trouble, Cullen would seem almost magically prescient when he knew what drugs to administer to undo the damage and save the day. Cullen is sometimes referred to as an “angel of death” or mercy killer. That is a misnomer. Not all of Cullen’s patients were terminal, and many were in fact on the mend. In every case, Cullen killed not because he believed the patient needed his intervention but because Cullen himself felt compelled to do so. It was always about him, not them. Exactly why Cullen needed this (as a sort of suicide by proxy or because of a God complex or for some sort of sociopathic stress relief) and how he selected his patients (at random, for personal reasons, as a sort of complex code for later criminologists to decipher or simply depending on his moods), we’ll never know. If Cullen himself knows, he’d never say.

Cullen was the master of a new machine that hospitals started using to track and distribute drugs, a computerized cabinet called a Pyxis MedStation. Manufactured by an Ohio company called Cardinal Health, the machine is essentially a metal drug cash register with a computer screen and keyboard affixed to the top. Not all the nurses were comfortable with the new computerized element of nursing care, but Cullen enjoyed it. He’d worked aboard nuclear submarines, and he’d always been good with the technical devices. He appreciated how the machine efficiently tracked a nurse’s drug withdrawals, linking each with the account of a particular patient and nurse to create a record. Hospital administrators relied on Pyxis to simplify billing while allowing the pharmacy to know exactly when any given drug was running low. But like any new technology, it was just a tool, one in the service of an intimate art practiced by real people with flaws of their own.

During their attempt to stop Cullen, Homicide detectives studied his Pyxis records, but they didn’t see a smoking gun — a clear pattern of drug orders by him corresponding to the hospital overdoses. What they did find were a large number of canceled orders. Cullen had realized that if he placed an order of the drug for his own patient, then quickly canceled it, the drug drawer popped open anyway. He could simply take what he wanted without recording it in the system. It was that easy.

And when Cullen sensed that the authorities were onto his methods, he quickly changed them. The canceled orders stopped, but the murders did not. Medical investigators puzzled over his Pyxis records and found nothing unusual. But a nurse (Cullen’s best friend-turned-confidential-informant for the prosecutor’s office) did notice that Cullen was frequently ordering acetaminophen from the computer system. Why would he go to the trouble of logging in his personal information just to order Tylenol? And why did he order them one at a time rather than in batches? It made no sense—until the next night, when she returned for her shift, ordered acetaminophen and watched the drawer pop open.

There, stocked in the plastic tray beside the acetaminophen, was the digoxin. A and D shared a drawer; Cullen had been ordering one but using the other.