More than two decades after New Jersey nurse Charles Cullen murdered dozens of patients, the man who first reported him to state officials says New Jersey still doesn’t do enough to keep patients safe.

“Could there be a Cullen doing this right now? The answer is yes, absolutely,” says Dr. Steven Marcus, the former head of the New Jersey Poison Information Center.

In the spring of 2004, the Poison Information Center got a series of calls from Somerset Medical Center about patients being killed or made sick by overdoses of medication that were never prescribed to them. Marcus urged hospital officials to report the incident. When they wouldn’t, he called the New Jersey Department of Health himself. But no action was taken until the hospital finally notified law enforcement months later. News 12 recently documented the Cullen case in an episode of "Crime Files."

Cullen eventually confessed to killing 40 patients at hospitals across New Jersey and Pennsylvania. Investigators learned he’d been suspected of foul play at several of those jobs, but the hospitals let him resign quietly rather than call police.

“They covered it up, and they just let him move on,” says Tim Braun, former head of the Somerset County Homicide Task Force, which arrested Cullen. “Every facility he worked at, he killed.”

In the wake of the Cullen case, New Jersey passed several pieces of legislation intended to prevent similar incidents. Health care workers and facilities are required to report any known or suspected crime and to report any staff member posing an “imminent danger." Marcus says that isn’t enough. He notes that in Cullen’s case, no one knew if the overdoses were a crime or a medication error, and no one would have reported him because no one at Somerset Medical Center would have known he was the staff member who posed the danger.

“What I was told by the Health Department was if somebody called and reported four peculiar overdoses within one hospital, they still would not do anything more than they did in the past,” Marcus said. Marcus contends overdoses should be treated like hospital-acquired diseases and reported to the NJDOH for investigation.

An NJDOH spokesperson acknowledges that health care facilities are not required to report suspicions to them but says “this does not obviate their responsibility to report them to law enforcement.”

The current owner of Somerset Medical Center, RWJ Barnabas Health, declined to be interviewed, saying the case is “more than two decades old” and citing the laws, which she said were “designed to prevent this type of tragedy from happening again."