US Pharm. 2010;35(7):65-68.
The Drug Enforcement Administration (DEA) has released its Interim Final Rule on Electronic Prescriptions for Controlled Substances With Request for Comment, which was published in the Federal Register on March 31, 2010, and went into effect on June 1, 2010.1-4 According to the DEA, “The rule revises DEA regulations to provide practitioners with the option of writing prescriptions for controlled substances electronically. The regulations also permit pharmacies to receive, dispense, and archive these electronic prescriptions. These regulations are an addition to, not a replacement of, the existing rules. The regulations provide pharmacies, hospitals, and practitioners with the ability to use modern technology for controlled substance prescriptions while maintaining the closed system of controls on controlled substances.”5,6
The Basics
There are some important caveats that pharmacists should note. The receipt and dispensing of controlled substances by means of electronic communication is optional. If electronic prescriptions are accepted by a pharmacy, the rule allows the electronic archiving of prescriptions, subject to security and retrievability provisions. According to the DEA, “Persons who wish to prescribe/dispense controlled substances using electronic prescriptions must select software that meets the requirements of this rule. Application [emphasis added]7 providers who make such electronic prescribing software or pharmacy software available may wish to carefully review the requirements of this rule if they wish their software to handle electronic prescriptions for controlled substance. As of June 1, 2010, only those electronic prescription applications and pharmacy applications that comply with all of DEA’s requirements as set forth in 21 CFR Part 1311 may be used by DEA-registered prescribing practitioners and DEA-registered pharmacies.”8
Existing State and Federal Laws
All other statutes and regulations that apply to the dispensing of controlled substances remain in effect; the new provisions only augment the existing mandates. For example, practitioners may still communicate Schedule III, IV, and V prescriptions by phone, by fax, or in written form.9 The big change is that now Schedule II prescriptions may be communicated electronically in addition to the traditionally required hardcopy written format. Remember that all state laws regarding the prescribing and dispensing of controlled substances remain in effect; this federal rule does not preempt existing inconsistent or different state-based laws, although many states have been poised to allow electronic prescribing of controlled substances for some time now.10 Just remember that the stricter law applies.
Technology Requirements
Before beginning to use the technology necessary to comply with the DEA regulations, a pharmacy must have in place hardware and software that meets minimum security measures.11 Generally, the technology application must be able to import, display, and store the required contents of a controlled substance prescription accurately and consistently.12 There are several components to this requirement (see TABLE 1). Some of these procedures are already standard measures for pharmacy operations and should not pose a hardship or require massive new programs to achieve compliance mandates. However, it is the DEA-registered pharmacy that is responsible for ensuring whatever system is used meets all of the standards before electronic prescriptions for controlled substances are accepted under the new rule.
Assurances
The are two alternatives for obtaining this assurance. One is to hire a third party to perform an audit on the application to determine that each of the standards is met. The other is to have the application certified by a DEA-approved certification organization. Either way, the entity hired to do the system analysis will issue a report that states whether the application complies with the DEA’s requirements and whether there are any limitations on its use for controlled substance prescriptions. There will no doubt be some electronic prescriptions that will require revisions before they can be accepted electronically. If the report indicates that the pharmacy application cannot accurately and consistently import, store, and display necessary information, the pharmacy will not be allowed process electronic prescriptions for controlled substances. The DEA offers the example of hospital prescriptions issued to staff members with an identifying suffix. If the audit or certification report indicates that the pharmacy application cannot import, display, and store both a hospital DEA number and the individual practitioner’s extension number, the pharmacy will not be permitted to accept electronic prescriptions that include only a hospital DEA registration. The pharmacy may, however, use the application to process other controlled substance prescriptions if the audit or certification report has found that the pharmacy application meets all other requirements.
Preliminary Reports
The technology provider must give a copy of the report to pharmacies that use or are considering use of its application to allow a pharmacy to determine whether the application is compliant with the DEA’s requirements. Note that the pharmacy cannot accept electronic prescriptions and use them as authority to dispense controlled substances until the audit or certification report is issued and the pharmacy has a written copy of the application provider’s approval of compliance with the DEA regulations in hand.
Limited Access
Another mandate is that the pharmacy must limit access to the technology that records the receipt, processing, and dispensing information for electronically prescribed controlled substances medication orders. The access control may be set to use individual names or by roles, such as pharmacist, pharmacy intern, or pharmacy technician. This control measure must also define who has permission to annotate, alter (where alteration is permitted by DEA regulations), or delete controlled substance prescription information.
Intermediaries
As indicated in TABLE 1, you must be able to digitally sign and archive controlled substance prescriptions or import and archive the records that the last intermediary digitally signed. As used in this regulation, intermediary means any technology system vendor that receives and transmits an electronic prescription between the practitioner and the pharmacy. As a basic principle, understand that an electronic prescription must be transmitted from the practitioner to the pharmacy in its electronic form. If an intermediary cannot transmit the electronic data file to the pharmacy, the intermediary must notify the prescriber. In this type of circumstance, if the prescription is for a Schedule III, IV, or V controlled substance, the prescriber would have to print the prescription, manually sign it, and fax the prescription directly to the pharmacy. This prescription must indicate that it was originally transmitted to, and provide the name of, a specific pharmacy, the date and time of transmission, and the fact that the electronic transmission failed. Schedule II prescriptions would have to be issued in the traditional hardcopy format.
Transmission
During normal electronic transmission between a prescriber and a pharmacy, the contents of a prescription cannot be altered. Note that this mandate applies only to the content; the electronic format of the prescription may vary depending on the intermediary’s technological software. Note also that this variance applies only to intermediaries and not to changes made on a prescription after a prescription is received in a pharmacy. The same laws and regulations that apply to paper prescriptions govern changes made by the pharmacy.
Changes After Receipt of an Electronic Prescription
Exactly what changes can be made to the face of a Schedule II prescription, whether transmitted electronically or hand delivered to a pharmacy, has been a source of confusion since the DEA issued its Final Rule, Issuance of Multiple Prescriptions for Schedule II Controlled Substances, in November 2007.13,14 In the rule’s preamble, the DEA stated that “the essential elements of the [schedule II] prescription written by the practitioner (such as the name of the controlled substance, strength, dosage form, and quantity prescribed)…may not be modified orally.” This is in opposition to the DEA’s previous policy, which permitted changes to Schedules III, IV, and V controlled substance prescriptions after oral consultation with the prescriber. In a letter to the New Mexico Regulation and Licensing Department Board of Pharmacy in January 2010, the DEA acknowledged that interpreting this position to mean that “absent the ability to make oral changes, a Schedule II prescription must be returned to the prescribing practitioner for correction or reissuance” creates a significant issue that they are planning to resolve through future rulemaking.15 In the meantime, the DEA instructs pharmacists “to adhere to state regulations or policy regarding those changes that a pharmacist may make to a Schedule II prescription after oral consultation with the prescriber.”16 As a result, some states, such as Kansas, have advised patients and pharmacists that a pharmacy cannot make any changes to the face of a Schedule II prescription, or else “the pharmacy is subject to discipline from the federal government.”17
The regulations for making changes to Schedules III, IV, and V prescriptions have not changed. Pharmacists may add or change the patient’s address upon verification, and modify the dosage form, drug strength, drug quantity, directions for use, or issue date only after consultation with the prescribing practitioner; this must then be noted on the prescription. The patient’s name, prescriber’s signature, and the drug prescribed (except for generic substitution permitted by state law) cannot be changed. Any state or local laws prohibiting changes to prescriptions for controlled substances must be followed.18
Identity Proofing Prescribers
Before dispensing a controlled substance prescription, a pharmacist needs to be certain that the prescriber has the proper credentialing to engage in this practice. The following information may be useful to pharmacists in educating prescribers about the steps necessary to comply with electronic prescribing. The Rule requires prescribers to undergo an identity proofing procedure before being allowed to prescribe and transmit controlled substances electronically. According to the DEA, “identity proofing is critical to the security of electronic prescribing of controlled substances.”19 The regulations state that authentication credentials used to sign controlled substance prescriptions may be issued only to DEA-registered prescribers (in person or by remote identity proofing) whose identity has been confirmed after applying and receiving credentialing from federally approved credential service providers (CSPs) or certification authorities (CAs) to obtain their two-factor authentication credential or digital certificate. In achieving this standard, the CSP or CA will be required to conduct identity proofing that meets National Institute of Standards and Technology Special Publication 800-63-1 Assurance Level 3.
The DEA advises that it expects application providers will work with CSPs or CAs to direct prescribers to one or more sources of two-factor authentication credentials that will be interoperable with their applications and that prescribers should contact their application provider to determine which CSP or CA the provider recommends that the prescriber use.20 After the identity proofing process is completed, the CSP or CA is required to either issue a new hard token or register and provide credentials for an existing token. Communications between the CSP or CA and the approved prescriber must occur through two channels (e.g., mail, telephone, or e-mail).
Two-Factor Credentialing
Insofar as the two-factor credentialing requirement goes, the DEA will accept knowledge (something unique that the prescriber knows), a hard token (stored somewhere other than the computer being used for electronic prescribing), or a biometric identification (e.g., fingerprints). Hard tokens are cryptographic keys stored on a PDA, cell phone, smart-card, USB memory stick, or a one-time use password device and are tangible, physical objects possessed by the individual prescriber. The credentialing information must be retained only by the prescriber and not shared by any other person. Failure to secure the credentialing information or devices could expose the prescriber to suspension or revocation of a DEA registration.
The prescriber will use the two-factor credentials to digitally sign and archive prescriptions. Each controlled substance prescription must be individually signed using the electronic signature method; multiple controlled substance prescriptions are not allowed using just one signature. Issuing multiple prescriptions for different patients using just one signature is also prohibited.
It is important for pharmacists to understand that according to the rule, signing and transmitting an electronic controlled substance prescription are considered two distinct actions. While the DEA states that electronic prescriptions for controlled substances should be transmitted as soon as possible after signing, it is understood that prescribers may prefer to sign prescriptions before office staff add pharmacy or insurance information. Therefore, the DEA is not requiring that transmission of the prescription occur simultaneously with signing the prescription.
Pharmacists may check the prescribers’ certificates that permit electronic prescribing and the status of DEA registration with the DEA. Pharmacists should also keep in mind that prescribers must be licensed or otherwise authorized to prescribe controlled substances by the state where the act of prescribing is done.
Simultaneous Electronic and Hardcopy Prescriptions
The DEA anticipates that there may be instances where a prescriber electronically transmits a controlled substance prescription and also issues a paper prescription. In such an instance, the pharmacist is required to check the pharmacy records to ensure that the electronic version was not received and the prescription was not dispensed. If both prescriptions were received, the pharmacist must mark one as void. The paper prescription must comply with all DEA requirements for any paper prescription, including a manual signature.
There also could be times when an electronic prescription is originally transmitted to a different pharmacy and the patient presents a paper prescription to your pharmacy. In this circumstance, the pharmacist must check with the other pharmacy to determine whether the prescription was received and dispensed. If the other pharmacy received the original electronic prescription, but had not dispensed the prescription, that pharmacy must mark the electronic version as void or canceled. If the pharmacy that received the original electronic prescription dispensed the prescription, the pharmacy with the paper version is not allowed to dispense medication using the paper prescription as authority and must mark the prescription as void.
Records
Once a prescription is created electronically, all records of the prescription must be retained electronically. These records must be kept for a minimum period of two years (state laws usually have longer retention requirements). In addition, pharmacy application service providers must backup files daily. Although it is not required, the DEA recommends that pharmacies store their backup copies at another location to prevent the loss of the records in the event of natural disasters, fires, or system failures.
Security Failures
The pharmacy’s system is required to run an internal audit for potential security incidents daily and generate a report of any problems. If the software generates a report and, upon investigation, the person designated to administer access controls for the pharmacy determines that the issuance or records of controlled substance prescriptions has been compromised or could have been compromised, the pharmacy must be reported to the application provider and DEA within one business day. In general, the security incidents that should be reported are those that represent successful attacks on the application or other incidents in which someone gains unauthorized access.
Impact
How the prescribing community responds to the new rule is not predictable. “Only time will tell if the system is burdensome to physicians and pharmacists,” said Del Konnor, president of DEA Solutions Group, a consulting firm that advises health care organizations on complying with laws and regulations related to controlled substances. Mr. Konnor said he hopes DEA investigators will use the rule as a “teaching aid initially to help physicians and pharmacists better understand the intent of the new regulation rather than begin to use it to seek out technical violations.”21
Surescripts, which operates the nation’s largest e-prescribing network, said in a statement that the company plans to work closely with “members of the nation’s pharmacies, pharmacy benefit managers, health plans, software vendors, and prescribers to analyze and act on the DEA’s requirements.” The company said the DEA rule “may impose particular challenges for prescribers and pharmacies,” but added that it plans to collaborate on solutions that let the prescribing community comply with the regulation’s standards and protocols. According to Surescripts data, by the end of 2009, 18% of eligible prescriptions were prescribed electronically (compared to 6.6% in 2008).22
Summary
The above only addresses the basic components of the procedures mandated by the new rule on prescribing and dispensing electronic controlled substances prescriptions. Pharmacists should take the time to familiarize themselves with the details and become comfortable and competent in knowing and following all of the applicable regulations. Hopefully, once the systems are fully implemented the numbers of prescribing and dispensing errors will decrease along with incidences of preventable controlled substances diversion.
REFERENCES
1. Docket No. DEA-218, RIN 1117-AA61. 21 CFR § 1311, subpart C. Electronic prescriptions for controlled substances. www.access.gpo.gov/su_docs/
2. 75 FR 16236 No. 61. Electronic prescriptions for controlled substances; final rule. March 31, 2010. www.deadiversion.usdoj.gov/
3. Caverly MW. Chief Liaison and Policy Section, Office of Diversion Control, USDOJ, DEA. Letter to electronic application providers and pharmacy application providers. April 2, 2010. www.deadiversion.usdoj.gov/
4. Electronic prescriptions for controlled substances. www.deadiversion.usdoj.gov/
5. See Note 4, supra.
6. Rules—2010. Electronic prescriptions for controlled substances. www.deadiversion.usdoj.gov/
7. As perhaps only a government bureaucracy can do with such supremacy, the DEA chose to use the word “application” to refer to the software and hardware technology that makes electronic prescribing possible within the context of the security provision required by the DEA. When reading the regulations or DEA literature about the regulations, “application” could easily be misinterpreted to mean “the act of applying,” as in “submit an application” for permission to use a particular device. Clearly, the DEA is using the word as “the act of putting something to a special use or purpose.” Consult any dictionary for further clarification.
8. See Note 3, supra.
9. Economic impact analysis of the interim final electronic prescription rule. March 2010. www.deadiversion.usdoj.gov/
10. 73 FR 36722. Electronic prescriptions for controlled substance; proposed rule. June 27, 2008. www.deadiversion.usdoj.gov/
11. 21 CFR §§ 1304.06(c), as amended, and 1311.205.
12. Electronic prescriptions for controlled substances. Interim final rule with request for comment, questions and answers for pharmacies [as of 03/31/2010]. www.deadiversion.usdoj.gov/
13. Questions & answers. What changes may a pharmacist make to a prescription written for a controlled substance in schedule II? 72 FR 64921. www.deadiversion.usdoj.gov/
14. See 21 CFR §§ 1306.05 and 1306.11.
15. Letter from Mark Caverly, Chief Liaison and Policy Section, Office of Diversion Control, USDOJ, DEA, to Larry Loring, State Drug Inspector, New Mexico Regulation and Licensing Department, Boards and Commissions Division-Pharmacy. January 6, 2010. www.rld.state.nm.us/pharmacy/. Accessed May 6, 2010.
16. See Note 13, supra.
17. Letter from Debra L. Billingsley, Executive Secretary, Kansas Board of Pharmacy, addressed to Kansas patients. April 12, 2010. www.kansas.gov/pharmacy/. Accessed May 6, 2010.
18. See Note 13, supra.
19. Electronic prescriptions for controlled substances. Interim final rule with request for comment: questions and answers for prescribing practitioners [as of 03/31/2010]. www.deadiversion.usdoj.gov/
20. See Note 19, supra.
21. Moore J. A second look at the DEA e-prescribing rule. Government Health IT. March 29, 2010. http://govhealthit.com/
22. See Note 21, supra.
To comment on this article, contact rdavidson@uspharmacist.com.
