Electronic Prescriptions for Controlled Substances

DEPARTMENT OF JUSTICE

Drug Enforcement Administration

21 CFR Parts 1300, 1304, 1306, and 1311

[Docket No. DEA-218P]

RIN 1117-AA61

Electronic Prescriptions for Controlled Substances

AGENCY:

Drug Enforcement Administration (DEA), Department of Justice.

ACTION:

Notice of Proposed Rulemaking.

SUMMARY:

DEA is proposing to revise its regulations to provide practitioners with the option of writing prescriptions for controlled substances electronically. These regulations would also permit pharmacies to receive, dispense, and archive these electronic prescriptions. These proposed regulations would be an addition to, not a replacement of, the existing rules. These regulations provide pharmacies, hospitals, and practitioners with the ability to use modern technology for controlled substance prescriptions while maintaining the closed system of controls on controlled substances dispensing; additionally, the proposed regulations would reduce paperwork for DEA registrants who dispense or prescribe controlled substances and have the potential to reduce prescription forgery. The proposed regulations would also have the potential to reduce the number of prescription errors caused by illegible handwriting and misunderstood oral prescriptions. Moreover, they would help both pharmacies and hospitals to integrate prescription records into other medical records more directly, which would increase efficiency, and would reduce the amount of time patients spend waiting to have their prescriptions filled.

DATES:

Written comments must be postmarked, and electronic comments must be sent, on or before September 25, 2008.

ADDRESSES:

To ensure proper handling of comments, please reference “Docket No. DEA-218” on all written and electronic correspondence. Written comments sent via regular or express mail should be sent to Drug Enforcement Administration, Attention: DEA Federal Register Representative/ODL, 8701 Morrissette Drive, Springfield, VA 22152. Comments may be directly sent to DEA electronically by sending an electronic message to

dea.diversion.policy@usdoj.gov

. Comments may also be sent electronically through

http://www.regulations.gov

using the electronic comment form provided on that site. An electronic copy of this document is also available at the

http://www.regulations.gov

Web site. DEA will accept electronic comments containing MS word, WordPerfect, Adobe PDF, or Excel files only. DEA will not accept any file formats other than those specifically listed here.

FOR FURTHER INFORMATION CONTACT:

Mark W. Caverly, Chief, Liaison and Policy Section, Office of Diversion Control, Drug Enforcement Administration, 8701 Morrissette Drive, Springfield, VA 22152, Telephone (202) 307-7297.

SUPPLEMENTARY INFORMATION:

Posting of Public Comments:

Please note that all comments received are considered part of the public record and made available for public inspection online at

http://www.regulations.gov

and in the Drug Enforcement Administration's public docket. Such information includes personal identifying information (such as your name, address, etc.) voluntarily submitted by the commenter.

If you want to submit personal identifying information (such as your name, address, etc.) as part of your comment, but do not want it to be posted online or made available in the public docket, you must include the phrase “PERSONAL IDENTIFYING INFORMATION” in the first paragraph of your comment. You must also place all the personal identifying information you do not want posted online or made available in the public docket in the first paragraph of your comment and identify what information you want redacted.

If you want to submit confidential business information as part of your comment, but do not want it to be posted online or made available in the public docket, you must include the phrase “CONFIDENTIAL BUSINESS INFORMATION” in the first paragraph of your comment. You must also prominently identify confidential business information to be redacted within the comment. If a comment has so much confidential business information that it cannot be effectively redacted, all or part of that comment may not be posted online or made available in the public docket.

Personal identifying information and confidential business information identified and located as set forth above will be redacted and the comment, in redacted form, will be posted online and placed in the Drug Enforcement Administration's public docket file. Please note that the Freedom of Information Act applies to all comments received. If you wish to inspect the agency's public docket file in person by appointment, please see the

FOR FURTHER INFORMATION CONTACT

paragraph.

I. Background

Legal Authority

DEA implements the Comprehensive Drug Abuse Prevention and Control Act of 1970, often referred to as the Controlled Substances Act (CSA) and the Controlled Substances Import and Export Act (21 U.S.C. 801-971), as amended. DEA publishes the implementing regulations for these statutes in Title 21 of the Code of Federal Regulations (CFR), Parts 1300 to 1399. These regulations are designed to ensure an adequate supply of controlled substances for legitimate medical, scientific, research, and industrial purposes, and to deter the diversion of controlled substances to illegal purposes. The CSA mandates that DEA establish a closed system of control for manufacturing, distributing, and dispensing controlled substances. Any person who manufactures, distributes, dispenses, imports, exports, or conducts research or chemical analysis with controlled substances must register with DEA (unless exempt) and comply with the applicable requirements for the activity.

Controlled Substances

Controlled substances are drugs that have a potential for abuse and psychological and physical dependence; these include opiates, stimulants, depressants, hallucinogens, anabolic steroids, and drugs that are immediate precursors of these classes of substances. DEA lists controlled substances in 21 CFR part 1308. The substances are divided into five schedules: Schedule I substances have a high potential for abuse and have no accepted medical use in treatment in the United States. These substances may only be used for research, chemical analysis, or manufacture of other drugs. Schedule II-V substances have accepted medical uses and also have potential for abuse and psychological and physical dependence. Virtually all Schedule II-V controlled substances are available only under a prescription written by a practitioner licensed by the State and registered with DEA to dispense the substances. Overall, controlled substances constitute between 10 percent and 11 percent of all prescriptions written in the United States.

History

The CSA and DEA's regulations were originally adopted at a time when most transactions and particularly prescriptions were done on paper. The CSA mandates that some records must be created and kept on forms that DEA provides and that many controlled substance prescriptions must be manually signed. In 1999, in response to requests from the regulated community, DEA began to examine how to revise its regulations to allow the use of electronic systems within the limits imposed by the statute and mindful that the records had to be usable in legal actions. On April 1, 2005, after extensive consultation with the regulated community, DEA published a final rule that allowed the electronic creation, signature, transmission, and retention of records of orders for Schedule I and II controlled substances, orders that prior to that time had to be created on preprinted forms that DEA issued (70 FR 16901, April 1, 2005).

At the same time, DEA began to examine how to revise its rules to allow electronic prescriptions for controlled substances. In addition to complying with the mandates of the CSA, regulations on electronic prescriptions must be consistent with other statutory mandates and Federal regulations. The Electronic Signatures in Global and National Commerce Act of 2000, commonly known as E-Sign, was signed into law on June 30, 2000 (Pub. L. 106-229). It establishes the basic rules for using electronic signatures and records in commerce. E-Sign was enacted to encourage electronic commerce by giving legal effect to electronic signatures and records and to protect consumers. E-Sign provides that, with respect to any transaction in or affecting interstate or foreign commerce, a signature may not be denied legal effect solely because it is in electronic form (15 U.S.C. 7001(a)). However, E-Sign further provides that, where a statute or regulation requires retention of a record, and an electronic record is used to meet such requirement, Federal, State, and local agencies may set performance standards to ensure accuracy, record integrity, and accessibility of records (15 U.S.C. 7004(b)(3)(A)). Such performance standards may be specified in a manner that requires the implementation of a specific technology if such requirement serves an important governmental objective and is substantially related to that objective interest (Id.).

In 2003, Congress enacted the Medicare Prescription Drug, Improvement, and Modernization Act (MMA) (Pub. L. 108-173). Section 1860D-4(e) (codified at 42 U.S.C. 1395w-104(e)) contains the requirement that the electronic transmission of prescriptions and prescription-related information for covered Part D drugs prescribed for Part D eligible individuals comply with final uniform standards adopted by the Secretary of the Department of Health and Human Services (HHS). One of the considerations in support of this move to electronic prescriptions was the view that using electronic prescriptions in lieu of written or oral prescriptions could reduce medical errors that occur because handwriting is illegible or phoned in prescriptions are misunderstood as a result of similar sounding medication names. Another consideration is that, if prescription records are linked to other medical records, practitioners can be alerted at the time of prescribing to possible interactions with other drugs the patient is taking or allergies a patient might have. Electronic prescribing systems also can link to insurance formulary lists to inform the practitioner prior to prescribing whether a drug is covered by a patient's insurance.

HHS adopted a rule on the transmission standard for electronic prescriptions in November 2005 (70 FR 67593, November 7, 2005) and revised it on June 23, 2006 (71 FR 36023). The standard focuses on the format for the transmitted information, not with the process of creating the prescription or maintaining the record at the pharmacy. HHS adopted the National Council of Prescription Drug Programs (NCPDP) SCRIPT Standard, Implementation Guide, Version 8.1. The standard specifies fields (name, date, address, etc.) and field lengths for certain transactions including issuing new prescriptions and refills. The rule applies to prescriptions issued to patients under Part D (the prescription drug program for Medicare patients). The rule does not require practitioners or pharmacies to use electronic prescriptions, but rather requires that companies that sponsor Part D coverage establish and maintain an electronic prescription program that meets the standard. The purpose of the standard is to ensure that electronic prescriptions are created and transmitted in a format that can be read by the receiving pharmacy (i.e., that the systems creating, transmitting, and receiving the prescriptions are interoperable).

The rule DEA is hereby proposing has been written to be consistent with the foregoing HHS standard. However, it bears emphasis that the context in which the HHS standard was issued was not specific to controlled substances and therefore not designed to provide safeguards against the diversion of controlled substances. The responsibility for establishing regulatory safeguards against diversion of controlled substances falls upon DEA as the agency charged with administering and enforcing the CSA. Accordingly, while the rule being proposed here by DEA is designed to work in tandem with the HHS standard, its scope is necessarily distinct from the HHS standard.

Prescription records and transmission are also subject to the Health Insurance Portability and Accountability Act (HIPAA), which establishes protection for health information. Any party to the creation, transmission, and storage of prescriptions must meet standards to ensure that the information is protected and not revealed to persons who are not authorized to see it. Health Plans, Health Care Clearinghouses, and covered Health Care Providers that are involved in the transmission of prescriptions must comply with HIPAA standards, which are codified at 45 CFR parts 160, 162, and 164. Because of the wide variety of healthcare providers subject to HIPAA, the requirements are general to allow the providers to adopt protections that are appropriate for their situations. For example, the security steps needed at a one-practitioner office will be very different from those needed at a large hospital system or chain pharmacy system. The DEA rule being issued here is consistent with HIPAA security guidance issued by HHS, as explained later in this document.

Because both DEA and HHS are involved in addressing electronic prescriptions, they held a joint public meeting on July 11 and 12, 2006, to gather information from the regulated community (practitioners and pharmacies) as well as from the prescription and pharmacy service providers, technical experts, and Federal, State, and local law enforcement. The meeting record is available at

http://www.deadiversion.usdoj.gov/ecomm/e_rx/mtgs/july2006/index.html

.

Based on the meeting and on the requirements of the CSA and the other applicable provisions of law outlined above, DEA has developed this proposed rule. As the proposed rule illustrates, DEA supports the adoption of electronic prescriptions for controlled substances in a manner that will minimize the risk of diversion. In the absence of appropriate controls, allowing electronic prescriptions for controlled substances could exacerbate the already increasing problem of prescription controlled substance abuse

in the United States, as discussed further below. It is also essential that the rules governing the electronic prescribing of controlled substances do not undermine the ability of DEA, State, and local law enforcement to identify and prosecute those who engage in diversion.

The remainder of this preamble for the rule is organized as follows:

Section II discusses the framework of pertinent provisions of the CSA and DEA regulations to provide a context for this proposed rule.

Section III describes the current requirements for controlled substance prescriptions.

Section IV discusses the existing electronic prescription and pharmacy systems.

Section V discusses potential vulnerabilities that need to be addressed to prevent electronic prescribing from contributing to the diversion of controlled substances.

Section VI discusses alternatives considered.

Section VII discusses the risk assessment DEA conducted regarding electronic prescriptions for controlled substances.

Section VIII describes the proposed rule and the rationale for the requirements DEA is proposing to impose on prescription and pharmacy systems that create, process, and archive controlled substance prescriptions.

Section IX provides a summary of the proposed rule requirements and their current implementation status.

Section X is a section-by-section analysis of the proposed rule.

Section XI describes a system for the electronic prescribing of controlled substances that DEA is proposing specifically for use by Federal health care agencies (including the United States Army, Navy, Marine Corps, Air Force, Coast Guard, Department of Veterans Affairs, Public Health Service, and Bureau of Prisons). These agencies would be permitted to use either system for controlled substances prescribing and dispensing.

Section XII discusses the incorporation by reference of one standard published by the National Institute of Standards and Technology.

Section XIII presents the required analyses on the economic and other impacts of the proposed rule.

II. Framework of the Pertinent Provisions of the CSA and DEA Regulations

In enacting the CSA, Congress sought to control the diversion of pharmaceutical controlled substances into illicit markets by establishing a “closed system” of drug distribution governing the legitimate handlers of controlled substances. H. Rep. No. 91-1444,

reprinted in

1970 U.S.C.C.A.N. 4566, 4571-72. Under this closed system, all legitimate manufacturers, distributors, and dispensers of controlled substances must register with DEA and maintain strict accounting for all controlled substance transactions

(Id.)

.

The CSA defines “dispense” to include, among other things, the issuance of a prescription by a practitioner as well as the delivery of a controlled substance to a patient by a pharmacy pursuant to a prescription (21 U.S.C. 802(10)). Thus, both practitioners who prescribe controlled substances and pharmacies that fill such prescriptions must obtain a DEA registration (21 U.S.C. 822(a)(2)). The CSA definition of practitioner (21 U.S.C. 802(21)) includes, among others, physicians, dentists, veterinarians, pharmacies, and, where authorized by an appropriate State authority, physician assistants and advance practice nurses.

It is important to reiterate here that DEA registers pharmacies, as opposed to pharmacists. As a rule, pharmacists themselves do not have the authority to independently prescribe controlled substances. Rather, pharmacists rely on the prescription, as written by the individual practitioner, for authority to conduct the dispensing.

Under longstanding Federal law, for a prescription for a controlled substance to be valid, it must be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice (

United States

v.

Moore, 423 U.S. 122 (1975)

; 21 CFR 1306.04(a)). As the DEA regulations state: “The responsibility for the proper prescribing and dispensing of controlled substances is upon the prescribing practitioner, but a corresponding responsibility rests with the pharmacist who fills the prescription.” (21 CFR 1306.04(a)).

The CSA provides that a controlled substance in Schedule II may only be dispensed by a pharmacy pursuant to a “written prescription,” except in emergency situations (21 U.S.C. 829(a)). In contrast, for controlled substances in Schedules III and IV, the CSA provides that a pharmacy may dispense pursuant to a “written or oral prescription.” (21 U.S.C. 829(b)). Where an oral prescription is permitted by the CSA, the DEA regulations further provide that a practitioner may transmit to the pharmacy a facsimile of a written prescription in lieu of an oral prescription (21 CFR 1306.21(a)).

Enforcement of the Controlled Substances Act

The Controlled Substances Act is unique among criminal laws in that it stipulates acts pertaining to controlled substances that are permissible. That is, if the CSA does not explicitly permit an action pertaining to a controlled substance, then by its lack of explicit permissibility the act is prohibited. Violations of the Act can be civil or criminal in nature, which may result in administrative, civil, or criminal proceedings. Remedies under the Act can range from modification or revocation of DEA registration, to civil monetary penalties or imprisonment, depending on the nature, scope, and extent of the violation.

Specifically, it is unlawful for any person knowingly or intentionally to manufacture, distribute, or dispense, a controlled substance or to possess a controlled substance with the intent of manufacturing, distributing, or dispensing that controlled substance, except as authorized by the Controlled Substances Act (21 U.S.C. 841(a)(1)).

Further, it is unlawful for any person knowingly or intentionally to possess a controlled substance unless such substance was obtained directly, or pursuant to a valid prescription or order, issued for a legitimate medical purpose, from a practitioner, while acting in the course of the practitioner's professional practice, or except as otherwise authorized by the CSA (21 U.S.C. 844(a)). It is unlawful for any person to knowingly or intentionally acquire or obtain possession of a controlled substance by misrepresentation, fraud, forgery, deception, or subterfuge (21 U.S.C. 843(a)(3)).

It is unlawful for any person knowingly or intentionally to use a DEA registration number that is fictitious, revoked, suspended, expired, or issued to another person in the course of dispensing a controlled substance, or for the purpose of acquiring or obtaining a controlled substance (21 U.S.C. 843(a)(2)).

Beyond these possession and dispensing requirements, it is unlawful for any person to refuse or negligently fail to make, keep, or furnish any record (including any record of dispensing) that is required by the CSA (21 U.S.C. 842(a)(5)). It is also unlawful to furnish any false or fraudulent material information in, or omit any information from, any record required to be made or kept (21 U.S.C. 843(a)(4)(A)).

Within the CSA's system of controls, it is the individual practitioner (e.g., physician, dentist, veterinarian, nurse

practitioner) who issues the prescription authorizing the dispensing of the controlled substance. This prescription must be issued for a legitimate medical purpose and must be issued in the usual course of professional practice. The individual practitioner is responsible for ensuring that the prescription conforms to all legal requirements. The pharmacist, acting under the authority of the DEA-registered pharmacy, has a corresponding responsibility to ensure that the prescription is valid and meets all legal requirements. The DEA-registered pharmacy does not order the dispensing. Rather, the pharmacy, and the dispensing pharmacist, merely rely on the prescription as written by the DEA-registered individual practitioner to conduct the dispensing.

Thus, a prescription is much more than the mere method of transmitting dispensing information from a practitioner to a pharmacy. The prescription serves both as a record of the practitioner's determination of the legitimate medical need for the drug to be dispensed, and as a record of the dispensing, providing the pharmacy with the legal justification and authority to dispense the medication prescribed by the practitioner. The prescription also provides a record of the actual dispensing of the controlled substance to the ultimate user (the patient) and, therefore, is critical to documenting that controlled substances held by a pharmacy have been dispensed legally. The maintenance by pharmacies of complete and accurate prescription records is an essential part of the overall CSA regulatory scheme established by Congress, wherein all those within the legitimate distribution chain must strictly account for all controlled substances on hand, as well as those received, sold, delivered, or otherwise disposed of (21 U.S.C. 827). The CSA recordkeeping requirements for prescriptions are somewhat unusual in that the practitioner is not required to maintain a record of prescriptions written; instead, the record is held only by the pharmacy.

Abuse of Controlled Substances

The level of control mandated by Congress for controlled substances far exceeds that for other prescription drugs commensurate with the facts that controlled substances can cause physical and psychological dependence and have historically been abused. Several studies of drug abuse patterns indicate that nonmedical use of prescription controlled substances (those in Schedules II through V) is an increasing problem even as the use of certain Schedule I substances appears to have declined somewhat in recent years.

The National Survey on Drug Use and Health (NSDUH) (formerly the National Household Survey on Drug Abuse) is an annual survey of the civilian, non-institutionalized, population of the United States aged 12 or older. The survey is conducted by the Office of Applied Studies, Substance Abuse and Mental Health Services Administration, of the Department of Health and Human Services. Findings from the 2006 NSDUH were released in September 2007 and are the latest year for which information is currently available.

The 2006 NSDUH

1

estimated that 20.4 million Americans were classified with substance dependence or abuse (8.3 percent of the total population aged 12 or older). Further, the 2006 NSDUH estimated that 6.7 million persons were current users, i.e., past 30 days, of psychotherapeutic drugs—pain relievers, anti-anxiety medications, stimulants, and sedatives—taken nonmedically. This represents 2.8 percent of the population aged 12 or older. Specifically, the NSDUH estimated that 5.2 million persons used pain relievers, 1.8 million used tranquilizers, 1.2 million used stimulants, and 0.4 million used sedatives. Except for tranquilizers, these estimates are increases from the corresponding estimates for 2005.

1

Substance Abuse and Mental Health Services Administration. (2007).

Results From the 2006 National Survey on Drug Use and Health: National Findings

(Office of Applied Studies, NSDUH Series H-32, DHHS Publication No. SMA 07-4293). Rockville, MD.

http://www.oas.samhsa.gov/nhsda.htm

.

According to the NSDUH, more than 20 percent of persons age 12 or older have used psychotherapeutic drugs nonmedically in their lifetime. Overall, 33 million Americans are estimated to have used prescription pain killers for nonmedical reasons in their lifetime. Specific pain relievers with statistically significant increases in lifetime use for 18 to 25 year olds between 2003 and 2006 were the Schedule III controlled substances Vicodin®, Lortab®, or Lorcet® (from 15.0 percent to 18 percent); Schedule III controlled substances containing hydrocodone (from 16.3 percent to 19.2 percent); the Schedule II controlled substance OxyContin® (from 3.6 percent to 5.1 percent); and the Schedule II controlled substances containing oxycodone (from 8.9 percent to 10.8 percent).

Results of a separate study of seventh through twelfth grade students were released April 21, 2005, by the Partnership for a Drug-Free America. The Partnership Attitude Tracking Study

2

tracks consumers' exposure to and attitudes about drugs. The study focuses on perceived risk and social attitudes. For the first time in its seventeen-year history, the study found that teenagers are more likely to have abused a prescription pain medication to get high than they are to have experimented with a variety of illicit drugs including Ecstasy, cocaine, crack and LSD. In 2004, the study reported that nearly one in five teenagers, 18 percent, or 4.3 million teenagers nationally, indicated they have used the Schedule III controlled substance Vicodin® without a prescription. Approximately ten percent of teens, or 2.3 million teens nationally, reported using the Schedule II controlled substance OxyContin® without a prescription. Further, the study reported that ten percent, or 2.3 million teenagers nationally, reported having used prescription stimulants, Ritalin® and/or Adderall®, without a prescription. The 2005 survey indicated that 50 percent of the teenagers surveyed indicated that prescription drugs are widely available; a third indicated that they were easy to purchase over the Internet.

2

Partnership for a Drug-Free America; Partnership Attitude Tracking study, 2005;

http://www.drugfree.org/Portal/DrugIssue/Research/

.

The 2006 National Institute of Drug Abuse survey of drug use by teens in the eighth, tenth, and twelfth grades, Monitoring the Future: National Results on Adolescent Drug Use

3

, found that past-year nonmedical use of Vicodin® (Schedule III) remained high among all three grades, with nearly one in ten high school seniors using it in the past year. Despite a drop from 2005 to 2006 in past-year abuse of OxyContin® among twelfth graders (from 5.5 percent to 4.3 percent), there has been no such decline among the eighth and tenth grade students, and the rate of use among the youngest students has increased significantly since it was included in the survey in 2002.

3

Johnston, L. D., O'Malley, P. M., Bachman, J. G., and Schulenberg, J. E. (2007).

Monitoring the Future national results on adolescent drug use: Overview of key findings, 2006.

(NIH Publication No. 07-6202). Bethesda, MD: National Institute on Drug Abuse;

http://www.monitoringthefuture.org/pubs.html

.

The consequences of prescription drug abuse are seen in the data collected by the Substance Abuse and Mental Health Services Administration on emergency room visits. In the latest data, Drug Abuse Warning Network (DAWN), 2005: National Estimates of Drug-Related Emergency Department Visits,

4

SAMHSA estimates that about

599,000 emergency department visits involved nonmedical use of prescription or over-the-counter drugs or dietary supplements, a 21 percent increase over 2004. Of the 599,000 visits, 172,000 involved benzodiazepines (Schedule IV) and 196,000 involved opiates (Schedule II and III). Overall, controlled substances represented 66 percent of the estimated emergency department visits. Between 2004 and 2005, the number of visits involving opiates increased 24 percent and the number involving benzodiazepines increased 19 percent. About a third (200,000) of all visits involving nonmedical use of pharmaceuticals resulted in admission to the hospital; about 66,000 of those individuals were admitted to critical care units; 1,365 of the visits ended with the death of the patient. More than half of the visits involved patients 35 and older.

4

Substance Abuse and Mental Health Services Administration, Office of Applied Studies.

Drug

Abuse Warning Network, 2005: National Estimates of Drug-Related Emergency Department Visits

. DAWN Series D-29, DHHS Publication No. (SMA) 07-4256, Rockville, MD, 2007;

http://dawninfo.samhsa.gov/pubs/edpubs/default.asp

.

Means by Which Controlled Substances Are Diverted

Understanding the means by which controlled substances are diverted is critical to determining appropriate regulatory controls. Diversion of prescription controlled substances can occur in a number of ways, including, but not limited to, the following:

• Prescription pads are stolen from practitioners' offices by patients, staff, or others and illegitimate prescriptions are written.

• Legitimate prescriptions are altered to obtain additional amounts of legitimately prescribed controlled substances.

• Drug-seeking patients may falsify symptoms and/or obtain multiple prescriptions from different practitioners for their own use or for resale. In some cases, organized groups visit practitioners with fake symptoms to obtain prescriptions, which are filled and resold. Some patients resell their legitimately obtained drugs to earn extra money.

• Prescription pads containing legitimate practitioner information (e.g., name, address, DEA registration number) are printed with a different call back number that is answered by an accomplice to verify the prescription.

• Computers and scanning or copying equipment are used to create prescriptions for nonexistent practitioners or to copy legitimate practitioners' prescriptions.

• Pharmacies and other locations where controlled substances are stored are robbed or burglarized.

Diversion from within the practitioner's practice or pharmacy may also occur, such as in the following situations:

• Prescriptions are written for other than a legitimate medical purpose. Some practitioners knowingly write prescriptions for nonmedical purposes. Criminal organizations commonly referred to as “rogue Internet pharmacies” often employ practitioners to issue prescriptions based on online questionnaires from patients with whom the practitioner has no legitimate medical relationship.

• Controlled substances are stolen from a pharmacy by pharmacy personnel. Legitimately dispensed prescriptions may be altered to make the thefts less detectable.

• Legitimate prescriptions may be stolen from legitimate patients. The stolen legitimate prescriptions may be filled by persons addicted to or abusing controlled substances.

Given these common methods of diversion, as well as the alarmingly increasing extent of prescription controlled substance abuse in the United States, many of those at the DEA/HHS public meeting in 2006, particularly representatives of Federal and state law enforcement and regulatory agencies, emphasized that any system allowing the electronic prescribing of controlled substances must have sufficient safeguards to prevent contributing further to the diversion problem in this country. Indeed, this is true regardless of the means used to divert controlled substances in the paper-based system, because electronic prescribing of controlled substances could, if not properly implemented, present another means of diversion in addition to those listed above. However, with proper controls, the risk of diversion can actually be reduced through the use of electronic prescriptions. Among the essential elements of such a system are ensuring that only DEA registrants electronically sign and authorize controlled substance prescriptions and that the prescription record cannot be altered without the alteration being detectable. A system that fails to provide verification of the signer's identity and authority to issue controlled substance prescriptions, and/or fails to ensure that alteration of the record is detectable, would create new routes of diversion that could be even harder to prevent and detect.

III. Current Requirements for Prescriptions for Controlled Substances

As noted above, the CSA requires that, except in limited emergency circumstances, a pharmacist may only dispense a Schedule II controlled substance pursuant to a written prescription from a practitioner (21 U.S.C. 829(a)). For Schedule III and IV controlled substances, a pharmacist may dispense the controlled substance pursuant to a written or oral prescription from a practitioner (21 U.S.C. 829(b)). Every written prescription must be signed by the practitioner in the same way the practitioner would sign a check or other legal document, e.g., “John H. Smith” or “J.H. Smith” (21 CFR 1306.05). A prescription for a controlled substance may be issued only by an individual practitioner who is authorized to prescribe by the State in which he is licensed to practice and is registered, or exempted from registration, with DEA (21 U.S.C. 822, 823). To be valid, a prescription must be written for a legitimate medical purpose by an individual practitioner acting in the usual course of professional practice; a corresponding responsibility rests with the pharmacist who fills the prescription (21 CFR 1306.04). An order purporting to be a prescription issued not in the usual course of professional treatment is not a prescription within the meaning and intent of the Controlled Substances Act, and the person knowingly filling such a purported prescription, as well as the person issuing it, is subject to the penalties provided for violations of the provisions of law relating to controlled substances.

Longstanding DEA regulations specify that each controlled substance prescription contain certain information including the practitioner's manual signature (21 CFR 1306.05). The manual signature affixed to the controlled substance prescription by the practitioner serves as formal attestation by the practitioner that the prescription has been written for a legitimate medical purpose and affirms the practitioner's authority to prescribe the controlled substance in question. The prescribing practitioner is responsible in case the prescription does not conform in all essential respects to the law and regulations. Further, a corresponding liability rests upon the pharmacist who fills a prescription not prepared in the form prescribed by DEA regulations (21 CFR 1306.05).

A prescription may be filled only by a pharmacist acting in the usual course of professional practice who is

employed in a registered pharmacy (21 CFR 1306.06). Except under limited circumstances, a pharmacist may dispense a Schedule II controlled substance only upon receipt of the original written prescription manually signed by the practitioner (21 U.S.C. 829, 21 CFR 1306.11). A pharmacist may dispense a Schedule III or IV controlled substance only pursuant to a written and manually signed prescription from an individual practitioner, which is presented directly or transmitted via facsimile to the pharmacist, or an oral prescription, which the pharmacist promptly reduces to writing containing all of the information required to be in a prescription, except the signature of the practitioner (21 U.S.C. 829, 21 CFR 1306.21).

Every prescription must be initialed and dated by the pharmacist filling the prescription (21 CFR 1304.22(c)). Under many circumstances, pharmacists are required to note certain specific information regarding dispensing on the prescription or recorded in a separate document referencing the prescription before the prescription is placed in the pharmacy's prescription records.

DEA requires the registered pharmacy to maintain records of each dispensing for two years from the date of dispensing of the controlled substance (21 U.S.C. 827(b), 21 CFR 1304.04). However, many States require that these records be maintained for longer periods of time. These records must be made available for inspection and copying by authorized employees of DEA (21 U.S.C. 827(b)). This system of records is unique in that the prescribing practitioner creates the prescription, but the dispensing pharmacy retains the record.

The signature requirement for written prescriptions for controlled substances provides DEA with reliable evidence needed to enforce the CSA in administrative, civil, and criminal legal proceedings. In criminal proceedings for violations of the CSA, the Government must prove the violation beyond a reasonable doubt. As the agency responsible for monitoring compliance with the regulatory requirements of the CSA, it is essential that DEA have the ability to determine whether a given prescription for a controlled substance was, in fact, signed by the practitioner whose name appears on the prescription. It is likewise essential that DEA have the ability to determine that a prescription that has been filled by a pharmacy was not altered after it was prepared by the practitioner. Further, because DEA relies on the records of these prescriptions in the conduct of investigations, DEA must also know that the prescription has not been altered after receipt by the pharmacy.

The elements of the prescription that identify the practitioner (the practitioner's name, address, DEA registration number, and signature) also serve to enable the pharmacy to authenticate the prescription. If a pharmacy is unfamiliar with the practitioner, it can use the registration number to verify the identity of the practitioner through publicly available records. Those same records would indicate to the pharmacy whether the practitioner has the authority to prescribe the schedule of the controlled substance in question.

Requiring that the original documents be maintained in paper form serves to support both the accuracy and integrity of each record and, thus, the accuracy and integrity of the system of records as a whole. The availability of the original written and manually signed prescription provides a level of document integrity and provides physical evidence if the record has been altered: alterations of a hard-copy record are usually apparent upon close examination. A forensic examination of a prescription can prove that a practitioner signed it or, equally important, that the practitioner did not sign it. The maintenance of the paper record at a pharmacy also ensures that State and local law enforcement agencies have access to records they need for investigations. In addition, there will be a limited number of pharmacy employees who will have annotated the record and can testify that the prescription is, in fact, the prescription they received and dispensed.

IV. Existing Electronic Prescription Systems

At present, there are more than 110 service providers that offer systems to generate electronic prescriptions and approximately 20 that handle the receipt of prescriptions at pharmacies.

5

The electronic capabilities of practitioners' offices and pharmacies and the systems used are considerably different. Both types of systems, however, can be classified in the same ways. Systems may be stand-alone software that only handle prescriptions or integrated into larger management systems. In general, pharmacy systems are part of larger pharmacy management systems. Most electronic prescription systems are now integrated into larger electronic health records (EHR) systems; existing stand-alone systems may be integrated into EHR systems in the future.

6 7

5

Estimates are based on the number of systems certified by SureScripts plus the number of electronic medical record systems certified by the Certification Commission for Health Information Technology.

6

National Alliance on Health Information Technology, “Report to the office of the National Coordinator on Health Information Technology on Defining Key Health Information Technology Terms”, April 28, 2008.

http://www.nahit.org/cms/images/docs/hittermsfinalreport_051508.pdf

.

7

The National Alliance for Health Information Technology has defined the terms “electronic Medical record (EMR),” “electronic health record (EHR),” and “personal health record (PHR).” Both EMRs and EHRs are defined to be maintained by practitioners, whereas a PHR is defined to be maintained by the individual patient. The main distinction between an EMR and an EHR is the EHR's ability to exchange information interoperably. DEA's use of the term EHR in this rule relates to those records maintained by practitioners, as opposed to a PHR maintained by an individual patient, regardless of how those records are maintained.

Systems may also be installed on a practice or pharmacy computers or may be operated by application service providers (ASPs). In the ASP model, the program is retained on the ASP servers and the user accesses the system using leased lines or over the Internet. The ASP retains the records generated. Many pharmacy systems are installed at the pharmacy, but larger chains often operate like an ASP, holding the records on a central server that any pharmacy in the chain may access. Many practitioner stand-alone electronic prescription systems are ASPs. Because practitioners want to be able to access the system when they are out of the office, access is usually over the Internet. Practitioners log on to the system using the same kinds of identification mechanisms as other online business sites (passwords, user IDs).

Pharmacy Systems

. Almost all pharmacies have computerized prescription records, which are integrated into overall pharmacy management systems that process insurance claims and billings. When a pharmacy receives a prescription on paper or by phone, the pharmacist or technician keys the information on the prescription into the system; if the patient has had other prescriptions filled at that pharmacy, the patient's personal identifying information is already in the system and does not have to be rekeyed.

Many pharmacy systems have been reprogrammed to be able to capture the data from electronic prescriptions directly. Although many pharmacies have the ability to accept electronic prescriptions, few such prescriptions are sent currently. Many of the “electronic prescriptions” generated are in fact transmitted to the pharmacy as faxes or simply printed out and given to

the patient. Renewals are more likely to be handled electronically than original prescriptions. Nonetheless, the capability to accept electronic prescriptions is widespread in the pharmacy sector.

Practitioner Electronic Prescription Systems

. Electronic prescription systems for practitioners have existed for a number of years, but are still not widely used. A Centers for Disease Control and Prevention (CDC) study of electronic medical record (EMR) system use in 2006 found that about 12 percent of physicians have the ability to send prescriptions electronically using their EMR system.

8

The number of those systems that are used or that generate true electronic prescriptions is unclear. A Rand Health study of 58 electronic prescribing systems found that only 58 percent allowed electronic transmission of the prescriptions (as a data file), while almost all produced printed prescriptions and most could generate faxes.

9

The CDC study indicated that the electronic prescribing function is one of the less used functions of EMRs.

8

Centers for Disease Control and Prevention, “Electronic Medical Record Use by Office-Based Physicians and Their Practices: United States 2006.”

Advance Data from Vital and Health Statistics

, Number 393, October 26, 2007.

9

Wang, C. Jason

et al.

, “Functional Characteristics of Commercial Ambulatory Electronic Prescribing Systems: A Field Study,”

Journal of the American Medical Informatics Association

, 2005; 12:346-356.

As noted above, many electronic prescription systems are Web-based ASPs. The ASP maintains the records, which reduces the initial cost to the practice by limiting the investment in hardware and connections. The ASP enrolls a practice, issues keys or sets up other authentication mechanisms, which allow the practitioner to log onto the system from any location. Most ASP systems and some installed systems can be accessed using PDAs and other handheld devices. Because many office staff may need to access the systems, many service providers also set different levels of authority so that only practitioners may sign prescriptions; the ability to support varying access levels is a requirement for EHR certification for systems certified by the Certification Commission for Healthcare Information Technology (CCHIT). Over the long term, it is generally assumed that stand-alone electronic prescription systems will be integrated into or replaced by electronic health record (EHR) systems. In this way, data on prescriptions will be automatically added to a patient's records. This shift to EHRs is occurring rapidly. Of the 119 systems certified by SureScripts or CCHIT at the end of 2007, 103 were EHRs. DEA welcomes comments on the protections currently implemented in the systems referenced above to protect against noncontrolled substance prescription forgery, fraud, and other related crimes, and what risk-mitigating controls are in place.

DEA also seeks comment as to whether up-to-date information or statistics are available regarding physicians' ability to send noncontrolled substance prescriptions electronically using their EHR systems and usage of such system functionality. When providing comments regarding this or any other request in this NPRM, commenters should clearly cite the source of the information, the origin of the data, the methodology or analytical techniques used to derive the information, and the limitations of the information, so that DEA may determine the quality, objectivity, utility, and integrity of any data or information provided.

Intermediaries

. With so many electronic prescription systems and pharmacy systems, the issue of interoperability is critical. Electronic prescriptions will be of limited value to pharmacies if their systems cannot read the prescription and translate the data directly into their databases. To deal with this issue, the National Council for Prescription Drug Programs (NCPDP) has established a standard format for prescriptions, NCPDP SCRIPT standard in XML (current version is 10, but version 8.1 is the standard that Medicare specifies). Despite the standard, interoperability problems are likely to continue as both practitioner and pharmacy systems may be using different platforms and different versions of SCRIPT. At present, the interoperability problem is solved by using intermediaries that reformat the prescription so that the receiving pharmacy will be able to process it electronically.

Electronic prescriptions are transmitted through not one, but a series of intermediaries. The first recipient, once the prescription is signed, may be the ASP or an aggregator that the electronic prescription system uses. This recipient assigns a trace number to the electronic prescription that becomes part of the prescription record. The ASP or aggregator generally will transmit it to SureScripts or a similar intermediary. SureScripts is a service established by the pharmacy industry to reformat the prescriptions so the receiving pharmacy's system can process them without rekeying the information. SureScripts certifies both pharmacy and practitioner service providers, to ensure that the data it receives will be translatable into other formats. SureScripts may transmit the reformatted electronic prescription directly to a pharmacy, the central server of a chain pharmacy, or the ASP pharmacy management system, which then routes the prescription to the pharmacy for ultimate dispensing. DEA welcomes comments on the protections currently implemented by intermediaries to protect against noncontrolled substance prescription forgery, fraud, and other related crimes, and what risk-mitigating controls are in place. DEA also welcomes comments regarding the current standards and practices used by network intermediaries to route noncontrolled substance electronic prescriptions and whether such networks allow or provide the capability to “open” an electronic prescription that is en route.

Hospitals

. A final complexity to the electronic prescription network arises from practitioners who serve on the staff of hospitals. Two technical issues exist with any electronic prescriptions these practitioners may write. First, hospital electronic record systems are written in computer languages other than SCRIPT, often HL7. If a staff practitioner writes an electronic prescription for a patient to fill at a pharmacy outside of the hospital, the intermediaries or pharmacies have to be able to translate the electronic prescriptions from HL7 to their own computer system language. Second, staff practitioners are not required to register with DEA. They are allowed to issue prescriptions under the hospital DEA registration number with a hospital-assigned extension that identifies the specific person issuing the prescription. DEA does not dictate the format of the extension. In at least some cases, pharmacy computer systems have not been able to handle the extensions.

V. Potential Vulnerabilities That Need To Be Addressed To Prevent Electronic Prescribing From Contributing to the Diversion of Controlled Substances

Many parties in the healthcare industry are encouraging the adoption of electronic prescriptions because such prescriptions have the potential to improve patient safety by eliminating medical errors that arise from misread or misunderstood prescriptions and eliminating adverse events that result from drug interactions. They can also control costs by ensuring that more drugs prescribed are covered by formularies or are generic versions.

Although DEA also supports electronic prescribing, the Administration faces some challenges as it moves into an electronic world. A recent study conducted for HHS by the

American Health Information Management Association

10

noted that “e-prescribing presents a new vulnerability because of the increased velocity of authenticated automated transactions.” Unless an electronic prescription system is properly designed, DEA's ability to prevent diversion and take legal action against those who violate the CSA could be seriously undermined.

10

American Health Information Management Association, “

Report on the Use of Health Information Technology to Enhance and Expand Health Care Anti-Fraud Activities,

” [September 2005] p. 45.

As discussed above, with the paper-based system, the paper records provide DEA and other law enforcement agencies with documents that can be used in legal actions to prove that a practitioner has issued prescriptions for other than legitimate medical purposes, that others have forged prescriptions, or that pharmacy records or inventories are inconsistent with prescriptions received. The necessity for presenting prescriptions to pharmacies and picking up the drugs also limits the scope of diversion when it occurs. In contrast, electronic prescriptions can be easy to create, transmit, and alter, often without leaving a trail that links the person forging or altering a prescription to the record. Not only practice and pharmacy staff, but also staff at any of the systems involved in creating, transmitting, and processing prescriptions could generate or alter prescriptions. With the Internet and mail order pharmacies, those bent on diversion gain the ability to send prescriptions to a large number of pharmacies with a few keystrokes.

DEA's concerns with the existing electronic prescription system are the following:

• Service providers do not always determine whether the people enrolling are legally permitted to issue prescriptions, let alone controlled substance prescriptions. Some service providers appear to enroll practices over the Internet; some require submission of copies of the person's DEA registration and State license. Such procedures provide no assurance that authority to issue controlled substance electronic prescriptions will not be granted to people who are not DEA registrants. The DEA registrant list, including DEA registration numbers, is publicly available. The DEA number also appears on each controlled substance prescription and in many cases is preprinted on prescription pads so that any patient receiving a prescription for any drug, regardless of whether it is a controlled substance, will have access to the number. State license information is readily accessible from online State databases. Office staff may have access to the originals to copy. Copies of registration and license certificates would be easy to generate and submit. Present service provider procedures do not protect a practitioner from someone inside or outside the practitioner's practice setting up an account and creating fraudulent prescriptions in the practitioner's name. Moreover, current system designs could also allow a practitioner to repudiate prescriptions written for the purpose of diversion.

• Some systems may not limit who within a medical practice can “sign” prescriptions. Many staff at practices may have legitimate needs to access the system; only some have a legal right to sign prescriptions. Unless systems limit the “signing” function to practitioners with a legal right to issue prescriptions and provide unique identifiers that make it possible to determine who signed the prescription, taking enforcement action against practitioners who issue illegal prescriptions will be impossible because DEA will not be able to prove beyond a reasonable doubt who signed the prescription. This problem is exacerbated because “signing” in an electronic prescription system is a function that is usually nothing more than a keystroke that indicates that the prescription is complete; there is no “signature” applied to the prescription. In some cases, there may not be a “signing” function, but simply a command to transmit. (The SCRIPT standard does not currently provide a field for an electronic signature or an indication that the prescription has been signed.)

• Access to systems is usually by means of easily shared or stolen information (passwords, user IDs). As William Winsley, Executive Director of the Ohio Board of Pharmacy testified at the DEA/HHS July 2006 public meeting, “Passwords are useless as a means of computer security in a healthcare setting.” Too many people are in the vicinity of computers in practice offices to be certain that a password has not been compromised. If passwords or PINs are the only means of authentication for an electronic prescription system, law enforcement agencies will not be able to prove beyond a reasonable doubt who signed an electronic prescription. Practitioners will be able to repudiate prescriptions by saying that someone must have used their passwords.

• Once created and signed, electronic prescriptions pass through several intermediaries, all of which may open the record. Although this process is usually handled without individuals accessing the record, there is no guarantee that they could not do so. Most identity theft occurs not from people hacking into systems, but rather from insiders who know how to manipulate the system. Paul Donfried of SAFE BioPharma

11

and Strategic Identity Group noted at the July 2006, DEA/HHS public meeting: “It generally is not the cryptography or the firewalls or the audit logs or the data centers that people attack. It is whatever the weak link in the chain is, which normally is the human beings who are responsible for keeping the stuff running and operating correctly.”

11

SAFE BioPharma is an organization “that created and manages the SAFE digital identity and signature standard for the pharmaceutical and healthcare industries.”

• The processing of the prescriptions by multiple parties could mean that law enforcement would have to prove that none of the parties altered the document. This requirement could substantially increase the cost of bringing cases against registrants who are diverting controlled substances as well as burden the service providers and intermediaries, which would have to produce audit trail records and experts to testify.

• The records of the prescriptions are often held by the service providers and intermediaries, not the pharmacies. With paper records, DEA and other law enforcement agencies have the right to inspect and remove records from pharmacies. With electronic records held by service providers and others, DEA and other agencies would have to subpoena records from the third parties—nonregistrants over whom law enforcement may have limited jurisdiction. Although this is a lesser problem for DEA, it could pose a substantial barrier to State and local law enforcement, which would be in the position of having to find other agencies willing to serve subpoenas on service providers who were located in other States.

• Records of electronic prescriptions at pharmacies and at intermediaries may be stored as strings of data, not as easily read text. These records must be able to be downloaded into a format that is easily read and manipulated by law enforcement.

DEA is convinced that its concerns can be addressed without creating insurmountable barriers to electronic prescribing. DEA's requirements in developing this proposed rule are the following:

• The approach must meet DEA's statutory mandates. Only DEA registrants may be granted the authority

to sign controlled substance electronic prescriptions.

• The method used to authenticate a practitioner to the electronic prescribing system must ensure to the greatest extent possible that the practitioner cannot repudiate the prescription. Authentication methods that can be compromised without the practitioner being aware of the compromise are not acceptable.

• Electronic prescriptions must include all information required for paper controlled substance prescriptions.

• The prescription records must be reliable enough to be used in legal actions without having to substantially expand the number of witnesses that need to be called to verify records.

• The pharmacy system must allow annotation of the records as required for paper prescriptions and must indicate who made each annotation.

• The security systems used by any of the service providers must, to the greatest extent possible, prevent the possibility of insider creation or alteration of controlled substance prescriptions.

In addition, DEA wishes to adopt an approach that is flexible enough that future changes in technologies will not make the system obsolete or lock registrants into more expensive systems. DEA notes that its requirements do not relate to most of the functions of electronic prescribing systems. Other than requiring that the electronic prescription contain the basic information that any controlled substance prescription must contain (and that most prescriptions contain), DEA is not concerned about the format or transmission standards, or any of the added functions (formulary checks, clinical support, medication histories) available in electronic prescribing systems.

Further, as DEA notes throughout this document, the electronic prescribing of controlled substances is in addition to, not a replacement of, existing requirements for written and oral prescriptions for controlled substances. This proposed rule would provide a new option to prescribing practitioners and pharmacies. It does not change existing regulatory requirements for written and oral prescriptions for controlled substances. Prescribing practitioners will still be able to write, and manually sign, prescriptions for Schedule II, III, IV, and V controlled substances, and pharmacies will still be able to dispense controlled substances based on those written prescriptions and archive those records of dispensing.

VI. Alternatives Considered

In developing this rule, DEA considered a range of alternatives, from imposing virtually no requirements on existing systems to requiring systems using public key infrastructure. This section discusses the options considered and why DEA rejected some of them.

Allowing the use of any existing electronic prescription system without additional security.

DEA considered whether to permit electronic prescribing of controlled substances using existing systems without any additional requirements. This would be the alternative most supported by service providers of existing electronic prescribing systems, as it would require no system modifications and would allow for the electronic prescribing of controlled substances as soon as a Final Rule permitting this activity became effective. Some have suggested that DEA permit the use of any existing system; if that system is used for diversion, DEA could then tighten its regulations later.

In discussing this alternative, and to understand why DEA rejected it, it first must be noted that any electronic prescribing systems currently being utilized are generally limited to noncontrolled substances as DEA regulations currently do not allow for the electronic prescribing of controlled substances.

12

Thus, any systems currently in place were not specifically tailored to the unique concerns relating to controlled substances—most notably the heightened need to prevent diversion of controlled substances as compared to noncontrolled substances. It is also important to understand the following regarding the current systems used to create, transmit, and process electronic prescriptions.

12

DEA has granted an exception to its regulations to allow the United States Department of Veterans Affairs to conduct a pilot program involving the electronic prescribing of controlled substances using a system based on public key infrastructure (PKI) technology. PKI-based systems are discussed in greater detail later in this document.

As discussed above, there are more than 100 vendors marketing systems to practitioners and about 20 marketing systems to pharmacies. These vendors range from start-ups with revenues of less than $1 million to a few very large corporations. There are at present no requirements for how these systems enroll practitioners, no requirements that they verify that the person enrolling is who he claims to be or is eligible to sign prescriptions. Some systems offer enrollment over the Internet. There are no requirements that prescriptions be signed only by someone authorized under State law to do so.

Some systems set access controls; others appear to grant general access to everyone in the office; in these systems, the prescription cannot be linked to a single practitioner. Many, perhaps most, of these systems allow access to prescription signing using nothing more than a password or a password/user ID, forms of identification that are easily compromised, especially in a healthcare setting where multiple staff use the same computers. Prescriptions could be created by anyone and signed by anyone. Some systems appear to rely on the good intentions of the practitioners' staff, a reliance that the high degree of insider medical identity theft and insider prescription forgery renders naïve at best.

There are no standards governing the security of the transmission of electronic prescribing systems currently being utilized. Therefore, while some of the intermediaries that handle prescriptions between the practitioner and pharmacy might have voluntarily implemented effective security measures, they are not legally obligated to do so and—in the absence of binding regulatory requirements—there is no way to ensure that they or others who might enter the market will have effective measures in the future. The intermediaries (up to five per transmission) are not required to keep records or audit trails although the best of them do. As ever, the weakest link can undermine the entire system. At the pharmacy, there are no requirements for audit trails or system security. Some pharmacy systems have good security practices, but others might not. Records could be created or altered without leaving a trace.

The existing system, in short, relies on the hope that vendors will employ good security practices; a few vendors may meet these, but others for simplicity or for economic reasons may choose to ignore them. The widespread reliance on simple passwords stored on computers available to any staff member undermines any claim of reasonable security controls. The existing voluntary certification bodies may help, but for transmission they only look at whether the system can interoperate with them. There is, in any case, no requirement that practitioners or pharmacies use only certified vendors; given the high costs of some certified systems, it would be surprising if some practitioners did not elect less expensive, uncertified solutions. Overall, the existing system provides no legal requirements for identity proofing, assurance of nonrepudiation, ability to authenticate the record, and record integrity. It exposes DEA registrants to the threat of

identity theft, insider criminal activity, service provider or intermediary staff criminal activity, and potential criminal penalties for the actions of others that they will find hard to disprove. It creates a new high-speed route for widespread prescription forgery and diversion, which results in drug abuse and deaths. The idea that DEA should wait until this occurs before attempting to impose security requirements cannot be reconciled with the agency's statutory responsibilities and the magnitude of the harm to the public health and safety that would result if an insufficiently secure system were to cause an increase in diversion of controlled substances. Such an idea also fails to properly take into consideration the length of time required to change regulations.

For this alternative, the only way for the pharmacy, dispensing pharmacist, and DEA to ensure that the prescription a pharmacy received was, in fact, issued by the practitioner whose name and DEA registration number are on the prescription would be to require the pharmacy to call the practitioner and confirm each prescription. For DEA to allow a controlled substance prescription to be dispensed without this check would be to abdicate its statutorily mandated responsibilities. Although this alternative would impose the fewest burdens on service providers, it would be hugely expensive for practitioners and pharmacies, requiring up to 300 million callbacks a year. DEA has estimated the costs of this alternative, but DEA does not consider that the costs could be justified or that practitioners or pharmacies would adopt this alternative given the increased burden that it would represent.

Public Key Infrastructure.

DEA considered proposing that all electronic controlled substance prescriptions be digitally signed using a digital certificate issued by a recognized Certification Authority. Under this approach, the prescription as signed and the digital signature would be sent to the pharmacy, which would be required to validate the prescription to ensure that it had not been altered after signature. This alternative would provide DEA and other law enforcement agencies with the best forensic evidence, and it would provide practitioners and pharmacies with the best protection against identity theft and forgeries, reducing their legal exposure. However, DEA has been advised that existing systems which follow the standards adopted by the Secretary of HHS pursuant to the MMA for electronic transmission of prescriptions and prescription-related information for covered Part D drugs prescribed for Part D eligible individuals are incompatible with the requirement of digitally signed prescriptions. Electronic prescriptions are processed through intermediaries that may reformat the prescriptions to ensure that the receiving pharmacy can capture the data; the reformatting makes validation of the record impossible. In addition, the intermediaries have expressed concern about incorporating the digital signature, which is usually at least 128 bits, within the current SCRIPT standard. Consequently, DEA does not consider this option to be a viable mandatory approach.

DEA considered and is proposing two options:

Electronically signed prescriptions with security controls.

Under this alternative, practitioners would be required to undergo in-person identity proofing and submit documentation of that to a service provider. The identity proofing would be conducted by a DEA-registered hospital, a State licensing board, or State or local law enforcement agency. The service provider would be required to check the validity of the DEA registration and State license before issuing an authentication protocol to be used to sign controlled substance prescriptions. The authentication protocol would have to be two-factor, with one factor stored on a hard token (e.g., a PDA, a multifactor one-time-use password token, a thumb drive, a smart card). DEA would also impose certain system requirements related to the prescription elements and their presentation; most existing systems may already meet these requirements. The prescription would have to be transmitted immediately upon being signed and the service provider would have to digitally sign and archive the record before transmitting the plain text prescription to the intermediaries. The pharmacy would have to digitally sign and archive the prescription as received. The pharmacy system would need an internal audit trail to record any attempts to alter a record and conduct internal checks for such attempts. Both the electronic prescription service provider and the pharmacy system provider would need to obtain annual third-party audits for security and processing integrity. The service provider would have to generate a monthly log, which practitioners would be required to check for obvious anomalies. The rationale for each of the requirements is presented under the discussion of the proposed rule below.

Modified digitally signed prescriptions.

Due to the current use of digital signatures by Federal health care systems, and the added security afforded by such signatures, DEA is proposing to allow practitioners that prescribe controlled substances at Federal health care facilities (e.g., Department of Veterans Affairs, Department of Defense) the additional option of using digital certificates, issued by such Federal agencies, to sign controlled substance prescriptions issued in the course of their official duties within those facilities. These Federal agencies would need to determine that the practitioner is authorized and registered, or exempted from the requirement of registration, to prescribe controlled substances. The private key would be required to be stored on a hard token. Federal agencies will already be meeting this requirement in issuing Personal Identification Verification (PIV) cards under Federal Information Processing Standard 201. Most of the system requirements would be the same as in the previous option except that the Federal agency could elect to allow the practitioner to digitally sign and archive the prescription once the DEA-required elements are complete and transmit later when other information has been added (e.g., retail pharmacy URL). The Federal agency would not have to digitally sign the record as transmitted. The pharmacy requirements would be the same. The digital signature would not be transmitted to the pharmacy; the pharmacy would not have to validate the record. However, if a Federal agency wished to include the digital signature as part of the transmission, DEA is permitting this alternative. In that case, the pharmacy would be required to validate the digital signature, but would not be required to digitally sign the prescription as received. Because a Certification Authority would issue the digital certificate and because record integrity is more assured with a digital signature, DEA would not require a check of a monthly log or third-party audits for security. The rationale for each of the requirements is presented under the discussion of the proposed rule below.

VII. Risk Assessment of Electronic Prescriptions for Controlled Substances

On December 16, 2003, the Office of Management and Budget (OMB) issued guidance to Federal agencies on e-authentication (M-04-04) that directed agencies to conduct e-authentication risk assessments to determine the level of authentication needed. It should be noted that M-04-04 was primarily intended to provide guidance to Federal agencies that utilize services through

the Internet, not private sector entities that do so. However, M-04-04 states: “Private-sector organizations and state, local, and tribal governments whose electronic processes require varying levels of assurance may consider the use of these standards where appropriate.” With this understanding, the document provides a useful illustration of how to identify and analyze the risks associated with the authentication process.

Assurance is the degree of confidence in the vetting process used to establish the identity of an individual to whom a credential was issued, the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued, and the degree of confidence that a message when sent is secure. OMB established four levels of assurance:

Level 1:

Little or no confidence in the asserted identity's validity.

Level 2:

Some confidence in the asserted identity's validity.

Level 3:

High confidence in the asserted identity's validity.

Level 4:

Very high confidence in the asserted identity's validity.

M-04-04 states that to determine the appropriate level of assurance in the user's asserted identity, agencies must assess the potential risks and identify measures to minimize their impact. The document states that the risk from an authentication error is a function of two factors: (a) Potential harm or impact and (b) the likelihood of such harm or impact. The document then specifies six categories of harm that might result from an authentication error:

• Inconvenience, Distress, or Damage to Standing or Reputation

• Financial Loss

• Harm to Agency Programs or Public Interests

• Unauthorized Release of Sensitive Information

• Personal Safety

• Civil or Criminal Violations

With respect to each of these six categories, the agency must assess the potential impact as “low,” “moderate,” or “high.” Table 1 showsOMB's impact criteria for each category of harm.

13

13

Office of Management and Budget. “E-Authentication Guidance for Federal Agencies” M-04-04. December 16, 2003.

Table 1.—M-04-04 Potential Impacts of Authentication Errors

Low impact

Moderate impact

High impact

Potential Impact of Inconvenience, Distress or Damage to Standing or Reputation

At worst, limited short-term inconvenience, distress or embarrassment to any party

At worst, serious short-term or limited long-term inconvenience or damage to the standing or reputation of any party

Severe or serious long-term inconvenience, distress or damage to the standing or reputation to the party (ordinarily reserved for situations with particularly severe effects or which may affect many individuals).

Potential Impact of Financial Loss

At worst, an insignificant or inconsequential unrecoverable financial loss to any party, or at worst, an insignificant or inconsequential agency liability

At worst, a serious unrecoverable financial loss to any party, or a serious agency liability

Severe or catastrophic unrecoverable financial loss to any party; or severe or catastrophic agency liability.

Potential impact of harm to agency programs or public interests

At worst, a limited adverse effect on organizational operations, assets, or public interests. Examples of limited adverse effects are: (i) mission capability degradation to the extent and duration that the organization is able to perform its primary functions with noticeably reduced effectiveness; or (ii) minor damage to organizational assets or public interests

Examples of serious adverse effects are: (i) significant mission capability degradation to the extent and duration that the organization is able to perform its primary functions with significantly reduced effectiveness; or (ii) significant damage to organizational assets or public interests

A severe or catastrophic adverse effect on organizational operations or assets, or public interests. Examples of severe or catastrophic effects are: (i) severe mission capability degradation or loss of [sic] to the extent and duration that the organization is unable to perform one or more of its primary functions; or (ii) major damage to organizational assets or public interests.

Potential Impact of unauthorized release of sensitive information

At worst, a limited release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a low impact, as defined in FIPS PUB 199

At worst, a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a moderate impact, as defined in FIPS PUB 199

At worst, a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a high impact, as defined in FIPS PUB 199.

Potential Impact to Personal Safety

At worst, minor injury not requiring medical treatment

At worst, moderate risk of minor injury or limited risk of injury requiring medical treatment

A risk of serious injury or death.

Potential impact of civil or criminal violations

At worst, a risk of civil or criminal violations of a nature that would not ordinarily be subject to enforcement efforts

At worst, a risk of civil or criminal violations that may be subject to enforcement efforts

A risk of civil or criminal violations that are of special importance to enforcement programs.

The Memorandum then states:

Agencies should then tie the potential impact category outcomes to the authentication level, choosing the lowest level of authentication that will cover all of potential impacts identified. Thus, if five categories of potential impact are appropriate for Level 1, and one category of potential impact is appropriate for Level 2, the transaction would require a Level 2 authentication. For example, if the misuse of a user's electronic identity/credentials during

a medical procedure presents a risk of serious injury or death, map to the risk profile identified under Level 4, even if other consequences are minimal.

Again, with the understanding that M-04-04 was not specifically designed to be used by Federal agencies when issuing regulations governing the general public, the logic and method of analysis employed by M-04-04 nonetheless serves as a useful model for completing DEA's task of determining the appropriate level of authentication for electronic prescribing of controlled substances. (In fact, DEA is unaware of any other Government documents that provide any such particularized guidance for completing this task.) For the proposed rule, the two aspects that are relevant to the e-authentication risk assessment are the identity-proofing and the storage of the authentication protocol or digital certificate. The following table presents the six categories of harm and impact using the three OMB-defined potential impact values to determine an identity authentication assurance level for the electronic prescribing of controlled substances (see Attachment A of the memorandum, “E-Authentication Guidance for Federal Agencies”).

Table 2.—Impact of Harms of Electronic Prescriptions for Controlled Substances

Potential impact of authentication errors

DEA rating, OMB description

Comment

Inconvenience, Distress, or Damage to Standing or Reputation

Moderate—At worst, serious short term or limited long-term inconvenience, distress, or damage to the standing or reputation of any party

Identity theft, issuing of illegitimate prescriptions in a practitioner's name, or alteration of prescriptions could expose practitioners to legal difficulties and force them to prove that they had not enrolled in an electronic prescription system or issued specific prescriptions.

Financial Loss

N/A

Harm to Agency Programs or Public Interests

High—A severe or catastrophic adverse effect on organizational operations or assets, or public interests. Examples of severe or catastrophic effects are: (i) Severe mission capability degradation or loss of (sic) to the extent and duration that the organization is unable to perform one or more of its primary functions; or (ii) major damage to organizational assets or public interests

Not to place such strict requirements on authentication protocols used to sign electronic controlled substances prescriptions would open the electronic prescribing system for controlled substances to rampant diversion—diversion which would be very difficult for DEA to detect because of the breadth of the potential problem. Were the authentication protocol of a practitioner compromised, and were controlled substances prescriptions to be diverted for illicit purposes based on that compromised authentication protocol, such diversion would undermine the effectiveness of prescription laws and regulations of the United States. This diversion would, by its very nature, harm the public health and safety, as any illicit drug use does. Such diversion would undermine the effectiveness of the entire closed system of distribution of the United States created by the CSA and supported by international treaty obligations.

Unauthorized release of Sensitive Information

N/A

Personal Safety

High—A risk of serious injury or death

Congress expressly declared in enacting the CSA that the “improper use of controlled substances [has] a substantial and detrimental effect on the health and general welfare of the American people.” (21 U.S.C. 801(2)). Diversion and abuse of controlled substances results in a large number of deaths and medical visits each year; facilitating diversion can be expected to increase the level of abuse and harm.

Civil or Criminal Violations

High—A risk of civil or criminal violations that are of special importance to enforcement programs

Given the framework of the CSA and DEA's core mission to enforce the Act, there is perhaps nothing of greater importance among DEA's administrative responsibilities than ensuring that controlled substances are dispensed only by registered practitioners. The illicit possession of legitimate (pharmaceutical) controlled substances is a violation of the CSA. The writing of a controlled substance prescription by a person not authorized to do so constitutes illegal distribution of controlled substances and is a violation under 21 U.S.C. 841(a)(1). The person writing an illegitimate prescription could be criminally prosecuted; penalties for such a conviction could include imprisonment and/or fines. Because of the number of persons having access to an electronic prescription between the time it is written and the time it is dispensed, including the practitioner's office staff, intermediaries who process the prescription, and the pharmacy staff, the potential for alteration is great. A practitioner whose prescriptions were altered by someone else—office staff or staff at one of the intermediaries—could be subject to legal action in which the practitioner would have to prove that he was not responsible for the prescriptions to avoid civil or criminal liability. If a pharmacy knowingly dispenses a forged or altered prescription, such dispensing constitutes illegal distribution and is a violation of the CSA. The pharmacy could be subject to administrative, civil, or criminal action under the CSA. A criminal conviction for unlawful dispensing in violation of the CSA is a felony that could, depending on the schedule of the controlled substance involved, and the harm resulting, result in a sentence of a lengthy period of incarceration and substantial fine. Even without a criminal conviction, civil violations of the CSA can result in substantial fines. Criminal or civil violations of the CSA might also result in revocation of the pharmacy's registration to dispense controlled substances.

DEA welcomes comments regarding its assessment of risk for the six categories of harm for the electronic prescribing of controlled substances. Commenters should frame their comments in the context of the impacts of those categories of harm included in OMB M-04-04 and Table 1 above.

OMB provides the following guidance in M-04-04 on applying the risk assessment to assurance levels.

Table 3.—Maximum Potential Impacts for Each Assurance Level

Level 1

Level 2

Level 3

Level 4

Potential Impact of Inconvenience, Distress, or Damage to Standing or Reputation

Low Impact

Moderate Impact

Moderate Impact

High Impact.

Potential Impact of Financial Loss

Low Impact

Moderate Impact

Moderate Impact

High Impact.

Potential impact of harm to agency programs or public interests

n/a

Low Impact

Moderate Impact

High Impact.

Potential Impact of unauthorized release of sensitive information

n/a

Low Impact

Moderate Impact

High Impact.

Potential Impact to Personal Safety

n/a

n/a

Low Impact

Moderate Impact.

Potential impact of civil or criminal violations

n/a

Low Impact

Moderate Impact

High Impact.

The table below shows the potential impact as rated by DEA and the assurance level associated with each.

Table 4.—Potential Impact and Associated Assurance Levels for Electronic Prescriptions for Controlled Substances

Potential impact—DEA rating

Level of assurance

Inconvenience, Distress, or Damage to Standing or Reputation—Moderate

Level 2.

Financial Loss—N/A

N/A.

Harm to Agency Programs or Public Interests—High

Level 4.

Unauthorized release of Sensitive Information—N/A

Level 1.

Personal Safety—High

Level 4.

Civil or Criminal Violations—High

Level 4.

If any one or more of the potential impact categories for authentication errors is found to be high, M-04-04 directs agencies that the appropriate assurance level must be “Level 4” (the highest level). Indeed, DEA notes that M-04-04 specifically lists the following as an example of a situation for which Level 4 is appropriate:

A Department of Veteran's Affairs pharmacist dispenses a controlled drug. She would need full assurance that a qualified doctor prescribed it. She is criminally liable for any failure to validate the prescription and dispense the correct drug in the prescribed amount.

14

14

Although OMB M-04-04 describes a Department of Veterans Affairs pharmacist needing “full assurance that a

qualified doctor

prescribed [the controlled substance]” [emphasis added], DEA recognizes that in addition to physicians, the Department of Veterans Affairs also employs dentists and certain mid-level practitioners who are authorized to prescribe controlled substances.

The explanation provided in the above example is no less applicable where the pharmacist is employed by the private sector. Even if such risk is essentially identical for both VA pharmacies and private sector pharmacies, the reasoning of M-04-04 indicates that Level 4 assurance is appropriate in both scenarios.

NIST Special Publication (SP) 800-63, Electronic Authentication Guideline, provides guidance on applying the OMB assurance levels to identity proofing and authentication. Identity proofing is the process of determining whether the person being granted authorization to use a system is, in fact, the person he claims to be. Authentication refers to the method by which the person is then granted access to a computer system (e.g., PINs, passwords, biometrics). NIST SP 800-63 defines the steps needed to conduct identity proofing and establish authentication protocols for each OMB assurance level. DEA has used NIST SP 800-63 as a guideline in developing its proposed requirements.

Assurance Levels—Identity Proofing.

Identity proofing is the process of uniquely identifying a person. NIST SP 800-63 specifies a number of requirements for both remote and in-person identity proofing for each assurance level.

DEA believes that in-person identity proofing is critical to the security of the electronic prescribing of controlled substances. Ensuring that only licensed and registered practitioners are granted the authority to sign electronic prescriptions for controlled substances is the first step to maintaining the overall security of the electronic prescribing system for these substances. At present, some service providers appear to allow enrollment over the Internet and only require the applicant to submit a copy of the State license and DEA registration. This type of enrollment increases the potential for identity theft and the creation of fraudulent identities of prescribing practitioners and, subsequently, the potential for issuance of forged prescriptions. DEA welcomes comment regarding the enrollment processes service providers have developed to adequately determine whether the people enrolling in such services are legally permitted to issue noncontrolled substance prescriptions and whether and how such processes prevent noncontrolled substance prescription forgery, fraud, and other related crimes.

In-person identity proofing protects individual prescribing practitioners from identity theft. That is, without in-person identity proofing, it would be very easy for anyone to claim to be an individual prescribing practitioner and gain access to electronic prescribing systems for controlled substances; the most likely documents used to demonstrate identity as a prescribing practitioner—State license and DEA registration—can be easily obtained. Persons who work with prescribing practitioners have ready access to State licenses and DEA registration certificates as those documents are often stored at the prescriber's practice location. A member of the office staff could alter a practitioner's registration certificate or merely submit a copy of a practitioner's State license and DEA registration and begin issuing illegal prescriptions without the practitioner's knowledge. As information regarding State licensure and DEA registration is publicly available, people outside the office could create fraudulent DEA registration certificates and State licenses using legitimate numbers and gain access to the system.

Unlike written prescriptions, once a fraudulent identity has been established, electronic prescribing provides little or no indication of the potential for fraud. With written prescriptions, if a person not knowledgeable of prescription-writing styles and tendencies writes or alters prescriptions, those prescriptions are likely to be noticed by a pharmacist who may scrutinize them further. In fact, if the prescription seems out of the ordinary in any way, e.g., the format is unusual, the paper is different from normal, the signature looks wrong, the directions are not in the usual format, the drug name is misspelled, the abbreviations used are not standard, or the quantity seems high, the pharmacy has a responsibility to contact the prescribing practitioner to verify the prescription before filling the prescription. With electronic prescribing, however, once an identity is established, all electronic prescriptions appear the same. Most information is selected from drop-down menus, and there is little to distinguish an electronic prescription written by a person who is not a legitimate prescribing practitioner from one that is written by an individual granted proper State and DEA authority to prescribe controlled substances.

Based on DEA's decision that in-person identity proofing is critical to the overall security of the electronic prescribing system, DEA examined NIST requirements for in-person identity proofing.

Briefly, at Level 2, in-person identity proofing requires the applicant to possess a government-issued photographic identification that confirms the address of record or nationality. Level 2 requires inspection of the photographic identification, and the recording of the applicant's address or date of birth and the number associated with the government-issued photographic identification. If the identification confirms the address of record then credentials are issued and notice is sent to that address; if the address is not confirmed, then credentials are issued in a manner that confirms the address of record.

At Level 3, in-person identity proofing requires the applicant to possess a government-issued photographic identification. Level 3 requires inspection of the photographic identification and verification, through the issuing government agency or through credit bureaus or similar databases, that the information contained in the identification (e.g., name, address, date of birth) are consistent with the application. The applicant's name, address, and date of birth are recorded. If the identification confirms the address of record then credentials are issued and notice is sent to that address; if the address is not confirmed, then credentials are issued in a manner that confirms the address of record.

At Level 4, two independent forms of photographic identification or accounts must be verified, one of which must be a government-issued photographic identification. Further, a new recording of a biometric of the applicant must be captured. The government-issued photographic identification must be verified with the issuing government agency. For any form of photographic identification, the applicant's name, address, and date of birth are recorded.

If the secondary form of identification is a financial account, the financial account number must be verified through record checks sufficient to identify a unique individual. The biometric is recorded to ensure that the applicant cannot repudiate the application. Credentials must be issued in a manner that confirms the address of record.

After careful examination of all levels of in-person identity proofing, DEA determined that none of the NIST levels addressed its unique needs and requirements. DEA does not believe that capturing a biometric at the time of enrollment is necessary, as is required at Level 4. Further, DEA does not believe that verification of identity through use of credit bureaus or other third-party agencies would be feasible or is necessary, as is required at Level 3, given that practitioner's State licenses and DEA registrations are also being examined. DEA believed that such requirements could be intrusive for practitioners, who might not want hospitals, State licensing boards, or law enforcement agencies—the entities DEA is proposing to permit conduct in-person identity proofing—to review sensitive personal information such as address information retained by credit bureaus. Finally, DEA did not believe that the address checks required at Level 2 were useful for the purpose served by the in-person identity proofing DEA believes it must require. DEA notes that address checks generally mean address of residence, because that is the address listed on most forms of government-issued photographic identification, whereas prescribing practitioners will receive information and authentication protocols at their offices, which are the addresses listed on the DEA registration and State licenses.

Therefore, DEA has decided to propose in-person identity proofing consistent with, but not equivalent to, Level 3, as discussed below, but not link that in-person identity proofing to any specific NIST requirements.

DEA could not identify any mitigating factors that would enable it to propose remote identity proofing. Remote identity proofing relies on record checks, which would not prevent identity theft and may be more intrusive than the simple in-person requirements DEA is proposing. Remote identity proofing also relies on mailing credentials to the address of record, which would not prevent a member of the office staff from applying for access to the electronic prescribing system for controlled substances and intercepting the confirmation. The electronic world allows for far easier identity theft and can make it more difficult to identify diversion when it occurs. In contrast, when DEA or the States have discovered identity theft in the context of paper prescriptions, they have been able to prosecute the criminal using the paper trail created by fraudulent prescriptions. The paper prescriptions can prove who wrote them and, for the innocent practitioner, who did not write them. With electronic prescriptions, identities can be stolen, used to issue a large number of prescriptions, then dropped within days, leaving few if any traces, or worse, traces that link to a practitioner who then would have to prove that he or she was an innocent victim, not a criminal.

DEA is proposing to allow DEA-registered hospitals, State licensing boards, and State or local law enforcement agencies to review the identity documents and sign, with the applicant, a letter or form that states that the applicant is who the applicant claims to be. This approach should lessen the burden on service providers and ensure that practitioners will be able to have their documents checked locally.

Assurance Level—Authentication Protocol.

NIST SP 800-63 defines tokens as the means that a person wishing to gain access to an electronic system uses to authenticate their identity. In electronic authentication, the person wishing to gain access authenticates to a system or application over a network by proving that he has possession of a token. Therefore, a token must be protected.

Authentication methods are described as one-factor, two-factor, or three-factor, or as something you know, something you have, and something you are. PINs and passwords are something you know; cards such as ATM cards are something you have; biometrics (fingerprints, iris scans, hand prints) are something you are.

NIST SP 800-63 describes a single-factor token as either something the person knows, something the person has, or a biometric. Single-factor tokens include:

• Memorized secret tokens (passwords, passphrases).

• Pre-registered knowledge tokens: responses to a question known by the user (pet's name, favorite color).

• Look-up secret tokens—the user is prompted by the system to look up information stored on a physical or electronic device (the secret may be printed on a card or stored in the computer); the information looked up has been shared between the user and the system being authenticated to.

• Out of band tokens—Receipt of a secret on a physical device separate from the system being authenticated to which is then used to log onto the system (e.g., a password is sent to a cell phone; the person who possesses the cell phone uses the password to log onto the system).

• Single factor one time password (OTP) device—a hardware device that spontaneously generates one time passwords, which usually change every 60 seconds. The one time passwords are used to log onto the system.

• Single factor cryptographic device—a hardware device that uses embedded cryptographic keys; authentication occurs by proving possession of the device.

NIST discussed the vulnerability of single-factor authentication methods, specifically passwords, in Special Publication 800-32:

The traditional method for authenticating users has been to provide them with a personal identification number or secret password, which they must use when requesting access to a particular system. Password systems can be effective if managed properly, but they seldom are. Authentication that relies solely on passwords has often failed to provide adequate protection for computer systems for a number of reasons. If users are allowed to make up their own passwords, they tend to choose ones that are easy to remember and therefore easy to guess. If passwords are generated from a random combination of characters, users often write them down because they are difficult to remember. Where password-only authentication is not adequate for an application, it is often used in combination with other security mechanisms.

PINs and passwords do not provide non-repudiation, confidentiality, or integrity. If Alice wishes to authenticate to Bob using a password, Bob must also know it. Since both Alice and Bob know the password, it is difficult to prove which of them performed a particular operation.

15

15

National Institute of Standards and Technology. Special Publication 800-32

Introduction to Public Key Technology and the Federal PKI Infrastructure; February 26, 2001. http://csrc.nist.gov/

Pre-registered knowledge tokens usually have answers that may be known by other people in an office. Look-up secrets are as vulnerable as passwords in a medical practice settings. Out-of-band tokens would take more time to use. Single factor hard tokens could be borrowed or stolen and used easily. No single factor approach, therefore, would provide the assurance DEA and the practitioners need.

NIST SP 800-63 describes two-factor tokens as tokens that use two or more factors to achieve authentication. Multi-factor tokens include:

• Multi-factor software cryptographic tokens—a cryptographic key is stored on a computer and requires activation through a second factor of authentication.

• Multi-factor one time password device—a software device, (e.g., PDAs) or a hardware device (e.g., a card, thumb drive, fob), that generates one time passwords for use in authentication and requires activation through a second factor of authentication, usually a password.

• Multi-factor cryptographic hardware device—hardware device that contains a protected cryptographic key and requires activation through a second authentication factor.

As NIST points out, the use of more than one factor for authentication to a system raises the difficulty of an attacker successfully attacking a system. The more factors used, the more effort it takes to break the system to gain entry.

Briefly, at Level 2, single-factor authentication is allowed. Some combinations of single-factor authentication are still considered Level 2 (e.g., passwords plus pre-registered knowledge tokens are still rated as Level 2).

At Level 3, some combinations of single-factor tokens are acceptable (e.g., a password plus a single-factor one time password device). In addition, a multi-factor software cryptographic device is considered Level 3; this device allows for the storage of the cryptographic key on a disk (e.g., a hard drive of a personal computer).

At Level 4, only two types of tokens are acceptable—a multi-factor one time password device or a multi-factor cryptographic device that is stored on a hard token (e.g., a smart card, a thumb drive).

DEA is proposing that the authentication protocol meet Level 4, which requires two factors, one of which is stored on a hard token, which could be a PDA, a cell phone, a smart card, a thumb drive, or multi-factor one time password token. DEA has determined that only Level 4 meets its requirements based on the risk assessment and on the problems that arise with Level 3, where one of the factors can be stored on a computer rather than a hardware device that the practitioner can possess, or Level 2, where only a single factor is required. NIST describes Level 4 tokens as follows: “To achieve Level 4 with a single token or token combination, one of the tokens needs to be usable with an authentication mechanism that strongly resists man-in-the-middle attacks—this entails an electronic interface which may be placed under access control by the Claimant's (the person seeking to gain access to the system) operating system.”

16

17

DEA would like public comment on the present state of multi-factor tokens as implemented through multi-function devices such as PDAs, cell phones, smart cards, thumb drives and laptop computers.

16

National Institute of Standards and Technology. Special Publication 800-63-1

Electronic Authentication Guideline

draft; February 20, 2008. p. 52.

17

DEA notes that in the course of drafting this rulemaking, the National Institute of Standards and Technology issued a new draft Special Publication 800-63, which revises some guidelines regarding electronic authentication. DEA has taken these new guidelines into account in drafting this Notice of Proposed Rulemaking recognizing, however, that this Special Publication is a draft and subject to revision by NIST when the final SP 800-63-1 is issued.

As DEA is not proposing specific controls regarding the authentication process or the transmission of the prescription information, DEA believes that the security of the authentication itself is critical to bind the practitioner to the prescribing transaction. Level 4 authentication protocols protect the practitioner from the most likely “attack,” the use of his password or other token to access the system and issue prescriptions. Because Level 3 allows the storage of authentication protocols on office computers, the practitioner has no assurance that his authentication protocol will be safe or that he will be aware if it is compromised. From a law enforcement perspective, an authentication protocol stored on a computer to which others have access makes linking a prescription to a practitioner or to a staff member who has illegally issued prescriptions all but impossible. Level 4, where the practitioner can retain possession of the hard token, protects the practitioner and provides law enforcement with the necessary nonrepudiation.

Because of the attributes of medical practices, DEA could identify no mitigating factors that could overcome the vulnerabilities that exist and allow a lower level of assurance. In medical practices, most staff members have access to any of the computers in the office. Practitioners and nurses see patients in multiple examination rooms, moving from room to room; of necessity, practitioners must leave their offices and computers unattended for long periods of time. Passwords, which are usually part of two-factor authentication protocols to access the system, are vulnerable to attack because (1) many people write them down; (2) most people choose passwords that are easy to guess; and (3) in medical settings, with multiple people working in the vicinity of a computer, it is easy for someone else to watch a password being keyed into the system. If both parts of a multi-factor identification protocol can be stored on an office computer, or if there is only one factor needed (Level 2), the practitioner will have no assurance that someone in the office is not issuing prescriptions in his name. The practitioner will also be able to repudiate any prescription written in his name; law enforcement officials will not be able to prove beyond a reasonable doubt in a criminal proceeding that his authentication protocol had not been compromised. Storing one of the factors on a hard token means that the practitioner can retain possession of the device and ensures that it is not misused. The practitioner will not be able to repudiate prescriptions issued in his name; the practitioner will either have written the prescription, knowingly given the hard token to someone else, or, if the token was lost, stolen, or compromised, have taken appropriate actions (such as ensuring that the authentication protocol has been revoked to prevent its misuse).

The hard token protects the practitioner in the same way a manually signed written prescription does. If a written prescription is forged, a practitioner can prove that he did not write it by comparing handwriting. By maintaining sole possession of the hard token, the practitioner can eliminate the risk of fraudulent prescriptions and, if the token is lost, stolen, or compromised, he will be immediately alerted to the threat and have the authentication protocol revoked. This assurance that only a legitimate practitioner issued the prescription also protects the pharmacy. As discussed above, with a paper prescription there are potentially many indications that the prescription was not written by a practitioner. If the prescription seems out of the ordinary in any way the pharmacy has a responsibility to verify the prescription before filling the prescription. With electronic prescriptions, it will be much more difficult to identify these potentially telltale characteristics because the software fills in items from a menu of acceptable options; unless the quantity is high, the pharmacist will have little reason to question an electronic prescription.

The requirement for two-factor authentication (something you know and something you have) has been implemented by a number of healthcare systems. One system with almost 300 hospitals and clinics is using a

combination of PINs (something you know) and a one-time-password token or software tokens (PDAs) for almost 30,000 users. Another medical center uses the same approach for more than 4,500 users. A third health care system with a variety of treatment centers has deployed this approach to 8,000 people at more than 40 sites. These deployments indicate that the requirement is feasible in healthcare settings and that it is flexible enough to provide access and access control as practitioners move among settings in which they practice.

Although the electronic prescribing of controlled substances plainly fits in the categories of transactions for which Level 4 assurance is warranted, DEA has decided, following interagency discussions, not to propose all of the authentication requirements that NIST SP 800-63 indicates are appropriate for Level 4. Among other things, as explained below, DEA is not proposing that practitioners digitally sign prescriptions or that pharmacies routinely validate prescriptions that are digitally signed because doing so would be incompatible with many existing systems currently in use for the electronic prescribing of noncontrolled substances. Nonetheless, DEA is proposing here an alternative authentication system that comes as close as reasonably possible to the level of security called for in NIST SP 800-63 while remaining compatible with existing systems used for noncontrolled substance prescriptions and, at the same time, adhering to DEA's overarching obligation to minimize the likelihood of diversion of controlled substances.

Assurance Level—Authentication Process.

The authentication process addresses security between the creator of a message and its recipient. At Level 4, the authentication process involves strong cryptographic authentication of all parties and all sensitive data transfers. A variety of technologies can meet Level 2 and 3; the levels are defined by their resistance to certain forms of attack. Level 2 can be met with an encrypted TLS protocol session. Level 3 can be met with authenticated TLS and public key certificates.

DEA is not proposing to set any standards for the authentication process. The NIST requirements apply primarily to the transmission of information. DEA is concerned about the possibility that an electronic prescription could be altered during transmission, but the agency is not proposing specific regulations in this area at this time. DEA is proposing to address the vulnerabilities that exist by having the prescription digitally signed by the service provider prior to transmission and on receipt at the pharmacy. These requirements will not prevent alteration during transmission, but they will allow DEA to identify that it has occurred and protects registrants from being accused of issuing a fraudulent prescription or altering a legitimate prescription. DEA also notes that the security of these records during transmission is subject to HIPAA.

Summary.

In conclusion, although the risk of electronic prescribing of controlled substances maps to Assurance Level 4 using the criteria of M-04-04, DEA is not proposing all of the requirements associated with that level. Instead, DEA is proposing in-person identity proofing specific to its needs; these requirements are consistent with, but not equivalent to, Level 3, and address concerns specific to DEA. Further, DEA is proposing use of a hard token, with that hard token meeting the requirements of Level 4. Finally, DEA is not proposing any requirements regarding the authentication process and transmission of the electronic prescriptions. The table below provides a summary of DEA's conclusions regarding its risk assessment of systems to permit the electronic prescribing of controlled substances.

Table 5.—Summary of Risk Assessment for Electronic Prescriptions for Controlled Substances

M-04-04 Assurance Level

Level 4—High potential impact of harm to agency programs or public interests, personal safety, civil or criminal violations.

NIST identity proofing

In-person identity proofing requirements specific to DEA; requirements consistent with, but not equivalent to, NIST Level 3 in-person identity proofing.

NIST authentication protocol

Level 4—Use of hard token or multifactor one-time-use password token is necessary to bind the prescriber to the prescription.

NIST authentication process

N/A—DEA is not proposing any requirements in this area.

As has been discussed, DEA is proposing in-person identity proofing requirements consistent with, but not equivalent to, Level 3; authentication protocol requirements, use of a hard token and two-factor authentication, meeting the requirements of Level 4; and no requirements regarding the authentication process. DEA welcomes comments and information regarding alternative solutions for the electronic prescribing of controlled substances employing security controls that are as effective as those being proposed in this Notice of Proposed Rulemaking and also would meet DEA statutory and regulatory obligations under the Controlled Substances Act. Information provided should be as specific and detailed as possible to provide the Administration with an understanding of how the commenter believes the alternative solution could be implemented to satisfy the foregoing considerations. Any person providing such comments should discuss the specific risks being addressed and how any such risk-mitigating controls are incorporated into the alternative being discussed, and should state why the commenter believes such controls are adequate to address DEA's concerns. Any person providing such comments should also discuss the system vulnerabilities, risks, and weaknesses of any alternatives provided.

If a commenter believes that any proposed requirement is either too stringent or too lax, the commenter should so state, providing a detailed explanation of how the controls mitigate the identified risks, or how the lack of controls aggravate or fail to address the risks involved in the electronic prescribing of controlled substances and, thus, why the commenter's alternative warrants consideration as an alternative to the requirement being proposed. Hence all comments should clearly identify how all risk-mitigating compensating controls adequately address each security concern outlined in the proposed rule.

For example, DEA welcomes comments on the following topics:

• Whether in-person identity proofing requirements consistent with, but not equivalent to, Level 3, are sufficient to address DEA's concerns, or whether (a) more stringent requirements, such as those required under Level 4, are necessary, or (b) DEA's concerns could be addressed with Level 2 requirements combined with risk-mitigating controls.

• Whether authentication protocol requirements, use of a hard token and two-factor authentication, meeting the requirements of Level 4 are sufficient to

address DEA's concerns, or whether (a) more stringent requirements, such as those imposed in a public key infrastructure system, are necessary, or (b) DEA's concerns could be addressed with Level 3 requirements combined with risk-mitigating controls.

• Whether no requirements regarding the authentication process, as proposed in this rule, should cause DEA concern, such that imposing requirements is necessary.

VIII. Proposed Standards for Electronic Prescription Systems for Controlled Substances

The following discussion relates to requirements DEA is proposing regarding the creation, signature, transmission, processing and dispensing of controlled substance prescriptions. As discussed below, practitioners and pharmacies—DEA registrants—must use systems and service providers which comply with all requirements DEA may finalize. While these requirements pertain specifically to prescriptions for controlled substances, nothing in this rule precludes practitioners, pharmacies, or service providers from using these same standards for prescriptions for noncontrolled substances, if they so desire. However, DEA notes that any references throughout the following discussion relate solely to prescriptions for controlled substances.

In this rule, DEA is proposing various security requirements for systems and service providers that market software and services to practitioners and pharmacies to create, sign, transmit, process and dispense electronic controlled substance prescriptions. It is incumbent upon DEA registrants—practitioners and pharmacies—the entities regulated by DEA, to use systems and service providers that comply with DEA security requirements for the electronic prescribing and dispensing of controlled substances. DEA recognizes that its registrants may not be able to evaluate a service provider's compliance and so is establishing third-party audit and other requirements to assist registrants in determining whether a system or service provider they currently use, or are considering using, meets DEA security requirements. While this preamble and rule require actions of service providers, it is the DEA-registered practitioner or pharmacy DEA will look to if the system or service provider that practitioner is using is not in compliance with DEA regulations. It is, ultimately, the DEA-registered individual practitioner and pharmacy who are responsible for the prescribing and dispensing of any controlled substance prescription, and the requirements of this rule do not change that longstanding responsibility and liability.

DEA is proposing the following requirements for the use of electronic systems to create, sign, dispense, and archive controlled substance prescriptions, which are discussed in detail below:

• The electronic prescription service provider must receive a document prepared by an entity permitted to conduct in-person identity proofing of prescribing practitioners regarding the conduct of the in-person identity proofing. The document may be prepared on the identity proofing entity's letterhead or other official form of correspondence, or the service provider may design a form for use by the identity proofing entity. Regardless of the format, the document must contain certain information required by DEA. Entities DEA is proposing to permit conduct in-person identity proofing of prescribing practitioners include:

○ The entity within a DEA-registered hospital that has previously granted the practitioner privileges at the hospital (e.g., a hospital credentialing office);

○ The State professional or licensing board, or State controlled substances authority, that has authorized the practitioner to prescribe controlled substances;

○ A State or local law enforcement agency.

○ The service provider must check both the practitioner's State license and DEA registration to determine that both are current and in good standing.

• Authentication: Access to the electronic prescribing system for the purposes of signing prescriptions must meet the standards for Level 4 authentication in NIST SP 800-63. That is, the system must require at least two-factor authentication to access the system; one factor must be a cryptographic key stored on a hard token that meets the requirements for Level 4 authentication in NIST SP 800-63 or a multi-factor one time password token. The hard token must be a hardware device that meets the following criteria:

○ The token must require entry of a password or biometric to activate the authentication key.

○ The token is not able to export the authentication key.

○ The token must be validated under Federal Information Processing Standard (FIPS) 140-2 as follows:

▪ Overall validation at Level 2 or higher.

▪ Physical security at Level 3 or higher.

• The security of the system must be audited annually using a third-party audit that meets the requirements of a SysTrust or WebTrust audit for security and processing integrity.

• The system must limit signing authority to those practitioners that have a legal right to sign prescriptions for controlled substances (i.e., the system must set varying levels of access to the system based on responsibilities).

• The system must have an automatic lock out if the system is unused for more than 2 minutes.

• The prescription must contain all of the required data (date of issuance of the prescription; patient name and address; registrant full name, address, DEA registration number; drug name, dosage form, quantity prescribed, and directions for use; and any other information specific to certain controlled substances prescriptions mandated by law or DEA regulations). Prior to signing the controlled substance prescription, the system must show the prescribing practitioner at least the patient name and address, drug name, dosage unit and strength, quantity, directions for use, and the DEA number of the prescriber whose identity is being used to sign the prescription.

• Where more than one prescription has been prepared for signing, prior to authenticating to the system the practitioner must positively indicate which prescription(s) are to be signed.

• The practitioner must authenticate himself to the system immediately before signing a prescription.

• After authenticating to the system but prior to transmitting the prescription, the system must present the practitioner with a statement indicating that the practitioner understands that he is signing the prescription being transmitted. If the practitioner does not so indicate, by performing the signature function, the prescription cannot be transmitted.

• The system must transmit the electronic prescription immediately upon signature. The system must not transmit a controlled substance prescription unless it is signed by a practitioner authorized to sign such prescriptions.

• The electronic data file must include an indication that the prescription was signed.

• The system must not allow printing of prescriptions that have been transmitted; if a prescription is printed, it must not be transmitted.

• The system must generate a monthly log of controlled substance prescriptions and transmit it to the

practitioner for his review. The practitioner must indicate that the log was reviewed. A record of that indication must be maintained for five years.

• The first recipient of the prescription must digitally sign the prescription and archive the digitally signed version of the prescription as received.

• The first pharmacy system that receives the prescription must digitally sign and archive a copy of the prescription as received. Alternatively, the intermediary that transmits the prescription to the pharmacy may digitally sign the transmitted prescription and transmit both the record and the digitally signed copy for the pharmacy to archive.

• The digital signatures must meet the requirements of FIPS 180-2 and 186-2.

• The pharmacy system must check to determine whether the DEA registration of the prescribing practitioner is valid. (Alternatively, any of the intermediary systems may conduct this check provided that the record indicates that the check has been conducted. The CSA database may be cached for one week from the date of issuance by DEA of the most current database.)

• The pharmacy system must be able to store the complete DEA number including extensions.

• The pharmacy system must have an audit trail that identifies each person who annotates or alters the record. The pharmacy system must conduct daily internal audits to identify any auditable events.

• The system must have a backup system of records stored at a separate location.

• The pharmacy system must have a third-party audit that meets the requirements of SysTrust or SAS 70 audits for security and processing integrity.

• The contents of a controlled substance prescription must not be altered, other than by reformatting, during transmission.

• A prescription created electronically for a controlled substance must remain in its electronic form throughout the transmission process to the pharmacy; electronic prescriptions may not be converted to other transmission methods, e.g., facsimile, at any time during transmission.

DEA would like the public to comment on the ability of those members of industry currently providing electronic prescribing systems for noncontrolled substances to meet the requirements set forth in this proposed rule, and whether there might be entrepreneurs not currently providing electronic prescribing systems who would be willing and able to develop innovative systems that would meet the requirements proposed here.

Other Requirements

In addition to the system requirements, DEA is proposing to require the following:

• A registrant must have separate password/keys for each DEA registration he holds and uses to issue prescriptions. Multiple keys may be stored on the same hard token.

• The registrant must use the appropriate DEA registration for prescriptions issued. Practitioners holding multiple registrations in a single State may use just one for any prescription written in that State.

• The registrant must retain sole possession of the hard token. If a token is lost or compromised and the registrant fails to notify the service provider within 12 hours of discovery, the registrant will be held responsible for any prescriptions written using the token.

• The pharmacy must annotate the record with the same information required for a paper prescription.

• The practitioner and pharmacist must notify DEA and the service provider if they identify problems in the logs they review that indicate that prescriptions have been created without their knowledge or altered.

Discussion of the Proposed Rule System Requirements

As noted previously, electronic prescribing is in addition to existing prescribing methods for controlled substances. DEA's goal is to impose as few new requirements on electronic prescription systems as possible while retaining the ability to enforce the Controlled Substances Act and its implementing regulations. Many of the requirements listed above exist in at least some systems currently in use. The Certification Commission for Health Information Technology EHR certification standards for security cover many of the access and authentication requirements DEA is proposing here. DEA believes that the proposed requirements will protect both practitioners and pharmacies by ensuring that they can meet their legal obligations and lessen the threat of someone misusing their authorities to divert controlled substances. DEA emphasizes that its electronic prescription requirements do not alter the responsibilities of the practitioner and pharmacy in regard to controlled substance prescriptions. Both the prescribing practitioner and the dispensing pharmacy have a legal responsibility to ensure that only prescriptions issued for legitimate medical purposes by DEA registrants acting in the usual course of their professional practice are dispensed. A practitioner who knowingly allows someone to issue prescriptions in the practitioner's name is legally responsible for those prescriptions. A pharmacy that fails to check the validity of a controlled substance prescription before dispensing is legally responsible if the prescription is invalid.

In-person identity proofing.

DEA considered requiring service providers to conduct in-person identity proofing of prescribing practitioners as part of their enrollment process. However, after careful consideration, DEA determined that in-person identity proofing by service providers created certain vulnerabilities which could not be overcome. Specifically, DEA was concerned that by requiring service providers to both identity proof practitioners and issue practitioners access to the electronic prescribing system to prescribe controlled substances, the entire system was vulnerable to compromise. Without separation of the identity and enrollment tasks, it could be quite easy for service provider staff to create a fraudulent identity and enroll that identity in the electronic prescribing system. While some service providers have asserted that their staffs are trustworthy, DEA did not want to establish a system which could be easily subverted for the diversion of controlled substances. Further, DEA was concerned that such a system may prove to be inconvenient for prescribing practitioners and service providers alike. Although DEA believes that many service providers would be on site at practitioners' offices routinely due to the complexity of the EHR systems of which electronic prescribing is often a part, DEA recognizes that conducting enrollment activities at that time may be inconvenient. Practitioners may not be at the practice location when the service provider staff is present. If enrollment could not occur, service providers' staff would have to make separate trips specifically for in-person identity proofing. Such trips could be difficult depending on the location of the service provider as compared to the practitioner.

To address DEA's concerns that the identity proofing and enrollment functions not reside within the same entity, and to ensure that practitioners have ready access to the entities

permitted to conduct in-person identity proofing, DEA is proposing that the following entities may conduct in-person identity proofing:

• The entity within a DEA-registered hospital that has previously granted that practitioner privileges at the hospital (e.g., a hospital credentialing office);

• The State professional or licensing board, or State controlled substances authority, that has authorized the practitioner to prescribe controlled substances;

• A State or local law enforcement agency.

DEA is proposing that before a service provider grants access to the electronic prescription system for the prescribing of controlled substances, the service provider must receive a document prepared by one of the above-listed entities regarding the conduct of the in-person identity proofing. DEA is proposing two alternatives for the format of the identity proofing document: The document may be prepared on the identity proofing entity's letterhead or other official form of correspondence, or the service provider may design a form for use by the identity proofing entity. Regardless of the format, the document must contain all of the following information:

• The name and DEA registration number, where applicable, of the entity which conducted the in-person identity proofing of the practitioner;

• The name of the person within the entity who conducted the in-person identity proofing of the practitioner;

• The name and address of the practitioner whose identity is being verified;

• For each State in which the practitioner wishes to prescribe controlled substances electronically, the name of the State licensing authority and State license number of the practitioner whose identity is being verified;

• Except for individual practitioners who prescribe controlled substances using the DEA registration of the institutional practitioner, for each State in which the practitioner wishes to prescribe controlled substances electronically, the DEA registration number and date of expiration of DEA registration of the practitioner whose identity is being verified;

• For individual practitioners who prescribe controlled substances using the DEA registration of the institutional practitioner, a statement by the institutional practitioner acknowledging the authority of the individual practitioner to prescribe controlled substances using the institution's DEA registration, and the specific internal code number assigned to the individual practitioner;

• The type of government-issued photographic identification checked (e.g., the practitioner's driver's license, passport) and a statement that the photograph on the identification matched the person presenting the photographic identification;

• The date on which the practitioner's in-person identity proofing was conducted;

• The signature of the person within the entity who conducted the in-person identity proofing;

• The signature of the practitioner who is the subject of the in-person identity proofing.

Before granting the practitioner access to the system to sign controlled substances prescriptions, the service provider must check with each State and DEA to determine that the practitioner's State license to practice medicine is current and in good standing. In those States in which a separate controlled substance registration is required to prescribe controlled substances, the service provider must also check with the appropriate State authority to determine that the practitioner's State license is current and in good standing. Finally, to ensure that the application to gain access to sign controlled substances is legitimate, the service provider must contact the prescribing practitioner at the practitioner's registered location by telephone to confirm the practitioner's intent to apply to prescribe controlled substances using the service provider's system. The service provider must obtain the telephone number from a public source other than the application received from the practitioner. Alternatively, the service provider may confirm the practitioner's intent in person at the practitioner's registered location.

The service provider must retain the document regarding identity proofing in its files for five years. DEA recognizes that in-person identity proofing will add a step to enrollment, but anything less would make it easy to steal a practitioner's identity and issue fraudulent prescriptions. In-person identity proofing will protect practitioners from this type of abuse. The records may be maintained electronically.

DEA seeks comments on in-person identity proofing requirements, and those requirements' effects, if any, on practitioners, including those practicing at multiple locations. DEA also seeks comments regarding alternatives to in-person identity proofing that achieve the same or higher level of assurance as that which DEA is proposing here.

Authentication

. As explained above in the risk assessment, DEA is proposing that the authentication protocol must be two-factor and meet NIST SP 800-63 Level 4 criteria. One factor must be stored on a hard token that meets the FIPS 140-2 standard for the cryptographic module.

The HIPAA Security Guidance issued by HHS on December 28, 2006, also recommends two-factor authentication, beyond a combination of password and user ID, although it does not detail how this should be implemented.

18

The standards for electronic health records system security developed by the Certification Commission for Healthcare Information Technology (CCHIT) require systems to support two-factor identification.

19

Consequently, all of the EHR systems certified by CCHIT (approximately 85 systems) already support two-factor authentication. The requirement to store the key on a token will not impose an incremental cost for these systems.

18

HIPAA Security Guidance for Remote Use of and Access to Electronic Protected Health Information December 28, 2006;

http://www.cms.hhs.gov/SecurityStandard/Downloads/SecurityGuidanceforRemoteUseFinal122806.pdf

.

19

CCHIT Security Criteria 2007 Final 16 Mar 07; criteria S21.

http://www.cchit.org/files/Ambulatory_Domain/CCHIT_Ambulatory_SECURITY_Criteria_2007_Final_16Mar07.pdf

.

The highest form of protection would be three-factor authentication (something you know, something you have, and something you are), but given the difficulties that still exist in ensuring that biometric readers function accurately at all times, DEA decided not to require a biometric password. DEA notes that biometric authentication is not prohibited in this rule; DEA supports this method of authentication, but is not requiring it at this time. Practitioners may decide to use a biometric as one of the passwords; some systems, including some PDAs, have, or support the use of, a fingerprint reader for access control.

Federal Information Processing Standard (FIPS) 140-1/140-2 is a standard entitled “Security Requirements for Cryptographic Modules.”

20

The standard is issued by NIST to lay out general requirements for cryptographic modules for computer and telecommunications systems. These standards ensure that cryptographic modules, which protect information such as passwords and other records,

are robust enough that “breaking” the encryption is generally not feasible. The FIPS standards have been adopted by the United States government and are required for all cryptographic-based security systems that are used by, or approved by, Federal agencies to protect unclassified information. DEA, therefore, must require that the software modules used comply with these standards. A list of vendors whose cryptographic modules have been validated as FIPS 140-2 compliant may be obtained from the NIST Web site at

http://csrc.nist.gov/cryptval/140-1/1401val.htm

. As of March 2008, more than 900 modules have been certificated as compliant. The vendors include providers of PDAs, cell phones (Palm, Blackberry, Nokia), one time password tokens, as well as network and software providers. (When the FIPS 140-1 standard was updated to 140-2, all modules approved under the 140-1 standard were grandfathered and are considered compliant under 140-2.)

20

National Institute of Standards and Technology. FIPS 140-2 “Security Requirements for Cryptographic Modules”, May, 2001.

http://csrc.nist.gov/publications/PubsFIPS.html

.

DEA notes that practitioners are not required to learn cryptographic keys; a password entered into a hard token accesses the key, which the service provider then recognizes. From the practitioner's perspective, the only difference from the common security controls on computer systems is that one of the keys is stored on a token. If that token is a PDA, the practitioner may not see a difference from the existing electronic prescription systems except when the practitioner wants to use a personal computer, when he would need to connect the PDA to the computer to access the system.

Authentication protocol expiration and revocation

. The practitioner's authentication protocol to sign controlled substances prescriptions is based on the validity of the practitioner's DEA registration and on the security of the hard token and password. DEA would require the service provider to revoke the practitioner's authentication protocol if the practitioner's DEA registration expires (unless the service provider determines that the registration has been renewed), is revoked, suspended, or terminated. DEA will make available to service providers information regarding the registration status of prescribing practitioners, including practitioners' names, addresses, DEA registration numbers, and dates of expiration for those DEA registrations. The service provider must check the DEA registration database at least once a week to ensure that the service provider has the most current DEA registration information. DEA will permit service providers to cache this information for one week from the date of issuance by DEA of the most current database. DEA seeks comment regarding the interval for updating by DEA of registration information to service providers.

Further, DEA is proposing to require the service provider to revoke the authentication protocol used to sign controlled substance prescriptions immediately upon receiving notification from the practitioner that a password or token has been compromised, lost, or stolen. In such cases, the service provider may issue a new authentication protocol to the practitioner.

DEA is interested in receiving comment regarding the current industry practices used to authenticate practitioners who use electronic prescribing systems for noncontrolled substances and whether and how such practices prevent noncontrolled substance prescription forgery, fraud, and other related crimes.

Access limitations and signing

. DEA is proposing a series of requirements related to the creation, signing, and transmitting of controlled substance prescriptions:

• After authenticating to the system but prior to signing the controlled substance prescription, the system must present the practitioner with a statement indicating that the practitioner understands he is signing the prescription being transmitted. If he does not so indicate, the prescription must not be transmitted.

• The electronic prescription system must include a function that requires a practitioner to electronically “sign” the completed prescription prior to transmission. The prescription file must include an indication that the prescription was signed.

• The system must limit access to the signing function for controlled substances to practitioners authorized to sign controlled substance prescriptions.

• The system must transmit the prescription immediately upon signature.

• The system must not transmit the prescription unless it has been signed.

DEA wishes to ensure that the act of signing controlled substances prescriptions is clearly understood by the practitioner. Therefore, DEA is proposing to require that, after authenticating to the system but prior to signing the controlled substance prescription, the system must present to the practitioner certain information regarding controlled substances prescriptions being transmitted. Specifically, the system must display for the practitioner the patient's name and address; the name of the drug being prescribed; the dosage strength and form, quantity, and directions for use; and the DEA registration number under which the prescription will be authorized. While this information is displayed, the practitioner must be presented with the following statement (or its substantial equivalent): “I, the prescribing practitioner whose name and DEA registration number appear on the controlled substance prescription(s) being transmitted, have reviewed all of the prescription information listed above and have confirmed that the information for each prescription is accurate. I further declare that by transmitting the prescription(s) information, I am indicating my intent to sign and legally authorize the prescription(s).” The practitioner must positively indicate agreement with this statement. Such agreement can be accomplished through a check box or other means determined by the system. If the practitioner does not indicate agreement to this statement, the controlled substances prescriptions may not be transmitted.

DEA believes that such a statement is necessary to help to positively bind the practitioner to the prescription. DEA believes that this requirement is similar to many banking and online billing systems that require the user to agree to certain terms and conditions before billing or other financial transactions are permitted to occur. This statement will help to provide nonrepudiation of the prescriptions; that is, the inclusion of this statement will make it more difficult for the practitioner to deny having signed the controlled substance prescriptions.

Although the requirement for signing may seem obvious, signing is not currently an automatic part of electronic prescriptions. The standard that the industry has developed and HHS has adopted for the transmission of electronic prescriptions (the National Council for Prescription Drug Programs (NCPDP) SCRIPT) does not include a field that indicates that the prescription has been signed. Signing an electronic prescription does not create a record of the act of signing; it is simply a function that usually is linked to transmission. The SCRIPT fields clearly provide for cases where someone other than the practitioner creates and transmits a prescription under the practitioner's supervision. Although this approach may be legal for prescriptions for noncontrolled substances, it is not legal for controlled substance prescriptions. Agents of a practitioner may prepare the prescription at the practitioner's direction, as they can with paper prescriptions, but only the registered

practitioner may sign and issue the prescription. As noted above, the signature represents the practitioner's attestation of the validity of the prescription and legally binds the practitioner to the prescription.

Another scenario that the SCRIPT standard allows is for two DEA registration numbers associated with two practitioners to appear on a single prescription; the standard allows a practitioner and supervisor to be identified with DEA registration numbers. This scenario is not acceptable for controlled substance prescriptions. The prescribing registrant is solely responsible for issuing the prescription; approval by a supervisor does not alter the legal liability of the prescribing practitioner for the validity of the prescription. Identifying two registrants on a prescription could lead to confusion about which registrant was legally responsible and create confusion in pharmacy record systems.

To ensure that only authorized practitioners sign controlled substance prescriptions, the service provider must ensure that only DEA-registered practitioners are allowed to sign prescriptions for controlled substances and that each practitioner is uniquely identified. Specifically, the system must require that the DEA registrant whose DEA number is listed on the prescription sign the prescription. The system must not allow any other person to sign the prescription. Many office staff may have legitimate reasons to access the system, particularly when the electronic prescription capability is part of an EHR system. Some service providers now explicitly place limits on the level of access granted to various members of a practice. CCHIT Security Criteria require that EHR systems set access controls for specific tasks. DEA would require that all service providers do this if their systems will be used to issue controlled substance prescriptions. Nurses or other members of a practice staff may prepare the prescription, as they may with paper prescriptions, but the systems must allow only a practitioner authorized by the State and DEA to issue controlled substance prescriptions to sign and transmit the prescription.

This requirement is necessary to prevent others with access to the system from creating and signing prescriptions. In a recent discussion of an electronic prescription system, the service provider indicated that the illegality of a staff member issuing a prescription was a sufficient deterrent to prevent this from happening just, the service provider stated, as it prevents staff from stealing prescription pads.

21

Office staff have stolen prescription pads to create fraudulent paper prescriptions and called in fraudulent prescriptions. That they can do so with paper prescriptions is not a reason to facilitate their illegal activities with electronic prescriptions. DEA also notes that medical identity theft—where patient records are sold or misused—is a crime that often involves insiders. The

Report on the Use of Health IT to Enhance and Expand Health and Anti-Fraud Activities

cited a study that found that 70 percent of identity theft cases involved insider theft of data.

22

21

http://www.nationalerx.com/pdf/NEPSI-eRx-faq.pdf

.

22

The

Report on the Use of Health IT to Enhance and Expand Health Care Anti-Fraud Activities

, prepared for the Office of the National Coordinator, U.S. Department of Health and Human Services, September 30, 2005.

http://www.hhs.gov/healthit/hithca.html

.

This requirement will protect practitioners by eliminating the possibility that a staff member will be able to issue controlled substance prescriptions unless the practitioner grants them access to his authentication methods, which would make the practitioner legally responsible for any prescriptions that staff created. This requirement is also consistent with the HIPAA Security Guidance, issued on December 28, 2006, which recommended setting authorization levels particularly for portable devices and health record systems that can be remotely accessed.

DEA notes that role-based access control lists may need to be modified to comply with this requirement. Not every physician is a DEA registrant; not every DEA registrant is allowed to prescribe all Schedule II-V controlled substances. Authorizations for mid-level practitioners (e.g., nurse practitioners, physicians' assistants) vary across States. Service providers will need to ensure that their access control process reflects the actual authorizations of individuals and does not rely solely on roles.

To ensure that a prescription cannot be altered once it is “signed,” DEA is proposing that the prescription must be transmitted immediately on signing. Practitioners would be able to create a group of prescriptions and store them to be signed later. Agents of the practitioner (e.g., nurses) could also, at the practitioner's direction, enter some or all of the data into an electronic prescription as they can do for paper prescriptions. The practitioner, however, must authenticate to the system to sign the prescription because the practitioner is the ultimate authority for the prescription. If others prepare all or part of prescriptions, the practitioner could authenticate to the system and sign one or more prescriptions simultaneously depending on the system. If the system allows a practitioner to sign multiple prescriptions at once, DEA would require that the practitioner be required to indicate separately that he or she intends to sign each controlled substance prescription listed; this can be done by checking a box as some systems currently do. The critical requirement is that once the prescription is signed, it must be immediately transmitted so that there can be no question that someone else at the office had the opportunity to alter it. Many existing systems already have this feature. DEA notes that systems may apply varying labels to the signing function (e.g., sign, transmit); DEA does not think it is necessary to change these labels. The critical element is that the practitioners understand that when they use the function, they are exercising their authority to issue a controlled substance prescription and that they are responsible for accuracy, completeness, and validity of the prescription.

The other part of this requirement is that a controlled substance prescription must not be transmitted unless it has been “signed.” The system must be designed to prevent any transmission until the practitioner has “signed” the prescription. In addition, the system must not allow a prescription to be printed once it has been transmitted or to be transmitted if it was printed. These conditions are necessary to prevent a single prescription being used to generate multiple copies to be filled.

As noted above, the NCPDP SCRIPT standard does not currently include a field for a “signature” or for any indication that the prescription has been signed. DEA would require that controlled substance prescriptions include an indication that the prescription was signed; this indication could be a single character field. The industry has indicated that this alteration is feasible. It will provide pharmacies with additional assurance that the prescription was issued legally.

DEA welcomes comment on the current industry practices used to “sign” electronic prescriptions for noncontrolled substances and whether and how such practices prevent noncontrolled substance prescription forgery, fraud, and other related crimes.

Prescription data

. Electronic prescriptions must contain the same information that DEA requires for paper prescriptions (21 CFR 1306.05): The date of issuance of the prescription;

practitioner's full name and address; practitioner's DEA registration number; patient's full name and address; drug name, strength, quantity, dosage form, and directions for use. DEA notes that for military or Public Health Service practitioners exempt from registration, the prescription must include the practitioner's service identification number or Social Security Number as required by 21 CFR 1306.05(h). This information may not be altered once the practitioner signs the prescription other than to reformat. The current version of NCPDP SCRIPT provides fields and codes for all of the required data elements, but not all of them are mandatory. For a controlled substance prescription, however, all of this information must be included. Other practitioner identifiers (State license number or National Provider Identifier) may not substitute for the DEA registration number. A system that completes practitioner and patient name and address only by linking to a National Provider Identifier (NPI) number and insurance records is not sufficient for DEA purposes for two reasons. First, practitioners will have a single NPI, but they may have multiple DEA registrations, particularly if they practice in more than one State. A prescription must have the correct DEA registration and location. Second, a system that assumes that details on the patient will be filled in by linking to insurance files will not account for the part of the population that does not have prescription drug insurance. As discussed above, multiple prescribers and their DEA registration numbers on a single prescription are also not acceptable. Electronic prescription systems would not be allowed to transmit a prescription for a controlled substance unless all of the required elements are complete.

DEA is also proposing to require that the system show the practitioner all of the DEA-required prescription information before the prescription is signed to ensure that a practitioner does not inadvertently misprescribe a controlled substance or sign a prescription created by an agent for his signature without having been presented with the contents. Although many systems do this, the RAND study indicated that some do not. In those cases, the practitioner sees only the drop down menus sequentially and may not have the opportunity to review the completed prescription. Where an agent enters the data for the prescription, it is particularly important that the practitioner be able to see the details to ensure that diversion is not occurring. DEA notes that the data may be presented in any format the system devises (e.g., arrayed like a paper prescription, a single line with the data selected shown); the essential items are the patient name and address, drug name, dosage form and units, quantity prescribed, directions for use, and the DEA registration number of the prescribing practitioner. DEA recognizes that systems may not routinely display the patient's address and seeks comments on whether displaying this information would pose technical problems.

DEA believes it is important to allow the signing and transmission of more than one prescription simultaneously. However, it is critical that the practitioner know, and positively indicate, which prescriptions are to be signed and transmitted. Where more than one prescription has been prepared at any one time, DEA is proposing to require that, prior to authenticating to the system, the practitioner indicate which prescription(s) are to be signed and transmitted. Such indication could be as simple as checking a box associated with each prescription the practitioner wishes to sign and transmit. DEA is not proposing any requirements to address a circumstance in which a prescription is not indicated for signature and transmission.

DEA would not allow alteration of any of the required information after the prescription is signed except to reformat. DEA does not believe that the intermediaries are altering the data because formulary checks appear to occur prior to signing. If, however, there are cases where the content of the required elements is altered (e.g., to change the prescribed drug to a generic drug) after signing, DEA would consider the prescription invalid and the parties that changed the data to have issued a prescription without being authorized to do so, a violation of the Controlled Substances Act.

Automatic timeout

. For security reasons, many computer systems now lock the computer if it is not used for a period of time, often 5 or 10 minutes. The user mus

This text is long and has been trimmed here. Open the source document for the complete record.