# Implementation of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3AE9-7698 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** April 6, 2009 - **Citation:** 74 FR 15596 ## Text DEPARTMENT OF JUSTICE Drug Enforcement Administration 21 CFR Parts 1300, 1301, 1304, 1306 [Docket No. DEA-322I] RIN 1117-AB20 Implementation of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 AGENCY: Drug Enforcement Administration (DEA), Department of Justice. ACTION: Interim final rule with request for comments. SUMMARY: The Ryan Haight Online Pharmacy Consumer Protection Act, which was enacted on October 15, 2008, amended the Controlled Substances Act and Controlled Substances Import and Export Act by adding several new provisions to prevent the illegal distribution and dispensing of controlled substances by means of the Internet. DEA is hereby issuing an interim rule to amend its regulations to implement the legislation and is requesting comments on the interim rule. DATES: This interim rule is effective April 13, 2009, except §§ 1300.04, 1301.19, and 1304.40, which are effective April 6, 2009. Section 1300.04(i) (the definition of “practice of telemedicine”) has an implementation date of January 15, 2010, unless such date is superseded by future regulatory actions as explained in the SUPPLEMENTARY INFORMATION section. Written comments must be postmarked on or before June 5, 2009, and electronic comments must be sent on or before midnight Eastern time June 5, 2009. ADDRESSES: To ensure proper handling of comments, please reference “Docket No. DEA-322” on all written and electronic correspondence. Written comments being sent via regular or express mail should be sent to the Drug Enforcement Administration, Attention: DEA Federal Register Representative/ODL, 8701 Morrissette Drive, Springfield, VA 22152. Comments may be sent to DEA by sending an electronic message to dea.diversion.policy@usdoj.gov . Comments may also be sent electronically through http://www.regulations.gov using the electronic comment form provided on that site. An electronic copy of this document is also available at the http://www.regulations.gov Web site. DEA will accept attachments to electronic comments in Microsoft Word, WordPerfect, Adobe PDF, or Excel file formats only. DEA will not accept any file formats other than those specifically listed here. Please note that DEA is requesting that electronic comments be submitted before midnight Eastern time on the day the comment period closes because http://www.regulations.gov terminates the public's ability to submit comments at midnight Eastern time on the day the comment period closes. Commenters in time zones other than Eastern time may want to consider this so that their electronic comments are received. All comments sent via regular or express mail will be considered timely if postmarked on the day the comment period closes. FOR FURTHER INFORMATION CONTACT: Mark W. Caverly, Chief, Liaison and Policy Section, Office of Diversion Control, Drug Enforcement Administration, 8701 Morrissette Drive, Springfield, VA 22152; Telephone: (202) 307-7297. SUPPLEMENTARY INFORMATION: Posting of Public Comments: Please note that all comments received are considered part of the public record and made available for public inspection online at http://www.regulations.gov and in the DEA's public docket. Such information includes personal identifying information (such as your name, address, etc.) voluntarily submitted by the commenter. If you want to submit personal identifying information (such as your name, address, etc.) as part of your comment, but do not want it to be posted online or made available in the public docket, you must include the phrase “PERSONAL IDENTIFYING INFORMATION” in the first paragraph of your comment. You must also place all the personal identifying information you do not want posted online or made available in the public docket in the first paragraph of your comment and identify what information you want redacted. If you want to submit confidential business information as part of your comment, but do not want it to be posted online or made available in the public docket, you must include the phrase “CONFIDENTIAL BUSINESS INFORMATION” in the first paragraph of your comment. You must also prominently identify confidential business information to be redacted within the comment. If a comment has so much confidential business information that it cannot be effectively redacted, all or part of that comment may not be posted online or made available in the public docket. Personal identifying information and confidential business information identified and located as set forth above will be redacted and the comment, in redacted form, will be posted online and placed in the DEA's public docket file. Please note that the Freedom of Information Act applies to all comments received. If you wish to inspect the agency's public docket file in person by appointment, please see the “For Further Information” paragraph. Preamble I. Legislation Upon Which These Regulations Are Based The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (Pub. L. 110-425) (hereafter, the “Ryan Haight Act” or the “Act”) was enacted on October 15, 2008. The Act amended the Controlled Substances Act (CSA) and Controlled Substances Import and Export Act (CSIEA) by adding various provisions to prevent the illegal distribution and dispensing of controlled substances by means of the Internet. 1 The law becomes effective April 13, 2009 (except for one provision relating to telemedicine discussed below). Thus, as of April 13, 2009, it will be illegal under federal law to “deliver, distribute, or dispense a controlled substance by means of the Internet, except as authorized by [the CSA]” or to aid or abet such activity. 21 U.S.C. 841(h)(1). The Act applies to all controlled substances in all schedules. 1 Consistent with the CSA itself, the Ryan Haight Act relates solely to controlled substances. Controlled substances are those psychoactive drugs and other substances—including narcotics, stimulants, depressants, hallucinogens, and anabolic steroids—that are placed in one of the five schedules of the CSA due to their potential for abuse and likelihood that they may cause psychological or physical dependence when abused. Controlled substances constitute only a small percentage of all pharmaceutical drugs. Approximately 10 percent of all drug prescriptions written in the United States are for controlled substances, with the remaining approximately 90 percent of prescriptions being written for noncontrolled substances. The amendments to the CSA made by the Ryan Haight Act, as well as the regulations being issued here, do not apply to noncontrolled substances. This document serves three purposes: (1) To explain the new legislation; (2) to announce the amendments to the DEA regulations that implement the new legislation; and (3) to request comments on the amendments to the regulations, which are being issued as an interim rule as contemplated in the legislation. II. Authority in Ryan Haight Act To Issue Regulations The Ryan Haight Act contains various provisions that call upon the Attorney General to issue regulations to implement the Act. Among these is the following general grant of authority: The Attorney General may promulgate and enforce any rules, regulations, and procedures which may be necessary and appropriate for the efficient execution of functions under this Act or the amendments made by this Act, and, with the concurrence of the Secretary of Health and Human Services where this Act or the amendments made by this Act so provide, promulgate any interim rules necessary for the implementation of this Act or the amendments made by this Act, prior to its effective date. 2 2 Public Law 110-425, sec. 3(k)(1). This regulatory authority of the Attorney General has been delegated to the Administrator of DEA. 3 It is evident from the foregoing provision of the Act that Congress contemplated it would be necessary for DEA to issue regulations on an interim basis in order to implement the Act within the relatively short time period between the passage of the Act (October 15, 2008) and its effective date (April 13, 2009). Indeed, Congress envisioned that DEA would need to issue interim rules “prior to its effective date” ( i.e., before April 13, 2009) to effectively implement the new requirements of the Act. 4 Accordingly, the rules published here are effective immediately while at the same time the agency is seeking public comment on them. Following the comment period, DEA will review the comments and make any modifications to the interim rule that are appropriate. Also, as explained below, the Act contemplates that DEA will, with the concurrence of the Secretary of Health and Human Services, promulgate regulations governing the issuance to practitioners of a special registration relating to the practice of telemedicine. Those regulations will be issued separately at a later date. 3 Functions vested in the Attorney General under the CSA have been delegated to the Administrator of DEA. 28 CFR 0.100. Accordingly, in this document, “DEA Administrator” will be used in place of all statutory references to the Attorney General. 4 Congress's express grant of authority under the Ryan Haight Act to issue interim rules as the DEA Administrator finds necessary to implement the Act prior to its effective date forms the basis for the DEA Administrator's conclusion, as is set forth in Section X below, that “good cause” exists under the Administrative Procedure Act (APA) for the issuance of interim rules (those which take effect immediately on an interim basis prior to the public comment period) because “notice and public procedure thereon are impracticable, * * *[and] contrary to the public interest.” See 5 U.S.C. 553(b)(B). III. Overview of the Legislation A. Reasons for the Legislation The unlawful use of pharmaceutical controlled substances has reached alarming levels in the United States in recent years, causing a substantial detrimental effect on the public health and safety. According to the most recently published National Survey on Drug Use and Health (2007), 5 6.9 million Americans reported using psychotherapeutic drugs 6 nonmedically during the prior month. 7 With specific regard to pain relievers, 5.2 million respondents reported abusing these drugs, 8 which is an 18 percent increase from 2004. 9 This study further indicates that, in the United States, the abuse of prescription drugs is second only to that of marijuana and is higher than the abuse of cocaine, heroin and hallucinogens combined. 10 Among persons aged 12 and older who reported using illicit drugs for the first time in 2007, abuse of pain relievers was the most common category of first-time illicit drug use. 11 5 Available at http://www.oas.samhsa.gov/nsduh/2k7nsduh/2k7Results.pdf. 6 The study states: “Psychotherapeutics include the nonmedical use of any prescription-type pain relievers, tranquilizers, stimulants, or sedatives. Over-the-counter substances are not included.” Id. at 55. 7 Id. at 1. 8 Id. 9 Compare 2004 National Survey on Drug Use and Health at 1, available at http://www.oas.samhsa.gov/nsduh/2k4nsduh/2k4results.pdf. 10 See id. at 73. 11 Id. at 4. The false sense of security that some associate with the abuse of these substances is also alarming. Many mistakenly believe that if a drug may be prescribed for medical use, abusing that drug cannot be as harmful as abusing more conventional “street” drugs, such as heroin or cocaine. According to the 2005 Partnership Attitude Tracking Study 12 , 40 percent of teens surveyed believe that prescription medicines are “much safer” to use than illegal drugs. Furthermore, the same study concluded that 31 percent believe there is “nothing wrong” with using prescription medicines without a prescription “once in awhile.” 13 12 Partnership for a Drug-Free America; Partnership Attitude Tracking Study, Teens in grades 7 through 12, 2005; http://www.drugfree.org/Files/Full_Teen_Report (page 21). 13 Id. at 20-21. One of the main factors contributing to the nationwide increase in the diversion of pharmaceutical controlled substances has been the rise in the number of Internet sites that sell or facilitate the sale of these drugs for other than legitimate medical purposes. While in-person “prescription mills” (practitioners' offices that readily supply drug seekers with prescriptions for controlled substances without establishing a legitimate medical basis for doing so) have always been, and remain, a significant source of diversion, the advent of rogue Web sites that cater to those who abuse pharmaceutical controlled substances has allowed the criminal operators of these sites to exploit the anonymity of the Internet to generate illicit sales of controlled substances (and/or prescriptions therefor) that far exceed those of any in-person prescription mill. This is particularly evident when examining the data relating to the sales of hydrocodone, which is the most widely abused pharmaceutical controlled substance in the United States. According to data registered distributors of controlled substances provided to DEA 14 in 2006, 34 pharmacies in the United States that were supplying rogue Internet sites dispensed a total of more than 98 million dosage units of hydrocodone. Hence, these pharmacies each dispensed an average of approximately 2.9 million dosage units of hydrocodone per pharmacy in a single year. By means of comparison, the average pharmacy in the United States dispenses approximately 88,000 dosage units of hydrocodone per year. 14 Distributors are required to submit certain reports to DEA's ARCOS unit, as provided in 21 CFR 1304.33. Congress passed the Ryan Haight Act precisely because of “the increasing use of prescription controlled substances by adolescents and others for nonmedical purposes, which has been exacerbated by drug trafficking on the Internet.” 15 The person for whom the Act was named, Ryan Haight, was “a California high school honors student and athlete who died in 2001 from an overdose of controlled substances that he had purchased from a rogue online pharmacy.” 16 According to the Senate Report accompanying the legislation, “Ease of access to the Internet, combined with lack of medical supervision, has led to tragic consequences in the online purchase of prescription controlled substances.” 17 The Senate Report then cited a list of examples of persons in the United States who had died from overdoses of controlled substances obtained via the Internet. 18 15 S. Rep. No. 110-521, at 1 (2008). 16 Id. at 12. 17 Id. at 5. 18 Id. at 5-6. B. Common Methods Employed by Operators of Rogue Web Sites That Sell Pharmaceutical Controlled Substances The rogue Web sites that the Ryan Haight Act seeks to eliminate take on a variety of appearances and use a variety of methods. One common factor is that all these Web sites are marketed toward drug seekers who are willing to pay a premium to obtain pharmaceutical controlled substances without having a legitimate medical need for them. While the “business models” that the operators of these sites employ to evade detection by law enforcement and/or to create the facade of compliance with the law have evolved significantly over time, there tend to be three categories of participants in these schemes: the prescribing practitioner; the pharmacy that fills the prescriptions; and the criminal facilitator (a non-DEA registrant) who runs the operation. 19 19 The “business models” described here are not the only ones employed by operators of rogue sites; methods other than those described above have been utilized by those who divert controlled substances by means of the Internet. While it has always been illegal to dispense a controlled substance without a legitimate medical purpose, prior to the Act, a rogue operator could design a site that would make it clear to drug seekers that pharmaceutical controlled substances could be obtained through the site without a legitimate medical purpose. For example, a typical rogue site would display prominently on its homepage a list of the pharmaceutical controlled substances that it sold and prompt customers to click on their desired drugs. These Web sites could easily be found by using any of various Internet search engines and entering search terms such as “hydrocodone no prescription.” Unsolicited e-mails or other forms of online advertising and marketing often steered potential customers to these Web sites; the advertisements announced that controlled substances could be readily obtained through the Web site without an in-person medical evaluation and sometimes without even a prescription—thus insuring a drug seeking customer could obtain the controlled substance without a legitimate medical need. Thus, prior to passage of the Act, attracting customers was relatively easy for these rogue Web sites. However, to deliver the goods that the customers were seeking (pharmaceutical controlled substances and/or prescriptions for such), the operator of the rogue Web site usually had to enlist the services of two types of DEA registrants: a practitioner and pharmacy. Thus, the typical criminal facilitator had to recruit an unscrupulous practitioner willing to prescribe controlled substances without a legitimate medical evaluation obtained through a bona fide doctor-patient relationship. While the overwhelming majority of practitioners would want no part of this type of improper arrangement, criminal facilitators were able to find some unscrupulous practitioners willing to participate. Investigations have revealed that these facilitators often target practitioners who carry significant debt, such as those recently graduated from medical school, or those who have retired and are looking for some “extra income.” Regardless of the motivations of the participating practitioners, the facilitator would persuade them to enter into an agreement whereby they would agree to write prescriptions for controlled substances without adhering to the standard professional practices employed by practitioners when evaluating the medical condition of patients and determining the appropriate treatment in return for payment from the facilitator based on the number of prescriptions they would write. These arrangements operated in several ways. In some instances, the facilitator would arrange for a practitioner to issue prescriptions for controlled substances based solely on reviewing online questionnaires the customers submitted to the Web site. Other schemes involved facilitators requiring the customers of the Web site to fax some documentation that purported to be the customers' “medical records” and then having an unscrupulous practitioner issue prescriptions for controlled substances based on a “review” of these faxed documents. A third type of scheme involved the facilitator having customers of the Web site call a telephone number staffed by employees of the site, answer a series of questions purporting to create a “medical history,” and then have unscrupulous practitioners write the prescriptions based on these answers. Whatever the methods employed, these rogue Web site operations were merely a sham, as every step in the process was designed to sell customers controlled substances and/or prescriptions for controlled substances without regard to actual medical need. Some criminal facilitators have been content to take in the profits associated with selling the prescriptions for controlled substances. (Some rogue Web sites charge customers a separate fee for arranging the issuance of prescriptions.) Others have sought to increase their profits by also having customers fill the prescriptions through a pharmacy affiliated with the Web site. To achieve the latter, the criminal facilitator needed to enter into an agreement with an unscrupulous pharmacy that was willing—for a fee—to fill prescriptions for controlled substances with essentially no questions asked and for as many prescriptions as the Web site could steer toward the pharmacy. 20 In addition to paying the pharmacy for the cost of the drugs, the criminal facilitator would also typically pay the pharmacy an agreed upon amount that, in some instances, amounted to millions of dollars. Given the amount of money to be made from these arrangements, DEA has seen pharmacies close their doors completely to walk-in customers and convert their entire business to filling orders generated from rogue Web sites. In some instances, criminal facilitators have used multiple brick and mortar pharmacies to service their list of drug seeking customers. In other cases, a single pharmacy has supplied multiple rogue Web sites. 20 The small percentage of pharmacies who have so participated in these rogue Web site schemes have, in many cases, filled extraordinary numbers of prescriptions for controlled substances that dwarf the sales figures of walk-in pharmacies. These rogue Web sites generally provide the customer with a wide variety of quick and easy payment methods, such as cash-on-delivery, lines of credit, and credit “gift” cards. They also typically structure the various steps of the ordering process so as to link and shift the buyer to different Web sites, making it difficult for investigators to connect payments, products, and Web providers together. Rarely do such rogue Web sites contain any identifying information about where the online pharmacy is located or who owns or operates the Web site. On the contrary, these Web sites frequently fluctuate in name and number minute by minute. Finally, the typical rogue Web site fails to provide any information on how a patient may contact the prescribing practitioner or the pharmacist to consult with them about the drug(s) ordered, including drug interactions and adverse reactions. Recognizing that these rogue Web sites fuel the abuse of prescription controlled substances and thereby increase the number of resulting overdoses and other harmful consequences, Congress passed the Ryan Haight Act to prevent the Internet from being exploited to facilitate such unlawful drug activity. IV. Brief Summary of Some of the Key Provisions of the Legislation Before examining the legislation in detail, the following is a brief recitation of two of the most important new statutory requirements: the in-person medical evaluation requirement for prescribing practitioners and the modified registration requirement for online pharmacies. A. In-person medical evaluation requirement —One of the primary ways in which the Ryan Haight Act combats the use of the Internet to facilitate illegal sales of pharmaceutical controlled substances is by mandating, with limited exceptions, that the dispensing of controlled substances by means of the Internet be predicated on a valid prescription involving at least one in-person medical evaluation. While the lack of an in-person medical evaluation has always been viewed as a “red flag” indicating that diversion might be occurring, the Ryan Haight Act makes it unambiguous that it is a per se violation of the CSA for a practitioner to issue a prescription for a controlled substance by means of the Internet without having conducted at least one in-person medical evaluation, except in certain specified circumstances. At the same time, it is crucial to bear in mind that, as Congress expressly stated under the Act, the mere fact that the prescribing practitioner conducted one in-person medical evaluation does not demonstrate that the prescription was issued for a legitimate medical purpose within the usual course of professional practice. Even where the prescribing practitioner has complied with the requirement of at least one in-person medical evaluation, a prescription for a controlled substance must still satisfy the additional, fundamental prerequisite that has been legally mandated for more than 90 years: it must be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. 21 21 21 CFR 1306.04(a); United States v. Moore , 423 U.S. 122 (1975). This requirement has been a part of federal law since the Harrison Narcotic Act of 1914. Id . at 131. For a detailed explanation of the “legitimate medical purpose requirement,” see 71 FR 52716, 52717 (2006 DEA policy statement). B. Requirement of modified registration for online pharmacies —Another of the core provisions of the Act is the requirement that any person who operates a Web site that fits within the definition of an “online pharmacy” must obtain from DEA a modification of its DEA pharmacy registration that expressly authorizes such online activity. Only DEA-registered pharmacies are eligible under the Act to obtain such a modification of registration. One of the ramifications of this requirement is that those who are not DEA-registered pharmacies (for example, those nonregistrants who have heretofore facilitated unlawful Internet controlled substance sales by enlisting the services of unscrupulous pharmacies and/or prescribing practitioners) are prohibited from operating online pharmacies. The Act's definition of “online pharmacy” encompasses more than merely legitimate pharmacies that may obtain a modification of their DEA registrations allowing them to dispense controlled substances by means of the Internet. As explained below, the definition of “online pharmacy” includes, among others, those persons who operate the types of rogue Web sites that the Act was designed to eliminate. Consistent with the longstanding structure of the CSA (since it was enacted in 1970), the Ryan Haight Act prohibits all controlled substance activities by “online pharmacies” except those expressly authorized by the Act. Again, only DEA-registered pharmacies may obtain a modification of their registration authorizing them to operate as online pharmacies. In addition, a pharmacy that has obtained such a modification of its registration may not operate as an online pharmacy unless it has notified DEA of its intent to do so and its Web site contains certain declarations designed to provide clear assurance that it is operating legitimately and in conformity with the Act. (These requirements are discussed at length below.) V. Detailed Explanation of the Legislation Consistent with the structure of the CSA, the Ryan Haight Act sets out numerous regulatory requirements and other substantive provisions and makes it unlawful to “knowingly or intentionally * * * deliver, distribute, or dispense a controlled substance by means of the Internet, except as authorized by [the Act].” 22 Thus, this explanation of the Act will be divided into two main parts: (1) Explaining the Act's regulatory requirements and other substantive provisions and (2) explaining what it means to “knowingly or intentionally * * * deliver, distribute, or dispense a controlled substance by means of the Internet.” 22 21 U.S.C. 841(h)(1)(A). A. New definitions under the Act The Act adds several new definitions to the CSA. These new statutory definitions are being added to the DEA regulations as part of this Interim Rule. While many of the new definitions are self-explanatory, some are discussed in this preamble to assist in understanding the Act. The following are two of the key definitions in the Act, which are set forth in 21 U.S.C. 802: (51) The term “deliver, distribute, or dispense by means of the Internet” refers, respectively, to any delivery, distribution, or dispensing of a controlled substance that is caused or facilitated by means of the Internet. This definition is plainly broad in scope, encompassing any activity utilizing the Internet that causes or facilitates the delivery, distribution, or dispensing of a controlled substance. This definition is incorporated into the Act's definition of an “online pharmacy”: (52) The term “online pharmacy” * * * means [with certain exceptions discussed below] a person, entity, or Internet site, whether in the United States or abroad, that knowingly or intentionally delivers, distributes, or dispenses, or offers or attempts to deliver, distribute, or dispense, a controlled substance by means of the Internet. The definition of “online pharmacy” is also broad in scope. First, it includes not only a “person” 23 but also any other “entity” or “Internet site”—“whether in the United States or abroad”—that otherwise meets the definition of an “online pharmacy.” Second, it also includes not only any such person, entity or Internet site “that knowingly or intentionally delivers, distributes, or dispenses * * * a controlled substance by means of the Internet,” but also any such one who “offers or attempts” to do so. 23 As set forth in 1 U.S.C. 7, the word “person” includes “corporations, companies, associations, firms, partnerships, societies, and joint stock companies, as well as individuals.” Consistent therewith, the DEA regulations define “person” to include “any individual, corporation, government or governmental subdivision or agency, business trust, partnership, association, or other legal entity.” 21 CFR 1300.01(b)(34). Hence, the term “online pharmacy” includes, among other things: (i) Any Web site that sells, or offers to sell, any controlled substance or a prescription therefor to a person in the United States; (ii) any person who operates such a Web site; 24 (iii) any person who pays a practitioner to write prescriptions for controlled substances for customers of such a Web site; (iv) any person who pays a pharmacy to fill prescriptions for controlled substances that were issued to customers of such a Web site; (v) any pharmacy that knowingly or intentionally fills prescriptions for controlled substances that were issued to customers of such a Web site; and (vi) any person who sends an e-mail that: Offers to sell a controlled substance or a prescription for a controlled substance in a manner not authorized by the Act; directs buyers to a Web site operating in violation of the Act; or otherwise causes or facilitates the delivery, distribution, or dispensing of a controlled substance in a manner not authorized by the Act. 24 The Act exempts certain categories of persons from the application of 21 U.S.C. 841(h)(1), such as Internet service providers and Web hosting services, so long as such persons do not act in concert with others who violate the Act. While the general scope of the definition of an “online pharmacy” is broad, the definition expressly excludes the following categories: (i) Manufacturers or distributors registered under subsection (a), (b), (d), or (e) of [21 U.S.C. 823] who do not dispense controlled substances to an unregistered individual or entity; (ii) Nonpharmacy practitioners who are registered under [21 U.S.C. 823(f)] and whose activities are authorized by that registration; (iii) Any hospital or other medical facility that is operated by an agency of the United States (including the Armed Forces), provided such hospital or other facility is registered under [21 U.S.C. 823(f)]; (iv) A health care facility owned or operated by an Indian tribe or tribal organization, only to the extent such facility is carrying out a contract or compact under the Indian Self-Determination and Education Assistance Act; (v) Any agent or employee of any hospital or facility referred to in clause (iii) or (iv), provided such agent or employee is lawfully acting in the usual course of business or employment, and within the scope of the official duties of such agent or employee, with such hospital or facility, and, with respect to agents or employees of health care facilities specified in clause (iv), only to the extent such individuals are furnishing services pursuant to the contracts or compacts described in such clause; (vi) Mere advertisements that do not attempt to facilitate an actual transaction involving a controlled substance; (vii) A person, entity, or Internet site that is not in the United States and does not facilitate the delivery, distribution, or dispensing of a controlled substance by means of the Internet to any person in the United States; (viii) A pharmacy registered under [21 U.S.C. 823(f)] whose dispensing of controlled substances via the Internet consists solely of— (I) Refilling prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(55)]; or (II) Filling new prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(56)]; or (ix) Any other persons for whom the [DEA Administrator] and the Secretary [of Health and Human Services] have jointly, by regulation, found it to be consistent with effective controls against diversion and otherwise consistent with the public health and safety to exempt from the definition of an “online pharmacy”. 21 U.S.C. 802(52)(B). To elaborate briefly on these exceptions, under exception (i), a DEA-registered manufacturer or distributor 25 that uses the Internet to facilitate activities permitted by its DEA registration does not constitute an online pharmacy. Under exception (ii), a DEA-registered nonpharmacy practitioner ( e.g ., physician, dentist, veterinarian, scientific investigator, hospital, or other person authorized by his registration to dispense controlled substances) may do so by means of the Internet without being an online pharmacy. Under exceptions (iii) through (v), certain hospitals and other health care facilities associated with the United States government, as well as agents and employees acting in the course of their duties for such institutions, are not online pharmacies. Under exception (vi), an advertisement is not an online pharmacy, provided the advertisement does not “attempt to facilitate an actual transaction involving a controlled substance.” 25 Under the CSA, a DEA-registered “distributor” delivers controlled substances to other DEA registrants; it may not administer, dispense, or otherwise deliver controlled substances to patients. See 21 U.S.C. 802(11), 822(a), 822(b), 828(a). Under exception (vii), a person, entity, or Internet site located outside the United States is only excepted from the definition of an online pharmacy if it “does not facilitate the delivery, distribution, or dispensing of a controlled substance by means of the Internet to any person in the United States .” (Emphasis added.) Thus, Web sites operated by persons located abroad, along with persons who operate the sites, do fall within the definition of an online pharmacy if they sell or offer to sell controlled substances to persons in the United States or otherwise “facilitate the delivery, distribution, or dispensing of a controlled substance by means of the Internet to any person in the United States.” Under exception (viii), a DEA-registered pharmacy is excepted from the definition of an online pharmacy if it dispenses controlled substances via the Internet solely by “refilling prescriptions for controlled substances in schedule III, IV, or V” and “filling new prescriptions for controlled substances in schedule III, IV, or V” (as those terms are defined in the Act). Finally, under exception (ix), the DEA Administrator and the Secretary of Health and Human Services have the authority to jointly decide to issue regulations making further exceptions to the definition of an online pharmacy, where they determine that doing so is “consistent with effective controls against diversion and otherwise consistent with the public health and safety.” Pursuant to this clause, the regulations being issued here contain two exceptions to the definition of an online pharmacy: One relating to electronic prescribing of controlled substances and the other to the use of automated dispensing systems. These exceptions are explained below. B. In-Person Medical Evaluation Requirement To directly prohibit what had been the practice of many rogue Web sites—allowing customers to buy controlled substances and/or prescriptions for controlled substances via the Internet without ever seeing the prescribing practitioner in person—the Ryan Haight Act includes as one of its central features the “valid prescription” requirement. This requirement is set forth in 21 U.S.C. 829(e)(1): “No controlled substance that is a prescription drug as determined under the Federal Food, Drug, and Cosmetic Act 26 may be delivered, distributed, or dispensed by means of the Internet without a valid prescription.” 26 Nearly every pharmaceutical controlled substance is a prescription drug under the Federal Food, Drug, and Cosmetic Act (FDCA). In the very rare instance where a drug contains a controlled substance but may be dispensed under the FDCA without a prescription, the DEA regulations specify the procedures a pharmacist must follow to dispense such a drug lawfully to a purchaser. 21 CFR 1306.26. The Act further defines the meaning of “valid prescription” in 21 U.S.C. 829(e)(2)(A): “The term `valid prescription' means a prescription that is issued for a legitimate medical purpose in the usual course of professional practice by—(i) a practitioner who has conducted at least 1 in-person medical evaluation of the patient; or (ii) a covering practitioner.” The Act explains the meaning of “in-person medical evaluation” in 21 U.S.C. 829(e)(2)(B): (i) The term “in-person medical evaluation” means a medical evaluation that is conducted with the patient in the physical presence of the practitioner, without regard to whether portions of the evaluation are conducted by other health professionals. (ii) Nothing in clause (i) shall be construed to imply that 1 in-person medical evaluation demonstrates that a prescription has been issued for a legitimate medical purpose within the usual course of professional practice. Thus, for every controlled substance that is delivered, distributed, or dispensed by means of the Internet, there must be a “valid prescription,” which means not only that the prescription must comply with the longstanding requirement of being issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice, but also that the prescribing practitioner must either (i) have conducted at least one in-person medical evaluation of the patient or (ii) meet the definition of a “covering practitioner” (explained below). Any practitioner who writes a prescription for a controlled substance that fails to comply with this provision of the Act, as well as any pharmacy that knowingly or intentionally fills such a prescription, violates 21 U.S.C. 841(h)(1). Hence, the Act makes it unambiguous that, except in limited and specified circumstances, it is a per se violation of the CSA for a practitioner to issue a prescription for a controlled substance by means of the Internet without having conducted at least one in-person medical evaluation. However, the Act also expressly provides that a prescribing practitioner does not automatically meet the requirement of issuing a prescription for a legitimate medical purpose while acting in the usual course of professional practice merely by having conducted a single in-person medical evaluation of the patient. Rather, as with all situations in which a prescription for a controlled substance is issued, all the facts and circumstances surrounding the issuance of the prescription must be evaluated in determining whether it was issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. 27 A rogue Internet operation cannot, for example, defeat the purpose of the Act by establishing a method of operation in which a practitioner conducts a perfunctory in-person “evaluation” of each “patient” simply for the purpose of selling prescriptions for controlled substances to the patient in perpetuity with no follow-up visits. This topic is addressed further below in Section VII, which provides additional information for practitioners. 27 For a detailed explanation of the “legitimate medical purpose requirement,” see 71 FR 52716, 52717 (2006 DEA policy statement). See also, 21 CFR 1306.04(a); United States v. Moore , 423 U.S. 122 (1975). With respect to the term “covering practitioner,” the Act states (21 U.S.C. 829(e)(2)(C)): The term “covering practitioner” means, with respect to a patient, a practitioner who conducts a medical evaluation (other than an in-person medical evaluation) at the request of a practitioner who—(i) has conducted at least 1 in-person medical evaluation of the patient or an evaluation of the patient through the practice of telemedicine, within the previous 24 months; and (ii) is temporarily unavailable to conduct the evaluation of the patient. Thus, a prescribing practitioner who falls within the above definition of a “covering practitioner” need not conduct an in-person medical evaluation as a prerequisite to prescribing a controlled substance to a given patient, provided that the practitioner for whom the covering practitioner is covering has conducted an in-person medical evaluation of that patient and provided further that this covering arrangement is taking place on only a temporary basis. Moreover, just as with the primary practitioner, the requirement that the prescription must be issued in the usual course of professional practice for a legitimate medical purpose applies with equal force to a “covering practitioner.” The Act also provides for an exception to the requirement of an in-person medical evaluation for practitioners who are engaged in the “practice of telemedicine” within the meaning of the Act. 21 U.S.C. 829(e)(3)(A). Of course, a practitioner engaged in the “practice of telemedicine” remains subject to the requirement that every prescription for a controlled substance be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. The Act provides a temporary definition of the “practice of telemedicine” pending issuance of new regulations addressing “telemedicine.” The topic of “telemedicine” is further addressed in paragraph D below. C. Requirements for Online Pharmacies Modified Registration Requirement —The Act imposes various requirements for those persons and other entities that fit within the Act's definition of an online pharmacy. To begin with, an online pharmacy may only operate lawfully as an online pharmacy if it is a DEA-registered pharmacy that has obtained from DEA a modification of its registration authorizing it to engage in such activity. 21 U.S.C. 823(f), 841(h)(1). An online pharmacy that is not validly registered with a modification authorizing it to operate as an online pharmacy as required by 21 U.S.C. 823(f) will violate 21 U.S.C. 841(h)(1) if it knowingly or intentionally delivers, distributes, or dispenses a controlled substance by means of the Internet. Moreover, under the Act, the only type of online pharmacy that is eligible to apply to DEA for such modification of registration is a DEA-registered pharmacy. 21 U.S.C. 823(f). Thus, any person, entity, or Internet site that falls within the definition of an online pharmacy—and is not a DEA-registered pharmacy that has obtained a modification of its registration authorizing it to operate as an online pharmacy—is necessarily violating the Act if it knowingly or intentionally delivers, distributes, or dispenses a controlled substance by means of the Internet. The regulations being issued here set forth the process by which a DEA-registered pharmacy may apply online for a modification of its registration authorizing it to operate as an online pharmacy. Under the Act, DEA must base its decision on whether to grant or deny such an application for a modification of registration on the same statutory criteria that it must consider in evaluating an application for registration submitted by a pharmacy or other practitioner. 21 U.S.C. 823(f). Reporting Requirement —A pharmacy that has obtained a modification of its registration authorizing it to dispense controlled substances by means of the Internet must report to DEA, on a monthly basis, the total amount of each controlled substance it dispenses. 21 U.S.C. 827(d)(2). For pharmacies that are subject to this requirement, the monthly report must include all controlled substances dispensed by any means—not just controlled substances dispensed by means of the Internet. Id . However, if a pharmacy with such a modified registration dispenses an amount that falls below the threshold in a given month, it is not required to submit a report for that month. Id . The monthly threshold is either (A) 100 or more prescriptions for controlled substances filled by the pharmacy or (B) 5,000 or more total dosage units of controlled substances dispensed. Id . Again, these threshold amounts include all controlled substances dispensed by the pharmacy by any means (through walk-in business, by mail, by means of the Internet, or otherwise). Id . If the pharmacy meets or exceeds either of the foregoing amounts in a given month, it must report to DEA the total amount of controlled substances it dispensed by any means during that month. Id . The regulations being issued here specify the time and manner in which such reports must be filed. Statements that must appear on an online pharmacy's Web site —Every online pharmacy is required under the Act to “display in a visible and clear manner on its homepage a statement that it complies with the requirements of [21 U.S.C. 831] with respect to the delivery or sale or offer for sale of controlled substances and shall at all times display on the homepage of its Internet site a declaration of compliance in accordance with this section.” 21 U.S.C. 831(a). In addition, the Act requires every online pharmacy to satisfy the following requirement relating to what the Act refers to as the “Internet Pharmacy Site Disclosure Information.” As set forth in 21 U.S.C. 831(c), each online pharmacy shall post in a visible and clear manner on the homepage of each Internet site it operates, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage, the following information for each pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of, that Web site: • The name and address of the pharmacy as it appears on the pharmacy's Drug Enforcement Administration Certificate of Registration. • The pharmacy's telephone number and e-mail address. • The name, professional degree, and States of licensure of the pharmacist-in-charge, and a telephone number at which the pharmacist-in-charge can be contacted. • A list of the States in which the pharmacy is licensed to dispense controlled substances. • A certification that the pharmacy is registered under this part to deliver, distribute, or dispense by means of the Internet controlled substances. • The name, address, telephone number, professional degree, and States of licensure of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof. • The following statement, unless revised by the [DEA Administrator] by regulation: “This online pharmacy will only dispense a controlled substance to a person who has a valid prescription issued for a legitimate medical purpose based upon a medical relationship with a prescribing practitioner. This includes at least one prior in-person medical evaluation or medical evaluation via telemedicine in accordance with applicable requirements of section 309.” While the foregoing requirements are largely self-explanatory, some aspects warrant special emphasis. The requirement that an online pharmacy post the foregoing information “in a visible and clear manner on the homepage of each Internet site it operates, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage” is intended to ensure that members of the public who visit such Web sites are informed about the Ryan Haight Act's core requirements and to ensure that the DEA-registered pharmacies and prescribing practitioners affiliated with the site, if any, are clearly identified. Any effort by an online pharmacy to hide or reduce the visibility on the Web site of this required information will subject those responsible to potential criminal and civil liability and, in the case of DEA registrants, potential loss of registration. The required information must be displayed “for each pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of, that Web site.” Thus, if multiple pharmacies dispense controlled substances pursuant to orders made on, through, or on behalf of, that Web site, each required category of information must be displayed for each such pharmacy. The requirement (under paragraph (4)) that an online pharmacy list the States in which it is licensed to dispense controlled substances is designed to ensure that an online pharmacy only dispenses controlled substances to patients in States in which it is authorized to practice pharmacy. Dispensing beyond the scope of State licensure is one of the recurring transgressions of some rogue online pharmacies and generally violates State law. 28 28 A State may bring a civil action in federal court to enjoin any violation of the Ryan Haight Act—not merely those violations of State law—and to obtain other appropriate legal or equitable relief. 21 U.S.C. 882(c). State licensure requirement —The Act also requires that online pharmacies comply with State licensure requirements. Specifically, the Act requires that: Each online pharmacy shall comply with the requirements of State law concerning the licensure of pharmacies in each State from which it, and in each State to which it, delivers, distributes, or dispenses or offers to deliver, distribute, or dispense controlled substances by means of the Internet, pursuant to applicable licensure requirements, as determined by each such State. 21 U.S.C. 831(b). Required notification to DEA —The Act contains a provision that is designed to ensure that DEA, and the applicable State boards of pharmacy, are aware of the existence of an online pharmacy before it commences operation. The Act's notification requirements are set forth in 21 U.S.C. 831(d)(1): Thirty days prior to offering a controlled substance for sale, delivery, distribution, or dispensing, the online pharmacy shall notify the [DEA Administrator], in such form and manner as the [Administrator] shall determine, and the State boards of pharmacy in any States in which the online pharmacy offers to sell, deliver, distribute, or dispense controlled substances. Pursuant to this provision, the regulations being issued here provide that such notification to DEA shall be made by the pharmacy as part of the process by which it applies to DEA for a modification of its registration authorizing it to operate as an online pharmacy. The Act specifies that the foregoing notification must include the following information: (A) The information required to be posted on the online pharmacy's Internet site under [21 U.S.C. 831(c)] and shall notify the [DEA Administrator] and the applicable State boards of pharmacy, under penalty of perjury, that the information disclosed on its Internet site under [21 U.S.C. 831(c)] is true and accurate; (B) The online pharmacy's Internet site address and a certification that the online pharmacy shall notify the [Administrator] of any change in the address at least 30 days in advance; and (C) the Drug Enforcement Administration registration numbers of any pharmacies and practitioners referred to in [21 U.S.C. 831(c)], as applicable. 21 U.S.C. 831(d)(2). Thus, the information that an online pharmacy is required to post on its Web site must also be provided to DEA as part of the application for a modification of its DEA registration in order to satisfy part of the notification requirement. Declaration of compliance —Beginning on the date on which the online pharmacy makes the notification to DEA required by 21 U.S.C. 831(d), and continuing thereafter, it must “display on the homepage of its Internet site, in such form as the [DEA Administrator] shall by regulation require, a declaration that it has made such notification to the [Administrator].” 21 U.S.C. 831(e). The regulations being issued here specify precisely the form in which this declaration must be made. Additional considerations regarding statements, declarations, notifications, and disclosures required under the Act —As stated in 21 U.S.C. 831(f): “Any statement, declaration, notification, or disclosure required under [21 U.S.C. 831] shall be considered a report required to be kept under [the CSA].” One important effect of this provision is that, in conjunction with 21 U.S.C. 843(a)(4), it is a felony violation of the CSA to furnish false or fraudulent material information in, or omit any material information from, any statement, declaration, notification, or disclosure required under 21 U.S.C. 831. 29 29 In addition, the Act lists the following as an example of a violation of 21 U.S.C. 841(h)(1): “making a material false, fictitious, or fraudulent statement or representation in a notification or declaration under [21 U.S.C. 831(d) or (e)].” 21 U.S.C. 841(h)(2)(E). Such conduct might also subject the offender to liability under 18 U.S.C. 1001(a). D. Telemedicine As indicated above, “a practitioner engaged in the practice of telemedicine” within the meaning of the Act is exempt from the requirement of an in-person medical evaluation as a prerequisite to prescribing or otherwise dispensing controlled substances by means of the Internet. Before explaining the meaning of the “practice of telemedicine,” it bears repeated emphasis that all practitioners who prescribe controlled substances—even those engaged in the practice of telemedicine—remain subject to the requirement that the prescription be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. Prescribing a controlled substance without conducting an in-person medical evaluation has always been, and remains under the Act, a strong indication (or “red flag”) of likely diversion. 30 The Act simply made the failure to perform an in-person medical evaluation in certain circumstances 31 an automatic violation of the CSA, while leaving it as a factor indicative of possible diversion in all other circumstances. 30 See , e.g. , United States v. Rosen , 582 F.2d 1032, 1036 (5th Cir. 1978). 31 These circumstances are specified in 21 U.S.C. 829(e) and discussed above. The definition of the “practice of telemedicine” includes seven distinct categories that involve circumstances in which the prescribing practitioner might be unable to satisfy the Act's in-person medical evaluation requirement, yet nonetheless has sufficient medical information to prescribe a controlled substance for a legitimate medical purpose in the usual course of professional practice. In these circumstances, provided certain safeguards are in place to ensure that the practitioner who is engaged in the practice of telemedicine is able to conduct a bona fide medical evaluation of the patient at the remote location, and is otherwise acting in the usual course of professional practice, the Act contemplates that the practitioner will be permitted to prescribe controlled substances by means of the Internet despite not having conducted an in-person medical evaluation. The Act defines these categories, through the definition of “practice of telemedicine,” which is set forth in 21 U.S.C. 802(54). The Act specifies that the definition of the “practice of telemedicine” found in 21 U.S.C. 802(54) does not take effect at the same time the rest of the Act takes effect (April 13, 2009). Rather, the Act provides for a temporary definition of the “practice of telemedicine” that will apply beginning April 13, 2009, and continuing until the earlier of two dates: (i) three months after the date on which regulations are promulgated to carry out 21 U.S.C. 831(h) [relating to the issuance of a special registration to practice telemedicine] or (ii) January 15, 2010. 32 Until the first of the foregoing two dates is reached, the Act states that the following definition applies: 32 Public Law 110-425, section 3(j). [T]he term “practice of telemedicine” means the practice of medicine in accordance with applicable Federal and State laws by a practitioner (as that term is defined in section 102 of the Controlled Substances Act (21 U.S.C. 802)) (other than a pharmacist) who is at a location remote from the patient and is communicating with the patient, or health care professional who is treating the patient, using a telecommunications system referred to in section 1834(m) of the Social Security Act (42 U.S.C. 1395m(m)), if the practitioner is using an interactive telecommunications system that satisfies the requirements of section 410.78(a)(3) of title 42, Code of Federal Regulations. The rule being issued today contains both definitions of the practice of telemedicine (temporary and permanent), with the respective effective dates indicated. Special registration for telemedicine —A practitioner who is engaged in the practice of telemedicine within the meaning of the Act is not subject to the mandatory in-person medical evaluation requirement of 21 U.S.C. 829(e) (although such practitioner remains subject to the requirement that all prescriptions for controlled substances be issued for a legitimate medical purpose). The Act's permanent definition of the “practice of telemedicine” includes, as an example, “a practitioner who has obtained from the [DEA Administrator] a special registration under [21 U.S.C. 831(h)].” 21 U.S.C. 802(54)(E). The Act specifies certain criteria that DEA must consider when evaluating an application for such a registration. However, the Act contemplates that DEA must issue certain regulations to effectuate this special registration provision. Specifically, the Act states: “The [DEA Administrator] shall, with the concurrence of the Secretary [of Health and Human Services], promulgate regulations specifying the limited circumstances in which a special registration under [21 U.S.C. 831(h)] may be issued and the procedures for obtaining such a special registration.” DEA will issue a separate rule promulgating regulations consistent with this directive. As explained above, until such regulations are promulgated, or until January 15, 2010 (whichever comes first), the temporary definition of the practice of telemedicine recited above remains in effect. E. Exemptions for Electronic Prescribing of Controlled Substances and Automated Dispensing Systems Electronic prescribing of controlled substances —On June 27, 2008, DEA published in the Federal Register a Notice of Proposed Rulemaking that would amend the DEA regulations to allow practitioners to electronically prescribe controlled substances (73 FR 36722). DEA is currently developing a final rule on electronic prescribing of controlled substances that takes into account the numerous public comments that were submitted in response to the proposed rule. Once the rule is finalized and published in the Federal Register , practitioners will be permitted to electronically prescribe controlled substances in accordance with the requirements in the regulations. In most cases, electronic prescribing of controlled substances will occur by means of the Internet. Given the Act's definitions, a pharmacy that knowingly or intentionally fills an electronic prescription for a controlled substance would (in the likely event that such an electronic prescription were transmitted via the Internet) fall within the Act's definition of an online pharmacy. As indicated above, the Act gives the DEA Administrator, acting jointly with the Secretary of Health and Human Services, authority to exempt by regulation certain persons from the definition of an “online pharmacy,” where the Administrator and the Secretary have found that doing so is “consistent with effective controls against diversion and otherwise consistent with the public health and safety.” 21 U.S.C. 802(52)(B)(ix). Pursuant to this authority, the regulations being issued here today contain a provision that exempts from the definition of an online pharmacy any DEA-registered pharmacy “whose delivery, distribution, or dispensing of controlled substances by means of the Internet consists solely of * * * filling prescriptions that were electronically prescribed in a manner authorized by this chapter and otherwise in compliance with the Act.” 21 CFR 1300.04(h)(9). To eliminate any possible confusion as to how this exception applies, this provision of the regulations further states: “A registered pharmacy will be deemed to meet this exception if, in view of all of its activities other than [the acceptance of electronic prescriptions for controlled substances transmitted in accordance with the requirements of this chapter], it would fall outside the definition of an online pharmacy.” A DEA-registered pharmacy that is so exempted from the definition of an online pharmacy is not required to obtain a modified registration and is not subject to the reporting requirement of 21 U.S.C. 827(d)(2) or the additional requirements relating to online pharmacies set forth in 21 U.S.C. 831. It should be understood that the exception provided in 21 CFR 1300.04(h)(9) cannot take effect until DEA issues regulations allowing for the electronic prescribing of controlled substances. Until then, electronic prescribing of controlled substances is not permitted by the DEA regulations and thus cannot form the basis for any exception to the requirement of a modified registration for DEA-registered pharmacies. It should also be clear from the language of 21 CFR 1300.04(h)(9) that this exception provides no loophole for operators of rogue Internet Web sites or unscrupulous pharmacies that fill prescriptions generated through such sites. The mere fact that a pharmacy accepts electronic prescriptions does not , in any way, immunize the pharmacy from the requirements of the Act. Likewise, a rogue Web site that operates in violation of the Act cannot escape liability simply by having either (i) unscrupulous practitioners who have a contract to write prescriptions on behalf of the site issue such prescriptions electronically or (ii) unscrupulous pharmacies that have a contract to fill such prescriptions do so through the acceptance of electronic prescriptions. To the contrary, the regulation is written so that the exception cannot possibly be utilized by a rogue Web site; only a DEA-registered pharmacy is eligible for the exception and only to the extent it is otherwise acting in conformity with the CSA and the DEA regulations. Exemption for automated dispensing systems —Under current DEA regulations, a DEA-registered retail pharmacy may install and operate an automated dispensing system at a long term care facility under certain specified conditions. 21 CFR 1301.27. Among other requirements, any retail pharmacy that installs and operates an automated dispensing system at a long term care facility must maintain a separate registration at each long term care facility in which its automated dispensing systems are located. Id . Prescription information may be transmitted by the retail pharmacy to the automated dispensing system via the Internet. Therefore, a pharmacy that operates an automated dispensing system at a long term care facility could potentially fall within the Act's definition of an online pharmacy. Pursuant to 21 U.S.C. 802(52)(B)(ix), the DEA Administrator and the Secretary have jointly concluded that it would be consistent with effective controls against diversion and otherwise consistent with the public health and safety to issue the following exemption. As set forth in 21 CFR 1300.04(h)(10), if a DEA-registered retail pharmacy does not deliver, distribute, or dispense, or offer to deliver, distribute, or dispense, controlled substances by means of the Internet, other than to communicate prescription information to an automated dispensing system for which it holds a separate registration at a long term care facility, that retail pharmacy is exempted from the definition of an online pharmacy. As a result, such a pharmacy is not required to obtain a modified registration and is not subject to the reporting requirement of 21 U.S.C. 827(d)(2) or the additional requirements relating to online pharmacies set forth in 21 U.S.C. 831. VI. Criminal Provisions of the Ryan Haight Act The Ryan Haight Act adds two new criminal offenses to the CSA. The first new offense is set forth in 21 U.S.C. 841(h)(1), which states: It shall be unlawful for any person to knowingly or intentionally- (A) Deliver, distribute, or dispense a controlled substance by means of the Internet, except as authorized by [the CSA]; or (B) Aid or abet (as such terms are used in section 2 of title 18, United States Code) any activity described in subparagraph (A) that is not authorized by [the CSA]. The Act contains specific examples of conduct which would violate 21 U.S.C. 841(h)(1). These examples in the Act, however, are not an exclusive list of the types of conduct that constitute violations of 21 U.S.C. 841(h)(1). With this proviso made clear, 21 U.S.C. 841(h)(2) lists the following as examples of violations: (A) Delivering, distributing, or dispensing a controlled substance by means of the Internet by an online pharmacy that is not validly registered with a modification authorizing such activity as required by [21 U.S.C. 823(f)] (unless exempt from such registration); (B) Writing a prescription for a controlled substance for the purpose of delivery, distribution, or dispensation by means of the Internet in violation of [21 U.S.C. 829(e)]; (C) Serving as an agent, intermediary, or other entity that causes the Internet to be used to bring together a buyer and seller to engage in the dispensing of a controlled substance in a manner not authorized by [21 U.S.C. 823(f) or 829(e)]; (D) Offering to fill a prescription for a controlled substance based solely on a consumer's completion of an online medical questionnaire; and (E) Making a material false, fictitious, or fraudulent statement or representation in a notification or declaration under [21 U.S.C. 831(d) or (e)]. As these examples are largely self-illuminating, and some have already been addressed in this preamble, only limited further amplification is provided here. Paragraph (C), in particular, reflects that the Act was intended not only to prohibit DEA registrants from using the Internet to facilitate the unlawful dispensing of controlled substances, but to also prohibit non-DEA registrants from doing so. Most notably, paragraph (C) is aimed squarely at the criminal facilitator whose “business plan” for operating a rogue online pharmacy is to recruit an unscrupulous practitioner to write prescriptions based on insufficient or nonexistent medical evaluations and/or an unscrupulous pharmacist to fill such prescriptions. The Act contains certain categories of conduct that do not result in the participants falling within the Act's definition of an online pharmacy. Specifically, 21 U.S.C. 841(h)(3) states: (A) This subsection [21 U.S.C. 841(h)(1)] does not apply to: (i) The delivery, distribution, or dispensation of controlled substances by nonpractitioners to the extent authorized by their registration under [the CSA]; (ii) The placement on the Internet of material that merely advocates the use of a controlled substance or includes pricing information without attempting to propose or facilitate an actual transaction involving a controlled substance; or (iii) except as provided in subparagraph (B), any activity that is limited to— (I) the provision of a telecommunications service, or of an Internet access service or Internet information location tool (as those terms are defined in section 231 of the Communications Act of 1934) [47 U.S.C. 231]; or (II) the transmission, storage, retrieval, hosting, formatting, or translation (or any combination thereof) of a communication, without selection or alteration of the content of the communication, except that deletion of a particular communication or material made by another person in a manner consistent with section 230(c) of the Communications Act of 1934 [47 U.S.C. 230(c)] shall not constitute such selection or alteration of the content of the communication. (B) The exceptions under subclauses (I) and (II) of subparagraph (A)(iii) shall not apply to a person acting in concert with a person who violates paragraph (1). Thus, paragraph (A)(i) allows DEA-registered nonpractitioners (such as manufacturers and distributors) to utilize the Internet in carrying out activities authorized by their DEA registrations (and otherwise in conformity with the CSA) without being subject to liability under 21 U.S.C. 841(h)(1). Paragraph (A)(ii) allows for Web sites that advocate the use of controlled substances or contain pricing information “without attempting to propose or facilitate an actual transaction involving a controlled substance.” Paragraph (A)(iii) exempts from application of 21 U.S.C. 841(h)(1) Internet service providers, Web hosting services, and certain other specified entities that do not alter content of Internet transmissions. However, it is crucial to bear in mind that the exception of paragraph (A)(iii) does not apply to “a person acting in concert with a person who violates [21 U.S.C. 841(h)(1)].” Thus, any person whose conduct would be sufficient to prove that he conspired to violate 21 U.S.C. 841(h)(1), or aided and abetted such violation, is not immune from prosecution under paragraph (A)(iii). The second new criminal offense added by the Act is 21 U.S.C. 843(c)(2)(A). This provision expressly prohibits using the Internet to advertise illegal transactions in controlled substances. Specifically, this provision states: It shall be unlawful for any person to knowingly or intentionally use the Internet, or cause the Internet to be used, to advertise the sale of, or to offer to sell, distribute, or dispense, a controlled substance where such sale, distribution, or dispensing is not authorized by [the CSA] or by the Controlled Substances Import and Export Act. The Act further states: Examples of activities that violate [21 U.S.C. 843(c)(2)(A)] include, but are not limited to, knowingly or intentionally causing the placement on the Internet of an advertisement that refers to or directs prospective buyers to Internet sellers of controlled substances who are not registered with a modification under [21 U.S.C. 823(f)]. Thus, for example, it is unlawful under the Act to knowingly or intentionally place an advertisement on the Internet that directs persons to a Web site that sells prescriptions for controlled substances where the operator of the Web site is not a DEA-registered pharmacy with a modification authorizing it to operate as an online pharmacy. As another example, it is unlawful under the Act to knowingly or intentionally place an advertisement on the Internet that offers to sell a controlled substance without a prescription or that directs persons to a Web site through which a controlled substance may be purchased without a prescription. Two important points should be noted with respect to 21 U.S.C. 843(c)(2)(A). First, to establish a violation of this felony provision, it is not necessary that the person placing the advertisement actually engage in a transaction involving a controlled substance. Rather, merely placing on the Internet an advertisement that is designed to facilitate, or offers to facilitate, an illegal sale of a controlled substance is sufficient to violate 21 U.S.C. 843(c)(2)(A). Second, the Act applies to advertisements relating to violations not only of the CSA, but also of the Controlled Substances Import and Export Act (CSIEA, which is found in 21 U.S.C. 951 through 971). Thus, it is a violation of 21 U.S.C. 843(c)(2)(A) to place an advertisement on the Internet that offers, for example, to ship controlled substances into the United States for personal medical use, since doing so would violate the CSIEA. 33 What It Means to “Knowingly or intentionally deliver, distribute, or dispense a controlled substance by means of the Internet.” 33 Under the CSIEA, the importation of controlled substances into the United States is prohibited except by persons registered with DEA to do so or persons exempted from such requirement. 21 U.S.C. 952, 957, 960. In accordance with the CSIEA, DEA has issued a regulation authorizing a person to import certain controlled substances for personal medical use, provided the person has the drugs in his possession upon entering the United States, makes the required declaration to the U.S. Customs and Border Protection, and otherwise complies fully with the requirements of the regulation. 21 CFR 1301.26; 69 FR 55343 (2004). Under no circumstances is it permissible under the CSIEA or the regulations for a person to have controlled substances shipped into the United States for personal medical use. The Ryan Haight Act is structured around the phrase “knowingly or intentionally deliver, distribute, or dispense a controlled substance by means of the Internet.” The meaning of this phrase is therefore essential to the meaning of the Act. To explain its meaning, it is helpful to divide the phrase into two parts, starting with the latter half (“deliver, distribute, or dispense a controlled substance by means of the Internet”). The Act itself contains the following definition: The term “deliver, distribute, or dispense by means of the Internet” refers, respectively, to any delivery, distribution, or dispensing of a controlled substance that is caused or facilitated by means of the Internet. 21 U.S.C. 802(51) (emphasis added). Given that the phrase “deliver, distribute, or dispense by means of the Internet” has the foregoing definition, the next question is: What does it mean to “ knowingly or intentionally ” deliver, distribute, or dispense a controlled substance by means of the Internet? The phrase “knowingly or intentionally” has been a part of the CSA since its enactment in 1970. Among other provisions, 21 U.S.C. 841(a)(1) (the most widely utilized criminal provision of the CSA) makes it an offense to “knowingly or intentionally * * * manufacture, distribute, or dispense, or possess with intent to manufacture, distribute, or dispense, a controlled substance” except as authorized by the CSA. There are numerous reported federal cases, some of which are discussed below, in which practitioners and pharmacists have been convicted of violating 21 U.S.C. 841(a)(1). These cases establish clear precedent for interpreting the phrase “knowingly or intentionally” in the context of practitioners who unlawfully prescribe controlled substances and pharmacists who unlawfully fill prescriptions for controlled substances. Specifically, a practitioner may be convicted of knowingly or intentionally dispensing controlled substances in violation of the CSA where the practitioner either (i) had actual knowledge of the illegal activity or (ii) was presented with facts that put him on notice that criminal activity was particularly likely and yet intentionally failed to investigate those facts. 34 The following statement by one federal court of appeals exemplifies the standard under which pharmacists may be held liable for knowingly or intentionally dispensing controlled substances in violation of the CSA: 34 United States v. Katz , 445 F.3d 1023, 1031 (8th Cir. 2006), cert. denied , 127 S.Ct. 421 (2006). The question, then, in any case where a pharmacist is charged with illegal distribution of controlled substances, is whether he knew that the purported prescription was not issued for a legitimate medical purpose or in the usual course of medical practice. The key element of knowledge may be shown by proof that the defendant deliberately closed his eyes to the true nature of the prescription. 35 35 United States v. Lawson , 682 F.2d 480, 482 (4th Cir. 1982) (citations omitted), cert. denied , 459 U.S. 991 (1982). Another federal court has similarly stated that a pharmacist may be convicted of unlawfully dispensing controlled substances where the evidence establishes that the pharmacist “deliberately closed his eyes to wrongdoing that should have been obvious to him.” 36 Courts have referred to such conduct as “willful blindness” or “deliberate ignorance.” As one court has stated: 36 United States v. Veal , 23 F.3d 985, 988 (6th Cir. 1994). Ignorance is deliberate if the defendant was presented with facts that put her on notice that criminal activity was particularly likely and yet she intentionally failed to investigate those facts.* * * If, in light of certain obvious facts, reasonable inferences support a finding that a defendant's failure to investigate is equivalent to `burying one's head in the sand,' the jury may consider willful blindness as a basis for knowledge. 37 37 Katz , 445 F.3d at 1031. Thus, a pharmacist who fills a prescription that was issued in violation of any provision of the Act may be held criminally liable under 21 U.S.C. 841(h)(1) if he did so knowingly or intentionally—that is, if he either (i) had actual knowledge of the violation or (ii) deliberately disregarded facts that would have led a reasonable pharmacist to be highly suspicious about the likelihood of such a violation. Likewise, a practitioner who writes a prescription in violation of the Act may be held criminally liable under 21 U.S.C. 841(h)(1) if he did so knowingly or intentionally—which can be proven by showing that either (i) the practitioner had actual knowledge of the violation or (ii) the practitioner deliberately disregarded facts that would have led a reasonable practitioner to be highly suspicious about the likelihood of such a violation. VII. Additional Information About the Ryan Haight Act for Pharmacists, Practitioners, Other Registrants, and Members of the Public This section provides additional information specifically tailored to various categories of persons who are likely to be affected by, or otherwise have an interest in, the Ryan Haight Act. This information must be read in conjunction with the general information explaining the Act provided above. For example, the definitions of the terminology used in the Act will not be repeated in this section (due to their length) and should be reviewed as necessary by returning to the appropriate sections of the preamble. A. Additional Specific Information for Pharmacists If you are a pharmacist, and your DEA-registered pharmacy falls within the definition of an “online pharmacy,” your pharmacy must, beginning on April 13, 2009, obtain from DEA a modification of its registration authorizing it to operate as an online pharmacy. (DEA will issue to the pharmacy a Certificate of Registration indicating the modification of registration.) The Ryan Haight Act contains several exceptions to the definition of an online pharmacy, so you should review carefully these exceptions before submitting an application for such modification of registration. Among other things, particular consideration should be given to the exception set forth in 21 U.S.C. 802(52)(B)(viii) that excludes from the definition of an online pharmacy those DEA-registered pharmacies “whose dispensing of controlled substances via the Internet consists solely of * * * (I) refilling prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(55)] or (II) filling new prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(56)].” Also, the regulations being issued here exempt from the definition of online pharmacy any registered pharmacy “whose delivery, distribution, or dispensing of controlled substances by means of the Internet consists solely of * * * filling prescriptions that were electronically prescribed in a manner authorized by this chapter and otherwise in compliance with the Act.” Given these exceptions to the definition of an online pharmacy, DEA anticipates that the overwhelming majority of pharmacies in the United States, if they follow their current practices, will not, as of April 13, 2009, fall within the definition of an online pharmacy. However, as of April 13, 2009, if a pharmacist knowingly or intentionally dispenses a controlled substance by means of the Internet, and the pharmacy fits within the definition of an online pharmacy, but does not hold a modified DEA registration authorizing it to operate as an online pharmacy, the pharmacy and the pharmacist are violating 21 U.S.C. 841(h)(1) and subject to potential criminal prosecution and loss of the pharmacy's DEA registration. Accordingly, if the anticipated activities of your pharmacy will render it an online pharmacy within the meaning of the Act, you should submit to DEA your application for a modified registration as early as possible, since you will not be permitted to engage in the activities of an online pharmacy until DEA has approved such application. To expedite matters, DEA has established an online application process for registrants to apply for such modification of registration. In addition, as explained earlier in this preamble, any pharmacy that fits within the Act's definition of an online pharmacy must display certain information on its Web site and make certain notifications to DEA, as required by the Act and the regulations being issued here. Also, if a pharmacy has applied for and been granted a modification of its registration authorizing it to operate as an online pharmacy, it is obligated to submit monthly reports of all controlled substances dispensed by any means (walk-in business, dispensing by mail, or any other type of dispensing—whether by means of the Internet or not), provided such dispensing meets or exceeds the threshold amounts. A pharmacist has always had a corresponding responsibility to ensure that any dispensing of controlled substances conforms with the CSA and DEA regulations. 38 That same corresponding responsibility now applies with respect to the new requirements of the Ryan Haight Act and the implementing regulations. That is, a pharmacist's corresponding responsibility now includes ensuring that controlled substances are dispensed in conformity with the Ryan Haight Act. For example, under the Act, a pharmacist may not knowingly or intentionally fill a prescription for a controlled substance that was issued in violation of the inperson medical evaluation requirement of 21 U.S.C. 829(e). 38 See 21 CFR 1306.04(a). How does a pharmacist, when presented with a prescription (whether it is a written prescription presented in person, an oral prescription, a faxed prescription, or otherwise) know whether the prescription was “dispensed by means of the Internet,” and thus subject to the requirements of the Act? Again, under the law, a pharmacist has a corresponding responsibility to ensure that any prescription filled was issued in conformity with the law and regulations. The same legal standard that has always applied in determining whether a pharmacist met this responsibility will also apply in determining whether the pharmacist acted properly in filling a prescription subject to the requirements of the Ryan Haight Act. If the pharmacist either (i) had actual knowledge that the prescription was issued by means of the Internet and that the requirements of the Act were not met or (ii) in view of all the circumstances surrounding a particular prescription, and, in the exercise of proper professional practice, should have known of such violation, or deliberately closed his eyes to circumstances indicative of a possible violation, or otherwise failed to take appropriate steps that a professional pharmacist should take to investigate suspicious circumstances, the pharmacy and pharmacist may be deemed to have knowingly or intentionally violated 21 U.S.C. 841(h)(1). Depending on the circumstances, the relevant factors for this inquiry might include: the number of prescriptions received from a practitioner; the practitioner's pattern of prescribing; the address of the patient in relation to that of the practitioner; and the distance from the practitioner to the pharmacy. If, taking factors such as these into account, the pharmacist either (a) actually knows that the patient to whom a prescription for a controlled substance was issued was steered to the practitioner through a Web site or (b) should reasonably suspect so and fails to verify, the pharmacist who fills such a prescription will have knowingly or intentionally dispensed a controlled substance by means of the Internet. If such dispensing occurs, both the pharmacy and the pharmacist fall within the definition of an online pharmacy, and both will automatically violate 21 U.S.C. 841(h)(1) if the pharmacy does not have a modified DEA registration authorizing it to operate as an online pharmacy. Again, such a violation, or any other transgression by a pharmacist of the corresponding responsibility as it pertains to the requirements of the Act may result in criminal prosecution of the pharmacist and/or administrative proceedings to revoke the pharmacy's registration. Pharmacists should also note that the new requirements of the Act are in addition to, and not in lieu of, the longstanding requirement that all prescriptions for controlled substances be issued by a practitioner acting in the usual course of professional practice and otherwise in conformity with the CSA and DEA regulations. Thus, when a prescription for a controlled substance has been issued by means of the Internet, even if the pharmacy that fills the prescription has obtained from DEA a modification of its registration, and even if the pharmacist has confirmed that the prescribing practitioner has conducted at least one in-person medical evaluation of the patient, the pharmacist still has the corresponding responsibility to ensure that the prescription was issued for a legitimate medical purpose in the usual course of professional practice. For example, if the pharmacist knows that a prescription for a controlled substance was issued by a practitioner who works for a Web site that sends its customers to practitioners for a one-time sham medical evaluation with the intent to sell prescriptions to the customers repeatedly thereafter with no in-person follow-up evaluations, the fact that the practitioner conducted an in-person “evaluation” purporting to comply with the Act does not excuse the pharmacist from fulfilling his corresponding responsibility to fill only those prescriptions for controlled substances that were issued for a legitimate medical purpose in the usual course of professional practice. To list another common practice of rogue Internet site operators, if you are an owner of a pharmacy and you are approached by an “entrepreneur” who offers to funnel to you large quantities of prescriptions for filling in exchange for a fee, there is a strong possibility that you are being asked to serve as the supplier to a rogue Web site. This is especially so if such “entrepreneur” is not affiliated with a legitimate health care organization. Again, the rogue Web sites that the Act was designed to eliminate often depend on the assistance of DEA-registered pharmacies. If you as a pharmacy owner or pharmacist are asked to participate in a scheme that raises suspicions about compliance with the Act, you are risking potential criminal liability and loss of DEA registration if you agree to participate without taking reasonable steps to rule out the possibility that the scheme will violate the Act. A pharmacist is not, however, obligated to know what cannot be known through the exercise of sound professional pharmacy practice. For example, it is conceivable that a customer could walk into a pharmacy with a prescription that was issued by means of the Internet (or such a prescription could be faxed to a pharmacy) with the pharmacist having no reasonable basis to know or suspect that it was issued by means of the Internet. As long as the pharmacist meets his corresponding responsibility to take reasonable steps under the circumstances to ensure that the prescription was issued in accordance with the requirements of the Ryan Haight Act (as well as all other applicable requirements of the CSA and DEA regulations), the pharmacist will not be held strictly liable for filling a prescription that he could not reasonably have known was issued by means of the Internet. Thus, it is absolutely unnecessary for a pharmacy to apply for a modification of its DEA registration authorizing it to operate as an online pharmacy for the sole purpose of ensuring that it does not—despite the exercise of sound professional judgment—inadvertently fill a prescription that was issued by means of the Internet. B. Additional Specific Information for Practitioners If you are a physician, dentist, veterinarian, mid-level practitioner, or other practitioner registered with DEA to prescribe, administer, or dispense controlled substances, and your activities involving controlled substances are limited to those authorized by your registration, you are exempted under the Ryan Haight Act from the definition of an “online pharmacy.” As a result, you are not subject to the requirement of obtaining a modified DEA registration that applies to pharmacies that dispense controlled substances by means of the Internet. Nonetheless, there are other requirements of the Act and the implementing regulations that, depending on the nature of your practice, might apply to you. DEA believes that the overwhelming majority of practitioners in the United States, based on their current practices, do not engage in activities that constitute delivering, distributing, or dispensing controlled substances by means of the Internet. 39 Accordingly, the overwhelming majority of practitioners need not change their practices because of the enactment of the Ryan Haight Act. However, if you are a DEA-registered practitioner who prescribes or otherwise dispenses a controlled substance by means of the Internet, you must comply with the provisions of the Act that apply to you. 39 As discussed above, the electronic prescribing of controlled substances is not currently permitted under the DEA regulations, but DEA has proposed regulations that, once finalized, will allow such practice. The electronic prescribing of controlled substances through use of the Internet does, as explained above, constitute delivering, distributing, or dispensing controlled substances by means of the Internet. Nonetheless, since the overwhelming majority of practitioners only prescribe controlled substances to patients for whom they have conducted an in-person medical evaluation, and only for a legitimate medical purpose in the usual course of professional practice, it is anticipated that the overwhelming majority of practitioners will continue this practice once electronic prescribing of controlled substances becomes permissible under the DEA regulations. If so, such practitioners would satisfy the “valid prescription” requirement of the Ryan Haight Act. First, if you are a DEA-registered practitioner who prescribes or otherwise dispenses a controlled substance by means of the Internet, you must comply with the provision of the Act relating to the in-person medical evaluation requirement, which is set forth in 21 U.S.C. 829(e). Certain exceptions apply to this requirement, as are discussed above in this preamble. Note, however, that the Act expressly states that compliance by a practitioner with the in-person medical evaluation requirement does not, by itself, satisfy the requirement that every prescription be issued for a legitimate medical purpose in the usual course of professional practice. Whether a prescription was issued for a legitimate medical purpose in the usual course of professional practice must, as always, be determined based on the totality of the circumstances under which a particular prescription was issued to a particular patient. As DEA has previously stated, “DEA recognizes that the overwhelming majority of American physicians who prescribe controlled substances do so for legitimate medical purposes [and] exercise the appropriate degree of medical supervision—as part of their routine practice during office visits.” 40 However, this favorable characterization cannot be applied to the very small percentage of practitioners who write prescriptions on behalf of rogue Internet Web sites. Indeed, the main reason Congress enacted the Ryan Haight Act was to bring an end to the rogue Web sites that hire unscrupulous practitioners to write prescriptions without a legitimate medical purpose and outside the usual course of professional practice. 40 71 FR 52716, 52719 & 52723 (2006 DEA policy statement). If you are a practitioner who knowingly or intentionally prescribes or otherwise dispenses controlled substances on behalf of a particular Web site, and if that Web site is not compliant with the requirements of the Act and the implementing regulations, you are dispensing controlled substances by means of the Internet in a manner not authorized by the Act. Doing so constitutes a violation of 21 U.S.C. 841(h)(1) and may result in criminal prosecution and/or administrative proceedings to revoke your DEA registration. If you are a practitioner who writes prescriptions on behalf of a particular Web site, your name must appear prominently on that Web site. (This requirement helps to distinguish those Web sites that are compliant with the Act and the implementing regulations from those that are not compliant.) If such Web site is operated on behalf of a group medical practice in which you participate, it is sufficient that your name (along with the names of your fellow practitioners who write prescriptions on behalf of the site) are posted in a visible and clear manner on the homepage of the Web site, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage. 41 It is anticipated that most every medical office in the United States that currently has a Web site is already in compliance with this provision as it is common practice for such Web sites to post in such manner the names of the practitioners. If, however, you are one of what is anticipated to be a very small number of practitioners who, beginning on or after April 13, 2009 (the effective date of the Ryan Haight Act), writes prescriptions on behalf of a Web site of a DEA-registered pharmacy, the Act requires the Web site to post additional information identifying you. Specifically, the Web site must post the following information in a visible and clear manner on the homepage of each Internet site it operates, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage: “The name, address, telephone number, professional degree, and States of licensure of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof.” 42 41 As stated in 21 CFR 1304.50: “For a Web site to identify itself as being exempt from the definition of an online pharmacy by virtue of section 102(52)(B)(ii) of the Act (21 U.S.C. 802(52)(B)(ii)), the Web site shall post in a visible and clear manner on its homepage, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage, a list of the DEA-registered nonpharmacy practitioners who are affiliated with the Web site. Any nonpharmacy practitioner affiliated with such a Web site is responsible for compliance with this section. An institutional practitioner that otherwise complies with the requirements of the Act and this chapter will be deemed to meet the requirements of this section if, in lieu of posting the names of each affiliated individual practitioner, it posts its name (as it appears on its Certificate of Registration) in a visible and clear manner on its homepage and in a manner that identifies itself as being responsible for the operation of the Web site.” 42 21 U.S.C. 831(c)(6). How does a practitioner know whether he is writing prescriptions that are issued through, or on behalf of, a Web site? In some cases, this will be obvious to the practitioner. For example, if a practitioner is approached by a person who offers to pay the practitioner to write prescriptions for “patients” who will be routed to the practitioner through the Web site, the practitioner has actual knowledge that he is being asked to dispense controlled substances by means of the Internet within the meaning of the Act. (As most practitioners would immediately recognize, such a proposal is inherently suspect, since the legitimate practice of medicine is not structured around writing prescriptions for controlled substances and being compensated primarily or exclusively on that basis.) 43 The profitability of rogue Internet Web sites typically depends on the ability of the criminal facilitator who operates the site to recruit unscrupulous practitioners to enter into such types of contractual arrangements. 43 Such an arrangement whereby compensation is based primarily or exclusively on the number of prescriptions for controlled substances issued is a “red flag” indicating that diversion of controlled substances into illicit channels might be occurring—regardless of whether the Internet is involved. In response to the enactment of the Ryan Haight Act, some rogue Web sites have come up with the following approach in an effort to circumvent the new law. Drug-seeking customers who visit the rogue Web site are told that they should arrange a visit with one of the practitioners affiliated with the site to satisfy the Act's requirement of an in-person medical evaluation. Once the practitioner has gone through the motions of conducting what purports to be a medical evaluation, the “patient” will be permitted to purchase controlled substances (or prescriptions therefor) through the Web site in perpetuity, without having to see the practitioner in person again. A practitioner who might be inclined to consider entering into a contract with the operator of such a rogue Web site should consider that, in all likelihood, such an operation violates the Act—despite its purported compliance with the in-person medical evaluation requirement. For one, under the Act, the only persons who may operate Web sites through which controlled substances are prescribed or otherwise dispensed are DEA-registered practitioners (pharmacies and nonpharmacy practitioners). 44 Thus, a non-DEA registrant may not operate a Web site that constitutes an “online pharmacy” within the meaning of the Act (which includes, for example, a Web site that sells prescriptions for controlled substances or fills such prescriptions). Second, even in the unlikely event that the person who is offering the practitioner the opportunity to participate in such a Web site is a DEA registrant with the appropriate registration allowing it to dispense controlled substances by means of the Internet, the prescribing practitioner must ensure that the Web site properly displays his name and the other required information in the manner required by the Act and the implementing regulations. 44 See 21 U.S.C. 802(51), 802(52), 823(f), & 841(h)(1). Further, even if the Web site has the required registration and posts the required information, it is difficult to envision how a conscientious practitioner could enter into a contract to provide medical evaluations and/or issue prescriptions through referrals from a Web site that is designed primarily to attract and supply persons seeking to obtain controlled substances for other than legitimate medical purposes (rather than to provide legitimate medical care to patients without a predetermined goal of selling drugs or prescriptions). Indeed, a Web site that operates in such a manner—such as by offering to arrange in-person “medical evaluations” for the purpose of allowing customers to obtain controlled substances through the Web site indefinitely thereafter—should be viewed by a practitioner as a “red flag” indicating that diversion of controlled substances to illicit channels might be occurring. The same considerations apply if you, as a practitioner, are offered a contract or otherwise presented with a proposal to write prescriptions to customers of a Web site based on reviewing online questionnaires or faxed “medical records” or by answering telephone calls through a phone number affiliated with the Web site. If these customers are being referred to you through the Web site or at the request of the owner or operator of the Web site, any prescriptions for controlled substances you write for the customers constitute “dispensing by means of the Internet” within the meaning of the Act. As explained above, a practitioner who dispenses a controlled substance by means of the Internet in violation of the Act may be held criminally liable under 21 U.S.C. 841(h)(1) if he did so knowingly or intentionally—which can be proven by showing that either (i) the practitioner had actual knowledge of the violation or (ii) the practitioner deliberately disregarded facts that would have led a reasonable practitioner to be highly suspicious about the likelihood of such a violation. In addition, any transgression of the Act may result in administrative action to revoke the practitioner's DEA registration. With the foregoing considerations in mind, DEA again emphasizes that the current practices of the overwhelming majority of practitioners in the United States do not involve delivering, distributing, or dispensing controlled substances by means of the Internet. This means that the vast majority of practitioners need not alter their current practices to conform to the requirements of the Ryan Haight Act. C. Additional Specific Information for DEA-Registered Distributors The ability of rogue Internet sites to supply controlled substances to persons who seek them for other than legitimate medical purposes depends largely on the existence of DEA-registered pharmacies that are willing to supply the customers of these Web sites. As the data provided at the beginning of this preamble illustrates, it takes only a relatively small number of unscrupulous pharmacies, working in conjunction with rogue Internet sites, to supply enormous quantities of hydrocodone and other controlled substances, causing a substantial detrimental effect on the public health and welfare. Accordingly, if you are a DEA-registered distributor, it is critical that you are vigilant in taking appropriate steps to avoid supplying the pharmacies that service the customers of rogue Web sites. In a September 27, 2006, letter to all DEA-registered distributors, DEA specified a number of pharmacy practices that might be indicative of diversion. While all the considerations set forth in that letter remain valid today, the enactment of the Ryan Haight Act should further assist distributors in avoiding distributing controlled substances to pharmacies that are supplying customers of rogue Web sites. For example, if you are a distributor and you know that a pharmacy is soliciting buyers of controlled substances via the Internet, or is associated with an Internet site that solicits orders for controlled substances, 45 you are on notice that the pharmacy is an “online pharmacy” under the Act. If so, it is unlawful, per se, for the pharmacy to be operating without a modified DEA registration authorizing it to operate as an online pharmacy. Under such circumstances, if the pharmacy does not have such a modified registration, it would be unlawful for you as a distributor to supply the pharmacy with controlled substances. (The pharmacy's Certificate of Registration will reflect its status as an online pharmacy in its business activity designation.) 46 45 As explained earlier in this preamble, the Ryan Haight Act contains an exception from the definition of “online pharmacy” for any pharmacy registered under 21 U.S.C. 823(f) whose dispensing of controlled substances via the Internet consists solely of “refilling prescriptions for controlled substances in schedule III, IV, or V” or “filling new prescriptions for controlled substances in schedule III, IV, or V” (as those terms are defined in 21 U.S.C. 802(55) and (56)). 21 U.S.C. 802(52)(B)(viii). Given these and other exceptions in the Act, it is anticipated that most pharmacies, if they continue their current practices, will not fall within the definition of an online pharmacy. However, a pharmacy that actively solicits buyers of controlled substances via the Internet or is associated with a Web site that does so cannot fall within the foregoing exception and, therefore, does constitute an online pharmacy. 46 DEA provides a “Registration Validation” tool on its Web site, through which DEA registrants may query DEA's registration database regarding another DEA registrant to gather specific information about that registrant. Information available includes: The registrant's name, address, and DEA registration number; the date of expiration of the registration; business activity; and the schedules of controlled substances the registrant is authorized to handle. Even if you do not have actual knowledge that the pharmacy is operating through a Web site, if the pharmacy's buying patterns are of a volume or otherwise of a nature indicating a reasonable likelihood that the pharmacy is supplying customers of a Web site or otherwise engaging in practices that render it an online pharmacy within the meaning of the Ryan Haight Act, the sound course of action for the distributor would be to confirm that the pharmacy is complying with the Act prior to supplying the pharmacy with controlled substances. 47 47 As with all DEA registrants, distributors have a duty to maintain effective controls against diversion of controlled substances. 21 U.S.C. 823(b)(1), 823(e)(1); 21 CFR 1301.71(a). As part of this responsibility, all distributors must design and operate a system to disclose to the registrant suspicious orders of controlled substances and must report to DEA any such suspicious orders of controlled substances in accordance with 21 CFR 1301.74(b). Failure to comply with these or any other applicable regulatory requirements may, depending on the circumstances, result in civil monetary penalties and/or administrative revocation proceedings, among other things. D. Additional Specific Information for Consumers The full title of the Ryan Haight Act is “The Ryan Haight Online Pharmacy Consumer Protection Act of 2008.” As this title implies, a primary purpose of the Act is to protect consumers by ensuring that only legitimate, law-abiding Web sites dispense controlled substances via the Internet. One of the ways the Act achieves this goal is by allowing only pharmacies who are properly registered with DEA to operate Web sites through which prescriptions for controlled substances are filled. In addition, the Act and the implementing regulations require such Web sites to fully disclose to consumers certain basic information, such as the name and telephone number of the pharmacist-in-charge, a list of the states in which the pharmacy is authorized to dispense controlled substances, the names of any practitioners who have a contractual relationship to issue prescriptions for controlled substances through referrals from the Web site, and a certification that the Web site is acting in compliance with the Act. Accordingly, the Act should make it easier for consumers to differentiate between legitimate and illegitimate Web sites that sell controlled substances. One strong indicator of an unlawful Web site is that it lets you as a customer pick the controlled substance and then charges you a fee to arrange for a practitioner to prescribe that controlled substance to you. An unlawful Web site might further offer to refund all or part of your fee if you are not sold the prescription for your drug of choice. A Web site that engages in such practices is virtually certain to be a rogue Web site that is not operating in compliance with the Ryan Haight Act. Consumers should also be aware that the Act also prohibits certain advertising practices relating to the types of criminal activities the Act is designed to eliminate. Specifically, the Act makes it a crime to place an advertisement on the Internet that offers to sell a controlled substance or a prescription for a controlled substance in a manner that would be illegal (in violation of the CSA or the CSIEA). 48 For example, the Act makes it unlawful to place an advertisement on the Internet stating: “Hydrocodone! No Prescription Needed!” (or words to the same effect). This provision of the Act also makes it illegal to place an advertisement on the Internet that refers consumers to a Web site that is operating in violation of the Act (such as one that sells controlled substances but is not properly registered with DEA). This ban on illegal Internet advertising also applies to unsolicited commercial e-mail, which is sometimes referred to as “spam” or “junk e-mail.” Consequently, beginning on April 13, 2009, if you as a consumer receive an unsolicited commercial e-mail with the subject line: “Hydrocodone! No Prescription Needed!,” the sender of that e-mail has violated the law. Likewise, if you receive spam directing you to a Web site that is operating in violation of the Act, the spammer has also violated the Act. 48 The exact wording of this provision is found in 21 U.S.C. 843(c)(2) and is recited above in this preamble. Consumers should also be wary of rogue Web sites falsely claiming that they are allowed to sell controlled substances without complying with the Ryan Haight Act because they are located outside the United States. Any such claim is flatly wrong. In fact, as explained earlier in this preamble, it has always been unlawful under the Controlled Substances Import and Export Act (CSIEA) (even prior to the Ryan Haight Act) to ship controlled substances into the United States for personal medical use. Any person who ships controlled substances from abroad into the United States illegally, along with the person in the United States who places the order for such a shipment and thereby causes the controlled substances to be illegally shipped into the United States, violates the CSIEA and is subject to criminal prosecution. 49 49 21 U.S.C. 952, 957, 960(a)(1). VIII. Regulatory Changes To Implement the Ryan Haight Act This section summarizes the regulations contained in this Interim Rule, which are being issued to implement the Ryan Haight Act. This section should be viewed as merely a summary provided for the convenience of the reader, and any registrant subject to the Ryan Haight Act should read carefully the entire preamble along with the text of the regulations being issued here. A. Notification and Registration As provided in 21 CFR 1304.40, all online pharmacies that intend to dispense controlled substances by means of the Internet must provide DEA with a thirty-day notice of such intent. To do this, they must apply for a modified registration via the online application process. The Administrator must approve the application for a modified registration and issue a Certificate of Registration indicating the modification before the online pharmacy may engage in any activity of an online pharmacy. As discussed previously in the preamble, the only entities that may apply for a modified registration are registrants with a valid Certificate of Registration (DEA Form 223) as a pharmacy. If you are not registered with DEA as a pharmacy and you intend to dispense controlled substances by means of the Internet, you must first apply for registration as a pharmacy in accordance with 21 CFR 1301.13. Upon receipt of the Certificate of Registration as a pharmacy from the Administrator, you may then apply for a modification to your registration to operate as an online pharmacy. The Administrator may deny an application for such registration or such modification of registration if the Administrator determines that the issuance of such registration or modification would be inconsistent with the public interest. 21 CFR 1301.19. The same statutory criteria used in determining the public interest for purposes of evaluating an application for registration—those found in 21 U.S.C. 823(f)—will be used in evaluating an application for a modification of registration to operate as an online pharmacy. An online pharmacy must make a separate thirty-day advance notice to the State boards of pharmacy in each State in which it intends to offer to sell, deliver, distribute, or dispense controlled substances. In accordance with 21 U.S.C. 831, the following information must be included in the notification to DEA that must be submitted as part of the Application for Modification of Registration: • All Internet pharmacy site disclosure information as listed below. • A certification, under penalty of perjury, that the Internet pharmacy site disclosure information that is posted on the online pharmacy's Web site is true and accurate. • A listing of all Internet Web site addresses (also known as the uniform resource locator or URL) owned by the online pharmacy to conduct its online business activities. • A certification that the online pharmacy will notify DEA of any changes to any of its Internet Web site addresses (URLs) at least 30 days in advance. • The name, address, telephone number, professional degree, DEA registration numbers and States of licensure of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof. • The DEA registration numbers of each pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of the online pharmacy. Pharmacies that intend to dispense controlled substances by means of the Internet must apply for the modified registration using the online registration process by going to the DEA Office of Diversion Control Web site at http://www.deadiversion.usdoj.gov . Registrants must positively acknowledge and agree to several statements during the application process. These acknowledgements will be printed on the registrant's receipt of registration for future reference. The following is a list of the acknowledgments with which a registrant must agree as part of the online pharmacy application process: 1. Pursuant to section 309(e) of the Controlled Substances Act (21 U.S.C. 829(e)), you, as an online pharmacy, acknowledge and agree that no controlled substance that is a prescription drug may be delivered, distributed, or dispensed by means of the Internet without a valid prescription. 2. Pursuant to 21 CFR 1306.09, you, as an online pharmacy, acknowledge and agree that a prescription for a controlled substance may only be dispensed by means of the Internet by a pharmacist, acting in the usual course of his professional practice, and employed in a pharmacy whose registration has been modified to authorize it to operate as an online pharmacy. 3. You, as an online pharmacy, acknowledge and understand that you may not engage in any activity of an online pharmacy, as defined in 21 CFR 1300.04(h), until your application for modified registration to operate as an online pharmacy is granted and a Certificate of Registration indicating the modification is issued by the Administrator (DEA Form 223). 4. You, as an online pharmacy, understand that the Administrator may deny an application for a modification of registration if the Administrator determines that the issuance of such modification would be inconsistent with the public interest. In determining the public interest, the Administrator considers the factors listed in 21 U.S.C. 823(f). 5. Pursuant to section 303(f) of the Controlled Substances Act (21 U.S.C. 823(f)), you, as an online pharmacy, certify that you are authorized by the appropriate state authority(ies) to modify your existing DEA registration to authorize you to dispense schedule II-V controlled substances by means of the Internet. 6. Pursuant to 21 CFR 1301.19, if you, as an online pharmacy, cease to dispense controlled substances by means of the Internet, you acknowledge and agree that you shall promptly notify the Administrator by modifying your registration to reflect the appropriate business activity. 7. Pursuant to section 307(d) of the Controlled Substances Act (21 U.S.C. 827(d)), you, as an online pharmacy, understand you are required to report the dispensing of controlled substances by means of the Internet to the Administrator in the manner set forth in 21 CFR 1304.55. This report will include the total quantity of each controlled substance that the pharmacy dispenses each calendar month. The report must be submitted to DEA electronically via online reporting, electronic file upload, or other means as approved by DEA. The monthly report shall include the date range of the reporting period, the NDC, and total quantity of each controlled substance dispensed. Reporting shall include all controlled substances dispensed via Internet transactions, mail-order, face-to-face transactions, or any other means. The report shall be submitted to DEA by the 15th day of the following month. (For threshold amounts refer to DEA Web site: http://www.deadiversion.usdoj.gov .) 8. Pursuant to section 311(a) of the Controlled Substances Act (21 U.S.C. 831(a)), you, as an online pharmacy, agree to display at all times on your homepage, in a visible and clear manner, a statement that your online pharmacy complies with the requirements of section 311 of the Act (21 U.S.C. 831) with respect to the delivery or sale or offer for sale of controlled substances. 9. Pursuant to section 311(b) of the Controlled Substances Act (21 U.S.C. 831(b)), you, as an online pharmacy, acknowledge and agree to comply with the requirements of State law concerning the licensure of pharmacies in each State from which and to which you, deliver, distribute, or dispense, or offer to deliver, distribute, or dispense controlled substances by means of the Internet. 10. Pursuant to section 311(c) of the Controlled Substances Act (21 U.S.C. 831(c)), you, as an online pharmacy, acknowledge and agree to post the following Internet Pharmacy Site Disclosure information in a visible and clear manner on the homepage of each Internet site you operate, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage: (A) The name and address of the pharmacy as it appears on the pharmacy's DEA Certificate of Registration. (B) The pharmacy's telephone number and e-mail address. (C) Name of pharmacist-in charge, professional degree, States of licensure, and telephone number. (D) List of States in which the pharmacy is licensed to dispense controlled substances. (E) Certification [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3AE9-7698. Public record. Not legal advice.