Notices - 2011
[Federal Register Volume 76, Number 202 (Wednesday, October 19, 2011)]
[Rules and Regulations]
[Pages 64813-64816]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-26738]
DEPARTMENT OF JUSTICE
Drug Enforcement Administration
21 CFR Parts 1300, 1304, 1306 and 1311
[Docket No. DEA-360]
Electronic Prescriptions for Controlled Substances Clarification
AGENCY: Drug Enforcement Administration (DEA), Department of Justice.
ACTION: Clarification and notification.
SUMMARY: DEA wishes to emphasize that third-party audits of software
applications for Electronic Prescriptions for Controlled Substances
(EPCS) must encompass all applicable requirements in our regulations,
including security, and must address "processing integrity" as set
forth in our regulations. Likewise, where questions or gaps may arise
in reviewing a particular application, DEA recommends consulting
federal guidelines set forth in NIST Special Publication 800-53A. DEA
is also announcing the first DEA approved certification process for
EPCS. Certifying organizations with a certification process approved by
DEA pursuant to the regulations are posted on DEA's Web site once
approved.
FOR FURTHER INFORMATION, CONTACT: Imelda L. Paredes, Office of
Diversion Control, Drug Enforcement Administration, 8701 Morrissette
Drive, Springfield, Virginia 22152; Telephone (202) 307-7165.
SUPPLEMENTARY INFORMATION:
Background
The Drug Enforcement Administration (DEA) is a component of the
Department of Justice and is the primary agency responsible for
coordinating the drug law enforcement activities of the United States.
DEA also assists in the implementation of the President's National Drug
Control Strategy. The diversion control program (DCP) is a strategic
component of the DEA's law enforcement mission. It is primarily the DCP
within DEA that implements and enforces Titles II and III of the
Comprehensive Drug Abuse Prevention and Control Act of 1970, often
referred to as the Controlled Substances Act (CSA) and the Controlled
Substances Import and Export Act (CSIEA) (21 U.S.C. 801-971), as
amended (hereinafter, "CSA").\1\ DEA drafts and publishes the
implementing regulations for these statutes in Title 21 of the Code of
Federal Regulations (CFR), parts 1300 to 1321. The CSA together with
these regulations are designed to establish a closed system for
controlled substances and to prevent, detect, and eliminate the
diversion of controlled substances and listed chemicals into the
illicit market while ensuring a sufficient supply of controlled
substances and listed chemicals for legitimate medical, scientific,
research, and industrial purposes.
---------------------------------------------------------------------------
\1\ The Attorney General's delegation of authority to DEA may be
found at 28 CFR 0.100.
---------------------------------------------------------------------------
The CSA and DEA's implementing regulations establish the legal
requirements for possession and dispensing of controlled substances,
most notably pursuant to a prescription issued for a legitimate medical
purpose by a practitioner acting in the usual course of professional
practice. "The responsibility for the proper prescribing and
dispensing of controlled substances is upon the prescribing
practitioner, but a corresponding responsibility rests with the
pharmacist who fills the prescription." 21 CFR 1306.04(a). A
prescription serves both as a record of the practitioner's
determination of the legitimate medical need for the drug to be
dispensed, and as a record of the dispensing, providing the pharmacy
with the legal justification and authority to dispense the medication
prescribed by the practitioner. The prescription also provides a record
of the actual dispensing of the controlled substance to the ultimate
user (the patient) and, therefore, is critical to documenting that
controlled substances held by a pharmacy have been dispensed legally.
The maintenance by pharmacies of complete and accurate prescription
records is an essential part of the overall CSA regulatory scheme
established by Congress.
Electronic Prescriptions for Controlled Substances (EPCS)
Historically, where federal law required that a prescription for a
controlled substance be issued in writing, that requirement could only
be satisfied through the issuance of a paper prescription. Given
advancements in technology and security capabilities for electronic
applications, DEA recently amended its regulations to provide
practitioners with the option of issuing electronic prescriptions for
controlled substances (EPCS) in lieu of paper prescriptions. Efforts to
develop EPCS have been underway for a number of years. DEA's Interim
Final Rule for Electronic Prescriptions for Controlled Substances was
published on March 31, 2010 at 75 FR 16236-16319 and became effective
on June 1, 2010. While these regulations have paved the way for
controlled substance prescriptions to be issued electronically, not all
States have authorized electronic prescriptions for controlled
substances, particularly Schedule II controlled substances which have a
significant potential for abuse.
The information technology industry is currently in the process of
developing and testing applications to implement the requirements set
forth in the Interim Final Rule. As this process continues, DEA
believes it prudent to issue the following clarifications,
recommendation, and update to help ensure that the requirements of the
Interim Final Rule are properly implemented. Specifically, DEA is
clarifying that third-party audits must be conducted by qualified
persons and must determine that an application meets all of the
applicable requirements in 21 CFR part 1311 as well as other
requirements referenced in Part 1311. "Processing integrity" must be
addressed in audits of EPCS applications. DEA recommends that federal
guidelines as set forth by the National Institute of Standards and
Technology (NIST), including NIST Special Publication 800-53A, be
consulted where questions arise. DEA has also announced an approved
certification process for EPCS applications and has posted this
information on its Web site. DEA notes its concern that proposed EPCS
applications receive careful review prior to being used to create,
sign, transmit or process controlled substance prescriptions so as to
ensure the closed system for controlled substances established by the
CSA. Secure and safe dispensing of controlled substances is necessary
to protect the public interest and prevent diversion of controlled
substances to illicit purposes. As with any violations of the CSA or
DEA's implementing regulations, if diversion occurs in the EPCS
environment, or if controlled substances are otherwise dispensed in
violation of the EPCS regulations, those responsible may be subject to
administrative and/or judicial action, to include civil injunction.
Current Issues
National Prescription Drug Abuse Epidemic
Implementation of electronic prescriptions for controlled
substances is occurring at the same time the President has declared
current prescription drug misuse and abuse as an epidemic constituting
a major public health and public safety crisis.\2\ The non-medical use
of prescription drugs is on the rise in the United States. Drug induced
deaths now exceed motor vehicle accident deaths in the United
States.\3\ According to the "Drug Abuse Warning Network (DAWN), 2009:
National Estimates of Drug-Related Emergency Department Visits," the
[[Page 64815]]
Substance Abuse and Mental Health Services Administration (SAMHSA),\4\
emergency department visits involving non-medical use of
pharmaceuticals (misuse or abuse) almost doubled between 2004 and 2009
from 627,291 in 2004 to 1,244,679 visits in 2009 (a 98.4 percent
increase).\5\ About half of the 2009 emergency department visits
related to abuse or misuse of pharmaceuticals involved painkillers and
more than one-third involved drugs to treat insomnia and anxiety.\6\
---------------------------------------------------------------------------
\2\ "Epidemic: Responding to America's Prescription Drug Abuse
Crisis," Office of National Drug Control Policy, Executive Office
of the President of the United States, 2011. http://www.whitehousedrugpolicy.gov/publications/pdf/rx_abuse_plan.pdf.
\3\ National Vital Statistics Reports, Vol. 59, No. 4, March 16,
2011, http://www.cdc.gov/nchs/data/nvsr59/nvsr59_04.pdf.
\4\ Behavioral Health Statistics and Quality, "Highlights of
the 2009 Drug Abuse Warning Network (DAWN) Findings on Drug-Related
Emergency Department Visits," The DAWN Report, December 28, 2010.
\5\ Id. at 4.
\6\ Id. at 3.
---------------------------------------------------------------------------
The 2009 National Survey on Drug Use and Health (NSDUH) \7\
estimated that 7.0 million persons used prescription-type
psychotherapeutic drugs--pain relievers, anti-anxiety medications,
stimulants, and sedatives--non-medically. This represents 2.8 percent
of the population aged twelve or older. These estimates were 13 percent
higher than those from the 2008 Survey. In 2009, 2.2 million persons
aged twelve or older used pain relievers non-medically for the first
time; that averages to over 6,000 new users per day. Teenagers (grades
9-12) believe that prescription drugs are easier to obtain than illegal
drugs. There is a concern that young people may perceive prescription
and/or over-the-counter drugs as "safer" than illegal drugs because
of their intended, legitimate medical use.\8\
---------------------------------------------------------------------------
\7\ Substance Abuse and Mental Health Services Administration,
"Results from the 2009 National Survey on Drug Use and Health:
Volume I, Summary of National Findings," Office of Applied Studies,
2010 (NSDUH Series H-38A, HHS Publication No. SMA 10-4856), http://www.oas.samhsa.gov/nsduh/2k9NSDUH/2k9Results.pdf.
\8\ Partnership for a Drug-Free America and MetLife Foundation,
"2009 Parents and Teens Attitude Tracking Study Report" March 2,
2010.
---------------------------------------------------------------------------
Increased Security Breaches
Cyber attacks are growing in frequency, size and complexity and are
of concern as EPCS goes online. Responses by 583 U.S. businesses of all
sizes to a recent independent survey conducted by the Ponemon Institute
released June 22, 2011 found that 90 percent had at least one cyber
security breach in the past 12 months. This survey found that the top
two endpoints from which these security breaches occurred are
employees' laptop computers and employee's mobile devices.\9\ Numerous
recent news articles describe incidents of major security breaches or
hacking incidents into major U.S. private and government computer
systems, including incidents involving electronic health records.\10\
These incidents occur for many reasons, but access to controlled
substances has not been cited as an objective because such substances
have not been communicated via an electronic system. With the impending
implementation of electronic prescriptions for controlled substances,
DEA wishes to reiterate that adequate security of EPCS has been and
continues to be a primary consideration in any electronic system used
to communicate a legitimate controlled substance prescription for the
purpose of dispensing to an ultimate user.
---------------------------------------------------------------------------
\9\ http://www.marketwire.com/printer_friendly?id=1529987;
http://business.financialpost.com/2011/06/23/survey-finds-90-of-u-s-companies-hacked-in-past-year/.
\10\ For example, among others, see Wall Street Journal articles
May 19 (U.N. International Atomic Energy Agency), May 27 (Lockheed
Martin), June 2 (Google), June 10 (Citigroup), June 11 (Sony), 2011;
Workers' Compensation California Medical Record Privacy Breach,
August 23, 2011, http://workers-compensation.blogspot.com/2011/08/major-california-medical-record-privacy.html; New York Times article
September 8, 2011 (electronic medical record breaches).
---------------------------------------------------------------------------
Clarifications
DEA wishes to provide the following clarifications.
Third-Party Audits of EPCS Applications
EPCS, as with paper prescriptions, requires the individual
practitioner be responsible for ensuring the prescription conforms to
all legal requirements and the pharmacist, acting under the authority
of the DEA-registered pharmacy, has a corresponding responsibility to
ensure the prescription is valid and meets all legal requirements.
Review of an EPCS application must be thorough in order to provide the
prescriber and pharmacist the level of assurance needed in order to use
the application.
Before any application may be used for electronic prescriptions for
controlled substances, it must be reviewed, tested and determined by a
third party to meet all of the requirements of 21 CFR part 1311. See 21
CFR 1311.300(a). There are two alternative processes for review of EPCS
applications: (1) A third-party audit conducted by a person qualified
to conduct a SysTrust, WebTrust or SAS 70 audit or a Certified
Information System Auditor as stated in 21 CFR 1311.300(b), which
comports with the requirements of paragraphs (c) and (d) of 21 CFR
1300.300 or (2) A certification by a certifying organization whose
certification process has been approved by DEA as stated in 21 CFR
1311.300(e), which certification verifies that the application meets
all of the requirements of 21 CFR part 1311.
21 CFR 1311.300(c) and 21 CFR 1311.300(d) state respectively that
an audit for installed applications and application service providers
must, among other things, determine that the application meets all of
the applicable requirements in Part 1311. This includes all of Part
1311 and references to Parts 1300, 1304 and 1306.
Some individuals may be misinterpreting 21 CFR 1311.300(c) and (d),
which state that audits "for installed applications must address
processing integrity and determine that the application meets the
requirements of this part," and audits "for application service
providers must address processing integrity and physical security and
determine that the application meets the requirements of this part."
(emphasis added). To further clarify, the Code of Federal Regulations
is organized by title, chapter, part, subpart, section and paragraph.
Any audit must include all of the applicable requirements for
electronic prescriptions of controlled substances found in 21 CFR part
1311 and not just section 1311.300 of part 1311. Part 1311 also cross-
references Parts 1300, 1304 and 1306 which establish specific
requirements that must be the subject of any audit. Thorough review and
testing of all requirements is both required by the regulations and
necessary to ensure secure and effective electronic prescribing and
dispensing of controlled substances in the interests of public health
and safety.
"Processing Integrity" must be addressed in audits of EPCS
prescriber and pharmacy applications.
EPCS applications must address security to prevent insider threats
and outsider attacks on any system. Careful review by an independent,
qualified third-party of the "processing integrity" of any
application is required to determine whether an application or
application service provider has adequate protection against the range
of potential security threats.
Person qualified to conduct a third-party audit.
DEA notes that 21 CFR 1311.300(b)(1) and (2) require that a third-
party audit be conducted by a person qualified to conduct a SysTrust,
WebTrust or SAS 70 audit or by a Certified Information System Auditor.
The regulations do not require one of these types of audits, but rather
that the person conducting the audit must have specified
qualifications. As provided in 21 CFR 1311.300(c) and (d), any audit
must address processing
[[Page 64816]]
integrity and determine that the application meets the requirements of
DEA's regulations. DEA is reviewing the fact that the American
Institute of Certified Public Accountants has replaced SAS 70 audits
referenced in 21 CFR 1311.300(b)(1) and will necessarily address this
issue in the final rule on EPCS.
Recommendation
Where questions arise in reviewing a particular EPCS prescriber or
pharmacy application, DEA recommends that federal guidelines as set
forth by the National Institute of Standards and Technology (NIST),
specifically NIST Special Publication 800-53A, be consulted. Other NIST
standards and publications are incorporated by reference in the Interim
Final Rule and must be complied with as stated in the Interim Final
Rule.
Some of the questions surrounding interpretation of DEA's EPCS
regulations as applied to specific applications are addressed by
federal guidelines articulated by the National Institute of Standards
and Technology in NIST Special Publication (SP) 800-53A, as revised.
Federal computer systems must comply with federal guidelines as
outlined in NIST SP 800-53A.\11\ As NIST SP 800-53A states, the
publication may be used by nongovernmental organizations on a voluntary
basis. Although the Interim Final Rule does not require compliance with
NIST SP 800-53A, DEA believes this publication provides useful guidance
and that it is advisable for private sector entities to consult the
publication when reviewing security requirements for EPCS applications.
In addition, EPCS will be used on federal systems in the military, the
Department of Veterans Affairs and elsewhere where such systems must
comply with federal guidelines.
---------------------------------------------------------------------------
\11\ http://csrc.nist.gov/publications/nistpubs/800-53A-rev1/sp800-53A-rev1-final.pdf. Note that the latest version of SP800-53A
should be consulted as it is regularly updated to meet technology
developments.
---------------------------------------------------------------------------
DEA notes that the Notice of Proposed Rulemaking (NPRM) in June 27,
2008 discussed NIST SP 800-53A and whether or not it should be the
basis for security requirements. 73 FR 36746-47 (June 27, 2008). DEA
did not require application of NIST SP 800-53A in the Interim Final
Rule due to the perceived need for flexibility and because security
would be ensured by review of "processing integrity." In light of
developments since that time, DEA will be revisiting this issue as it
is clear that a mechanism must be established in the EPCS regulations
to keep EPCS applications current with technology, particularly
security requirements.
Update
All certifying organizations with a certification process approved
by DEA pursuant to 21 CFR 1311.300(e) are posted on DEA's Web site once
approved.
As noted above, the Interim Final Rule provides that, as an
alternative to the audit requirements of 21 CFR 1311(b) through (d), an
electronic prescription or pharmacy application may be verified and
certified as meeting the requirements of 21 CFR Part 1311 by a
certifying organization whose certification process has been approved
by DEA. The preamble to the Interim Final Rule further indicated that,
once a qualified certifying organization's certification process has
been approved by DEA in accordance with 21 CFR 1311.300(e), such
information will be posted on DEA's Web site. 75 FR 16243, March 31,
2010. On September 22, 2011, DEA approved the certification process
developed by InfoGard Laboratories, Inc. and relevant information has
been posted on DEA's Web site at http://www.DEAdiversion.usdoj.gov
under electronic prescriptions.
Dated: October 7, 2011.
Joseph T. Rannazzisi,
Deputy Assistant Administrator, Office of Diversion Control.
[FR Doc. 2011-26738 Filed 10-18-11; 8:45 am]
BILLING CODE 4410-09-P
NOTICE: This is an unofficial version. An official version of this publication may be obtained
directly from the Government Printing Office (GPO).
|
