DEA Proposes Long-Awaited

Controlled Substance E-Prescribing Rules

On June 27, 2008, the U.S. Drug Enforcement Administration (DEA) issued proposed rules to govern prescriptions for controlled substances. The comment period closed September 25.

Present DEA regulations, mostly dating back to the early 1970s, make no provision for electronic transmission of prescription information. E-prescribing for non-controlled substances has become common and efficient, but until recently the DEA has not attempted to update its requirements for controlled substance prescriptions.

The proposed regulations have received a skeptical reaction from the medical community, mostly over the perceived burden and cost of implementing them. Their ultimate fate remains uncertain.

Background

Federal law has long mandated that prescriptions for Schedule II controlled substances be “in writing.” Prescriptions for Schedule III, IV and V controlled substances may be written or oral. An oral prescription must be promptly reduced to writing and filed by the pharmacist. DEA regulations require that a written prescription “shall be written in ink or indelible pencil and shall be manually signed by the practitioner.”

One may question whether the “manually signed” requirement remains enforceable. In the Electronic Signatures in Global and National Commerce Act of 2000 (E-Sign Act), Congress provided that “[n]otwithstanding any statute, regulation, or other rule of law... a signature... may not be denied legal effect, validity, or enforceability solely because it is in electronic form...” In any event, the E-Sign Act allows agencies to specify “performance standards to assure accuracy, record integrity, and accessibility of records that are required to be retained.” The DEA’s proposed regulations rest on this authority.

Advantages of Electronic Prescriptions

Among other things, e-prescribing technology allows practitioners to detect potentially harmful drug interactions, avoids possible misreading of handwritten prescriptions, permits generic alternatives to be more readily identified, and eases compliance with insurance requirements. So pronounced and obvious are these benefits that, on July 15, President Bush signed into law the Medicare Improvements for Patients and Providers Act of 2008 (MIPPA). MIPPA provides incentives to physicians who e-prescribe for Medicare patients under Medicare Part D. Providers who e-prescribe will be eligible for a bonus; practitioners who do not e-prescribe will be penalized.

Highlights of Proposed Regulations

The 62 pages of regulations impose a number of security-related obligations. No system now in place can meet them. Among many other things, the proposed rules require the following:

● Identity Proofing, including an initial face-to face meeting between the practitioner and a representative of an “authorized entity,” such as a hospital granting privileges to the practitioner, a state professional licensing board or controlled substances authority, or a state or local law enforcement agency.

● Two-Factor Authentication, to meet the standards for “Level 4” authentication. To access the system, practitioners must use a “hard token” (examples include a smart card, thumb drive, or handheld device such as a PDA), together with a password or biometric such as a fingerprint. The token must not be able to export authenticating information.

● Security Timeout. The system must require reauthentication if the practitioner does not use the system for more than two minutes.

● Signing Authority. Only practitioners who are legally permitted to sign prescriptions for controlled substances may sign a prescription for a controlled substance. The practitioner must authenticate to the system immediately before signing the electronic prescription.

● Prescription Transmission. The system must immediately transmit the prescription upon signature. The practitioner cannot issue a prescription for filling at a later time. If a prescription is printed it cannot be transmitted; if transmitted, it cannot be printed.

● Monthly Prescription Log. The system must generate a log of all electronic prescriptions for controlled substances the practitioner has issued during the previous month. The practitioner must indicate he has reviewed the log, and must retain the record and the indication for five years.

● Miscellaneous requirements. The practitioner must retain sole possession of the hard token and must report loss or theft or compromise within 12 hours. The provider of the service must retain a qualified third party to conduct an audit of the system prior to first use, and annually thereafter.

● Multiple Passwords and Keys. Current regulations require practitioners to maintain a separate DEA registration for each state in which they are registered. The regulations require that the practitioner obtain a separate hard token and password for each registration the practitioner holds.

The DEA estimates substantial compliance costs to practitioners and hospitals. For example: $62 to $266 per practitioner for costs associated with identity proofing, $36,700 per system for initial programming to comply with DEA requirements, and $25,000 to $100,000 for annual third party audits.

Points of Disagreement

One wonders whether the DEA’s proposals take into account the realities of the practice of medicine. For example, many practitioners assign the task of filling out the body of a prescription to a staff member, for the practitioner to review and sign. This perfectly lawful and appropriate practice will not be possible under the regulations, which effectively require the practitioner to complete the entire prescription. As another example, a practitioner who receives an emergency telephone call while preparing a prescription will return to find himself automatically logged out after two minutes. These and other requirements will add to the time required for the issuance of a prescription, for little if any apparent gain in security.

On September 25, 2008 the American Medical Association (AMA) and 33 other organizations submitted joint written comments. Among other things, the AMA questioned the necessity for an in-person meeting to verify practitioner identity, advocated a single DEA number per practitioner, objected to the across-the-board two-minute system timeout, argued against the added requirement of monthly review of prescription logs, urged the DEA to permit the printing of a file copy of an electronically-transmitted prescription, and contended that a 12-hour reporting requirement for lost hard tokens is unrealistic.

The AMA saved its strongest criticism for the requirement of a hard token access device, arguing that “the requirement to use a hard token is unworkable in most practice settings.” Noting that primary care physicians write as many as 100 prescriptions per day, the comment observed:

"Adding just a few minutes each day for each controlled substance prescription would substantially affect physician practice workflows and take time away from patient care. The efficiencies intended under an electronic system would be lost if the token approach is adopted."

Conclusion

Whatever presidential administration the new year brings, observers predict substantial revision to the regulations before they become final. Providers should keep close watch on developments in this area.

Brad Williams is a partner at Ice Miller. He concentrates his practice in white collar crime, grand jury proceedings, federal taxation, section 1983 litigation, proceedings before federal and state administrative agencies, legal and regulatory compliance, health care, and the False Claims Act (including qui tam litigation).

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice.  The reader must consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.