In this Interim Final Rule, the DEA updates and makes effective many of the provisions contained in the corresponding Proposed Rule issued in June of 2008 while adopting several new approaches designed to make the rules less burdensome and more flexible.  The DEA balanced these considerations with the need to minimize the potential for diversion by requiring that any system used for e-prescribing of controlled substances must: 

• Safeguard against identity theft and must allow only DEA registrants to sign controlled substance electronic prescriptions;
• Safeguard against repudiation by the prescriber of the prescription;
• Protect the reliability of prescription records to allow enforcement of laws relating to controlled substances; and
• Safeguard against alteration of controlled substance prescriptions.

While the DEA’s Interim Final Rule opens the door for electronic prescriptions of controlled substances, a number of questions must be answered before this approach to prescribing can be implemented.  First, as the DEA notes, existing e-prescribing applications do not necessarily contain all of the safeguards required by the new rules and will therefore need reprogramming.  Second, these applications must be certified as compliant with the new standards before they can be used for e-prescribing of controlled substances.  Currently, however, no certification bodies are able to certify compliance.  Third, providers will need to consider whether they must continue to comply with existing state laws relating to prescribing of controlled substances.

The DEA is seeking additional comments on specific provisions (discussed below).  Interested providers should review the Interim Final Rule (http://www.federalregister.gov/OFRUpload/OFRData/2010-06687_PI.pdf) and should submit comments to the DEA within sixty (60) days from March 31, 2010 (May 30, 2010).

General Overview

As noted above, the Interim Final Rule finally provides practitioners and pharmacies the option of writing electronic prescriptions for controlled substances.  Previously, even though electronic prescriptions were an option for non-controlled substances, controlled substance prescriptions were generally not valid unless written and signed by the prescriber.  The Interim Final Rule provides clarification with respect to a variety of proposed methods for implementing e-prescribing functionality and security.  Specifically, highlights of the Interim Final Rule include the following:

• Practitioners must be "identity proofed."  Individual (e.g., non-institutional) practitioners must obtain authentication credentials from approved credential service providers.  Institutional providers such as hospitals may conduct the identity proofing for any individual practitioner to whom it is granting e-prescribing application access.
• The "two-factor authorization" requirement was expanded to allow the use of biometric screening as a replacement for the use of a hard token, password or challenge question to conduct identity verification. 
• Completion of the prescription two-factor authentication protocol constitutes the prescribing practitioner’s signature of a prescription.
• Information not required by DEA regulations (such as pharmacy URLs and staff annotations) may be added to a prescription after an electronic practitioner signature. 
• Printing of transmitted electronic prescriptions is now permitted, provided that the printout is clearly marked as being a copy that does not authorize drug dispensation.
• A prescription may be printed when electronic transmission fails, provided the prescription indicates that it was originally transmitted electronically to a specific pharmacy, the date and time of transmission, and that the transmission failed.
• While intermediaries of electronic prescriptions are prohibited from altering prescription information, changes made by pharmacies to that same information are permitted when consistent with those rules that apply to all paper-based controlled substance prescriptions. 
• While the Interim Final Rule retains the requirement to prepare a monthly log of controlled substance prescriptions, the DEA has eliminated the proposed requirement that a practitioner indicate his or her review of that log. 
• A pharmacy must only check a DEA registration when it has reasons to suspect the validity of that registration or associated prescription. 
• The recordkeeping requirement has been reduced from five (5) years to two (2) years.

The DEA reiterated in the Interim Final Rule the fact that these new e-prescribing rules are to be considered as an addition to, and not a replacement of, existing requirements for written and oral controlled substance prescriptions. 

Conclusion

Although the provisions contained in the Interim Final Rule will be in full force and effect upon publication in the Federal Register on March 31st, the regulation is subject to a 60 day Congressional review period.  Depending on the outcome of this review, the effective date may change.  In addition, the DEA is seeking additional comments on several topics of interest:  identity proofing, access control, authentication, biometric subsystems and testing of those subsystems, internal audit trails for electronic prescription applications, and third-party auditors and certification organizations.  While this Interim Final Rule is a step forward in allowing e-prescribing of controlled substances, the agency's request for input on these issues reflects that further refinement of the standards may be forthcoming. 

If you would like additional information about this issue, please contact Jeffrey Short (317-977-1413, jshort@hallrender.com); Melissa Markey (248-457-7853, mmarkey@hallrender.com); Joan Lowes (248-457-7857, jlowes@hallrender.com); Todd Nova (414-721-0464, tnova@hallrender.com); or your regular Hall Render attorney.