[Federal Register Volume 85, Number 77 (Tuesday, April 21, 2020)]
[Rules and Regulations]
[Pages 22018-22021]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-07085]
[[Page 22018]]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF JUSTICE
Drug Enforcement Administration
21 CFR Parts 1300, 1304, 1306, and 1311
[Docket No. DEA-218I]
RIN 1117-AA61
Electronic Prescriptions for Controlled Substances
AGENCY: Drug Enforcement Administration, Department of Justice.
ACTION: Interim final rule; reopening of comment period.
-----------------------------------------------------------------------
SUMMARY: The Drug Enforcement Administration (DEA) published an interim
final rule in the Federal Register on March 31, 2010, which provides
practitioners with the option of writing prescriptions for controlled
substances electronically. Since publishing the interim final rule, DEA
has received questions and requests for clarification on various issues
concerning the implementation and technical requirements for the
electronic prescribing of controlled substances. DEA is therefore
reopening the March 31, 2010, interim final rule to solicit comments
from the public on specific issues outlined below regarding the
electronic prescribing of controlled substances in anticipation of
subsequently publishing a final rule on these topics.
DATES: DEA is reopening a comment period for the interim final rule
published March 31, 2010, at 75 FR 16236, which became effective June
1, 2010. Electronic comments must be submitted, and written comments
must be postmarked, on or before June 22, 2020. Commenters should be
aware that the electronic Federal Docket Management System will not
accept comments after 11:59 p.m. Eastern Time on the last day of the
comment period.
ADDRESSES: To ensure proper handling of comments, please reference
``RIN 1117-AA61/Docket No. DEA-218I'' on all correspondence, including
any attachments.
Electronic comments: DEA encourages that all comments be
submitted electronically through the Federal eRulemaking Portal, which
provides the ability to type short comments directly into the comment
field on the web page or to attach a file for lengthier comments.
Please go to http://www.regulations.gov and follow the online
instructions at that site for submitting comments. Upon completion of
your submission, you will receive a Comment Tracking Number for your
comment. Please be aware that submitted comments are not
instantaneously available for public view on Regulations.gov. If you
have received a Comment Tracking Number, your comment has been
successfully submitted, and there is no need to resubmit the same
comment.
Paper comments: Paper comments that duplicate the
electronic submission are not necessary and are discouraged. Should you
wish to mail a paper comment in lieu of an electronic comment, it
should be sent via regular or express mail to: Drug Enforcement
Administration, Attn: DEA Federal Register Representative/DPW, 8701
Morrissette Drive, Springfield, VA 22152.
FOR FURTHER INFORMATION CONTACT: Scott A. Brinks, Diversion Control
Division, Drug Enforcement Administration; Mailing Address: 8701
Morrissette Drive, Springfield, Virginia 22152; Telephone: (571) 362-
3261.
SUPPLEMENTARY INFORMATION:
Posting of Public Comments
Please note that all comments received are considered part of the
public record. They will, unless reasonable cause is given, be made
available by DEA for public inspection online at http://www.regulations.gov. Such information includes personal identifying
information (such as your name, address, etc.) voluntarily submitted by
the commenter. The Freedom of Information Act applies to all comments
received. If you want to submit personal identifying information (such
as your name, address, etc.) as part of your comment, but do not want
it to be made publicly available, you must include the phrase
``PERSONAL IDENTIFYING INFORMATION'' in the first paragraph of your
comment. You must also place all of the personal identifying
information you do not want made publicly available in the first
paragraph of your comment and identify what information you want
redacted.
If you want to submit confidential business information as part of
your comment, but do not want it to be made publicly available, you
must include the phrase ``CONFIDENTIAL BUSINESS INFORMATION'' in the
first paragraph of your comment. You must also prominently identify the
confidential business information to be redacted within the comment.
Comments containing personal identifying information and
confidential business information identified as directed above will
generally be made publicly available in redacted form. If a comment has
so much confidential business information or personal identifying
information that it cannot be effectively redacted, all or part of that
comment may not be made publicly available. Comments posted to http://www.regulations.gov may include any personal identifying information
(such as name, address, and phone number) included in the text of your
electronic submission that is not identified as directed above as
confidential.
An electronic copy of this document is available in its entirety
under the tab ``Supporting Documents'' of the public docket of this
action at http://www.regulations.gov under FDMS Docket ID: DEA-2010-
0010 (RIN 1117-AA61/Docket No. DEA-218I) for easy reference.
Background
Historically, where federal law required that a prescription for a
controlled substance be issued in writing, that requirement could only
be satisfied through the issuance of a paper prescription. DEA,
however, amended its regulations in 2010 to provide practitioners with
the option of issuing electronic prescriptions for controlled
substances (EPCS) in lieu of paper prescriptions. In particular, on
June 27, 2008, DEA published a Notice of Proposed Rulemaking (NPRM)
describing its plan to revise its regulations to allow the creation,
signature, transmission, and processing of controlled substance
prescriptions electronically. 73 FR 36722. After considering the
comments it had received and revising its proposed rule accordingly,
DEA published its Interim Final Rule (IFR) for Electronic Prescriptions
for Controlled Substances on March 31, 2010. 75 FR 16236. The IFR's
changes became effective June 1, 2010.\1\
---------------------------------------------------------------------------
\1\ On October 19, 2011, DEA published a short clarification
addressing certain EPCS topics to help ensure that industry properly
implemented the requirements of the IFR. 76 FR 64813.
---------------------------------------------------------------------------
The IFR is codified in DEA regulations in 21 CFR parts 1300, 1304,
1306, and 1311. These provisions govern many different aspects of the
electronic prescribing process and are explained in significant detail
in the IFR. See 75 FR 16284-16289. Rather than repeating the IFR's
explanation here, this discussion will briefly highlight several
aspects of the IFR particularly germane to the issues on which DEA is
seeking additional public comment.
The Controlled Substances Act (CSA), 21 U.S.C. 801-904, prevents
the diversion of controlled substances into improper channels by
requiring that
[[Page 22019]]
controlled substances only be prescribed by practitioners registered
with DEA (or exempt from the registration requirement). Thus, one of
DEA's primary goals in the IFR was to ensure that nonregistrants cannot
improperly gain access to electronic prescription applications--i.e.,
the computer software practitioners use to electronically issue their
prescriptions. Obviously, if nonregistrants could gain access to these
applications, they might be able to use them to fraudulently generate
or alter electronic prescriptions for controlled substances, thereby
diverting these controlled substances in violation of the CSA.
Thus, the IFR contains a number of measures designed to minimize,
to the greatest extent possible, the potential for the diversion of
controlled substances through such misuse of electronic prescription
applications. These include the IFR's approaches to identity proofing
(verifying that the user of an electronic prescription application is
who he or she claims to be) and logical access control (verifying that
the authenticated user has the authority to perform the requested
action).
Under the IFR, a practitioner can only sign and issue an electronic
prescription by using an authentication credential, and a practitioner
can only receive such a credential after having his or her identity
verified. For individual practitioners (as opposed to practitioners
associated with an institutional practitioner registrant), such
identity proofing is done by authorized third parties that, after
verifying a registrant's identity, issue an authentication credential
to the registrant. These third parties must be federally approved
credential service providers (CSPs) or certification authorities (CAs).
Further, the IFR requires CSPs and CAs to conduct identity proofing
at Assurance Level 3 of the National Institute of Standards and
Technology (NIST) Special Publication (SP) 800-63-1, ``Electronic
Authentication Guideline,'' which allows either in-person or remote
identity proofing. Since the IFR was published, changes in technology
have led to the creation of new, updated NIST guidelines, NIST SP 800-
63-3, ``Digital Identity Guidelines.'' Under NIST SP 800-63-3, the
relevant identity proofing assurance level is Identity Assurance Level
2. Identity Assurance Level 2 of NIST SP 800-63-3, like Assurance Level
3 of NIST SP 800-63-1, allows either in-person or remote identity
proofing.
The IFR allows institutional practitioners to conduct their own in-
house identity proofing as part of their credentialing process of the
individual practitioners who will be using the institution's electronic
prescribing application to issue prescriptions. If an institutional
practitioner chooses to conduct its own internal identity proofing,
that process must fulfill a number of specific requirements, such as
including review of a government-issued photographic identification of
the individual and ensuring that the individual's state authorization
to practice is in good standing. Once this process is completed, a
separate entity within the institutional practitioner (or an outside
CSP or CA) can issue an authorization credential to the individual. In
the alternative, rather than conducting its own identity proofing, an
institutional practitioner can require individuals to obtain identity
proofing and authentication credentials in the same manner as
individual practitioners, i.e., through a CSP or CA.
Under the IFR, authorization credentials must be two-factor. That
is, a user must supply two different forms of authentication--two
``factors''--to use their credential to issue an electronic
prescription. These factors can take one of three forms. A factor can
be knowledge-based--something only the practitioner knows--such as a
password or a response to a certain question. The factor can be
biometric data, such as a fingerprint or iris scan. Or the factor can
be a hard token, a cryptographic key stored on a special hardware
device, such as a smart card or cellular phone, separate from the
computer system containing the electronic prescribing application.
Accordingly, to issue an electronic prescription under the IFR, a
practitioner must first enter two different factors into the system
containing the prescription application (e.g., enter a password, scan a
fingerprint, insert a smartcard) before the system will allow that
practitioner to issue the prescription.
Identity proofing and two-factor authentication credentials are not
the only controls the IFR requires. The IFR also requires electronic
prescription applications to use ``logical access controls.'' Logical
access controls are controls in the application that ensure that the
application only allows DEA registrants (or persons otherwise
authorized under the CSA) to electronically sign controlled substance
prescriptions (or indicate that prescriptions are ready to be signed).
Logical access controls may be by user or role-based; that is, the
application may allow permissions to be assigned to individual users or
it may associate permissions with particular roles (e.g., physician,
nurse), and then assign each individual to the appropriate role.
In a private practice, logical access control must be handled by at
least two people within the practice, one of whom must be a DEA
registrant who has obtained his or her own two-factor authentication
credential. Once a practitioner has received an authentication
credential and wishes to use the electronic prescribing application,
the two or more individuals who set the access controls first verify
that the practitioner's DEA registration is valid. They then set the
application's logical access controls to grant the practitioner access
to those application functions that indicate a prescription is ready to
be signed and that sign controlled substance prescriptions. The
individuals handling the access controls must complete this process
together: One person must enter the data to grant access, and then
another person (who is a DEA registrant and who has an authentication
credential) must approve the entry using his or her own authentication
credential before the access becomes operational.
Institutional practitioners use a similar but slightly different
process to establish logical access control under the IFR. First, at
least two individuals within the institution's credentialing office
must approve any list of individuals who are to be permitted to use the
institution's electronic prescription application to sign controlled
substance prescriptions or indicate that controlled substance
prescriptions are ready to be signed. After the list is approved, it
must be sent to a separate entity within the institution (probably an
information technology office) that actually enters the logical access
control data and thereby grants the individuals on the list access to
the electronic prescription application. This process also requires at
least two individuals: One to enter the data to grant access and one to
approve this entry.
The IFR's logical access control provisions also require that
practitioners lose their permission to electronically sign controlled
substance prescriptions (or to indicate that such prescriptions are
ready to be signed) in certain scenarios: If the individual
practitioner's hard token or other authentication factor is lost,
stolen, or compromised; if the individual (or institutional)
practitioner's DEA registration expires without renewal; if the
individual (or institutional) practitioner's DEA registration is
terminated, revoked, or suspended; or if the individual practitioner is
no longer
[[Page 22020]]
authorized to use the electronic prescription application for whatever
reason (such as a practitioner's departure from the institution using
the application).
Additionally, the IFR requires that any electronic prescription
application used to prescribe controlled substances create and preserve
an ``audit trail,'' a record of who accessed the application and
certain operations they performed, including specified ``auditable
events.'' Among other things, such auditable events, include any
setting of or change to logical access controls related to the issuance
of controlled substance prescriptions. Whenever an auditable event
occurs, an individual authorized to set logical access controls must
review the auditable event and determine whether it was a security
event that compromised or could have compromised the integrity of the
electronic prescription application's prescription records. Any such
security events must be reported both to the provider of the electronic
prescription application and to DEA within one business day.
The IFR also contains certain provisions governing the transmission
of electronic prescriptions for controlled substances. After an
electronic prescription for a controlled substance has been digitally
signed and issued, the electronic prescription application must
transmit the prescription to a pharmacy application (software that
manages the receipt and processing of electronic prescriptions) as soon
as possible so that the pharmacy can fill the prescription. If the
practitioner is informed that the prescription's transmission has
failed, he or she may provide a paper or oral (where permitted)
prescription as a replacement (including a manually signed printout of
the electronic prescription), but must ensure that the replacement
prescription indicates that the prescription was originally issued
electronically but that transmission failed. Before filling such a
replacement prescription, a pharmacist must check his or her records to
ensure that the electronic prescription was not already received and
filled. If it was, the replacement prescription must be marked void. In
this manner, the IFR seeks to ensure that electronic prescriptions will
not be filled twice.
Finally, as discussed above, the IFR provides that biometric data,
such as a fingerprint, is one of the authentication factors that a
practitioner may use to issue a prescription. The IFR also provides
certain requirements that an electronic prescription application using
biometric data as an authentication factor must meet. On October 24,
2018, the SUPPORT for Patients and Communities Act (SUPPORT Act) was
signed into law. The SUPPORT Act mandated that, ``[n]ot later than 1
year after the date of enactment of this Act, the Attorney General
shall update the [IFR's] requirements for the biometric component of
multifactor authentication with respect to electronic prescriptions of
controlled substances.'' \2\ This requirement is part of a larger
provision that amends the Social Security Act to require e-prescribing
(with some exceptions) of drugs prescribed on or after January 1,
2021.\3\
---------------------------------------------------------------------------
\2\ Substance Use-Disorder Prevention that Promotes Opioid
Recovery and Treatment for Patients and Communities Act (SUPPORT
Act), Public Law 115-271, sec. 2003(c), 132 Stat. 3894, 3927(2018).
The Attorney General has delegated the authority to make the
required updates to the Administrator of the DEA. See 28 CFR 0.100.
\3\ SUPPORT Act, sec. 2003(a),(b). This requirement is codified
at 21 U.S.C. 1395w-104(e)(7).
---------------------------------------------------------------------------
Outstanding EPCS Issues and DEA's Need for Additional Comments
DEA received over 200 comments in response to its 2008 EPCS NPRM.
Many of the comments received in response to the NPRM included
arguments that the EPCS provisions should allow for more flexible
electronic processes similar to those for handling prescriptions for
non-controlled substances. DEA's 2010 IFR addressed these comments,
but, in light of the complexity of the issues involved and various
changes between the NPRM and IFR, also sought further comments about
certain issues. See 75 FR 16236, 16242, 16243, 16246, 16248, 16251-
16253, 16270, 16289, 16294. Since publishing the IFR, DEA has received
dozens of comments in response. Nonetheless, given the passage of time
since the IFR was published and the rapid pace of technological
development--in addition to the questions and requests for
clarification that DEA continues to receive about the IFR's
requirements--DEA has determined that it would be beneficial to reopen
the IFR for comment to solicit comments from the public on specific
issues, which are listed below, some of which DEA had previously raised
as topics for comment in the IFR. DEA anticipates that such additional
comments will prove helpful as it completes its final rule on these
topics. In addition, as stated earlier, Congress has required the DEA
to ``update'' its regulations on one of these issues, the biometric
component of two-factor authentication, and comments from the public
may help DEA to do so. DEA would like to remind commenters that any new
approaches they are suggesting would be helpful only if DEA is able to
adopt these new approaches while still ensuring the security and
accountability of systems to identify fraud and prevent diversion.
Thus, DEA is now soliciting public comment on the following issues.
1. DEA currently requires that the authentication credential be
two-factor to protect the practitioner from internal misuse, as well as
external threats. DEA is seeking comments in response to the following
questions:
Is there an alternative to two-factor authentication that
would provide an equally safe, secure, and closed system for electronic
prescribing of controlled substance while better encouraging adoption
of EPCS? If so, please describe the alternative(s) and indicate how,
specifically, it would better encourage adoption of EPCS without
diminishing the safety and security of the system.
Are practitioners using universal second factor
authentication (U2F)? If so, how (e.g., Near-Field Communication (NFC),
Bluetooth, USB, or Passwordless)?
Are practitioners using cellular phones as a hard token,
or as part of the two-factor authentication? Is short messaging service
(SMS) being used as one of the authentication factors used for signing
a controlled substance prescriptions?
Note: Authenticators using SMS and phone call verification
currently fall under RESTRICTED use as outlined in National Institute
of Standards and Technology (NIST) Special Publication (SP) 800-63B,
``Authentication and Lifecycle Management,'' sections 5.1.3.3 and
5.2.10. Vulnerabilities evolve over time and implementing organizations
should continually evaluate risk to determine long-term suitability.
2. As discussed, the IFR requires that a CSP or CA conduct identity
proofing at Assurance Level 3 of the NIST SP 800-63-1, ``Electronic
Authentication Guideline.'' As noted, because of updates in technology,
NIST SP 800-63-3, ``Digital Identity Guidelines,'' now provides the
most current relevant identity proofing guidelines. And, under NIST SP
800-63-3, the relevant assurance level is Identity Assurance Level 2.
DEA believes that the ability to conduct remote identity proofing
allowed for in Assurance Level 3 of NIST SP 800-63-1 and Identity
Assurance Level 2 of NIST SP 800-63-3 ensures that practitioners in
rural areas are able to obtain an authentication credential without the
need for travel. DEA further believes that application providers work
with CSPs or CAs to direct practitioners to
[[Page 22021]]
one or more sources of two-factor authentication credentials that will
be interoperable with their applications. Additionally, an IFR
provision, 21 CFR 1311.105, requires that a CSP providing EPCS
authentication credentials be approved by the General Services
Administration Office of Technology Strategy/Division of Identify
Management to conduct identity proofing at Assurance Level 3 or above
of NIST SP 800-63-1 (i.e., Identity Assurance Level 2 or above of NIST
SP 800-63-3). DEA has received questions asking for clarification of
this requirement. DEA is seeking comment on this approach to identity
proofing, as well as any more comments about whether clarification of
the language regarding CSP approval would be helpful.
3. DEA emphasizes that institutional practitioners are allowed, but
not required, to conduct identity proofing. If an institutional
practitioner decides to have each practitioner obtain identity proofing
and the two-factor authentication credential on his or her own, as
other individual practitioners do, that is permissible under the rule.
DEA is seeking comment on this approach to identity proofing by
institutional practitioners.
DEA is also seeking comment on the methods institutional
practitioners are using to validate the identity of practitioners
remotely. For example, are institutions viewing practitioners' driver's
licenses or other forms of identification remotely using video?
4. The IFR requires that any setting of or change to logical access
controls related to the issuance of controlled substance prescriptions
be defined as an auditable event and that a record of the changes be
retained as part of the internal audit trail. DEA is seeking comment on
this approach to logical access control for individual practitioners.
In particular, DEA is seeking comment on whether there are any
adjustments that DEA could make to this requirement that would reduce
its burden on practitioners while still protecting the integrity of
EPCS.
5. As explained above, the IFR sets requirements for how
institutional practitioners must establish logical access control for
their electronic prescription applications. Among other things, the IFR
requires that at least two individuals from the institution's
credentialing office provide the part of the institution that controls
the computer applications with the names of practitioners authorized to
issue controlled substance prescriptions. The entry of the data that
grant access to practitioners also requires the involvement of at least
two individuals, one to enter the data and another to approve the
entry. The institutional registrant is responsible for designating and
documenting individuals or roles that can perform these functions. And
a practitioner's access must be revoked whenever any of the following
occurs: The institutional practitioner's or, where applicable,
individual practitioner's DEA registration expires without renewal, or
is terminated, revoked, or suspended; the practitioner reports that a
token or other factor associated with the two-factor authentication
credential has been lost or compromised; or the individual practitioner
is no longer authorized to use the institutional practitioner's
application. DEA is seeking comment on this approach to logical access
control for institutional practitioners.
6. The IFR requires that security events--auditable events that
compromise or could compromise the integrity of the prescription
records of an electronic prescription application--be reported to both
the application's provider and DEA within one business day. DEA is
seeking comment from EPCS application users on whether they have
experienced a security incident and, if so, whether they have
experienced any difficulties reporting it.
7. DEA is generally seeking comment on any aspects of the IFR or
other EPCS areas where further clarification would be helpful. For
example:
What types of issues have registrants encountered during
the adoption and implementation of EPCS into their workflow,
particularly where a prescriber uses an electronic health record
(electronic medical record)?
What types of devices are currently being used to create,
sign, transmit, and process controlled substances electronically? For
example, are practitioners using iOS or Android mobile devices,
Chromebooks, Windows Laptop/Desktops, Mac OS, or others?
Are there problems using two-factor authentication due to
the method used to complete verification (e.g., prohibited or limited
cellular service, restriction on external USB devices, offline system
access)?
Has two-factor authentication caused barriers to efficient
workflows?
Have staff workflows at long-term and post-acute care
facilities faced barriers during the adoption and implementation of
EPCS?
8. Many institutions have implemented biometrics as part of their
authentication credentialing for electronic applications. DEA is
seeking comments in response to the following questions:
What types of biometric authentication credentials are
currently being utilized (e.g., fingerprint, iris scan, handprint)?
How has the implementation of biometrics, as an option for
meeting the two-factor authentication requirement, benefited the EPCS
program?
Are there alternatives to biometrics that could result in
a greater adoption rate for EPCS while continuing to meet the
authentication requirements? If so, please describe the alternative(s)
and indicate how, specifically, it would be an improvement on the
authentication requirements in the IFR.
9. Previous commenters have expressed concern regarding failed
transmissions of electronic prescriptions. DEA is seeking comment in
response to the following questions:
Have any entities experienced failed transmissions (e.g.,
an EPCS being sent to the wrong pharmacy, an incorrectly filled out
EPCS, an EPCS fails to send, the pharmacy does not have the prescribed
controlled substance in stock, or the pharmacy rejects the EPCS)?
If any failed transmissions have occurred, what
alternative means of submitting the prescription to the pharmacy have
been used?
Uttam Dhillon,
Acting Administrator.
[FR Doc. 2020-07085 Filed 4-20-20; 8:45 am]
BILLING CODE 4410-09-P