![](media/image1.png){width="2.45625in" height="0.8256944444444444in"}

September 25, 2008

Michele Leonhart

Acting Administrator

Drug Enforcement Administration

Attention: DEA Federal Register Representative/ODL

8701 Morrissette Drive

Springfield, VA 22152

RE: Docket No. DEA -- 218

*Federal Register,* Vol 73, No. 125; Notice of Proposed Rulemaking

**Electronic Prescriptions for Controlled Substances**

Dear Acting Administrator Leonhart:

On behalf of CVS Caremark, I appreciate the opportunity to comment on
the Drug Enforcement Administration's NPRM on electronic prescriptions
for controlled substances. CVS Caremark is the largest provider of
prescriptions and related healthcare services in the nation. CVS
Caremark operates 6,300 CVS/pharmacy stores; a pharmacy benefit
management, mail pharmacy and specialty pharmacy division, Caremark
Pharmacy Services; its retail-based health clinic subsidiary,
MinuteClinic; and its online pharmacy, CVS.com. SilverScript Insurance
Company, a national Part D Sponsor, and SilverScript, Inc., a Medicare
Part D pharmacy benefit management company (PBM), are both affiliates of
CVS Caremark.

CVS Caremark fills or manages more than one billion prescriptions
annually, and we are the industry leader in e-prescribing, filling more
than 30 percent of all electronic prescriptions in the United States.
CVS Caremark is also one of the founding members and owners of
SureScripts-RxHub -- the nationwide network for e-prescriptions \-- and
participates in the National Council for Prescription Drug Programs
(NCPDP) and works with government standard-setting bodies on this issue.
We have participated in both state and national e-prescribing
initiatives, and our business unit iScribe is a leading provider of
e-prescribing tools for physicians.

***CVS Caremark Systems Ensure State-of-the-Art Information Security for
All Prescriptions***

As a strong proponent of e-prescribing, CVS Caremark commends the DEA
for promulgating proposed rules to permit e-prescribing of controlled
substances, which represent 100 million written prescriptions filled by
our company each year. We agree with the Administration that
e-prescribing offers substantial patient safety benefits as compared to
written prescriptions.[^1] Study data also supports increased savings
for consumers and providers from e-prescribing.[^2] E-prescribing
provides enhanced patient convenience and greater efficiencies for
prescribers and pharmacies.

CVS Caremark supports the DEA's objective to prevent diversion of
controlled substances and agrees that e-prescribing of such products
must include safeguards to minimize its risk. Indeed, CVS Caremark
continually strives to improve our prescription processing systems. To
that end, we are developing RxConnect \-- a best-in-class pharmacy
system that combines the practical experiences of our pharmacists and
technicians with industry-leading technology for superior customer
service and patient safety. Operating on a centralized platform that
provides a secure, closed system, RxConnect will include
state-of-the-art data security safeguards for all prescriptions,
including controlled substances. As with the current retail prescription
processing system, RxConnect will have a dedicated, secure line of
communication with SureScripts-RxHub that is separated from other
systems by a firewall. RxConnect is in the first phase of pilot testing
in 66 pharmacies. These stores are the first of our 250 pilot stores
that will be converted over the next several months. Following a
successful pilot, the chain-wide-roll out of RxConnect will begin later
this year.

Similarly, our specialty pharmacy systems and networking infrastructure
operates 24 hours a day, 7 days a week, and 365 days a year with minimal
failures. Our security frameworks are designed to protect sensitive
information and our information systems from unauthorized access, use,
disclosure, disruption, modification, or destruction. External data is
sent and received via encryption software. Internal access is secured
via unique user IDs with encrypted passwords. We perform a 90-day review
of all users in our systems. Any user that has not signed in greater
than 90-days is removed. We also perform Periodic Access Reviews of all
users and their security roles within the Specialty applications.

Our highly automated, state of the art mail service pharmacies were
ranked "Highest Customer Satisfaction" in a 2007 J.D. Power and
Associates study. We have a zero-defect focus and our performance
statistics bear this out. Our systems are continually being updated to
meet safety, security, regulatory and contractual requirements to
protect patient safety and prevent diversion.

***Executive Summary***

***CVS Caremark Believes the Proposed Rule Imposes Burdensome
Requirements that Do Not Contribute to Patient Safety and Will Deter
E-prescribing of All Medicines***

We are concerned that the Administration's proposed rule -- while
supporting our mutual objectives -- includes provisions that
unintentionally create excessive and unnecessary burdens on pharmacies
and prescribers that will ultimately deter e-prescribing not only of
controlled substances, but of all medicines.

In its impact analysis, the DEA asserts that pharmacies will not be
directly affected economically by the proposed rule (see 21 CFR 36758).
CVS Caremark strongly disputes this assertion. As written, the proposed
requirements for record retention, audit and digital signature, and
pharmacy validation of prescriber DEA registration create new
liabilities and cost burdens for pharmacies where none now exist for
paper controlled substances scripts. We estimate that to add new
functionalities at our thousands of retail stores and facilities will
cost between \$1 and \$2 million and will take several months to
complete. This represents a significant investment for CVS Caremark as a
large chain; small chains and independent pharmacies will be severely
impacted. The proposed requirements also burden prescribers and system
vendors with onerous in-person identity proofing, audit and
recordkeeping duties that act as barriers to e-prescribing. Ironically,
while it is not disputed that electronic prescribing offers a more
secure environment for controlled substances than written scripts, DEA's
proposal seeks to impose more stringent rules than currently exist.

The consequence of these stringent requirements is likely a step
backward -- away from improved patient safety and fostering physician
use of comprehensive health information technology (HIT) systems such as
electronic health records. The DEA's proposed rules in this area are one
component of a multi-faceted effort by many federal agencies to advance
e-prescribing to reduce medical errors, increase system efficiencies and
reduce health care costs. Most recently, Congress has acted to foster
e-prescribing by creating financial incentives for providers to adopt
this technology under the Medicare Improvements for Patients and
Providers Act of 2008.[^3] This intent is further supported by the
Centers for Medicare and Medicaid Services' Physician Quality Reporting
Initiative that provides payments to qualified physicians who
demonstrate they have adopted e-prescribing.[^4] As written, the DEA's
proposed requirements for prescribers would create workflow disruptions
and new responsibilities that act as barriers to e-prescribing adoption,
and thus foil Congressional intent and conflict with its sister agency's
efforts.

CVS Caremark's comments are intended to identify concerns raised by the
proposed rule for pharmacies, prescribers and system vendors and propose
solutions that balance the legitimate interests of law enforcement with
the public health goals of private industry, the federal government and
state governments to promote the adoption and use of health information
technology.

**I. Pharmacy Prescription Processing**

A.  ***Digitally Signing and Archiving the Prescription -- §1311.160***

> Section 1311.160 of the proposed rule would require both the first
> recipient of an electronic controlled substance prescription and the
> first pharmacy system that receives such a script to digitally sign it
> and archive for five years the digitally signed version of the
> prescription as received. Alternatively, the intermediary that
> transmits the prescription to the pharmacy may digitally sign the
> transmitted prescription and transmit both the record and the
> digitally signed copy for the pharmacy to archive. The digital
> signatures must meet the requirements of FIPS 180-2 and 186-2.
>
> Digital signatures offer record integrity assurance that supports the
> validity of the electronic script for the controlled substance for
> purposes of nonrepudiation. However, if the pharmacy system is
> understood to be the internal prescription processing system in this
> section, digitally signing the prescription is a new requirement.
>
> Although the proposed rule does permit pharmacy reliance on the
> intermediary to digitally sign the prescription, we are concerned that
> this would result in increased costs for service. In addition, the
> role of an intermediary may be phased out over time as prescribers
> increasingly adopt electronic health record databases that could allow
> for direct transmission, thereby leaving the pharmacy with no
> alternative to adding digital signature functionality.
>
> Moreover, the DEA makes clear that compliance for this requirement
> rests with the pharmacy regardless of its reliance upon an
> intermediary, increasing our exposure to liability in addition to
> increasing our costs. Added costs will be incurred when FIPS standards
> evolve, making compliance upgrades necessary.
>
> Similarly, the requirement to retain a copy of each electronic
> controlled substance prescription for five years is inconsistent with
> the current requirement that written controlled substance
> prescriptions be retained for two years. CVS Caremark respectfully
> disagrees with DEA's statement in the NPRM that a five-year record
> retention requirement should not be a burden on pharmacies. In
> addition to system costs associated with storing an added three years
> of records, pharmacies would incur additional potential liability for
> the responsibility of maintaining the additional information.
>
> ***[Recommendation:]{.underline}*** We recommend that the DEA
> reconsider requiring a pharmacy to digitally sign a prescription upon
> receipt and recognize the security within current systems. As the DEA
> noted at 21 CFR 36744-45, existing pharmacy internal audit trails
> provide evidence of record integrity. We respectfully request that the
> DEA re-examine the sufficiency of audit trails to meet the objectives
> of the proposed revision. We also recommend that the DEA adopt record
> retention requirements consistent with existing rules for paper
> controlled substances prescriptions.

B.  ***Validating Prescriber DEA Registration Check and Storing the DEA
    Number -- §1311.165***

> Section 1311.165 of the proposed rule would require the pharmacy
> system to determine whether the DEA registration of the prescribing
> practitioner is valid. Alternatively, any of the intermediary systems
> may conduct this check provided that the record indicates that the
> check has been conducted. The Controlled Substances Act database may
> be cached for one week from the date of issuance by DEA of the most
> current database. Additionally, the pharmacy must verify that the
> prescriber signed the prescription, and the pharmacy system must be
> able to store the complete DEA number including extensions.
>
> CVS Caremark agrees with DEA that assuring prescribers of controlled
> substances are registered with DEA is an important aspect of
> preventing diversion. At retail, CVS Caremark pharmacists maintain
> close professional relationships with the local prescribing community
> and are very familiar with prescribers of controlled substances.
> Therefore, validation of a prescriber's DEA number occurs only when
> the pharmacist has reason to believe that the DEA number is invalid.
> Similarly, at Mail Service, our pharmacists follow the general
> guidance outlined in the DEA publication \"Pharmacist's Guide to
> Prescription Fraud\"
> (<http://www.deadiversion.usdoj.gov/pubs/manuals/pharm2/appendix/appdx_o.htm>). 
> Our pharmacists look for common characteristics of forged
> prescriptions and when there is a question about any aspect of the
> prescription order, they call the prescriber for verification or
> clarification.
>
> The DEA offers the option to purchase a costly CSA registration
> database. An annual subscription to the database as updated weekly
> costs as follows: for up to 5 concurrent users \-- \$4,400; Up to 10
> concurrent users \--\$7,288; 11+ concurrent users \$14,025. A
> subscription based on weekly updates is not real-time and therefore
> does not insulate the pharmacy from liability if a change to the
> database has been made in the interim, nor does it accomplish the
> DEA's objective. If a new prescriber was not yet entered in the
> system, pharmacies would be forced to reject his or her prescriptions.
> Similarly, the DEA system may not register every DEA number that has
> been suspended or revoked -- since it is not real-time - and a
> pharmacy could be held liable for filling a prescription including a
> valid DEA number according to DEA's own database.
>
> Although the proposed rule does permit pharmacy reliance on the
> intermediary to validate the prescriber's DEA registration, we are
> concerned that this would result in increased costs for service.
> Moreover, such reliance would not shift ultimate liability for
> compliance from the pharmacy, as the DEA states at 21 CFR 36745 and
> elsewhere in the proposed rule.
>
> ***[Recommendation:]{.underline}*** CVS Caremark recommends that sole
> responsibility and liability for this verification requirement should
> rest with the service provider rather than the pharmacy. Under section
> 1311.105(c)(3) of the proposed rule, the DEA requires the service
> provider to verify a prescriber has a valid DEA registration prior to
> permitting access to an electronic prescription system for signing
> controlled substance prescriptions. The digital certificate held by
> the service provider assures the integrity of the electronic
> prescription from a prescriber whose DEA registration has been
> checked. Therefore, any additional check by either the pharmacy or
> intermediary prior to dispensing is unnecessarily redundant, and the
> pharmacy should bear no liability with regard to the status of the
> prescriber's DEA registration. This recommendation is dependent upon
> the subsequent recommendation where by the DEA retain primary
> responsibility for identity proofing and that the DEA also should
> provide a centralized database of state licenses whereby prescriber
> status can be checked electronically and periodically. (See below II.
> Systems Issues/Prescriber Impact -- A. Identity Proofing and
> Verification).

[]{.mark}

> Moreover, at 21 CFR 36742, DEA states it will "make available to
> service providers information regarding the registration status of
> practitioners, including practitioners' names, addresses, DEA
> registration numbers, and dates of expiration for those DEA
> registrations." Given this proposed direct communication of
> registration information between the DEA and service providers, they
> are in the best position to validate prescriber DEA registration.
>
> We also are concerned with the requirement that the pharmacy system
> must be capable of reading and retaining the full DEA registration
> number, including any extensions or other identification numbers also
> would impose new costs and ultimately prove unworkable.
> Extensions/suffixes on DEA registration numbers originating from
> hospitals are not readable by all of our internal systems. For
> example, our Specialty Pharmacy Services system would need to add this
> functionality.
>
> Of greater concern is that that the DEA does not assign or record
> these extensions and there is not a standard assignment protocol among
> health care institutions, making pharmacy validation impossible and
> DEA verification of the suffix unlikely.
>
> ***[Recommendation:]{.underline}*** CVS Caremark requests that DEA
> remove the requirements that pharmacies be held responsible for the
> validation of any extensions or other institutionally provided
> identification number that is not recognized by the DEA and is not
> able to be identified by the CSA database

C.  ***Processing the Record***

```{=html}
<!-- -->
```
1)  **Maintaining Record Form -- §1311.130**

> Section 1311.130 of the proposed rule would require that a
> prescription created electronically for a controlled substance must
> remain in its electronic form throughout the transmission process to
> the pharmacy; electronic prescriptions may not be converted to other
> transmission methods, e.g., facsimile, at any time during
> transmission.
>
> CVS Caremark agrees that keeping an e-script for a controlled
> substance in its electronic form through dispensing is optimal for
> patient safety and to prevent diversion. Myriad circumstances may
> result in transmission failure or a in a transmission that cannot
> result in a filled prescription (e.g., power outage, system down-time,
> closed pharmacy, wrong pharmacy location, etc.). It is unreasonable to
> disallow dispensing of necessary prescriptions as a result of
> transmission failures or errors. Such a requirement will undoubtedly
> result in patient harm and frustration, and may well decrease the
> number of prescribers and patients willing to use e-prescribing.
>
> []{.mark}
>
> ***[Recommendation:]{.underline}*** We recommend that the DEA include
> an exemption to allow a prescription to be printed once it has been
> transmitted in cases of electronic transmission failure or an
> inadvertent error in transmission. Under current practice,
> transmission failure for e-prescriptions of noncontrolled substances
> can result in the conversion of the script to facsimile to assure
> continuity of care and we recommend that the DEA explicitly permit
> this practice.
>
> Section 1311.230(d) of the proposed rule states that a controlled
> substance prescription may not be altered during transmission and that
> any changes to its content during transmission would render it
> invalid.
>
> As the DEA states at 21 CFR 36744, the common practice of generic
> substitution at the pharmacy involves an alteration to an element of
> the prescription. Substitution by pharmacists of FDA-approved generic
> drugs results in billions of dollars in savings annually to patients
> and the health care system. Although we do not believe it is DEA's
> intent to prohibit generic substitution of electronic controlled
> substance prescriptions, a strict reading of this provision as barring
> this practice could deter adoption of e-prescribing.
>
> ***[Recommendation:]{.underline}*** Therefore, CVS Caremark requests
> that the DEA clarify that generic substitution by the pharmacy
> receiving the electronically transmitted prescription is legal and
> does not require an additional prescription.

2)  **Annotating the Record -- §1311.165**

> Section 1311.165 of the proposed rule would require the pharmacy to
> annotate the record with the same information required for a paper
> prescription (number of units; dispensing date; full name of
> dispenser; number of allowable refills) and the record of annotations
> must be retained for five years. It is unclear what format the DEA
> intends for annotations under this provision.
>
> At CVS Caremark, this annotation functionality would need to be added
> to both RxConnect and our mail and Specialty Pharmacy Services
> systems. Thus, this section imposes a costly new requirement that does
> not currently apply to paper prescriptions. In addition, the five-year
> record retention requirement is inconsistent with existing two-year
> requirements and adds a cost burden while increasing the pharmacy's
> exposure to liability.
>
> ***[Recommendation:]{.underline}*** We recommend that DEA clarify the
> rule to state that annotations may be made by the pharmacy system and
> that the notes are derived from the dispensing record of the system.
> We also recommend that the DEA adopt record retention requirements
> consistent with existing rules for paper controlled substances
> prescriptions.

3)  **Transferring the Prescription -- §1306.25**

> Section 1306.25 of the proposed rule would allow a pharmacy to
> transfer an electronic prescription with remaining refills to another
> pharmacy provided the transfer is communicated between two licensed
> pharmacists.
>
> With 6,300 pharmacies and dozens of mail facilities and Specialty
> Pharmacy facilities, CVS Caremark routinely transfers prescriptions
> for both controlled and noncontrolled substances between pharmacies.
> Under most state pharmacy practice acts, when a pharmacist transfers a
> prescription within the same pharmacy chain, only one pharmacist is
> necessary to complete the transaction if using a common database.
> These prescription transfers can occur in a number of ways, including
> through the use of a central database or a distributed system. Our
> secure systems currently assure the integrity of records during
> transfers for all prescriptions.
>
> ***[Recommendation:]{.underline}*** CVS Caremark recommends that DEA
> should modify the transfer requirement for refills to delete the
> two-pharmacist requirement for intra-chain transfers and that this
> amended requirement should explicitly pre-empt state laws to the
> contrary.

D.  ***Recordkeeping***

```{=html}
<!-- -->
```
1)  **Downloading and Sorting the Record -- §1311.165**

> Section 1311.165 of the proposed rule would require the pharmacy
> system to have the ability to retrieve and sort electronic
> prescription information by the following data: prescriber name;
> patient name; drug dispensed; date dispensed. In addition, the
> pharmacy system must be able to download an electronic copy of the
> prescription record into a database or onto an easily readable
> spreadsheet that can be printed or provided electronically.
>
> At CVS Caremark, we currently have the requisite capability to meet
> the data sort and download/print format provision at the enterprise or
> corporate level. However, this functionality would have to be added to
> systems for implementation at the pharmacy level, resulting in
> significant cost burdens.
>
> ***[Recommendation:]{.underline}*** We respectfully request that the
> DEA require this functionality only at the enterprise level, and that
> the Administration clarify that access through a request to corporate
> headquarters is acceptable.

2)  **Backing Up and Storing the Record -- §1311.170**

> Section 1311.170 of the proposed rule would require the pharmacy
> system to maintain backup records in a place geographically separate
> from storage site. In addition, a copy of each record must be
> transferred to the backup storage site every 24 hours and backup
> copies must be maintained for 5 years from the date of creation.
>
> Paper prescription records are less secure than electronic records in
> cases of physical disasters, yet there are currently are no similar
> backup and storage requirements for paper prescriptions for controlled
> substances (or noncontrolled substances). While CVS Caremark and other
> large chain pharmacies have disaster recovery systems in place that
> comply with the backup and storage location requirements, the rules
> could impose significant burdens on smaller chain or independent
> stores.
>
> []{.mark}
>
> ***[Recommendation:]{.underline}*** We request that DEA define
> "geographically separate" as a "reasonable distance" from the primary
> storage facility.

3)  **Retrieving the Record -- §1311.180**

> Section 1311.180 of the proposed rule would require the pharmacy to
> maintain records of electronic controlled substance prescriptions for
> five years from date of creation and to make these records available
> to the DEA upon request.
>
> As we have noted repeatedly in our comments, the DEA's general record
> retention requirement of five years applied throughout the rule
> exceeds the current two year requirement under the CSA.[^5] Although
> the DEA states at 21 CFR 36749 its belief that these record retention
> requirements will not impose any new burdens on pharmacies, three
> additional years of record retention will in fact expose pharmacies to
> increased liability and potential costs.
>
> In addition, the DEA's record retrievability standards are unclear and
> inconsistent. Although the current practice is that records for paper
> prescriptions and e-scripts for noncontrolled substances are now
> available to DEA on a "readily retrievable" basis, DEA states at 21
> CFR 36749 that electronic records for controlled substances must be
> "immediately retrievable" by data sort and that records must be
> "immediately printed" upon DEA request.
>
> As with the downloading and sorting requirements in proposed §1311.165
> discussed above, implementation of these retrievability and print
> requirements at the pharmacy level would impose cost burdens.
>
> ***[Recommendation:]{.underline}*** CVS Caremark recommends that the
> DEA adopt record retention requirements consistent with existing rules
> for paper controlled substances prescriptions. We further recommend
> that DEA clarify that the current standard of "readily retrievable" is
> acceptable. Finally, we again ask that DEA require this functionality
> only at the enterprise level, and that the Administration clarifies
> that access through a request to corporate headquarters is acceptable.

E.  ***Audits & Reporting***

```{=html}
<!-- -->
```
1)  **Creating the Internal Audit Trail -- §1311.170**

> Section 1311.170(b) of the proposed rule would require the pharmacy
> system to have an audit trail that identifies each time a record is
> opened, annotated, deleted or altered and any person who views,
> annotates or alters the record. These records must be retained for
> five years.
>
> CVS Caremark believes that the scope of the audit requirements is
> overly broad and unnecessarily burdensome without clear relation to
> the DEA's objective of preventing diversion. For example, a
> prescription record typically is opened and viewed multiple times by
> pharmacy technicians and pharmacists in the course of dispending a
> drug or counseling a patient. Often, such openings and viewings are
> initiated at the patient's request, as in the case of verification of
> billing information. There is no existing audit requirement for paper
> prescriptions or electronic prescriptions for noncontrolled substances
> and CVS Caremark would have to add this functionality for its mail and
> Specialty Pharmacy Services systems.
>
> ***[Recommendation:]{.underline}*** Because it is unclear how a record
> of openings and views and by whom would further the DEA's mission of
> preventing diversion, and the burdens to pharmacies and patients of
> implementation of this aspect of the rule would be great, CVS Caremark
> recommends that DEA reconsider the necessity of including these
> actions in the internal audit trail. As we have stated above, the
> five-year record retention requirement is inconsistent with existing
> two-year requirements and adds a cost burden while increasing the
> pharmacy's exposure to liability. CVS Caremark recommends that the DEA
> adopt record retention requirements consistent with existing rules for
> paper controlled substances prescriptions.

2)  **Analyzing the Internal Audit Trail and Reporting Incidents
    --§1311.170(c)-(e)**

> Section 1311.170(c) of the proposed rule would require the pharmacy or
> service provider to establish and implement a list of auditable
> events, including, at a minimum: attempted or successful unauthorized
> access, use, disclosure, modification, or destruction of information
> or interference with system operations in the controlled substances
> prescription system and conduct a daily analysis of the system to
> identify if any auditable events have occurred. Section 1311.170(d) of
> the proposed rule would further require the pharmacy system to conduct
> daily internal audits and generate an incident report that identifies
> any auditable events. Any auditable event that did compromise or could
> have compromised a record must be reported to the service provider and
> DEA within one business day under section 1311.170(e) of the proposed
> rule.
>
> ***[Recommendation:]{.underline}*** CVS Caremark believes that the
> proposed extensive audit requirements are unnecessary given the use of
> the digital signature. Because DEA is proposing adopting a system of
> digital signatures as the most effective means of determining record
> integrity, this reliance should extend to the audit requirement. As
> such, only compromises of the encryption key in the possession of the
> service provider should trigger a reportable pharmacy system audit for
> the events listed and we recommend that the DEA modify its
> requirements accordingly.
>
> In the alternative, CVS Caremark requests clarification of the term
> "unauthorized modification" as an auditable event. Similarly, we
> request that DEA clarify that the practice of generic substitution,
> termed an "alteration" by the DEA at 21 CFR 36744, is not an auditable
> event under this section.
>
> Moreover, CVS Caremark is concerned that a single business day is not
> a sufficient period for reporting auditable event incidents to DEA if
> such an event occurs over a holiday or at a busy time. We recommend
> the DEA modify its requirement to permit a "reasonable" period for
> reporting such events.

3)  **Third Party Audits -- §1311.170(f)**

> Section 1311.170(f) of the proposed rule would require the pharmacy
> system to have a third-party audit that meets the requirements of
> SysTrust or SAS 70 audits for security and processing integrity prior
> to accepting any electronic controlled substance prescriptions and to
> redo the audit annually thereafter.
>
> There are no existing requirements for a third-party audit for paper
> prescriptions, including written prescriptions for controlled
> substances. CVS Caremark complies with state board of pharmacy
> regulations and state law in this area as well as federal privacy and
> security rules under HIPAA and therefore believes that costly
> third-party audits are redundant and unnecessary. Moreover, pharmacies
> currently are required to certify new releases of their processing
> systems with SureScripts-Rx Hub.
>
> On a side note, we do not believe that security audits should be
> limited to services provided by the AICPA and its constituents nor
> limited to Systrust, WebTrust and/or SAS-70 type audits; this will
> result in excessive costs that prevent broad adoption.
>
> ***[Recommendation:]{.underline}*** We recommend that DEA modify its
> third-party audit requirement to consist of DEA validation of
> SureScripts-RxHub certification and/or HIPAA and state law compliance.
> Such certification, or audits if the requirement is retained, should
> be required only when systems have changed, rather than annually. In
> addition, the DEA should provide for alternative independent
> assessments, approaches, methodologies/frameworks in addition to those
> that are noted, or make available the criteria necessary to be
> considered. The DEA also should establish the necessary criteria for
> other security audit/assurance firms to participate in the audit and
> certification process, this will foster competition and help drive
> down the price.

**II. Systems Issues/Prescriber Impact**

A.  ***Identity Proofing and Verification of Intent to Prescribe
    Controlled Substances --§1311.105***

> Section 1311.105 of the proposed rule would require the service
> provider to obtain documentation of in-person identity proofing of a
> prescribing practitioner from a designated entity permitted to conduct
> the identity proofing. The rule would require the service provider to
> check both the practitioner's State license and DEA registration to
> determine that both are current and in good standing. The service
> provider would be required to confirm the prescriber's intent to apply
> to prescribe controlled substances using the service provider's
> system.
>
> CVS Caremark has several concerns with the requirements in this
> section of the proposed rule because taken together, they are costly,
> burdensome and serve to discourage adoption of e-prescribing of
> controlled substances, and potentially of e-prescribing generally. In
> addition, while we assume that the purpose behind the requirements is
> to ensure the security of the system as related to e-prescribing for
> controlled substances, there are insufficient requirements to ensure
> that the identity proofing responsibilities are undertaken by entities
> with as much interest in the legitimacy of the system and enforcement
> as the DEA. Thus, as proposed the requirements appear to be nothing
> more than an unnecessary roadblock. As the DEA is aware, current
> practice for obtaining a DEA registration \-- which does not include
> in-person identity proofing \-- is significantly less cumbersome and
> difficult.
>
> Under the proposed rule, there would be an increased burden on state
> agencies due to inquiries from service providers and associated costs
> could be passed on to prescribers and/or pharmacies. In addition,
> there would be increased costs for service providers to allocate
> resources to manually check prescriber status. Rural providers, in
> particular, will find it difficult to comply with this provision since
> there is no assurance that an entity conducting identity proofing will
> be conveniently located.
>
> ***[Recommendation:]{.underline}*** We request clarification as to why
> the existing process is now deemed insufficient and how the new
> process will increase security, as it relies on entities far outside
> the DEA's authority.
>
> We recommend that the DEA retain primary responsibility for identity
> proofing at the time of prescriber registration, as under the current
> system. If, as DEA states at 21 CFR 36735, DEA registrations are
> currently "easily obtained" and "read\[ily\] access\[ible\]" to the
> public rendering them vulnerable to fraudulent use, then DEA should
> take steps to tighten its own processes and procedures including any
> necessary procedures for identity proofing for e-prescribing, rather
> than shifting that burden and its attendant costs to the service
> providers and prescribers. DEA also should provide a centralized
> database of state licenses whereby prescriber status can be checked
> electronically and periodically.
>
> Several states require in-person prescriber identity proofing at the
> State Board of Medicine as a condition of licensure, including New
> Mexico and North Carolina. We recommend that DEA consider accepting
> valid licenses in such states to meet this requirement and working
> with state medical boards to utilize the boards as identity proofing
> agents.
>
> In addition, CVS Caremark believes that the DEA proposal that the
> service provider verify the prescriber's intent to e-prescribe
> controlled substances seems needless and should be deleted. The fact
> that they are licensed and have a valid DEA allows them to write
> controlled substances and intent is not relevant.[^6]

B.  ***Hard Token Requirements***

```{=html}
<!-- -->
```
1)  **Token Authentication and Use -- §1311.110**

> Section 1311.110 of the proposed rule would require prescribers to use
> at least a two-factor authentication to access the system; one factor
> must be a cryptographic key stored on a hard token that meets the
> requirements for Level 4 authentication in NIST SP 800-63 or a
> multi-factor one time password token. The hard token must be a
> hardware device that requires entry of a password or biometric to
> activate the authentication key and must not able to export the
> authentication key. The system must have an automatic lock out if the
> system is unused for more than two minutes.
>
> CVS Caremark is concerned that two-factor authentication with a hard
> token is perceived by prescribers to be unworkable and that this
> requirement will deter them from e-prescribing controlled substances
> and thus from adopting e-prescribing generally. In addition, there are
> high costs associated with implementing and controlling a hard token
> system, including difficulty managing connections with a PDA and Web
> tools, that will discourage overall adoption of e-prescribing.
>
> CVS Caremark also believes that the two-minute lockout is a very short
> time frame that diminishes the usability of the product. This
> timeframe does not account for a typical prescriber office workflow
> that may include patient counseling that requires a pause in system
> use.
>
> ***[Recommendation:]{.underline}*** We recommend that DEA remove the
> requirement for a hard token as the rate of likely noncompliance will
> render it moot as an authentication device. DEA should instead
> consider other factors for the second authentication. In order to
> accommodate normal office workflow considerations, w e recommend that
> DEA increase the time-out window to 20 minutes.

2)  **Compromised Token -- §§1311.135, 1311.155**

> Section 1311.155 of the proposed rule would require the registrant to
> retain sole possession of the hard token. If a token is lost or
> compromised and the registrant fails to notify the service provider
> within 12 hours of discovery, the registrant will be held responsible
> for any prescriptions written using the token. Under section 1311.135,
> the service provider must revoke the authentication protocol
> immediately upon receiving notice from a prescriber that a password or
> token has been lost, stolen or compromised or if her DEA registration
> has expired or been terminated, revoked or suspended.
>
> CVS Caremark believes that it is unlikely that a prescriber will be
> able to comply with the requirement to maintain sole possession of the
> hard token in a typical practice setting. Moreover, prescribers
> registered in multiple states would need one token per state which
> would increase opportunities for lost or compromised tokens for
> prescribers who practice across multiple state lines, such as the
> metropolitan New York and Washington, DC areas.
>
> []{.mark}
>
> ***[Recommendation:]{.underline}*** As above, we recommend that DEA
> remove the requirement for a hard token as the rate of likely
> noncompliance will render it moot as an authentication device. DEA
> should instead consider other factors for the second authentication,
> such as biometrics.
>
> CVS Caremark believes that the proposed requirement for that the
> prescriber notify the service provider of a compromised token within a
> 12 hour window is too restrictive, particularly if the service
> provider is unable to receive such notification, as on a holiday or
> weekend. We recommend that the DEA increase the 12-hour window to one
> business day.

C.  ***Prescription Processing* -- §1311.120**

```{=html}
<!-- -->
```
1)  **Signing the Prescription and Contents of Display**

> Section 1311.120 of the proposed rule would require the system to
> display at least the patient name and address, drug name, dosage unit
> and strength, quantity, directions for use, and the DEA number of the
> prescriber whose identity is being used to sign the prescription prior
> to permitting singing. Where more than one controlled substance script
> has been prepared, the prescriber must positively indicate those
> prescriptions that are to be signed.
>
> We are concerned that requiring prescribers to positively indicate
> specific prescriptions for signing increases the number of steps or
> "clicks" required to prescribe and contributes to the perception, and
> in some cases the reality, that hand-writing a prescription for
> controlled substances is faster and easier than e-prescribing.
>
> CVS Caremark also is concerned that the data required to be displayed
> is very extensive for the small screen of a hand-held e-prescribing
> device. Including the prescriber's DEA registration number may not be
> useful because they often do not know it themselves and could not
> recognize whether it is accurate. We further believe that prescribers
> likely will ignore the entirety of the information, so the intended
> review does not occur at all.
>
> ***[Recommendation:]{.underline}*** In order not to deter
> e-prescribing, we recommend that DEA should require procedures that
> reduce the number of steps or "clicks" required to prescribe, rather
> than increase them. In the case of multiple prescriptions, DEA should
> propose a single review/approval step that signs all prescriptions,
> thereby reducing the number of clicks required to complete the
> transmission. We recommend that in order to ensure prescriber review
> of critical prescription data, DEA should limit the data to be
> displayed to that which is most essential for patient safety: patient
> name, drug name, dose, strength and quantity.

2)  **Signing Indication and Attestation -- §1311.125**

> Section 1311.125 of the proposed rule would require the system to
> include in the data file transmitted an indication that the
> prescription was signed and not transmit a prescription unless it has
> been signed. In addition, the rule would require the prescriber to
> authenticate himself to the system immediately before signing a
> prescription using a 2-factor authentication. After authenticating to
> the system but prior to transmitting the prescription, the system must
> display a statement such as "I, the prescribing practitioner whose
> name and DEA registration number appear on the controlled substance
> prescription(s) being transmitted have reviewed all of the
> prescription information listed above and have confirmed that the
> information for each prescription is accurate. I further declare that
> by transmitting the prescription information, I am indicating my
> intent to sign and legally authorize the prescription(s). The
> prescriber must positively indicate agreement with this statement as a
> condition of transmission.
>
> The requirement that the data file include an indication the
> prescription was signed is new for e-prescribing and service providers
> must add this functionality. An NCPDP SCRIPT standard will need to be
> developed. If the NCPDP SCRIPT standard is changed to simply include
> an indicator, and the pharmacy must simply check this indicator,
> retain it if set, or perform digital signing if not set (see digital
> signing estimate above), then we estimate the cost of adding this
> functionality at approximately \$40,000. However, CVS Caremark is
> concerned that a more complex NCPDP SCRIPT standard could result in
> burdensome costs for the service provider that will then be passed on
> to the prescriber, deterring e-prescribing generally. In addition,
> small chains and independent pharmacies may not be able to invest in
> the technology necessary to update to this standard, further limiting
> the implementation and utilization of e-prescribing of controlled
> substances.
>
> We also note that requiring the prescriber to authenticate himself to
> the system immediately before signing a prescription using a
> two-factor authentication increases the number of clicks to
> transmission and contributes to the perception that hand-writing a
> prescription is faster than e-prescribing. Similarly, the proposed
> attestation statement is too lengthy and will take up a page (screen)
> of PDA space. CVS Caremark believes that requiring a prescriber to
> indicate agreement with the attestation prior to every transmission
> will result in the prescriber ignoring the statement.
>
> ***[Recommendation:]{.underline}*** We recommend that DEA eliminate
> the step of authentication prior to signing a prescription as it is
> redundant to the security measure provided by signing. If the DEA
> wishes to require an attestation, CVS Caremark recommends that the
> attestation be displayed in full the first time a prescriber
> electronically prescribes a controlled substance. For each subsequent
> prescription, it should be displayed as a check box with a link to the
> full statement which a prescriber acknowledges having read.

3)  **Immediate Transmission -- §1311.130**

> Section 1311.130 of the proposed rule would require the system to
> transmit the electronic prescription immediately upon signature and
> would prohibit the system from allowing transmission of a prescription
> that has been printed. We are concerned that the requirement for
> immediate transmission after signature could be problematic for rural
> prescribers or if connectivity issues arise. Furthermore, print
> prohibitions may be problematic if a record of the prescription is
> needed for placement in a patient's chart as part of hospital
> discharge orders.
>
> ***[Recommendation:]{.underline}*** CVS Caremark recommends that the
> DEA should allow the prescriber the option to put the prescription in
> a queue or to immediately transmit. If opting to hold in a queue, the
> prescriber would have to approve prior to sending. If, however, the
> prescription is automatically held in a queue due to connectivity
> problems, the prescriber should not be required to re-approve the
> script.

D.  ***Recordkeeping -- §§1311.140, 1311.155***

> Section 1311.140 of the proposed rule would require the service
> provider to generate a monthly log of controlled substance
> prescriptions and transmit it to the prescriber for his or her review.
> The provision also would require the system to provide a means for the
> prescriber to indicate that the log was reviewed and require the
> prescriber to do so. A record of the log and the prescriber's
> indication of review must be maintained for five years. This record
> must be made available at the prescriber's request. Under section
> 1311.155 of the proposed rule, the prescriber must notify the service
> provider and the DEA within 12 hours of discovery of any security
> compromise of prescriptions issued.
>
> ***[Recommendation:]{.underline}*** For the service provider, the
> monthly log is a burdensome new requirement and functionality must be
> added at additional cost to the service provider that may be passed
> onto the prescriber. We are concerned that in addition to the service
> provider burden, the proposed requirements create new burden for the
> prescriber that increases prescriber liability and causes workflow
> disruption. Moreover, because this requirement does not currently
> exist for paper prescriptions or electronic prescriptions of
> noncontrolled substances, service providers would likely need to
> provide training to prescribers about compliance with this provision,
> thus further increasing costs and complexity with little overall
> benefit. CVS Caremark believes that requiring the review function may
> deter a prescriber from e-prescribing controlled drugs because it
> increases the perception that e-prescribing may be more cumbersome
> than writing scripts.
>
> We recommend that the DEA delete this requirement, or, in the
> alternative, allow for staff review of logs rather than mandating
> prescriber review.
>
> In addition, we believe that the prescriber notification window of 12
> hours is too restrictive, particularly if the service provider is
> unable to receive such notification, as on a holiday or weekend and
> recommend that DEA should modify the prescriber notification period to
> one business day.

F.  ***Audits & Reporting -- §§1311.145, 1311.155***

> Section 1311.145 of the proposed rule would require the service
> provider to conduct daily audits and notify the DEA within one
> business day of any security incidents indicating that the integrity
> of the system has been compromised. The provision would further
> require the system to obtain an annual security audit by a third party
> that meets the requirements of a SysTrust or WebTrust audit for
> security and processing integrity. The service provider must make the
> audit report available to the prescriber and must retain it for five
> years. Under section 1311.155 of the proposed rule, the prescriber
> would be required to determine annually that the service provider's
> audit meets the requirements of the rule.
>
> We are concerned that obtaining annual third-party audits that meet
> SysTrust or WebTrust certification standards would creates very high
> costs for service providers and that these costs would be passed on to
> the prescribers, deterring e-prescribing. In addition, based on the
> existing security provisions and the additional requirements DEA is
> proposing, this belt-and-suspenders approach is unnecessary and
> burdensome. CVS Caremark also believes that because review of the
> service provider's audit is outside the scope of most prescribers'
> expertise, the prescriber will need to outsource this function. Again,
> this creates an added cost burden that will serve as a deterrent to
> e-prescribing.
>
> ***[Recommendation:]{.underline}*** We recommend that the DEA remove
> this additional requirement as it is duplicative of other requirements
> that verify the validity of e-prescriptions. Alternatively, DEA should
> explore opportunities to subsidize audit costs or negotiate lower fees
> for participating service providers and prescribers.

**III. Maintenance of Paper Prescription Records and Inventories --
§1304.04**

In the proposed rule, section 1304.04 would be revised to require that
pharmacy records, excluding executed order forms and inventories shall
be maintained at each registered location. The proposed rule would
further require that each registered pharmacy maintain the following:
(1) Inventories and records of all controlled substances listed in
Schedule II shall be maintained separately from all other records of the
pharmacy. (2) Paper prescriptions for Schedule II controlled substances
shall be maintained at the registered location in a separate
prescription file. (3) Inventories and records of Schedules III, IV, and
V controlled substances shall be maintained either separately from all
other records of the pharmacy or in such form that the information
required is readily retrievable from ordinary business records of the
pharmacy. (4) Paper prescriptions for Schedules III, IV, and V
controlled substances shall be maintained at the registered location
either in separate prescription files for Schedules III, IV, and V
controlled substances only or in such form that they are readily
retrievable from the other prescription records of the pharmacy. (5)
Records of electronic prescriptions for controlled substances shall be
maintained in a system that meets the requirements of Part 1311 of this
chapter. The computers on which the records are maintained may be
located at another location, but the records must be immediately
accessible at the registered location if requested by the Administration
or other law enforcement agent. The electronic system must be capable of
printing out or transferring the records in a format that is readily
understandable to an Administration or other law enforcement agent at
the registered location. Electronic copies of prescription records must
be sortable by prescriber name, patient name, drug dispensed, and date
filled.

***[Recommendation:]{.underline}*** CVS Caremark believes that
electronic images should satisfy the recordkeeping requirements in
proposed 1304.04.  Many states have adopted regulations that
specifically authorize pharmacies to store electronic images of paper
prescriptions, in lieu of hardcopies.[^7]  We request that the DEA
clarify the paper prescription requirement to specifically authorize the
maintenance of electronic images, in lieu of paper prescription files.

**V. Summary/Conclusion**

E-prescribing is the cornerstone of efforts by both the public and
private sector to improve patient safety and healthcare outcomes through
the use of health information technology. CVS Caremark commends the DEA
for publishing its proposed rule on e-prescribing of controlled
substances, but we strongly believe that if implemented as written, the
rule will create excessive and unnecessary burdens on pharmacies and
prescribers that will ultimately deter e-prescribing not only of
controlled substances, but of all medicines.

As detailed above, CVS Caremark is concerned that the proposed
requirements for record retention, audit and digital signature, and
pharmacy validation of prescriber DEA registration create new
liabilities and cost burdens for pharmacies where none now exist for
paper controlled substances scripts. The proposed requirements also
burden prescribers and system vendors with onerous in-person identity
proofing, audit and recordkeeping duties that act as barriers to
e-prescribing.

CVS Caremark appreciates the opportunity to comment on the DEA's
proposed rule and we stand ready to assist the Administration as the
rulemaking process moves forward. If you have questions regarding our
comments, feel free to contact me at (202) 772-3501.

Sincerely,

Russell C. Ring

Senior Vice President

Government Affairs

[^1]: At least 1.5 million Americans are injured annually from Adverse
    Drug Events, creating costs in excess of \$3.5 billion. Institute of
    Medicine, *Preventing Medication Errors*, 2006.

[^2]: A severe or moderate drug-to-drug alert was sent to physicians for
    more than 1 million prescriptions (33 percent), resulting in nearly
    423,000 (41 percent) of those prescriptions being changed or
    canceled by the prescribing doctor; \-- More than 100,000 medication
    allergy alerts were presented, of which more than 41,000 (41
    percent) were acted upon; \-- Nearly 56,000 lists of dispensed
    prescription histories were downloaded by physicians; and \-- When a
    formulary alert was presented, 39 percent of the time the physician
    changed the prescription to comply with formulary requirements.
    *Southeastern Michigan ePrescribing Initiative Report*, 2007.

[^3]: Medicare Improvements for Patients and Providers Act of 2008,
    §132.

[^4]: 2008 Physician Quality Reporting Initiative (PQRI) , Eligible
    Professional Quality Measures, p. 9.

[^5]: 21 USC §827(b)

[^6]: DEA Practitioner's Manual, 2006 Edition, p. 7.

[^7]: Arizona \[AAC R4-23-408 (H)(2)\] and Illinois \[ICS 225 ILCS
    85/18\] have some of the most robust verbiage.  Similar regulations
    exist in Florida \[FAC 64B16-28.140 (1)(d)\], Pennsylvania \[49 Pa
    Code 27.14 (c)(2)\], and Texas \[22 TAC 291.34 (b)(5)(D)\].