INITIAL ECONOMIC IMPACT ANALYSIS 

OF THE 

PROPOSED ELECTRONIC PRESCRIPTION RULE 

Drug Enforcement Administration 

U.S. Department of Justice 

April 2008 

April 2008 
April 2008 
TABLE OF CONTENTS

EXECUTIVE SUMMARY ....................................................................................................... i 

CHAPTER 1: INTRODUCTION............................................................................................. 1 

1.1 BACKGROUND ...................................................................................................... 1 

1.2 ELECTRONIC PRESCRIPTIONS .......................................................................... 2 

1.3 Options Considered................................................................................................... 4 

1.4 ORGANIZATION OF THIS REPORT.................................................................... 7 

CHAPTER 2: AFFECTED UNIVERSE .................................................................................. 9 

2.1 REGISTRANTS ....................................................................................................... 9 

2.2 SYSTEM PROVIDERS.......................................................................................... 11 

CHAPTER 3: UNIT COSTS .................................................................................................. 15 

3.1 REQUIREMENTS.................................................................................................. 15 

3.2 COSTS .................................................................................................................... 16 

3.2.1 Identity Proofing ............................................................................................. 16 

3.2.2 Two-factor Authentication.............................................................................. 17 

3.2.3 Digital Certificates.......................................................................................... 18 

3.2.4 Monthly Review Of Controlled Substance Prescription Logs........................ 18 

3.2.5 Programming Costs......................................................................................... 18 

3.2.6 Auditing Requirements ................................................................................... 21 

3.2.8 Option 3 requirements..................................................................................... 22 

CHAPTER 4: TOTAL COSTS............................................................................................... 25 

4.1 NUMBERS OF PRACTITIONERS, OFFICES, AND SERVICE PROVIDERS 25 

4.2 START-UP COSTS AND ON-GOING COSTS.................................................... 30 

4.3 TOTAL COSTS...................................................................................................... 31 

CHAPTER 5: SMALL ENTITY ANALYSIS ....................................................................... 37 

5.1 CHARACTERISTICS OF SMALL ENTITIES..................................................... 37 

5.2 SMALL ENTITY COSTS ...................................................................................... 38 

5.3 ALTERNATIVES CONSIDERED ........................................................................ 40 

5.4 OTHER ISSUES..................................................................................................... 41 

CHAPTER 6: BENEFITS...................................................................................................... 45 

6.1 INTRODUCTION .................................................................................................. 45 

6.2 QUANTIFIED BENEFITS..................................................................................... 45 

6.3 QUALIT ATIVE BENEFITS.................................................................................. 49 

6.3.1 Reduction in Controlled Substance Prescription Forgery............................... 49 

6.3.2 Cost of Diversion and Abuse of Prescription Drugs............................................. 50 

6.4 CONCLUSI ON....................................................................................................... 52 

CHAPTER 7: CONCLUSIONS ............................................................................................ 53 

7.1 UNCERTAI NTIES................................................................................................. 53 

7.1.1 Rates of Adoption ........................................................................................... 53 

7.1.2 Costs to Service Providers .............................................................................. 53 

7.2 COSTS AND BENEFITS....................................................................................... 54 

7.3 SMALL ENTITY IMPACTS ................................................................................. 55 

APPENDIX A: WAGES, FRINGE BENEFITS, AND WEIGHTED AVERAGES ............. 58 

APPENDIX B: BIBLIOGRAPHY ........................................................................................ 61 

April 2008 
April 2008 
LIST OF TABLES 

Table ES-1: Total Costs ($) 

Table 2-1: Practitioner Universe 

Table 3-1: Summary of Identity Proofing Cost—Base Case 

Table 3-2: Summary of Identity Proofing Cost—Options 1 and 2 

Table 3-3: System Requirements 

Table 3-4: Summary of Costs, Other Than Identity Proofing—Base Case, Options 1 and 2 

Table 3-5: Option-3 Unit Cost 

Table 4-1: Implementation Schedule 

Table 4-2: Annual Increments in Affected Practitioners 

Table 4-3: Practitioners’ Offices Implementing Electronic Prescribing of Controlled 

Substances 

Table 4-4: Initial Visits Only for Proofing (Base Case) 

Table 4-5: Projected Reduction in Providers to Practitioners

Table 4-6: Start-up and Ongoing Costs 

Table 4-7: Total Costs ($) 

Table 4-8: Annualized Costs by Cost Item 

Table 4-9: Annualized Costs by Cost Item 

Table 4-10: Base Option - Yearly, 15-Year, and Annualized Costs 

Table 4-11: Option 1 - Yearly, 15-Year, and Annualized Costs 

Table 4-12: Option 2 - Yearly, 15-Year, and Annualized Costs 

Table 4-13: Option 3 - Yearly, 15-Year, and Annualized Costs 

Table 5-1: SBA Definitions of Small Entities 

Table 5-2: Incremental Cost of EMR Systems to Practitioners 

Table 6-1: Cost Savings of Callbacks Avoided 

Table 6-2: PV and Annualized Cost Savings for Callbacks 

Table 6-3: Costs Savings for Public Wait Time 

Table 6-4: Annualized Benefits 

April 2008 
April 2008 
EXECUTIVE SUMMARY 

Under the Controlled Substances Act (CSA), DEA is required to maintain a closed system of 

controls on controlled substances. For Schedule II controlled substances, which have the 

highest potential for abuse and dependence of those drugs with an accepted medical use in 

treatment in the United States, the CSA mandates that, with very limited exceptions, a 

pharmacist may only dispense a Schedule II controlled substance if there is an original 

written prescription from a practitioner. For Schedule III through IV controlled substances, 

the pharmacist may dispense if there is a written (original or fax) or oral prescription from a 

practitioner. DEA is proposing to give practitioners the option of signing and transmitting 

controlled substance prescriptions electronically; pharmacies would maintain records of these 

prescriptions electronically. The proposed rules for electronic prescriptions for controlled 

substances are an addition to, not a replacement of, the existing rules for controlled substance 

prescriptions. Practitioners will continue to be able to issue controlled substance 

prescriptions on paper or, for Schedule III-V substances, fax or call in prescriptions. 

DEA is proposing to allow, but not require, electronic prescriptions for controlled substances 

if the systems used to create, transmit, and process controlled substance prescriptions meet 

certain requirements that DEA has identified as being necessary to prevent the misuse of the 

systems for diversion and to ensure that the records will be usable in legal actions if needed. 

DEA examined four options. Under the Base Case, service providers would conduct inperson identity proofing and verify the DEA registration and State licenses of each 

practitioner allowed to sign an electronic controlled substance prescription. Before signing 

such a prescription, the practitioner would authenticate to the system using two-factor 

authentication that meets the standards of NIST Special Publication 800-63 Level 4. The 

systems would also have to meet requirements for the information contained in a controlled 

substance prescription. The electronic controlled substance prescription would have to be 

digitally signed by the service provider or first intermediary and archived. Practitioners 

would have to review a monthly log of controlled substance prescriptions issued under the 

practitioner’s name. Pharmacies would also have to digitally sign the controlled substance 

prescription on receipt and archive that record. Pharmacy systems would have to maintain an 

internal audit trail. All service providers would have to obtain a third-party audit annually 

that meets the requirements of a SysTrust, WebTrust, or SAS 70 audit for physical security 

and processing integrity. 

Option 1 differs from the Base Case only in that a DEA-registered hospital, a state licensing 

board, or a law enforcement agency would conduct the initial in-person identity proofing. 

The service provider would verify the DEA registration and State license and contact the 

applicant to verify that the practitioner had submitted the application. Option 2 is a modified 

public key infrastructure approach. The practitioner would obtain a digital certificate from a 

recognized Certification Authority and use that to digitally sign the controlled substances 

prescriptions. The monthly log check would be eliminated, and the audit would address only 

processing integrity. Option 3 would impose no requirements on the service providers. 

April 2008 i 
Pharmacies would be required to phone the practitioner to verify each controlled substance 

prescription received. 

COSTS 

DEA estimates that the costs of the options range from $19 million for Option 2 to $1.3 

billion for Option 3, both annualized over 15 years at 7 percent discount rate. The Base Case 

is estimated to cost $33 million annualized and Option 1 $38 million. Table ES-1 presents 

the estimated annualized costs of all options. 

Table ES-1: Total Costs ($)

7.0 percent 3.0 percent 

Base Case $32,561,000 $33,392,000 

Option 1 $38,256,000 $39,221,000 

Option 2 $18,595,000 $18,928,000 

Option 3 $1,280,000,000 $1,404,000,000 

Most of the direct practitioner cost in the Base Case and Option 1 is driven by the 

requirement to check a computer-generated log of controlled substance prescriptions once a 

month. The service provider costs over time are primarily the costs of the annual audit, 

which accounts for all but about $1.2 million a year of the annualized service provider costs 

in the first three options. 

BENEFITS 

The benefits of the rule that can be quantified – reductions in callbacks ($316 million) and 

reduced public wait time (up to $589 million) (at 7 percent) – far exceed the cost of the three 

of the four options considered. DEA has not attempted to quantify any reduction in medical 

errors. DEA expects that there will be reduced medication errors linked to more readable 

prescriptions, but decided that it did not have a reasonable basis for quantifying the benefits. 

Another benefit of electronic prescriptions for controlled substances that is ascribable to the 

proposed rule, but not easily quantified and monetized, would come from reductions in 

controlled substance prescription forgery and alteration. 

SMALL ENTITY IMPACTS 

The proposed rule will have an impact on a substantial number of small entities. The 

economic impact on those directly regulated by this rule would not be significant under the 

first three options. DEA estimates that the direct first-year costs to practitioners for in-person 

identity proofing, training, and log review will range from about $150 to $350, which 

represents less than 0.2 percent of the net income of the lowest paid physician. DEA cannot 

accurately estimate the incremental cost to the systems that will be passed on to practitioners 

and pharmacies because that cost will depend on how many customers each service provider 

has and how they finance their costs, but these costs are unlikely to be higher than the firstyear costs and should decline over time as the industry consolidates and costs can be 

April 2008 ii 
recovered from a larger practitioner base. For pharmacies, the incremental cost that their 

service providers may pass on would be less than $100 in the first year and about $35 a year 

in the out years, which represents about 0.003 percent of the average independent 

pharmacy’s annual sales. DEA, therefore, has determined that the proposed rule would not 

impose a significant economic impact on small entities directly regulated by DEA. 

Service providers are not directly regulated by DEA. The proposed rule indirectly affects 

them because DEA would require that its registrants use only systems and service providers 

that meet its requirements. DEA recognizes that the requirements may impose a significant 

impact on service providers, many of which are small entities, but the costs are not so great 

that a service provider would not be able to recover them from customers or that the 

incremental price increase would discourage customers from purchasing a system. DEA 

expects that some service providers may drop out of the market if they cannot meet the 

security standards that an auditor would demand, but given other government requirements 

for security under the Health Insurance Portability and Accountability Act and the public’s 

expectations for secure medical records, DEA believes that these service providers would not 

be able to meet the other standards and public expectations. The market for healthcare 

information technology (IT) is evolving rapidly. DEA anticipates that most of the current 

service providers will not be in this market by the time most practitioners have adopted 

electronic medical record (EMR) systems. As the history of other IT applications has shown, 

over time, for reasons unrelated to DEA, a few systems will dominate the market; for the 

remaining service providers, DEA’s requirements will not be a burden. 

April 2008 iii 
April 2008 iv 
CHAPTER 1: INTRODUCTION 

1.1 BACKGROUND 

Under the Controlled Substances Act (CSA)1

, DEA is required to maintain a closed system 

of distribution for controlled substances. DEA publishes the implementing regulations in 

Title 21 of the Code of Federal Regulations.2

 These regulations are designed to ensure an 

adequate supply of controlled substances for legitimate medical and other purposes, and to 

deter the diversion of controlled substances to illegal purposes. 

Controlled substances include narcotics, stimulants, depressants, hallucinogens, and anabolic 

steroids that have a potential for abuse and psychological and physical dependence. DEA 

divides controlled substances into Schedules I through V. Schedule I substances have a high 

potential for abuse and no accepted medical use in treatment in the United States and, 

therefore, may not be dispensed. Schedule II through V substances have accepted medical 

uses and also have potential for abuse and dependence. They may be dispensed; except for 

Schedule V substances, controlled substances cannot generally be dispensed except in 

response to a prescription. 

For Schedule II controlled substances, which have the highest potential for abuse and 

dependence of the medications with accepted medical uses in treatment in the United States, 

the CSA mandates that, except in emergency circumstances, a pharmacist may only dispense 

a Schedule II controlled substance if there is a written prescription from a practitioner. For 

patients in long term care facilities or hospices, prescriptions for Schedule II substances may 

be written and manually signed and faxed with the fax serving as the original prescription. 

Most Schedule II prescriptions, however, are written with the original prescription presented 

to the pharmacy before dispensing. Schedule II prescriptions may not be refilled; a new 

prescription must be issued. For Schedule III and IV controlled substances, the pharmacist 

may dispense if there is a written or oral prescription from a practitioner; faxed prescriptions 

may serve as the original prescription, but must be written and signed prior to being faxed. 

Regulations implementing the prescription requirements are found in 21 CFR part 1306. 

Under the regulations, a prescription for a controlled substance may be issued only by an 

individual practitioner who is authorized to prescribe by the State in which he or she is 

licensed to practice and is registered with DEA, or exempted from registration. To be valid, 

the prescription must be written for a legitimate medical purpose by an individual 

practitioner acting in the usual course of professional practice. Every controlled substance 

prescription must contain the name and address of the patient, the drug name, strength, 

dosage form and quantity, directions for use, and the name, address, and DEA registration 

number of the practitioner. Every prescription that is written must be dated as of, and signed 

on, the day it is issued. 

 

1

 21 U.S.C. 801 et seq. 2

 21 CFR parts 1300-1399. 

April 2008 1 
A prescription may be filled only by a pharmacist acting in the usual course of professional 

practice who is employed in a registered pharmacy. The prescribing practitioner is 

responsible in case the prescription does not conform in all essential respects to the law and 

regulations. A corresponding liability rests upon the pharmacist who fills a prescription not 

prepared in the form prescribed by DEA regulations. 

With respect to records, the pharmacy must maintain a paper file of all prescriptions, 

consisting of the original prescriptions, or, where allowed, the facsimiles of the original 

written prescriptions, or written documentation of oral prescriptions. The pharmacy must 

also maintain records of when the prescription was filled and by whom, for both original 

prescriptions and any partial fillings or refillings. Practitioners are not required to maintain 

copies of prescriptions written or other records of prescriptions (unless issued for 

maintenance or detoxification treatment). Consequently, although practitioners create the 

record, pharmacies maintain it. This division between the person who creates the record and 

the person who retains it makes the integrity of the record particularly important. 

Diversion of controlled substances may occur in a number of ways. With prescriptions, 

diversion may take place if a practitioner knowingly or otherwise writes a prescription for a 

person who does not have a legitimate need for it. Prescriptions may also be altered (e.g., 

changing a “10” to “40” or “100”) or forged. Prescription pads may be stolen to create 

forgeries or prescriptions may be used to create fake prescription forms. Pharmacy records 

can be altered to hide illegal dispensing or theft by pharmacy employees. Practitioners and 

pharmacists may illegally dispense substances. 

DEA’s recordkeeping requirements and its concern about its ability to determine the integrity 

of the prescription record are directed toward preventing diversion and having a legally 

defensible record to prove that diversion has occurred. With paper prescriptions, the signed 

prescription provides a provable link to the prescribing practitioner. Forgeries can usually be 

detected by handwriting experts. As a result, a practitioner whose prescriptions are altered or 

forged can prove that he or she did not issue the suspect prescriptions, but a practitioner who 

issues invalid prescriptions cannot deny them and can be subject to administrative, civil, and 

criminal penalties. Similarly, paper records held at pharmacies can be compared with 

pharmacy inventories to determine if all drugs dispensed were dispensed legally. 

1.2 ELECTRONIC PRESCRIPTIONS 

Industry has asked DEA to develop regulations that will allow the creation and transmission 

of electronic prescriptions for controlled substances. Many parties in the healthcare industry 

are encouraging the adoption of electronic prescriptions because such prescriptions have the 

potential to improve patient safety by reducing medical errors that arise from misread or 

misunderstood prescriptions. From DEA’s perspective, electronic prescriptions have distinct 

advantages, if created in a way that reduces the possibility of forgery or alteration. The 

reality of the speed of electronic communications, however, is that electronic prescriptions 

could also open a new avenue for rapid diversion, which could leave no trail that DEA could 

use to act against those diverting controlled substances. A recent study conducted for the 

Department of Health and Human Services (HHS) by the American Health Information 

April 2008 2 
Management Association, “Report on the Use of Health Information Technology to Enhance 

and Expand Health Care Anti-Fraud Activities,” noted that “e-prescribing presents a new 

vulnerability because of the increased velocity of authenticated automated transactions.”3

 

Electronic records are easy to create and relatively easy to alter without the alteration being 

detectable. Without proper protections, a criminal could open an account, use a practitioner’s 

DEA number to generate a fake prescription, send it to multiple pharmacies over a wide area, 

have confederates pick up the drugs, and close the account within a few hours. Because 

DEA registration numbers are publicly available, criminals could do this repeatedly without 

using any one DEA registration number more than once, making it unlikely that pharmacists 

would notice a pattern. Without proper controls, electronic prescriptions could create the 

potential for organized, widespread, and undetected diversion of controlled substances. 

To the extent that electronic prescriptions for noncontrolled substances are being issued at 

present, they are signed electronically, with personal identification numbers (PINs) or using 

some combination of passwords and user IDs and transmitted over closed networks or the 

Internet through three to five intermediaries who may open the prescription files to reformat 

them and add information, such as routing and payer data. Reformatting is often required if 

the pharmacy system is not compatible with the practitioner’s prescribing system. The 

service providers authorize the practitioners to use the system. Some systems allow 

practitioners to enroll online, without any assurance that the person is who he or she claims 

to be. Some systems authorize anyone in the practice to use the system so that the system 

cannot link a specific practitioner to a prescription. At the pharmacy, the prescription 

translates directly into the pharmacy computer system, and the records are maintained 

electronically. 

This existing electronic prescription system is not sufficient to protect the transactions as the 

CSA requires. From DEA’s perspective, the existing system has several fundamental flaws. 

 The system relies on service providers to authenticate practitioners and control the 

integrity of the transaction without ensuring that the service providers check the 

identity of the practitioner, limit access for prescription signing, or use 

authentication protocols that allow only authorized practitioners to sign a 

prescription. In addition, the service providers are not subject to security 

requirements for their own systems. DEA would have to prove that the third party 

was not at fault before it could successfully take action against a registrant who 

had been a party to diversion. For example, if a practitioner denied issuing 

prescriptions and claimed they had been forged, DEA would have to prove that 

the third party had not issued authorization to someone else to use the 

practitioner’s name and DEA registration number and that none of the third 

party’s employees or outside hackers had used the system to generate false 

prescriptions in the practitioner’s name. 

 

3

 Foundation of Research and Education, American Health Information Management Association. “Report on 

the Use of Health Information Technology to Enhance and Expand Health Care Anti-Fraud Activities,” 

prepared for the Office of the National Coordinator, US Department of Health and Human Services, September 

30, 2005. 

April 2008 3 
 The system does not provide for record integrity. Even a closed transmission 

network does not protect against insider actions. Many computer crimes, such as 

identity thefts, are committed by insiders who have the knowledge to overcome 

internal protections. Because the third parties routinely open prescriptions, the 

opportunity for insider alterations will be substantial. The systems may also not 

protect against determined outside hackers. 

 The system provides limited protection of the record’s integrity once it reaches the 

pharmacy. 

Overall, the existing electronic prescribing systems provide no assurance of security against 

identity theft, insider attacks, or outsider attacks. Although some existing systems might 

have voluntarily implemented effective security measures, they are not legally obligated to 

do so and – in the absence of binding regulatory requirements – there is no way to ensure that 

they or others who might enter the market will have effective measures in the future. With 

prescriptions moving through multiple parties from creation to dispensing, a security failure 

at any link in the chain could undermine the entire system, often leaving no evidence of the 

problem. 

1.3 OPTIONS CONSIDERED 

DEA has analyzed four options to consider the impact of varying requirements to address its 

concerns and provide adequate security. Under the Base Case, the following would be 

required: 

 The electronic prescription service provider would conduct in-person identity 

proofing. At the service provider’s office, a clerk would check the registrant’s 

State license and DEA registration to ensure that they are active and in good 

standing and enter an electronic record of the check, and then file the original 

hard copy of the proofing document. The service provider would keep a record of 

the identification checked, the person who checked it, and the date on which it 

was checked. 

 Authentication: Access to the electronic prescribing system for the purposes of 

signing prescriptions for controlled substances would meet the standards for Level 

4 authentication in NIST SP 800-63. That is, the system would require at least 

two-factor authentication to access the system; one factor would be on a hard 

token that meets the requirements for Level 4 authentication in NIST SP 800-63. 

 The security of the system would be audited annually using an independent thirdparty audit that meets the requirements of a SysTrust or WebTrust audit for 

security and processing integrity. 

 The system would limit signing authority to those practitioners that have a legal 

right to sign prescriptions for controlled substances (i.e., the system would set 

varying levels of access to the system based on responsibilities). 

 The system would have an automatic lock out if the system is unused for more 

than 2 minutes. 

April 2008 4 
 The prescription would contain all of the required data (date of issuance; patient 

name and address; registrant full name, address, DEA registration number; drug 

name, dosage form, quantity prescribed, and directions for use; and any other 

information specific to certain controlled substances prescriptions mandated by 

law or DEA regulations). Prior to signing the controlled substance prescription, 

The system would show the prescribing practitioner at least the patient name and 

address, drug name, dosage unit and strength, quantity, directions for use, and the 

DEA registration number of the prescriber whose identity is being used to sign the 

prescription. 

 Where more than one prescription has been prepared for signing, prior to 

authenticating to the system the practitioner would positively indicate which 

prescription(s) are to be signed. 

 The practitioner would authenticate himself to the system immediately before 

signing a prescription. 

 After authenticating to the system but prior to transmitting the prescription, the 

system would present the practitioner with a statement indicating that the 

practitioner understands that he is signing the prescription being transmitted. If 

the practitioner does not so indicate, by performing the signature function, the 

prescription could not be transmitted. 

 The system would transmit the electronic prescription immediately upon 

signature. The system would not transmit a controlled substance prescription 

unless it is signed by a practitioner authorized to sign such prescriptions. 

 The electronic data file would include an indication that the prescription was 

signed. 

 The system would not allow printing of prescriptions that have been transmitted; 

if a prescription is printed, it would not be transmitted. 

 The system would generate a monthly log of controlled substance prescriptions 

and transmit it to the practitioner for his review. The practitioner would indicate 

that the log was reviewed. 

 The first recipient of the prescription would digitally sign the prescription and 

archive the digitally signed prescription as received. 

 The first pharmacy system that receives the prescription would digitally sign and 

archive a copy of the prescription as received. Alternatively, the intermediary that 

transmits the prescription to the pharmacy could digitally sign the transmitted 

prescription and transmit both the record and the digitally signed copy for the 

pharmacy to archive. 

 The pharmacy system would check to determine whether the DEA registration of 

the prescribing practitioner is valid. (Alternatively, any of the intermediary 

systems could conduct this check provided that the record indicates that the check 

has been conducted. The CSA registration database could be cached for one week 

from the date of issuance by DEA of the most current database.) 

April 2008 5 
 The pharmacy system would be able to store the complete DEA number including 

extensions. 

 The pharmacy system would have an audit trail that identifies each person who 

annotates or alters the record. The pharmacy system would conduct daily internal 

audits to identify any auditable events. 

 The system would have a backup system of records stored at a separate location. 

 The pharmacy system would have an independent third-party audit that meets the 

requirements of SysTrust or SAS 70 audits for security and processing integrity. 

 A prescription created electronically for a controlled substance would remain in 

its electronic form throughout the transmission process to the pharmacy; 

electronic prescriptions may not be converted to other transmission methods, e.g., 

facsimile, at any time during transmission. 

Many existing electronic prescription and pharmacy systems already meet some or all of 

these requirements. 

In Option 1, the mechanism for in-person identity proofing is changed along with some of the 

ancillary procedures. The identity proofing would not be conducted by the service provider 

but by a DEA-registered hospital, State licensing board, or State or local law enforcement 

agency. The analysis assumes that in the great preponderance of cases, the identity proofing 

would be conducted by the hospital. Identity proofing of a registrant would be recorded in a 

hard document with signatures of the registrant and the agent who conducted the in-person 

identity proofing. The original document would be mailed from a practitioner’s office to the 

service provider. At the service provider’s office, a clerk would check the registrant’s State 

license and DEA registration to ensure that they are active and in good standing, and enter an 

electronic record of the check, as in the Base Case, and then file the original hard copy of the 

identity proofing document. The service provider would phone the applicant to verify the 

submission of the application. 

There is no change in the two-factor authentication or other requirements from the Base 

Case. 

In Option 2, the authentication protocol is changed to require the registrant’s digital 

signature, which is created by use of a digital certificate issued by a federally recognized 

Certification Authority. The original document recording in-person identity proofing would 

be stored at the Certification Authority’s office rather than at the service provider’s office; 

checking of the State license and DEA registration would be done at the service provider’s 

office. The service provider would archive the digitally signed prescription, but would not be 

required to digitally sign the prescription on receipt. The digital signature would not be 

transmitted to the pharmacy. Because security now depends on the digital signature and 

digital certificate, and not on the service provider’s system, systems would not have to be 

audited for security—only process integrity, a less intensive and less costly audit. The 

monthly log check would also be eliminated. The other requirements are the same as the 

Base Case. 

April 2008 6 
Option 3 imposes no requirements for identity proofing, authentication, or system attributes. 

Instead, sole reliance for security is placed on a requirement for a callback from the 

pharmacy to the practitioner office for every electronic prescription for a controlled 

substance. 

1.4 ORGANIZATION OF THIS REPORT 

The remainder of this report is organized as follows: 

Chapter 2 estimates the universe of entities potentially affected by the rule. 

Chapter 3 presents the unit costs of each of the options considered. 

Chapter 4 presents the total costs of each of the options considered. 

Chapter 5 presents the small entity analysis. 

Chapter 6 discusses the benefits of the proposed rule. 

Chapter 7 presents conclusions and discusses uncertainties associated with the analysis. 

April 2008 7 
April 2008 8 
CHAPTER 2: AFFECTED UNIVERSE 

The proposed rule potentially affects any person authorized under State law to prescribe 

controlled substances and registered with DEA as an individual practitioner or exempt from 

the requirement of registration. It also directly affects registered pharmacies that process 

controlled substance prescriptions. This chapter discusses estimates of the number of entities 

that would incur costs for compliance if they elect to issue or receive electronic prescriptions 

for controlled substances. The rule would not require any registrant to issue or accept 

electronic prescriptions for controlled substances; paper and, where permitted, oral 

prescriptions are still allowed. 

2.1 REGISTRANTS 

As of December 2007, DEA had 1.18 million registered individual practitioners. Not all of 

these, however, are likely to prescribe controlled substances or do so often enough to justify 

any investment in an electronic prescription system. For example, veterinarians, 

optometrists, animal shelters, ambulance services, etc. rarely if ever prescribe controlled 

substances. Nurse practitioners and physicians assistants who work in hospitals or 

institutional settings may not prescribe controlled substances often. Similarly, many 

physician specialties either do not prescribe any controlled substances (anesthesiologists, 

radiologists, pathologists) or do not often prescribe controlled substances as part of their 

usual practices (dermatologists, obstetricians/gynecologists, ophthalmologists). In addition, 

many practitioners hold multiple DEA registrations because they practice in more than one 

State or dispense or administer controlled substances at multiple locations in a single State. 

Finally, some practitioners retain their registrations when they retire. 

To estimate the number of practitioners who may use electronic prescribing for controlled 

substances, DEA used its registration data plus a Centers for Disease Control and Prevention 

(CDC) study of office-based physicians.4 The CDC study used data from the American 

Medical Association (AMA) and the American Osteopathic Association (AOA), which 

indicated that there were 489,829 physicians engaged in non-federal office-based care.5

 The 

study found that a third of those were out-of-scope because they were hospital-based, 

federally employed, anesthesiologists, radiologists, pathologists (11.3 percent), retired or 

deceased (9.5 percent), non-office-based (4.7 percent), not practicing (4.4 percent) and 

otherwise ineligible (3.9 percent). The study estimated that there were 311,200 office-based 

physicians in 2004. DEA used this estimate as its baseline for physicians although the 

estimate includes a number of specialties that may rarely prescribe controlled substances. 

Adjusting the number for growth to 2007, DEA estimates that 312,135 physicians may now 

be writing controlled substances prescriptions. 

 

4

 Hing, E., Burt, CW. “Characteristics of Office-Based Physicians and their Practices: United States, 2003-

2004,” Series 13, Number 164. Hyattsville, MD: National Center for Health Statistics. January 2007. 5

 Practitioners were limited to office-based because hospital-based practitioners do not usually write 

prescriptions and neither hospital-based nor federally employed practitioners would be purchasing electronic 

prescription systems. 

April 2008 9 
The other three practitioner groups that are likely to prescribe controlled substances are 

dentists, nurse practitioners, and physicians assistants. Because DEA had no basis for 

estimating the number of dentists that may hold multiple registrations or have retired, DEA 

used the number of currently registered dentists (170,969), recognizing that the estimate is 

probably slightly high. For nurse practitioners and physicians assistants, DEA used its 

current registrant population (119,659) reduced by 25 percent to 89,744. DEA reduced the 

number because many of these mid-level practitioners work in hospitals, where they are 

unlikely to write prescriptions. For physicians assistants, only 63 percent work in officebased practices according to data from the Bureau of Labor Statistics;6

 DEA has no estimates 

of where nurse practitioners work because they are aggregated with all nurses in BLS data. 

Table 2-1 presents the estimate of total practitioners who could engage in electronic 

prescribing for controlled substances and the growth rate applied for estimating the number 

in each of the out-years. 

Table 2-1: Practitioner Universe

Current number Future annual 

growth rate 

Physicians 312,135 0.1 percent 

Dentists 170,969 0.9 percent 

Mid-level practitioners 89,744 2.2 percent 

Total 572,848 0.7 percent 

Estimated growth rates are based on recent trends. Regarding physicians, the trend since 

2000 indicates a very slight negative growth rate. DEA does not believe this downward trend 

will continue; therefore, an annual growth rate for physicians of 0.1 percent has been 

estimated. The growth rate for dentists is based on the annual growth rate of DEA 

registrations for dentists from 2003 to 2007. The growth rate for mid-level practitioners is 

based on CDC data for increases in physicians assistants employment from 1999 to 2004. 

Nurse practitioners are a subset of nurses; employment of nurses grew 1.2 percent annually 

over that period.7 Using the 2.2 percent growth rate is, therefore, slightly conservative. The 

rate for the total number of practitioners is the weighted average of the separate rates. 

Part of the cost of initial in-person identity proofing depends on the number of practitioners’ 

offices. The 2002 Economic Census reports 321,423 offices of physicians and dentists 

(203,118 physicians’ offices and 118,302 dentists’ offices.)8

 Consonant with DEA’s 

estimate of the number of physicians likely to write controlled substances prescriptions, the 

number of physicians’ offices is reduced by 25.0 percent and added to the dentists’ offices to 

obtain 270,664 offices in 2002 where practitioners were likely to write controlled substances 

prescriptions. Using the 1997 and 2002 Economic Census,9

 DEA obtained the weighted 

 

6

 http://www.bls.gov/oes/current/oes291071.htm. 

7

 CDC, Health, United States, 2006, Table 108. 

8 http://www.census.gov/prod/ec02/ec0262ssszt.pdf

9 http://www.census.gov/prod/ec97/97s62-sz.pdf

April 2008 10 
annual growth rate for these offices from 1997 to 2002—0.77 percent. DEA used that rate to 

estimate the number of practitioners’ offices for this analysis in 2007—280,929 and to 

project the future growth of these offices. 

According to the National Association of Chain Drug Stores, there are about 57,000 retail 

pharmacies in the United States.10 Of these, about 40,000 stores are owned by chains. Since 

there are about 200 pharmacy chains in the United States, there are about 17,200 retailpharmacy firms. 

2.2 SYSTEM PROVIDERS 

There is more than one kind of system provider, and confusion can arise if clear distinctions 

are not made among them. It is necessary to establish a clear terminology before addressing 

the universe of system providers. 

A system provider is any firm that provides practitioners’ offices or pharmacies with the 

services and software required for transmitting or processing electronic prescriptions. 

System providers can be described in several ways. Providers may install systems on 

practice computers and servers, or they may install software needed to link the practice to the 

service provider’s systems. The latter are called application service providers (ASPs). An 

ASP system is usually less expensive initially because the practice does not need to purchase 

servers to store records and because trouble-shooting occurs at the ASP level rather than at 

the practice. Reprogramming can be done without needing to install patches or new software 

at the practice. ASPs also have the advantage that they can be accessed from any location 

through the Internet. Installed systems are more costly at least in the early years because 

they require more hardware and more on-site support. ASPs, however, may carry higher 

annual maintenance fees. 

Systems may be further divided into two groups—those that provide only electronic 

prescription services (stand-alone systems) and those that provide electronic prescriptions as 

part of an electronic medical record system (EMRs). These may be referred to as eprescription providers and EMR providers. The latter group is by far the larger; DEA 

expects the e-prescription providers to disappear over time because most practices 

transitioning to electronic records want a system that can integrate all of its records rather 

than just handle one function. Although most stand-alone e-prescription systems are ASPs, 

EMRs may be either ASPs or installed systems. 

Prescriptions at pharmacies are handled by a pharmacy management system. These systems 

may be ASPs or installed systems. The largest chains generally maintain a centralized 

system that links all of their stores, functioning in effect as an ASP for the chain. 

DEA estimated the number of electronic prescribing providers by combining the list of 

providers certified by SureScripts with the list of EMR system providers certified by the 

Certification Commission for Healthcare Information Technology (CCHIT) in December 

 

10 www.nacds.org/user-assets/pdfs/facts_resources/2006/Retail_Outlets2006.pdf 

April 2008 11 
2007.11, 12 The CCHIT list was used because any system certified under CCHIT must 

support electronic prescribing. Overall, 119 firms were listed. The number may be slightly 

high because some firms may be listed as both firms and software systems. Of the 119, 103 

are EMR systems; the remainder are electronic prescription systems. Of the EMR systems, 

86 are certified by CCHIT. SureScripts certifies 66 systems, including all of the stand-alone 

systems. The number of pharmacy system providers (20) is based on the number of these 

providers certified by SureScripts, which states that 95 percent of United States pharmacies 

are able to accept electronic prescriptions. The number may be slightly high because a few 

of the certified systems may be transmission networks rather than pharmacy management 

systems. Balancing that is the possibility that a few of the larger chain pharmacies may have 

their own systems, designed and maintained internally. 

Because the pharmacy systems are generally already in operation, DEA assumed that it is a 

mature market and the number of providing firms would remain at 20 throughout the 

implementation period. A similar assumption cannot be made about the systems serving 

practitioners. The market is evolving rapidly. When DEA began considering electronic 

prescriptions for controlled substances, the majority of the firms were marketing eprescription services. As the numbers above indicate, the great preponderance of firms is 

now selling EMR systems. It is reasonable to assume that most, and perhaps all, of the 

electronic prescription systems will be sold to an EMR firm, incorporate EMR capability, or 

simply fail. Similarly, it is likely that over the longer term, most of the EMR systems will 

not succeed in the competitive marketplace. These systems are not only internally 

complicated, requiring considerable investment in ongoing technical support from the 

provider, but they also must be able to interoperate with systems used by testing laboratories, 

hospitals, insurance companies, pharmacies, clinics, and other medical practices. In this 

situation, the tendency will be for a few systems to become dominant players and then 

replace the smaller systems because the dominant systems interoperate easily with other 

systems using the same basic platform. As a recent study of the evolution of word 

processing systems found, of more than 400 such systems being sold in the mid-1980s, only 

a very few remained 10 years later.13

Because the ongoing cost of the rule is driven in part by the cost to providers, DEA needed to 

estimate the number of firms serving practitioners that would exist over time. As discussed 

below under total costs, DEA projected that only 20 systems would remain in the market by 

the end of ten years. DEA also estimated that in the first year, only 110 firms would comply 

with the rule. This lower initial estimate (from the 119 firms certified) is based on the 

assumption that there are almost certainly too many firms competing for what is still a 

relatively small market; some will drop out rather than incur the effort and cost of becoming 

compliant with the rule. 

 

11 SureScripts is a pharmacy industry organization that certifies electronic prescription and pharmacy systems 

that comply with the National Council for Prescription Drug Program SCRIPT standard; SureScripts 

certification indicates that the service provider’s systems will interoperate with other systems using the SCRIPT 

standard. CCHIT establishes standards and certifies electronic medical record (EMR) systems. 12 http://www.cchit.org/choose/ambulatory/2007/index.asp, accessed 12/7/07 and www.surescripts.com/getconnected.aspx?ptype=physician, accessed 12/5/07. 

13 Bergin, T.J, “The Proliferation and Consolidation of Word Processing Software: 1985-1995.” 

IEEE Annals of the History of Computing. Volume 28, Issue 4, Oct.-Dec. 2006 Page(s):48 - 63 

April 2008 12 
A 2006 CDC study of EMR use found that only 12 percent of physicians reported having 

fully electronic EMR systems, which implies that the 103 EMR providers are vying for a 

market that has fewer than 40,000 practitioners.14 With the cost of building and maintaining 

a technically complex system, many existing firms are likely to run out of capital before they 

gain enough market share to be profitable, and the number of sellers in this market will 

continue to decline over time. 

 

14 Centers for Disease Control and Prevention, “Electronic Medical Record Use by Office-Based Physicians and 

Their Practices: United States 2006.” Advance Data from Vital and Health Statistics, Number 393, October 26, 

2007. 

April 2008 13 
April 2008 14 
CHAPTER 3: UNIT COSTS 

In estimating unit costs of the rule, the first step is to establish the baseline with which to 

determine the costs that are incremental with respect to the rule. DEA presumes that no 

practitioner’s office will adopt electronic prescribing simply to write controlled substance 

prescriptions; controlled substances now constitute about 11.0 percent of the total number of 

prescriptions written annually in the United States.15 The costs to a practitioner’s office of 

complying with the rule, therefore, are only the system costs directly required by the 

electronic prescriptions for controlled substances rule and do not include any of the costs that 

the office would incur for setting up electronic prescription capability without controlled 

substances. 

3.1 REQUIREMENTS 

DEA is considering four variants on a rule to allow electronic prescription of controlled 

substances—the Base Case, and Options 1, 2, and 3. The Base Case would impose the 

following requirements on an electronic prescription system: 

 In-person identity proofing imposes costs on practitioners and providers. 

 Two-factor authentication requires that each practitioner with authority to sign 

controlled substance prescriptions have a unique hard token to gain access to the 

system. This imposes costs on some practitioners. 

 Monthly review of controlled substance prescription logs by practitioners imposes 

a cost on practitioners. 

 System requirements impose reprogramming costs on service providers. 

 Requirements for annual independent third-party audits impose costs on service 

providers. 

Effects of options: 

• Under Options 1 and 2 in-person identity proofing also imposes costs on DEAregistered hospitals, State licensing boards, or law enforcement agencies; costs to 

practitioners rise because of the greater time required. 

• Option 2 does not require log reviews. 

• Option 2 requires that each registrant have a digital signature, generated by a digital 

certificate issued by a federally approved Certification Authority. This imposes costs 

on practitioners’ offices. 

• Option 2 imposes lower costs for independent third-party audits. 

 

15 The 11 percent is based on the percent of the top 200 brand name prescriptions filled (number of 

prescriptions, not value) and top 200 generic prescriptions that DEA identified as controlled substances. The 

analysis assumes that the remaining prescriptions (about one sixth of total prescriptions) will have the same 

proportion of controlled substance prescriptions as the top 400 do. 

April 2008 15 
• Option 3 has none of the above requirements. Instead, sole reliance for security is 

placed on a requirement for a callback from the pharmacy to the practitioner office 

for every electronic prescription for a controlled substance received. This imposes 

costs on pharmacies and practitioners’ offices. 

3.2 COSTS 

3.2.1 IDENTITY PROOFING

Base Case: 

Identity proofing under the Base Case requires a face-to-face meeting between each 

practitioner who will use the system and a representative from the service provider. The 

meeting would take two minutes of the practitioner’s time (to show the provider a 

government-issued photographic identification) and the service provider’s time to look at the 

identification and make a record of the type of identification seen. For each practitioner, an 

information clerk would spend another eight minutes at the service provider’s office 

verifying that the practitioner’s State license and DEA registration are active and in good 

standing, and entering the practitioner’s data into the service provider’s record of identity 

proofing. In many cases, the service provider would meet practitioners while on a visit to the 

practitioner’s office that would have been made for other purposes (e.g., installation, training, 

trouble-shooting). In some cases, however, the visit would be made for no other purpose 

than the identity proofing itself, particularly for some current electronic prescribing ASPs; in 

such a case, the service provider staff person’s travel time to and from the practitioner’s 

office would be a cost. DEA assumes an average round trip of two hours. Using a weighted 

average for practitioners’ wages (fully loaded) of $222.51, $83.80 for the service provider 

representative, and $33.89 for the service provider clerk, the cost of identity proofing is $7.42 

for practitioners, $2.79 for the service provider representative, and $4.52 for the service 

provider clerk. Thus, the cost of identity proofing without travel is $14.73. Two hours of 

travel adds $167.71, so the cost of identity proofing with travel is $182.34. 

Options 1 and 2: 

Identity proofing is conducted by a DEA-registered hospital, State licensing board, or State 

or local law enforcement agency—not by the service provider. DEA assumes that the great 

preponderance of the identity proofing would be done at hospitals. Since physicians 

routinely visit local hospitals, travel time to the hospital for a medical doctor is not included 

as a cost, but travel time for dentists and mid-level practitioners is regarded as incremental 

cost. Average round trip to a hospital is assumed as one hour. The identity proofing session 

at the hospital would require ten minutes of a practitioner’s time and ten minutes for an agent 

of the hospital. A hard document is generated and signed by both practitioner and hospital 

agent. The document is mailed from the practitioner’s office to the service provider’s office. 

For Option 2, the document would be mailed to the Certification Authority. Mailing requires 

two minutes of a secretary’s time plus postage. As in the Base Case, a clerk at the service 

provider’s office takes eight minutes to ensure that the practitioner’s State license and DEA 

registration are active and in good standing, and enter the data into the record. But, under 

April 2008 16 
Options 1 and 2, the service provider’s clerk also calls the practitioner’s office to verify the 

application. This requires three minutes for the service provider clerk and one minute for the 

practitioner. Finally, the service provider clerk takes another two minutes to file the 

document. 

For each identity proofing, then, 11 minutes are needed for the practitioner, ten minutes for 

the hospital agent, 13 minutes for the service provider clerk, and two minutes for the 

practitioner secretary. Full hourly cost for the hospital agent is $35.55, for the medical 

secretary, $30.33. Additional costs are $0.41 for postage and annual storage cost (in a 

standard filing cabinet) at the service provider’s office of $0.0116. 

Table 3-1: Summary of Identity Proofing Cost—Base Case 

Cost item Time Full hourly cost Unit cost 

Practitioner 2 minutes $222.51 $7.42 

Service provider representative 2 minutes $83.80 $2.79 

Service provider clerk 8 minutes $33.89 $4.52 

Travel for service provider representative 2 hours $83.80 $167.61 

Total without travel $14.73 

Total with travel $182.34 

Table 3-2: Summary of Identity Proofing Cost—Options 1 and 2 

Cost item Time Full hourly cost Unit cost 

MD 11 minutes $269.00 $49.32 

Dentist 11 minutes $214.07 $39.25 

Mid-level practitioner 11 minutes $76.94 $14.11 

Hospital staff 10 minutes $35.55 $5.93 

Service provider clerk 13 minutes $33.89 $5.65 

Practitioner secretary 2 minutes $30.33 $1.01 

Dentist travel 1 hour $214.07 $214.07 

Mid-level travel 1 hour $76.94 $76.94 

Postage $0.41 

Storage $0.01 

Totals 

MD (no travel) $63.84 

Dentist $267.83 

Mid-level practitioner $105.56 

In Option 2, the hard copy of the identity proofing document is stored at the office of the 

Certification Authority rather than the service provider’s office, but that does not change the 

cost. 

3.2.2 TWO-FACTOR AUTHENTICATION

This requirement is the same for the Base Case and for Options 1 and 2. Two-factor 

authentication requires that access to the system can be gained only using a combination of a 

 

16 The annualized cost of a standard file cabinet is $10.98 a year (at 7%); a file cabinet holds about 1,100 files. 

April 2008 17 
hard token, which holds the practitioner’s private cryptographic key or one-time-password 

and a password. A number of devices may serve this purpose: e.g., PDAs, Blackberries, 

thumb drives, smart cards, multi-factor one-time-password devices. It is assumed that 

physicians and dentists will already have a PDA and be familiar with its use. The same 

cannot be assumed for mid-level practitioners. DEA assumes that tokens would have to be 

purchased for 75.0 percent of mid-level practitioners and those mid-level practitioners would 

require training in the use of the tokens. For mid-level practitioners, the tokens would be 

thumb drives. Time required for training is estimated to be ten minutes per mid-level 

practitioner. Using the hourly wages (including fringes and overhead) for physician’s 

assistants of $76.94, the training cost is estimated to be $12.82. A thumb drive costs $12.00; 

total unit cost for mid-level practitioners only: $24.82. 

DEA has not considered the cost of using two-factor authentication prior to signing because 

the actual authentication is no different, from the practitioner’s point of view, from entering a 

password as persons that use electronic prescription systems already do. The protection in 

two-factor authentication is the storage of part of the authentication protocol on the hard 

token; the actual authentication does not add steps for the practitioner signing a prescription 

electronically although it may alter when the practitioner authenticates to the system. 

3.2.3 DIGITAL CERTIFICATES

An approved Certification Authority would charge each practitioner an annual fee of $30.00 

for issuing a digital certificate for a digital signature. The costs for digital certificates vary 

from less than $20 a year to $80 or more depending on the security features. 

3.2.4 MONTHLY REVIEW OF CONTROLLED SUBSTANCE PRESCRIPTION LOGS

This is the same for the Base Case and Option 1. There is no log review in Option 2. Once a 

month, each practitioner would review the log of his controlled substance prescriptions for 

that month. DEA is not proposing to require a comprehensive review or a cross-check with 

medical records. Rather DEA is proposing that the practitioner check the log for obvious 

anomalies – prescriptions for patients he did not see, prescriptions for substances he 

generally does not prescribe, prescriptions for quantities that seem abnormal. DEA estimates 

that a practitioner can review the log for obvious anomalies in an average of two minutes. 

Although some practitioners will need more time than that, there will be a significant number 

of practitioners who write few, or no, controlled substance prescriptions in any given month. 

The average cost is estimated to be $7.42 per month or $89.01 per year, using a weighted 

hourly wage for all practitioners. 

3.2.5 PROGRAMMING COSTS

As shown in Table 3-1, a number of the proposed requirements would necessitate 

reprogramming by some or all of the existing service providers. Any system currently able 

to transmit prescriptions electronically should be complying with the NCPDP SCRIPT 

standard, which includes fields for all of the basic prescription data elements that DEA 

requires. If any existing program is not transmitting those elements (e.g., practitioner or 

April 2008 18 
patient address), their programs should nonetheless already be capable of doing so with little 

effort because the fields already exist in the program. Some of the additional requirements, 

such as the pop-up screen prior to signing, should require relatively minor programming. 

Similarly, any ASP that does not have an automatic time-out function can add it relatively 

easily. Any system provider that conducts secure transactions over the Internet will already 

have a digital certificate and have done the programming needed to implement digital 

signing; they will need to program to sign these prescriptions, but the more complex 

programming for adding the digital signing functionality should already exist. The more 

complicated programming may be adding access limitations where they do not currently exist 

and adding two-factor authentication with a cryptographic key. Systems that do not support 

these functions may need more substantial reprogramming. 

Table 3-3 presents detail on the individual requirements that affect programming costs. The 

items in italics are those that will require few, if any, entities to incur such costs. 

Table 3-3: System Requirements 

Requirement Current practice 

Two-factor Level 4 

authentication 

EMRs certified by CCHIT must support 2-factor authentication.17 Most 

EMRs have this capability. E-prescribing systems may need to 

reprogram to require cryptographic keys. 

Limit access to 

signing function EMRs certified by CCHIT must do this. Many stand-alone systems also 

already do this. Some systems may need to add this functionality. 

Automatic lockout 

after a period of 

inactivity 

EMRs certified by CCHIT must do this. Most systems may have this 

function. For ASPs, the programming is relatively simple. 

Prescription must 

contain all DEA data 

elements 

All systems should already have this capability. All of the required 

elements are included in SCRIPT. If any system does not include all of 

these elements, it would have to reprogram. 

Present the required 

data elements to the 

practitioner 

Most systems present the full prescription information on a single 

screen. 

Indicate that each 

prescription is ready 

to be signed 

Some existing systems already do this, requiring practitioners to check 

off each prescription they want to sign. Others may need to reprogram 

to include this function. 

Authenticate to the 

system just before 

signing 

Unclear when current systems require authentication. At least one 

requires entry of separate password to sign. Most may need to 

reprogram to apply this function at signing. 

Transmit immediately 

upon signature 

May be common practice in existing systems because signing is the 

equivalent of transmitting. Some systems may need to reprogram to add 

this function. 

Do not transmit if 

printed; do not print if 

transmitted 

May be a new function for most systems. (This requirement does not 

prevent printing a copy of a medical record.) Systems may need to 

reprogram. 

 

17 CCHIT Security Criteria 2007 Final 16Mar07. 

April 2008 19 
Requirement Current practice 

Indicate that the 

prescription was 

signed 

A new field for e-prescriptions; industry has indicated that this is not a 

problem. SCRIPT will need to be revised to indicate which field will be 

used. SCRIPT has available fields that can be used. 

Generate monthly 

logs for practitioner 

review 

All systems should be able to generate records. 

First recipient digitally 

signs the prescription 

as transmitted 

At least one service provider is already doing so. Service providers all 

have digital certificates and the capability to sign records digitally. They 

will need to reprogram to include the function. 

Do not convert to fax if 

cannot be delivered May alter existing practice for some intermediaries. HHS has proposed 

removing an exemption from the SCRIPT standard for faxes. 

No alteration of the 

content during 

transmission except 

for formatting 

Industry says this does not happen so requirement should not impose a 

burden. 

First pharmacy (or last 

transmitter) digitally 

signs the prescription 

as received 

Intermediaries and at least some pharmacy system providers have digital 

certificates and the capability to sign records. Any system that conducts 

secure transactions on the Internet will have digital signature capability. 

They may all have to reprogram to add the signing function. 

Check the validity of 

the prescriber’s DEA 

registration 

(Pharmacy) 

Many pharmacies already check the DEA registration database for 

registration information. This will probably require some 

reprogramming to automate the check for each prescription. 

Store all of the DEA 

data in the pharmacy 

system 

Pharmacy systems already do this. Some may have problems with 

extensions to DEA registration numbers. 

Have an internal audit 

trail and analyze for 

auditable events 

(Pharmacy) 

Most systems have this capability. 

To estimate the cost of reprogramming, DEA divided the universe into systems that already 

implement many of the functions required and those that may not. EMRs are assumed to 

support most of the functions that may require more extensive programming. Stand-alone 

electronic prescription systems are assumed to need more programming to support two-factor 

Level 4 authentication and access limitations. For pharmacies, those systems that operate as 

ASPs are assumed to require lower levels of programming because they will already have 

digital signature functionality; the rest of the systems are assumed to need to add digital 

signature functionality. 

Based on industry information presented to DEA when the Agency developed the Controlled 

Substances Ordering System, DEA estimated that adding digital signature functionality or the 

authentication/access limits would require about 2,000 hours of programming time to install 

and test.18 For systems that only need to add new screens or less complex instructions, DEA 

 

18 70 FR 16911, April 1, 2005. Economic analysis is available at 

http://www.deadiversion.usdoj.gov/ecomm/csos/csos_eia_03112005.pdf. 

April 2008 20 
estimated that they would need 500 hours of programming and testing. DEA recognizes that 

these estimates are averages and that there will be considerable variability based on the 

functions that each system already has. Some systems may already meet almost all or all of 

the requirements. Others may require more extensive revision. DEA notes that given the 

complexity of even electronic prescribing systems, which are usually designed to link to drug 

and formulary databases as well as in-house record systems (schedules/calendars, patient 

databases, billing, etc.), the elements DEA is requiring are relatively simple and do not alter 

any basic functions of the system. For cost estimates, DEA assumes that systems with EMR 

capability and systems for providers to pharmacies will require 500 hours of reprogramming; 

systems for practitioners with capability only for electronic prescriptions will require 2,000 

hours. 

Given the hourly cost of a programmer of $73.24, 500 hours of reprogramming costs 

$36,619, and 2,000 hours costs $146,477. Both levels of reprogramming would be needed 

under the Base Case and Option 1, according to capabilities of providers’ existing systems. 

Under Option 2, however, only 500-hour reprogramming would be required. Because 

security would depend on the digital signature of a practitioner, complex authentication 

procedures would not be required for service providers’ systems. 

DEA also recognizes that the NCPDP SCRIPT standard itself will need revision to add an 

indication that the prescription has been signed. The standard is being revised on a 

continuing basis; HHS testing of elements of the standard indicated that three of the six 

elements tested were not ready for implementation. DEA, therefore, does not consider that 

the cost of what is a minor revision — designating one of the open fields to indicate that the 

prescription was signed — to impose any significant burden on the standard or on systems 

using the standard. SureScripts and other intermediaries may also have to reprogram their 

systems to ensure that no controlled substance prescription file is converted into a fax if the 

electronic transmission fails. These systems, however, are constantly adjusting to new 

service providers and existing service provider upgrades. This change should not impose a 

burden on them. DEA notes that transforming an electronic data file into a fax would create 

an illegal prescription because faxed prescriptions must be manually signed by the 

practitioner prior to transmission. 

3.2.6 AUDITING REQUIREMENTS

For the Base Case and Option 1, all system providers that serve practitioners would be 

required to undergo an annual third-party security audit for system security, processing 

integrity, and compliance with the rule. The audits would have to meet the standards of a 

SysTrust, WebTrust, or SAS 70 audit; these audit protocols are established and maintained 

by the American Institute of Certified Public Accountants and are widely recognized and 

used in the commercial sector for IT systems.19 The same level of audit would be required 

for providers that serve pharmacies under the Base Case and both Options 1 and 2. The level 

of audit for service providers to practitioners would drop under Option 2; reliance on the 

 

19 For a description of these audits, see 

http://www.ffiec.gov/ffiecinfobase/booklets/audit/audit_06_3_party.html. 

April 2008 21 
digital signature for security would lessen the need to audit for system security. Only audits 

for processing integrity would be required for practitioner service providers under Option 2. 

The first audit for a service provider is generally more costly than subsequent audits because 

the auditors need to familiarize themselves with the system and document its elements. 

Subsequent audits, if conducted by the same audit firm, do not involve the same learning 

curve. DEA estimates the following per-vendor costs for audits: First-year audits: $125,000; 

subsequent audits: $100,000. DEA notes that the costs of a SysTrust or SAS 70 audit range 

from $15,000 to $250,000 depending on the size of the company. DEA used a conservative 

estimate of $125,000 for the initial audit although in many cases the cost for the DEA 

required audit elements would be less. A full SysTrust or SAS 70 audit covers five areas; 

DEA is requiring that the audit address only two of those, physical security and processing 

integrity. For Option 2 audits, addressing only processing integrity, DEA estimates annual 

audit cost of $25,000, including first-year audits. 

Table 3-4: Summary of Costs, Other Than Identity Proofing—Base Case, Options 1 

and 2 

Cost item Time Full hourly 

cost 

Unit cost 

Two-factor token (mid-level practitioners only) 

Learning 2 minutes $76.94 $12.82 

Token $12.00 

Total $24.82 

Digital certificate (annual cost) (Option 2) $30.00 

Monthly log review 

(Base Case, Option 1)

2 minutes 

per month 

$222.51 $89.01 

Reprogramming 

Pharmacy systems 500 hours $73.24 $36,619 

Practitioner systems 

(EMR capability) 

(all systems in Option 2) 

500 hours $73.24 $36,619 

Practitioner systems 

(E-prescription only) 

(Base Case and Option1) 

2,000 hours $73.24 $146,477 

Audits—annual cost 

Pharmacy systems (first year) $125,000 

Pharmacy systems (2nd and subsequent years) $100,000 

Practitioner systems (first year) (Base Case, Option 1) $125,000 

Practitioner systems (2nd and subsequent years) 

(Base Case, Option 1) 

$100,000 

Practitioner systems (all years) (Option 2) $25,000 

3.2.8 OPTION 3 REQUIREMENTS

Option 3 requires that a technician at the pharmacy call a practitioner’s office and speak to 

the prescribing practitioner for every electronic prescription of a controlled substance 

April 2008 22 
received by the pharmacy. DEA estimates that this will take three minutes for the pharmacy 

technician, three minutes for a medical secretary who receives the call and retrieves the file, 

and one minute for the practitioner to look at the file and speak to the pharmacy technician. 

Table 3-5: Option-3 Unit Cost 

Cost item Time Full hourly cost Unit cost 

Pharmacy technician 3 minutes $26.63 $3.71 

Practitioner secretary 3 minutes $30.60 $1.53 

Practitioner 1 minute $222.51 $3.71 

Total $6.55 

April 2008 23 
April 2008 24 
CHAPTER 4: TOTAL COSTS 

To proceed from unit costs to total costs, it is necessary to establish the frequency of 

occurrence of cost items and the distribution of those occurrences, and thus of costs, over 

time. 

4.1 NUMBERS OF PRACTITIONERS, OFFICES, AND SERVICE PROVIDERS 

The first step is selection of the time horizon for the analysis. DEA has chosen 15 years for 

the period of the analysis. DEA expects that full implementation of electronic prescriptions 

for controlled substances will require 15 years, i.e., at the end of the 15th year of the analysis, 

all practitioners’ offices will have controlled substance electronic prescribing capability in 

their IT systems. 

Fifteen years is essentially an estimate of the time required for implementation of electronic 

prescription and EMR systems. As practitioners adopt EMR and electronic prescription 

systems, they will include electronic prescribing of controlled substances in the package, as 

the incremental cost of doing so for an office is very slight. (Going forward, DEA expects 

few practices to buy electronic prescription systems without getting the entire package with 

EMR.) Although the selection of the implementation period is somewhat arbitrary, DEA 

believes that 15 years is a reasonable estimate to reflect the balance between pressure from 

insurers, who want practitioners to implement EMR systems, and the reluctance of 

practitioners to invest in expensive systems that are time-consuming to implement and 

perhaps not yet fully tested. The larger practices may well acquire EMR systems early on, 

but the practices with five or fewer physicians—which employ 74.5 percent of all 

practitioners—will take much longer to do so.20 It is reasonable to assume that for the 35.8 

percent of practitioners in solo practice, it could take at least 15 years before they adopt 

EMRs. 

To distribute costs over time, year by year, it is necessary to project the rate at which 

electronic prescribing systems will be implemented in practitioners’ offices. Table 4-1 

shows the schedule at which DEA projects implementation over time. 

Table 4-1: Implementation Schedule 

Percentage of offices 

implementing in a year

Cumulative implementation 

percentage

Year 1 6.0 6.0 

Year 2 4.0 10.0 

Year 3 4.0 14.0 

 

20 Hing, E., Burt, CW. “Characteristics of Office-Based Physicians and their Practices: United States, 2003-

2004,” Series 13, Number 164. Hyattsville, MD: National Center for Health Statistics. January 2007. 

April 2008 25 
Percentage of offices 

implementing in a year

Cumulative implementation 

percentage

Year 4 5.0 19.0 

Year 5 5.0 24.0 

Year 6 5.0 29.0 

Year 7 6.0 35.0 

Year 8 6.0 41.0 

Year 9 7.0 48.0 

Year 10 9.0 57.0 

Year 11 10.0 67.0 

Year 12 11.0 78.0 

Year 13 11.0 89.0 

Year 14 6.0 95.0 

Year 15 5.0 100.0 

The rate in Year 1 is somewhat higher than the rate in the next several years, because some

percentage of offices has already adopted electronic prescription systems. After dropping in 

Year 2, the rate rises gradually to a peak in Years 12 and 13 and then drops as full 

implementation approaches. 

Total costs for practitioners and some costs for providers will also be affected by the annual 

growth rates of the different classes of practitioners—0.1 percent for physicians, 0.9 percent 

for dentists, 2.2 percent for mid-level practitioners, and 0.7 percent for the weighted growth 

rate for all practitioners. Table 4-2 shows the effect of the overall growth rate on number of 

practitioners and the combined effects of the implementation rate and the growth rate on the 

annual increment in the number of practitioners in offices with implemented e-prescription 

systems. 

Table 4-2: Annual Increments in Affected Practitioners 

Total 

practitioners Practitioners adding EPCS systems Cumulative practitioners inoffices with EPCS

Year 1 572,848 34,371 34,371 

Year 2 576,673 23,296 57,667 

Year 3 580,524 23,606 81,273 

Year 4 584,400 29,763 111,036 

Year 5 588,303 30,157 141,193 

Year 6 592,231 30,554 171,747 

Year 7 596,186 36,918 208,665 

April 2008 26 
Total 

practitioners Practitioners adding EPCS systems Cumulative practitioners inoffices with EPCS

Year 8 600,167 37,403 246,068 

Year 9 604,174 43,935 290,004 

Year 10 608,209 56,675 346,679 

Year 11 612,270 63,542 410,221 

Year 12 616,359 70,539 480,760 

Year 13 620,474 71,462 552,222 

Year 14 624,618 41,165 593,387 

Year 15 628,789 35,402 628,789 

As noted in the chapter on unit costs, there are both start-up costs and ongoing costs driven 

by the number of practitioners. Start-up costs incurred in each year will be based on the 

number of practitioners in offices implementing electronic prescriptions for controlled 

substances in that year plus new hires in offices that have already adopted controlled 

substances prescribing. The combination of implementation and growth rates captures both 

the newly implementing offices and the new hires. 

Ongoing costs for practitioners will be based on the total number of practitioners in offices 

where electronic prescriptions for controlled substances has been implemented in a given 

year, i.e., the cumulative number of practitioners in offices that have adopted electronic 

prescribing of controlled substances. 

While most costs depend on number of practitioners, there are two exceptions for ASPs. One 

has to do with office visits for in-person identity proofing (Base Case), the other with annual 

audits. In some cases, as noted in Chapter 3, under the Base Case, ASP staff would have to 

visit practitioners’ offices for no purpose other than to conduct initial identity proofing. In 

that case, an ASP staff person’s travel time to and from such offices is an incremental cost 

with respect to the rule, and the travel costs depend, in part, on the number of practitioners’ 

offices in which electronic prescriptions for controlled substances has been adopted. Table 

4-3 shows DEA’s projection of the total number of practitioners’ offices and the year-by-year 

number of offices implementing electronic prescriptions for controlled substances.21 The 

EPCS implementation rate for offices is the same as the implementation rate for practitioners 

as shown in Table 4-1. 

 

21 Growth rate is the weighted average of the growth rates of physicians’ and dentists’ offices based on the 

number of such offices in 1997 and 2002 as found in the 2002 Economic Census—0.77 percent for physicians’ 

offices, 0.71 percent for dentists’ offices, weighted average growth rate of 0.75 percent. 

April 2008 27 
Table 4-3: Practitioners’ Offices Implementing Electronic Prescribing of Controlled 

Substances

Offices adopting 

EPCS in a year Total offices 

Year 1 16,856 280,929 

Year 2 11,448 283,032 

Year 3 11,618 285,152 

Year 4 14,663 287,287 

Year 5 14,881 289,438 

Year 6 15,100 291,605 

Year 7 18,261 293,788 

Year 8 18,529 295,988 

Year 9 21,783 298,204 

Year 10 28,111 300,437 

Year 11 31,551 302,687 

Year 12 35,063 304,953 

Year 13 35,577 307,237 

Year 14 20,620 309,537 

Year 15 17,795 311,855 

DEA believes that visits only for initial identity proofing would be made almost entirely by 

ASPs offering only electronic prescription systems, not EMRs. A significant amount of 

work is required to set up and maintain an EMR system. It is highly unlikely that, during the 

initial set-up of the system, EMR provider staff would be in a practitioner’s office with no 

task to perform other than identity proofing. DEA expects that the electronic prescription 

system providers will disappear fairly quickly, either going out of business or expanding their 

services to include EMR. As this happens, the percentage of initial visits made only for 

identity proofing will decline to zero by the end of Year 5. This is shown in Table 4-4. 

Table 4-4: Initial Visits Only for Proofing (Base Case) 

Percentage of initial visits only for 

identity proofing 

Year 1 15.0 

Year 2 12.0 

Year 3 9.0 

Year 4 6.0 

Year 5 3.0 

April 2008 28 
Percentage of initial visits only for 

identity proofing 

Year 6 0.0 

Year 7 0.0 

Year 8 0.0 

Year 9 0.0 

Year 10 0.0 

Year 11 0.0 

Year 12 0.0 

Year 13 0.0 

Year 14 0.0 

Year 15 0.0 

Regarding audit costs for system providers, total cost is a function of the number of 

providers. DEA expects that there will be 110 firms offering services to practitioners’ offices 

in Year 1, and that this number will drop to 20 in Year 11 and stabilize at that level. The 

number of providers serving pharmacies remains stable at 20 throughout the analysis period. 

Table 4-5 shows the projected number of providers to practitioners over the analysis period. 

Table 4-5: Projected Reduction in Providers to Practitioners 

Number of providers serving 

practitioners 

Year 1 110 

Year 2 95 

Year 3 80 

Year 4 70 

Year 5 60 

Year 6 50 

Year 7 40 

Year 8 30 

Year 9 25 

Year 10 25 

Year 11 20 

Year 12 20 

Year 13 20 

Year 14 20 

Year 15 20 

April 2008 29 
4.2 START-UP COSTS AND ON-GOING COSTS 

Start-up costs are those incurred by an entity when it first implements electronic prescriptions 

for controlled substances and takes the steps needed to comply with the rule. Under the 

assumptions of this analysis, all start-up costs will be incurred during the 15-year analysis 

period. Ongoing costs are those incurred after initial implementation and which will 

continue indefinitely thereafter. 

Start-up costs for practitioners are the initial identity proofing and the purchase of hard 

tokens, and training in their use, for some of the mid-level practitioners. The major ongoing 

cost is the monthly log review (absent in Option 2). Under Option 2, the digital certificate is 

an ongoing cost for practitioners. There is also some ongoing cost associated with turnover 

of personnel in practitioners’ offices. When a practitioner moves to a new office, there is a 

high likelihood that the transfer will also be a move between providers; when that is the case, 

there must be a new identity proofing for that individual. Transfers of mid-level practitioners 

are assumed to require new purchases of hard tokens. 

For providers, the start-up cost is the required reprogramming. The major ongoing cost is the 

annual audit. But providers also incur ongoing cost for identity proofing, both when a 

practitioner’s office adopts electronic prescriptions for controlled substances and in the case 

of identity proofing required when practitioners transfer between offices with different 

providers. Most identity proofing costs are shifted from providers to hospitals in Options 1 

and 2. Table 4-6 presents a summary of start-up and ongoing costs and the timing of each 

group of costs. 

Table 4-6: Start-up and Ongoing Costs 

Base Case, Options 1 and 2 

Practitioners Providers 

Start-up 

costs 

Initial identity proofing 

Buying tokens for mid-levels 

Training for mid-levels in use of tokens 

Reprogramming for providers 

Timing of 

start-up 

costs 

These costs will accrue throughout the analysis 

period as practitioners adopt EPCS. 

All these costs will accrue in 

Year 1 of the analysis. 

Ongoing 

costs 

Monthly log reviews (not in Option 2) 

Digital certificates (only in Option 2) 

Proofing of transfers 

Buying tokens for transferring mid-levels 

Annual audits for providers 

Identity proofing for start-up 

practitioners 

Identity proofing of transfers 

(Identity proofing costs borne by 

hospitals in Options 1 and 2) 

Timing of 

ongoing 

costs 

All of these costs will accrue in the time after 

initial implementation in a practitioner office. 

These costs will accrue throughout 

the analysis period. 

All callbacks in Option 3 are ongoing costs. 

April 2008 30 
Some further assumptions regarding these costs must be made to estimate total costs. These 

are as follows: 

 For ongoing identity proofing visits due to personnel turnover, there is no 

incremental travel cost in the Base Case. 

 Percentage of personnel transfers between offices that are also transfers between 

service providers: 90.0 percent. 

 Annual turnover rate for physicians and dentists: 2.5 percent. 

 Annual turnover rate for mid-level practitioners: 5.0 percent. 

DEA assumes that ongoing identity proofing will not involve travel costs in the Base Case 

because provider staff may have to visit practices for other reasons, such as system upgrades, 

maintenance, and staff training. Identity proofing can occur during those visits. Identity 

proofing for transfers in Options 1 and 2 will still require travel to hospital for dentists and 

mid-level practitioners. 

4.3 TOTAL COSTS 

Table 4-7 shows the annualized costs over the analysis period for each of the four variants. 

The discounted present values over the analysis period are summed to yield present value of 

total cost for the period. The present-value total is then annualized with a capital recovery 

factor to yield annualized total costs. 

Table 4-7: Total Costs ($) 

7.0 percent 3.0 percent 

Base Case $32,561,452 $33,392,270 

Option 1 $38,256,015 $39,220,948 

Option 2 $18,594,831 $18,928,003 

Option 3 $1,280,040,536 $1,404,204,487 

Tables 4-8 and 4-9 show annualized costs of individual cost items for the Base Case and the 

three options with 7.0 and 3.0 percent interest rates. For simplicity, start-up and ongoing 

costs have been combined for the same item, e.g., identity proofing includes both start-up and 

ongoing identity proofing. Monthly log reviews are the largest single component of costs for 

the Base Case and Option 1. It is the absence of log reviews in Option 2 that makes it the 

low-cost variant. Annual audits for providers are large cost items. All the other costs are 

relatively trivial compared to these items, except for the enormous cost of the call-backs in 

Option 3. 

April 2008 31 
Table 4-8: Annualized Costs by Cost Item 

7.0 percent 

Practitioners Providers Total 

Base Case 

Identity 

proofing $352,367 $459,425 $811,792 

Tokens $90,757 $90,757 

Training $75,147 $75,147 

Log reviews $22,495,039 $22,495,039 

Reprogramming $824,224 $824,224 

Audits $8,264,492 $8,264,492 

Total $32,561,452 

Option 1 

Identity 

proofing $6,151,445 $354,910 $6,506,355 

Tokens $90,757 $90,757 

Training $75,147 $75,147 

Log reviews $22,495,039 $22,495,039 

Reprogramming $824,224 $824,224 

Audits $8,264,492 $8,264,492 

Total $38,256,015 

Option 2 

Identity 

proofing $6,151,445 $354,910 $6,506,355 

Tokens $90,757 $90,757 

Training $75,147 $75,147 

Digital 

Certificates $7,582,154 $7,582,154 

Reprogramming $703,606 $703,606 

Audits $3,636,812 $3,636,812 

Total $18,594,831 

Option 3 

Practitioners Pharmacies Total 

Callbacks $1,023,778,891 $256,261,645 $1,280,040,536 

April 2008 32 
Table 4-9: Annualized Costs by Cost Item 

3.0 percent 

Practitioners Providers Total 

Base Case 

Identity 

proofing $357,789 $443,823 $801,612 

Tokens $94,227 $94,227 

Training $76,832 $76,832 

Log reviews $24,389,580 $24,389,580 

Reprogramming $628,833 $628,833 

Audits $7,401,186 $7,401,186 

Total $33,392,270 

Option 1 

Identity 

proofing $6,269,439 $360,851 $6,630,290 

Tokens $94,227 $94,227 

Training $76,832 $76,832 

Log reviews $24,389,580 $24,389,580 

Reprogramming $628,833 $628,833 

Audits $7,401,186 $7,401,186 

Total $39,220,948 

Option 2 

Identity 

proofing $6,269,439 $360,851 $6,630,290 

Tokens $94,227 $94,227 

Training $76,832 $76,832 

Digital 

Certificates $8,220,726 $8,220,726 

Reprogramming $536,808 $536,808 

Audits $3,369,812 $3,369,812 

Total $18,928,003 

Option 3 

Practitioners Pharmacies Total 

Callbacks $1,123,085,458 $281,119,029 $1,404,204,487 

Tables 4-10 through 4-13 present the cost for each year, the total cost over 15 years, and the 

annualized costs for each option at both discount rates. 

April 2008 33 
Table 4-10: Base Option - Yearly, 15-Year, and Annualized Costs 

Total Costs 

Present value 

7% 3% 

YEAR 1 $27,861,426 $27,861,426 

YEAR 2 $16,169,934 $16,797,893 

YEAR 3 $15,604,822 $16,840,382 

YEAR 4 $16,009,317 $17,947,852 

YEAR 5 $16,209,149 $18,877,585 

YEAR 6 $16,338,328 $19,766,983 

YEAR 7 $16,881,782 $21,217,666 

YEAR 8 $17,246,153 $22,517,392 

YEAR 9 $18,185,251 $24,665,602 

YEAR 10 $19,881,208 $28,013,138 

YEAR 11 $21,282,559 $31,152,247 

YEAR 12 $22,952,181 $34,900,853 

YEAR 13 $24,300,482 $38,386,059 

YEAR 14 $24,012,809 $39,404,711 

YEAR 15 $23,631,498 $40,284,965 

Total $296,566,901 $398,634,754

Annual $32,561,452 $33,392,270 

Table 4-11: Option 1 - Yearly, 15-Year, and Annualized Costs 

Total Costs 

Present value 

7% 3% 

YEAR 1 $31,550,781 $31,550,781 

YEAR 2 $18,673,871 $19,399,070 

YEAR 3 $18,100,551 $19,533,717 

YEAR 4 $19,042,767 $21,348,615 

YEAR 5 $19,220,924 $22,385,174 

YEAR 6 $19,322,054 $23,376,854 

YEAR 7 $20,264,251 $25,468,882 

YEAR 8 $20,532,343 $26,807,997 

YEAR 9 $21,806,335 $29,577,067 

YEAR 10 $24,209,769 $34,112,192 

YEAR 11 $25,870,551 $37,867,899 

YEAR 12 $27,769,551 $42,226,097 

YEAR 13 $28,977,479 $45,774,038 

YEAR 14 $26,938,424 $44,205,609 

YEAR 15 $26,152,841 $44,583,136 

Total $348,432,492 $468,217,128

Annual $38,256,015 $39,220,948 

April 2008 34 
Table 4-12: Option 2 - Yearly, 15-Year, and Annualized Costs 

Total Costs 

Present value 

7% 3% 

YEAR 1 $17,424,141 $17,424,141 

YEAR 2 $8,834,926 $9,178,030 

YEAR 3 $8,671,300 $9,357,877 

YEAR 4 $9,409,060 $10,548,383 

YEAR 5 $9,432,139 $10,984,907 

YEAR 6 $9,422,978 $11,400,422 

YEAR 7 $10,061,005 $12,645,054 

YEAR 8 $10,089,256 $13,173,009 

YEAR 9 $10,755,886 $14,588,767 

YEAR 10 $12,063,256 $16,997,440 

YEAR 11 $12,803,342 $18,740,833 

YEAR 12 $13,579,798 $20,649,303 

YEAR 13 $13,843,780 $21,868,214 

YEAR 14 $11,786,863 $19,342,092 

YEAR 15 $11,182,396 $19,062,796 

Total $169,360,125 $225,961,268

Annual $18,594,831 $18,928,003 

Table 4-13: Option 3 - Yearly, 15-Year, and Annualized Costs 

Total Costs 

Present value 

7% 3% 

YEAR 1 $112,983,045 $112,983,045 

YEAR 2 $181,265,632 $188,305,074 

YEAR 3 $244,285,086 $263,627,104 

YEAR 4 $319,136,124 $357,779,641 

YEAR 5 $388,049,433 $451,932,179 

YEAR 6 $451,364,352 $546,084,716 

YEAR 7 $524,385,591 $659,067,761 

YEAR 8 $591,316,516 $772,050,805 

YEAR 9 $666,393,630 $903,864,357 

YEAR 10 $761,759,541 $1,073,338,924 

YEAR 11 $861,928,610 $1,261,643,999 

YEAR 12 $965,927,528 $1,468,779,581 

YEAR 13 $1,060,946,280 $1,675,915,162 

YEAR 14 $1,090,135,393 $1,788,898,207 

YEAR 15 $1,104,613,335 $1,883,050,744 

Total $9,324,490,097 $13,407,321,299

Annual $1,023,778,891 $1,123,085,458 

April 2008 35 
April 2008 36 
 CHAPTER 5: SMALL ENTITY ANALYSIS 

Under the Regulatory Flexibility Act of 1980 (5 U.S.C. 601-612) (RFA), Federal agencies 

must evaluate the impact of rules on small entities and determine whether the rule will have a 

significant economic impact on a substantial number of small entities. This section discusses 

DEA’s analysis of the impact on small entities. DEA emphasizes that the rule is voluntary. 

No businesses are required to comply with this rule unless they elect to issue or process 

controlled substance prescriptions as electronic data files; practitioners and pharmacies have 

the option to continue to use paper and, for Schedule III-V substances, oral prescriptions. 

5.1 CHARACTERISTICS OF SMALL ENTITIES 

As discussed in previous sections, the small entities directly affected by the proposed rule are 

practitioners and, to a limited extent, pharmacies. The firms marketing services and software 

are not directly affected by the rule because they will recover their costs from practitioners. 

Nonetheless, DEA will discuss the impact on these firms. Table 5-1 shows Small Business 

Administration’s standards for these firms. 

Table 5-1: SBA Definitions of Small Entities 

Affected 

Entity Industry Description NAICS Code 

Small Business Definition 

(sales in $)

Offices of Physicians 62111 $9,000,000 Practitioner 

and MidLevel 

Practitioner Offices of Dentists 621210 $6,500,000 

Service 

Provider Software Publishing 511210 $23,000,000 

Pharmacies and Drug Stores 44611 $6,500,000 

Supermarkets and Other 

Grocery Stores Pharmacy 44511 $25,000,000 

General Merchandise Stores 

Mail Order Houses 

45291 

454113 

$25,000,000 

$23,000,000 

Although some practitioners are part of large practices that may qualify as large businesses, 

so few practitioners fall into the large category that it is simpler to assume that they are all 

small entities. It is also the case that the service providers generally charge on a per 

practitioner basis rather than a per practice basis so that the costs may be considered as 

applying to individual practitioners. Mid-level practitioners are generally employed by a 

practice so their costs would be incurred by the practice, not the individual. They are not, 

therefore, small businesses. 

April 2008 37 
The lowest average net income for a physician in private practice listed in the AlliedPhysician Survey is $135,000.22 The American Dental Association states that the average 

net income of a dentist in private practice is $185,940 for a general practitioner. The average 

gross billings for a dentist in general practice per dentist are $595,340.23 For pharmacies, the 

17,500 independent pharmacies are small entities; the other pharmacies belong to about 200 

chains that are mostly large firms. There may be a few chains with fewer than 3 pharmacies, 

which could be small. In 2006, National Association of Chain Drug Stores data indicate that 

the average independent pharmacy had prescription sales of $2.48 million a year; average 

total sales are about $2.675 million.24

As discussed in Chapter 2, DEA estimates that there are about 130 service providers (110 for 

electronic prescriptions, 20 for pharmacies) that will be indirectly affected by this rule. A 

few of these are large entities or part of large companies (e.g., General Electric and 

McKesson). DEA has no information on the revenues of most of these firms. DEA notes 

that fully electronic EMRs cost between $20,000 and $50,000 per practitioner, with a usual 

monthly maintenance fee of $500 per practitioner. A provider, therefore, would need fewer 

than 4,000 practitioners to qualify as a large business. The providers of stand-alone 

electronic prescribing systems charge a tenth as much and are assumed to be small entities. 

5.2 SMALL ENTITY COSTS 

The costs to DEA registrants are relatively small. As discussed in Chapter 4, the initial costs 

to the practitioner would range from about $62 to $266 for identity proofing, mostly for the 

time to have the identification checked. The main ongoing costs for the proposed rule would 

be the monthly log review by practitioners (about $89 a year) plus any incremental cost of 

the software or service. The initial and ongoing costs for the basic rule elements represent 

less than 0.2 percent of the annual income of the lowest paid practitioner. 

 

22 www.allied-physicians.com/salary-surveys, accessed 1/16/2008. 

23 www.ada.org/ada/prod/survey/faq.asp, accessed 1/16/2008. 24 http://www.nacds.org/wmspage.cfm?parm1=507, accessed 1/18/2008. 

April 2008 38 
Determining the incremental cost of the system requirements per practitioner is difficult 

because it depends on the number of providers, the number of customers, the number of 

system requirements that a provider does not already meet, and how costs are recovered (in 

the year in which the money is spent or over time). For example, an EMR system that had to 

reprogram to the full extent would have incremental system costs of $161,000 ($125,000 for 

the third-party audit and $37,000 for reprogramming). If the service provider had 1,000 

practitioners enrolled in the first year, it would also incur about $5,660 for identity proofing. 

If the provider recovered the costs ($167,000) from its 1,000 customers, the incremental cost 

to those customers would be $167 or about $14 a month. The costs in the out years would be 

lower because no further programming is needed and the audit cost is lower ($100,000). If 

the provider added 1,000 practitioners a year over 15 years, the incremental cost per 

practitioner would fall as shown in Table 5-2. The costs shown are conservative because the 

audits may cost considerably less depending on the complexity of the system; many EMRs 

may need little reprogramming. Either or both of these factors in combination could reduce 

their costs considerably and, therefore, reduce the incremental costs to practitioners. 

Table 5-2: Incremental Cost of EMR Systems to Practitioners 

Year # 

Practitioners 

Total Provider 

Costs 

Annual 

Cost/Practitioner 

Monthly Cost/ 

Practitioner 

1 1000 $167,270 $167.27 $13.94 

2 2000 $105,648 $52.82 $4.40 

3 3000 $105,648 $35.22 $2.93 

4 4000 $105,648 $26.41 $2.20 

5 5000 $105,648 $21.13 $1.76 

6 6000 $105,648 $17.61 $1.47 

7 7000 $105,648 $15.09 $1.26 

8 8000 $105,648 $13.21 $1.10 

9 9000 $105,648 $11.74 $0.98 

10 10000 $105,648 $10.56 $0.88 

11 11000 $105,648 $9.60 $0.80 

12 12000 $105,648 $8.80 $0.73 

13 13000 $105,648 $8.13 $0.68 

14 14000 $105,648 $7.55 $0.63 

15 15000 $105,648 $7.04 $0.59 

In the first year, the total cost to a physician for DEA’s requirements would be less than 

$300; dentists would have higher initial costs because of travel time. After that, the cost will 

decline over time to about $100 to $150 a year including the incremental costs charged for 

the systems. The lowest paid physician earns about $135,000 a year. For none of the 

registrants will the cost represent a significant economic impact. 

For pharmacies, the only costs will be the incremental cost that their service provider charges 

to cover the costs of reprogramming and audits. In the first year, if the providers recover the 

programming costs in a single year, the average incremental cost to a pharmacy would be 

$85. After that, the incremental charge to recover the cost of the third-party audit would be 

$35 per pharmacy, assuming the cost is evenly distributed across all pharmacies. The first 

year charge represents 0.003 percent of an independent pharmacy’s annual sales. It also 

April 2008 39 
represents a far lower cost than the pharmacy will pay SureScripts or another intermediary 

for processing the prescriptions. Currently, SureScripts charges the pharmacy $0.215 per 

electronic prescription to process and reformat prescriptions to ensure that the pharmacy 

system will be able to capture the data electronically. Based on National Association of 

Chain Drug Stores data on the average price of prescriptions ($68.26) and the average value 

of prescription sales, an independent pharmacy processes about 36,400 prescriptions a year 

and would have to pay SureScripts about $7,800.25

5.3 ALTERNATIVES CONSIDERED 

Although these costs do not represent a significant economic impact, as discussed above, 

DEA considered options. The Base Case option would be less expensive initially, 

particularly for dentists and mid-level practitioners, because much less time would be needed 

for identity proofing. Once the identity proofing has occurred, however, the costs would be 

the same for the Base Case and Option 1. Option 2 would be less expensive for practitioners 

because the monthly log check would not be needed and the service provider costs would be 

lower because less stringent auditing requirements would be imposed, which would reduce 

the incremental costs recovered from the practitioner. 

DEA has not proposed the Base Case because of two concerns about identity proofing. First, 

DEA is concerned that having a service provider employee conduct the in-person identity 

proofing would make it easier for insider collusion to occur. Putting the in-person identity 

proofing in the hands of a DEA registrant or a public employee lessens that threat. Second, 

others expressed a concern that service providers would not visit practitioners’ offices often, 

which could delay implementation and adoption, particularly for rural practices. DEA is not 

proposing Option 2, the digital signature option, except for Federal healthcare systems 

because of the concerns expressed by industry with regard to the use of digital signatures and 

the problems they would create for intermediaries. The third option, which would impose no 

costs on service providers, would be very expensive for pharmacies and practitioners. If the 

average independent pharmacy processes 36,400 prescriptions, about 11 percent of those are 

likely to be for controlled substances. Their annual cost for conducting callbacks on each of 

those would be about $5,200 in 2008; eliminating callbacks that already occur, the costs 

would be about $3,800 in 2008. If the number of controlled substance prescriptions (359 

million original and newly authorized refills in 2008) were equally distributed among 

practitioners (about 573,000 in 2008), the average practitioner would incur costs of about 

$3,300 for callbacks under Option 3. Eliminating the callbacks that already occur, the 

average practitioner would incur new costs of about $2,200 under Option 3. 

DEA has, therefore, determined that the proposed rule would not impose a significant 

economic impact on a substantial number of small entities directly subject to the rule. Less 

expensive options are considered too burdensome by the service providers and 

intermediaries. The option that would impose no burden on service providers would impose 

substantially higher costs on practitioners and pharmacies. 

 

25 http://www.nacds.org/wmspage.cfm?parm1=507, accessed 1/18/2008. 

April 2008 40 
5.4 OTHER ISSUES 

Another issue that DEA considered is whether the incremental costs might affect 

practitioners’ decisions about purchasing a system that provides electronic prescribing. As 

discussed previously in this analysis, the market for these systems has shifted away from 

stand-alone systems to EMRs. The cost of an EMR system for the functionalities that 

CCHIT requires ranges from $20,000 and $50,000 per practitioner with a usual annual 

maintenance charge of $6,000 per practitioner. (There are some less expensive systems 

marketed as EMRs that have only some of the functions; some appear to provide billing, 

scheduling, and simple records, but none of the more complex functions such as electronic 

prescribing, database links, etc.) Even in the first year, where the incremental cost of adding 

DEA’s requirements would be between $150 and $200, this additional charge is unlikely to 

affect the decision to invest in an EMR, where the first year cost would be, at the low end 

$26,000 ($20,000 plus the $6,000 maintenance fee). The incremental costs would add less 

than 1 percent of the cost of the system; in the out-years, the incremental costs would 

similarly be a small fraction of the annual system maintenance cost. For stand-alone 

electronic prescription systems, the initial incremental costs will be higher because they are 

expected to need more programming. After the initial year, however, their incremental costs 

should be similar. These costs will represent a greater percentage increase in their monthly 

charges, which average $50 per month, but this is unlikely to affect the initial decision 

because most of these systems are being provided free to practitioners by insurers that want 

to encourage electronic prescribing. 

DEA considers it unlikely that any provider would attempt to market a product or service that 

could not be used for controlled substance records and, therefore, no provider will be 

disadvantaged by complying because all providers will incur costs and recover them from 

customers. The situation may be similar to certification of EMRs by CCHIT. Some were 

concerned that the standards would create barriers, but most of the companies certified have 

been small. The chairman of CCHIT, Mark Leavitt stated that the data on the revenues of 

firms that gained certification “laid to rest this concern that it was going to squeeze out small 

vendors. It actually seems to have done the opposite. It’s created a level playing field.”26 

DEA notes that the barriers to adoption of electronic prescribing cited in various government 

studies relate to the high cost of the systems, the disruption caused by implementing these 

systems, and the relatively early stage of system development and interoperability provided 

by the existing systems. Despite the benefits of legible prescriptions, both in terms of patient 

safety and fewer callbacks from pharmacies, practitioners have resisted adoption of 

electronic prescriptions. Insurance companies that have offered the systems for free have had 

difficulty finding practitioners willing to accept them because, while the service is free, the 

cost of additional hardware, training, and staff disruption is a barrier to adoption. In 2005, 

Wellpoint offered physicians $42 million in hardware, software, and support. "Of the 25,000 

physicians contacted, only 19,000 accepted these free gifts," Wellpoint then-CEO Leonard 

Schaeffer said. "And of those 19,000, only 2,700 physicians chose e-prescribing PDAs. The 

rest selected a paperwork reduction package. ... Free is not cheap enough," Schaeffer 

 

26 California HealthCare Foundation, “Gauging the Progress of the National Health Information Technology 

Initiative: Perspectives from the Field.” January 2008. 

April 2008 41 
concluded.27 The likelihood that the electronic prescribing systems will be part of EMR 

systems probably is also slowing adoption because practices do not want to invest in a standalone system that will be redundant later. 

A study of physicians’ experiences with commercial electronic prescription systems that was 

funded by HHS and published in Health Affairs on April 3, 2007, examined the 

implementation of electronic prescribing.28 The study focused on larger medical practices 

(12 of the 21 practices had more than 50 doctors; none had fewer than 5), which meant that 

many of the practices had IT staff and support. Many of the problems encountered involved 

not the basic function of writing a prescription, but other functions that are designed to 

improve patient safety (e.g., medication histories, clinical decision support) and formulary 

compliance. Connectivity with pharmacies was also a problem. Practice estimates of the 

number of prescriptions printed out for the patient ranged from 10 percent to close to 100 

percent. Despite the theoretical level of pharmacy readiness for electronic prescriptions, 

“most practices using electronic fax or EDI [electronic data interchange] reported spending 

substantial time educating pharmacies about e-prescribing.” Many practices noted that “at 

least some of the mail-order PBMs [pharmacy benefit managers] routinely rejected 

prescriptions sent via electronic fax or EDI...” 

Implementing a system was reported to be very complicated. One physician reported 

working with the IT department 4 hours a week for 6 months to iron out the “kinks” in the 

electronic prescribing module before the system could be tested. Maintenance of the system 

continued to demand staff resources. The study concluded: 

Much of the literature assessing barriers to electronic prescribing adoption and use 

has focused on cost, physician resistance, and changing practice workflow. Our 

findings highlight the role of product limitations, external implementation challenges, 

and physicians’ preferences for how to use system features and are consistent with 

several other assessments of e-prescribing system functionality and provider 

pharmacy connectivity. 

Respondents’ implementation hurdles belie the view that electronic prescribing 

products are relatively simple “plug-and-play” applications. It is hard to imagine that 

e-prescribing as it exists today can be the “killer app” that will drive further IT 

adoption. All of the practices we examined, regardless of size, IT expertise, 

geographic location, or vendor, had invested many financial and human resources in 

implementing and maintaining e-prescribing. 

These findings are consistent with the CDC study cited above, which found that electronic 

prescribing was one of the less used functions in a fully or partially electronic EMR system. 

 

27 Schaeffer, L. WellPoint Health Networks, Thousand Oaks, CA. Transforming an IT-Enabled Health Care 

System: The Health Plan Role. Presentation at the Second Annual National Health Information Summit. 

Washington DC, October 20, 2004. http://www.managedcaremag.com/archives/0504/0504.pharmacy.html 

28 Grossman, Joy M. et al., “Physicians’ Experiences Using Commercial E-Prescribing Systems,” Health 

Affairs, 26, no. 3 (2007), w393-w404. 

April 2008 42 
Creating an electronic prescription takes more time than writing a paper prescription and 

handing it to a patient. The electronic prescription system shifts some responsibility from the 

pharmacy to the practitioners. At present, it is the pharmacy that checks to see if a particular 

drug is covered by the patient’s insurance and that checks for drug interactions by examining 

other medications the patient is taking. With electronic prescriptions, all of these checks may 

occur before the practitioner signs the prescription. While this process may significantly 

reduce processing time at the pharmacy and ensure that more prescribed drugs are on the 

insurance companies’ formularies, it may substantially increase the time a practitioner must 

spend to create a prescription. Rather than spending a few seconds writing a prescription 

while talking to the patient, the practitioner has to move through a series of drop-down 

menus to select the patient, drug, dosage unit, and directions, then determine whether the 

insurance company will cover it and at what level of co-pay. Finally the practitioner will 

have to find the pharmacy from a drop-down menu. Electronic prescriptions are likely to 

save practices staff time in reduced callbacks, but the practitioners may initially see mainly 

the additional time that needs to be spent creating the prescription and the office disruption 

that occurs when staff need to be trained on new systems. (An earlier Rand study noted that 

although electronic prescriptions will eliminate errors caused by misread or misunderstood 

prescriptions, practitioners may not review the prescription to check that the right items from 

successive menus have been selected. Electronic prescriptions may introduce new errors 

through system design flaws. They may also reduce the likelihood that the pharmacy will 

check the prescription for errors.)29

Although the rule could impose a burden on the smallest service providers, the costs are not 

so great that a service provider would not be able to recover them from customers or that the 

incremental price increase would discourage customers from purchasing a system. The 

programming that may be needed to implement a conforming system is not so onerous that a 

service provider would find it a significant burden; these firms are in the business of 

designing, programming, implementing, and upgrading software systems. The cost of the 

annual third-party audit may be burdensome, but without the audit there is no assurance that 

the system is protected against identity theft and insider attacks, two of the most likely 

sources of diversion. Some providers may drop out of the market if they cannot meet the 

security standards that an auditor would demand, but given other government requirements 

for security under HIPAA and the public’s expectations for secure medical records, these 

providers would not be able to meet other standards and public expectations. The market for 

healthcare IT is evolving rapidly. As discussed above, DEA anticipates that most of the 

current providers will not be in this market by the time most practitioners have adopted EMR 

systems. Eventually, for reasons unrelated to DEA, a few systems will dominate the market; 

for these providers, DEA’s requirements will not be a burden. 

 

29 Bell, D.S. et al., “Recommendations for Comparing Electronic Prescribing Systems: Results of An Expert 

Consensus Process,” Health Affairs, May 25, 2004, W4-305-317. 

April 2008 43 
April 2008 44 
CHAPTER 6: BENEFITS

6.1 INTRODUCTION 

Electronic prescriptions are widely expected to reduce errors in medication dispensing 

because they will eliminate illegible written prescriptions and misunderstood oral 

prescriptions. They are also expected to reduce the number of callbacks from pharmacy to 

practitioner to address legibility, formulary, and contraindication issues. Electronic 

prescriptions may also reduce processing time at the pharmacy and wait time for patients. 

These benefits are likely to be mitigated to some extent. As the Rand study suggested, 

practitioners may fail to review the prescription and notice errors that occur when the wrong 

item is selected from one or more drop-down menus; pharmacists may be less likely to 

question a legible electronic prescription.30 In addition, the formulary and contraindication 

checks are functions that practitioners sometimes disable because they do not work as they 

should or take too much time.31 Nonetheless, electronic prescriptions may provide benefits 

in avoided medication errors, reduced processing time, and reduced callbacks. These 

benefits of electronic prescriptions are not directly attributable to this proposed rule except to 

the extent the rule facilitates implementation of electronic prescribing of controlled 

substances. 

6.2 QUANTIFIED BENEFITS 

DEA has quantified two types of benefits: reduced number of callbacks to clarify 

prescriptions and the reduction in wait time for patients picking up prescriptions. One of the 

greatest burdens in the paper system is the need for callbacks to clarify prescriptions. 

Clarifications and changes may be required for several reasons: the prescription is not 

legible; required information is not included on the prescription; the prescribed dosage unit 

does not exist; the particular medication is not approved by the patient’s health insurance; 

and the drug prescribed is contraindicated because it reacts with other medications the patient 

is taking or because it negatively affects other conditions from which the patient suffers. 

Each callback involves the pharmacist and one or more staff at the practitioner’s office, often 

including the practitioner. Electronic prescriptions will eliminate illegible prescriptions and 

should eliminate those with missing information or unavailable dosage units or forms. 

Whether the last two types of errors are eliminated will depend on the requirements of the 

software systems and the accuracy of the drug databases that they use. 

The public is also affected by the current system. For the majority of controlled substance 

prescriptions, the patient (or someone acting for the patient) presents a paper prescription to 

the pharmacy and then waits for the pharmacy to fill it. The time between the point when the 

 

30 Bell, D.S. et al., “Recommendations for Comparing Electronic Prescribing Systems: Results of An Expert 

Consensus Process,” Health Affairs, May 25, 2004, W4-305-317. 

31 Grossman, Joy M. et al., “Physicians’ Experiences Using Commercial E-Prescribing Systems,” Health 

Affairs, 26, no. 3 (2007), w393-w404. 

April 2008 45 
prescription is handed to the pharmacist and the point when it is ready for pick-up is a cost to 

the public. 

To estimate the part of these benefits that may accrue to the proposed rule, DEA estimated 

the number of controlled substance prescriptions that may require callbacks. Although there 

are widely varying estimates for callbacks, the best available data, based on the operation of 

the two largest mail order prescription pharmacies, support an estimate of 30 percent of 

original prescriptions.32 DrugTopics.com surveys of pharmacists in 199633 and 199934

indicated that 80 percent or 95 percent of the prescription problems were of the type that 

electronic prescriptions could eliminate (illegible, missing information, or formulary).35 The 

analysis estimates that 90 percent of the callbacks could be eliminated with electronic 

prescriptions because data from current operations indicate that formulary issues have 

become a more prevalent cause of callbacks than was the case in the earlier surveys.36 

Overall, the analysis estimates that 27 percent of original prescriptions require callbacks. 

DEA assumes that electronic prescriptions would phase in at the same rate as practitioners 

(i.e., if 6 percent of practitioners had adopted electronic prescribing for controlled substances, 

then 6 percent of the controlled substance prescriptions would be electronic.) Applying the 

cost of a callback as estimated for Option 3 ($6.58), Table 6-1 presents the annual data for 

the cost-savings from callbacks avoided over the 15 year implementation period. Table 6-2 

presents the PV of the costs at 7 and 3 percent discount rates. 

Table 6-1: Cost Savings of Callbacks Avoided 

Year # Original 

Prescriptions 

# Callbacks Implementation 

Rate

# Callbacks 

Avoided 

Cost Savings 

2008 326,767,500 88,227,225 0.06 5,293,634 $34,832,108

2009 336,570,525 90,874,042 0.1 9,087,404 $59,795,119

2010 346,667,641 93,600,263 0.14 13,104,037 $86,224,562

2011 357,067,670 96,408,271 0.19 18,317,571 $120,529,620

2012 367,779,700 99,300,519 0.24 23,832,125 $156,815,380

2013 378,813,091 102,279,535 0.29 29,661,065 $195,169,808

2014 390,177,484 105,347,921 0.35 36,871,772 $242,616,261

2015 401,882,808 108,508,358 0.41 44,488,427 $292,733,849

2016 413,939,293 111,763,609 0.48 53,646,532 $352,994,183

2017 426,357,471 115,116,517 0.57 65,616,415 $431,756,010

2018 439,148,195 118,570,013 0.67 79,441,909 $522,727,758

2019 452,322,641 122,127,113 0.78 95,259,148 $626,805,196

 

32 “Company Pushes the Envelope to Get Prescriptions in the Mailbox,” St. Petersburg Times, September 15, 

2002. Story reports on Medco’s mail order pharmacy operation. Barrett Toan, CEO of Express Scripts, also 

reported a 30 percent callback rate. Express Scripts and Medco process about 600 million prescriptions. 

33 “Where Does the Time Go?” Drugtopic.com, June 10, 1996. 

34 “No Rest for the Weary,” Drugtopic.com, June 21, 1999. 

35 The analysis assumes that electronic prescriptions will be produced using prescription software that has fields 

that must be completed and a database of formularies that will prompt the practitioner to select both the drug 

name and an available dosage unit. Existing prescription software systems include formularies. 

36 Medco reports 43 percent of its callbacks are for formulary issues; the Drugtopic surveys put the formulary 

callbacks at less than 25 percent. 

April 2008 46 
Year # Original 

Prescriptions 

# Callbacks Implementation 

Rate 

# Callbacks 

Avoided 

Cost Savings 

2020 465,892,321 125,790,927 0.89 111,953,925 $736,656,824

2021 479,869,090 129,564,654 0.95 123,086,422 $809,908,654

2022 494,265,163 133,451,594 1 133,451,594 $878,111,488

Table 6-2: PV and Annualized Cost Savings for Callbacks 

Year PV at 7% PV at 3% 

2008 $34,832,108 $34,832,108 

2009 $55,883,289 $58,053,514 

2010 $75,311,872 $81,274,920 

2011 $98,388,073 $110,301,677 

2012 $119,633,702 $139,328,434 

2013 $139,153,376 $168,355,191 

2014 $161,665,459 $203,187,299 

2015 $182,299,929 $238,019,408 

2016 $205,445,828 $278,656,867 

2017 $234,846,662 $330,905,030 

2018 $265,728,286 $388,958,544 

2019 $297,790,633 $452,817,410 

2020 $327,084,440 $516,676,275 

2021 $336,083,298 $551,508,383 

2022 $340,546,775 $580,535,141 

Total $2,874,693,730 $4,133,410,200 

Annualized $315,625,919 $346,241,638 

Assuming that electronic controlled substance prescriptions phased in over 15 years, as 

described above, the annualized time-saving for eliminating these callbacks would be $316 

million (at 7% discount) or $346 million (at 3% discount). 

Electronic prescriptions could also reduce the patient’s wait time at the pharmacy. The 

number of original controlled substance prescriptions that could require public wait time is 

based on the estimated number of original prescriptions (approximately 328 million in 2008), 

reduced by 19 percent, to account for those prescriptions phoned to the pharmacy37 plus 

another 15 percent to remove those that are currently filled by mail order pharmacies or longterm care facilities.38 Assuming the average wait time is 15 minutes for the 81 percent of 

original prescriptions that are presented on paper to retail pharmacies (not mail order or long-

 

37 A 1999 Drugtopics.com survey indicated that 36% of all prescriptions were phoned in; because refills are 

usually authorized on the original prescription and do not require second calls, and slightly less than half of 

prescriptions are refills, the analysis uses 19% for phoned in prescriptions. 

38 Based on IMS Health 2007 channel distribution by U.S. dispensed prescriptions. http://imshealth.com, 

accessed April 16, 2008. 

April 2008 47 
term care prescriptions), at the current United States average hourly wage ($19.62)39, Table 

6-3 presents the annual estimates. 

Table 6-3: Costs Savings for Public Wait Time 

Year 

Original Paper 

Prescriptions 

Paper Prescriptions 

Avoided Hours Saved Cost-Savings 

2008 220,767,123 13,246,027 3,311,507 $64,971,764

2009 227,390,137 22,739,014 5,684,753 $111,534,862

2010 234,211,841 32,789,658 8,197,414 $160,833,271

2011 241,238,197 45,835,257 11,458,814 $224,821,937

2012 248,475,342 59,634,082 14,908,521 $292,505,173

2013 255,929,603 74,219,585 18,554,896 $364,047,063

2014 263,607,491 92,262,622 23,065,655 $452,548,160

2015 271,515,716 111,321,443 27,830,361 $546,031,680

2016 279,661,187 134,237,370 33,559,342 $658,434,299

2017 288,051,023 164,189,083 41,047,271 $805,347,452

2018 296,692,553 198,784,011 49,696,003 $975,035,572

2019 305,593,330 238,362,797 59,590,699 $1,169,169,521

2020 314,761,130 280,137,405 70,034,351 $1,374,073,974

2021 324,203,964 307,993,765 6,998,441 $1,510,709,420

2022 333,930,083 333,930,083 83,482,521 $1,637,927,055

Total $10,347,991,204

The annualized savings over 15 years would be $589 million (at 7% discount) or $646 

million (at 3% discount). 

The estimates for public wait time are upper bounds. They assume that the practitioner will 

transmit the prescription and that the pharmacists will open the record and fill it before the 

patient arrives at the pharmacy. It is probably more realistic to assume that only a fraction of 

these benefits will be gained particularly in the early years when pharmacies are still getting 

used to electronic prescriptions. There may also be some offsetting costs to the pharmacy. 

The industry estimates that about 20 percent of prescriptions written are never presented to 

pharmacies. If these are sent to pharmacies electronically and prepared before the patient 

arrives, the pharmacy will have spent time for which it will not be reimbursed if the patient 

does not pick up the prescription. (It may be reasonable to expect the 20 percent to decline 

with electronic prescriptions, although probably not to zero.) 

Table 6-4 presents the annualized benefits at a 7 percent and 3 percent discount rate. 

 

39 BLS, “Employer Costs for Employee Compensation,” December 2007, March 12, 2008. Table 2. All 

civilian workers. 

April 2008 48 
Table 6-4: Annualized Benefits 

7% 3% 

Callbacks Avoided $315,626,000 $346,242,000 

Public Wait Time Avoided $588,732,000 $645,839,000 

The benefits, both of which represent time savings, clearly exceed by a wide margin the costs 

of the Base Case and Options 1 and 2. The costs of Option 3 at $1.3 to $1.4 billion a year 

exceed the benefits, which would not, of course, include callbacks eliminated. 

6.3 QUALITATIVE BENEFITS 

DEA is proposing additional security requirements for electronic controlled substance 

prescriptions to ensure that electronic prescriptions for controlled substances do not become 

an easy route for widespread and undetectable diversion of controlled substances. Properly 

secure electronic prescribing systems have the potential to reduce prescription forgeries, 

which will protect practitioners from identity theft and misuse of their DEA registration 

numbers by practice staff and others. Secure pharmacy systems may help identify diversion 

that occurs at pharmacies. 

DEA has not attempted to quantify or monetize the benefits of the proposed rule that relate to 

diversion because of a lack of data on the extent of diversion of controlled substances 

through forged or altered prescriptions and alteration of pharmacy records. These benefits 

are, however, discussed qualitatively in this section. The immediate cost of misuse of 

prescription controlled substances is also reviewed in terms of data on deaths and emergency 

room (ER) visits that result from nonmedical use of these drugs. 

6.3.1 REDUCTION IN CONTROLLED SUBSTANCE PRESCRIPTION FORGERY

Diversion of controlled substances through forgery, doctor shopping (where a patient visits 

more than one practitioner to receive prescriptions for the same controlled substance), and 

alteration of pharmacy records is a growing problem. Controlled substances are diverted in a 

number of ways, some of which will not be affected by electronic prescriptions. For 

example, diversion occurs when: 

 Controlled substances are stolen from practitioners and pharmacies. 

 Practitioners knowingly write non-legitimate prescriptions. 

 Practitioners write prescriptions for people who have lied about symptoms to 

obtain the drugs. A commonly used term for these patients is “doctor shoppers,” 

people who routinely visit different doctors with the same ailment to obtain 

multiple prescriptions for controlled substances, usually pain relievers. These 

prescriptions are then filled at various pharmacies and the drugs are abused or 

sold on the illicit market. 

Although DEA does not expect the proposed rule to eliminate these problems, it may act as a 

deterrent to practitioners who write non-legitimate prescriptions and to doctor shoppers 

April 2008 49 
because it will be easier for States to monitor prescriptions when they are electronic through 

the use of State prescription monitoring programs. Digitally signed prescription records will 

make it very difficult for a practitioner to claim that a prescription has been forged or altered. 

Some States are already using prescription monitoring programs to identify practitioners who 

prescribe unusual quantities of controlled substances and patients filling multiple 

prescriptions at different pharmacies. 

Electronic prescriptions for controlled substances will directly affect the following types of 

diversion: 

 Stealing prescription pads or printing them, and writing non-legitimate 

prescriptions. 

 Altering a legitimate prescription to obtain a higher dose or more dosage units 

(e.g., changing a “10” to a “40”). 

 Phoning in non-legitimate prescriptions late in the day when it is difficult for a 

pharmacy to complete a confirmation call to the practitioner’s office. 

These are examples of prescription forgery that contribute significantly to the overall 

problem of drug diversion. DEA expects this rule to reduce significantly these types of 

forgeries because only practitioners with secure prescription-writing systems will be able to 

issue electronic prescriptions for controlled substances and because any alteration of the 

prescription at the pharmacy will be discernible from the audit log and a comparison of the 

digitally signed records. DEA expects that over time, as electronic prescribing becomes the 

norm, practitioners issuing paper prescriptions for controlled substances may find that their 

prescriptions are examined more closely. 

6.3.2 COST OF DIVERSION AND ABUSE OF PRESCRIPTION DRUGS

A reduction in forged controlled substance prescriptions could result in a reduction in drugrelated deaths and medical care. The 2006 National Survey on Drug Use and Health 

(NSDUH) found that 6.7 million people in the United States currently use prescription-type 

therapeutic drugs for nonmedical reasons.40 This nonmedical use of prescription drugs can 

lead to death and emergency room visits. The Substance Abuse and Mental Health Services 

Administration (SAMHSA) runs the Drug Abuse Warning Network (DAWN), a public 

health surveillance system that monitors drug-related visits to hospital emergency 

departments and drug-related deaths investigated by medical examiners and coroners. 

SAMHSA reported that in 2003, in six States (Maine, Maryland, New Hampshire, New 

Mexico, Utah, and Vermont) there were 352 deaths from misuse of oxycodone and 

hydrocodone, both prescription controlled substances.41 The 32 metropolitan areas that are 

part of DAWN reported 3,530 deaths from misuse of oxycodone and hydrocodone and 1,381 

deaths that involved the misuse of benzodiazepines (Schedule IV controlled substances) in 

 

40 Substance Abuse and Mental Health Services Administration. (2007). Results from the 2006 National Survey 

on Drug Use and Health: National Findings (Office of Applied Studies, NSDUH Series H-32, DHHS 

Publication No. SMA 07-4293). Rockville, MD. 41 The DAWN Report – Opiate-related Drug Misuse Deaths in Six States, 2003. Issue 19, 2006. 

April 2008 50 
2003.42 These numbers do not include the 624 suicides that involved benzodiazepines or 

opiates other than heroin and methadone.) The 32 metropolitan areas represent about 24 

percent of the United States population. 

In another report, SAMHSA stated that in 2004 there were 42,491 emergency room visits 

involving nonmedical use of hydrocodone, 36,559 visits for nonmedical use of oxycodone, 

and 144,000 visits for nonmedical use of benzodiazepines.43 By 2005, the number of 

emergency visits for nonmedical use of these drugs rose to 51,225 for hydrocodone, 42,810 

for oxycodone, and 172,388 for the benzodiazepines. For all nonmedical use of prescription 

opiates except methadone, the number of visits was about 155,000.44 ER visits for all 

controlled substances except methadone represented 60 percent of the 598,542 ER visits 

involving nonmedical use of drugs.45 (With methadone, they represent 67 percent of these 

ER visits.) About 33 percent of all ER visits for nonmedical use of drugs resulted in the 

person being admitted to the hospital; about 12 percent of ER visits resulted in the person 

being admitted to an intensive care unit. 

Using a value per life of $3 million, the costs of the 2003 deaths from misuse of prescription 

controlled substances in the six States is more than $1 billion. The cost of the 2003 deaths 

from misuse of prescription controlled substances in the 32 metropolitan areas is more than 

$10 billion. The cost of the 2005 emergency room visits is above $350 million (at $1,000 per 

visit), not including the cost of further in-patient care for those admitted. These costs are 

some fraction of the total cost to the nation. Nonetheless, they add to more than $11.35 

billion in one year. DEA has no basis for estimating what percentage of these costs could be 

addressed by the proposed rule. If, however, the proposed rule prevents even a small fraction 

of the deaths and emergency care the benefits will far exceed the costs. DEA notes that, at 

7.0 percent, the total annualized cost of the rule is $38 million, 0.3 percent of $11.35 billion. 

These costs also do not represent all of the costs of drug abuse to society. Drug abuse is 

associated with crime and lost productivity. Crime imposes costs on the victims as well as 

on government. DEA does not track information on controlled substance prescription drug 

diversion because enforcement is generally handled by State and local authorities. The cost 

of enforcement is, however, considerable. In 2007, DEA spent between $2,700 for a small 

case and $147,000 for a large diversion case just for the primary investigators; adjudication 

costs and support staff are additional. It is reasonable to assume that State and local law 

enforcement agencies are spending similar sums per case. Some cases involve multiple 

jurisdictions, all of which bear costs for collecting data and deposing witnesses. The rule as 

proposed could reduce the number of cases and, therefore, reduce the costs to governments at 

all levels. A reduction in forgeries would also benefit practitioners who would be less likely 

to be at risk of being accused of diverting controlled substances and of then having to prove 

that they were not responsible. 

 

42 Drug Abuse Warning Network, 2003: Area Profiles of Drug-Related Mortality, SAMHSA March 2005. 

43 The DAWN Report – Emergency Department Visits Involving Non-medical Use of Selected 

Pharmaceuticals. Issue 23, 2006. 

44 Drug Abuse Warning Network, 2005: National Estimates of Drug-Related Emergency Department Visits 

DAWN Series D-29, DHHS Publication No. (SMA) 07-4256, Rockville, MD, March 2007. 

45 Methadone is excluded because it may be obtained either by prescription or from narcotic treatment 

programs. 

April 2008 51 
6.4 CONCLUSION 

Electronic prescriptions for controlled substances would produce cost savings that may be 

well in excess of the costs of the rule for three of the four options considered. If the rule 

reduces diversion, it may also produce benefits in terms of reduced numbers of deaths and 

medical costs that far exceed the cost of the rule. The rule would also protect practitioners 

from misuse of their DEA registrations and reduce the costs to law enforcement. In contrast, 

a less secure electronic prescription system could greatly increase diversion, the deaths and 

medical costs associated with drug misuse, and the number of diversion cases. A less secure 

system would dramatically increase investigation costs because every provider and 

intermediary involved in a transaction would have to provide testimony to attempt to 

demonstrate that a prescription was not altered during transmission. The costs of such 

testimony would fall on law enforcement, service providers, and intermediaries. Finally, a 

less secure system would expose practitioners to the risk of identity theft, with the 

considerable costs associated with resolving those problems. 

April 2008 52 
CHAPTER 7: CONCLUSIONS 

This chapter discusses the limitations of the analysis and presents the overall conclusions. 

7.1 UNCERTAINTIES 

Any economic analysis involves some level of uncertainty about elements of the analysis. 

This is particularly true for this analysis, which must estimate costs for implementation of a 

new technology and project voluntary adoption rates. This section discusses the elements 

that have the greatest level of uncertainty associated with them. 

7.1.1 RATES OF ADOPTION

In 2004, the President called for a majority of Americans to have interoperable electronic 

health records within 10 years.46 This analysis does not project adoption of electronic 

prescribing to be that rapid in part because recent studies indicate that little progress has been 

made in health IT adoption outside of very large medical practices and systems. A recent 

report from the California HealthCare Foundation stated that “while larger physician groups 

are increasingly using health IT, those who practice alone or in small groups are no closer to 

using health IT now than they were three years ago.” The report noted that even when 

practices install EMR systems, they do not necessarily use them.47

The barriers to adoption are the high cost of the systems, the disruption that implementation 

creates in a practice, and uncertainty about the systems themselves.48 As discussed in 

Chapter 2, the pattern with software systems is that a large number of firms enter a market, 

but the vast majority of them fail, leaving a very few dominant providers.49 The health IT 

market is still in the early phases of this process. DEA has no basis for estimating when 

dominant players will emerge. The 15-year implementation period projected may be too 

conservative or too optimistic. 

7.1.2 COSTS TO SERVICE PROVIDERS

The time for reprogramming existing systems is estimated to be between 500 hours and 

2,000 hours. DEA based the upper estimate on information provided by the industry for 

DEA’s rulemaking regarding electronic orders for controlled substances. The actual cost to 

existing service providers is likely to vary widely. Some providers may meet all or virtually 

all of the requirements and need little reprogramming. Many of the requirements are 

 

46 California HealthCare Foundation, “Gauging the Progress of the National Health Information Technology 

Initiative: Perspectives from the Field.” January 2008. 

47 Ibid. 

48 California HealthCare Foundation, Snapshot: The State of Health Information Technology in California, 

2008. 

49 Bergin, T.J, “The Proliferation and Consolidation of Word Processing Software: 1985-1995.” IEEE Annals 

of the History of Computing. Volume 28, Issue 4, Oct.-Dec. 2006 Page(s):48 – 63. 

April 2008 53 
standard practice for software (e.g., access controls, automatic time outs) and should need 

minimal adjustments. Most electronic prescribing systems appear to present the data DEA 

would require on prescriptions. Any software firm that uses the Internet for any transaction 

will have digital signature capability. EMR systems must support two-factor authentication 

and control access to gain CCHIT certification. Nonetheless, DEA expects that for some 

existing providers, the requirements may take more than the estimated time. 

Another uncertainty on provider costs relates to the third-party audit and security provisions 

that are needed to be judged acceptable under the SysTrust, WebTrust, or SAS 70 audit 

protocols. DEA did not assign a cost to actions that might be needed to meet the security 

standards because it has no basis for determining what may be needed by what fraction of the 

providers. To compensate for this, DEA used a high estimate for the cost of the audit itself. 

These audits range in cost from $15,000 to $250,000 depending on the complexity of the 

firm and the IT systems. DEA is requiring that the audit focus on only 2 of the 5 elements 

usually covered by the audit, hence the upper bound might be estimated to be $100,000 for 

the initial audit and less than that for subsequent years even for a large firm. Most of the 

firms marketing these systems are not large, so even lower costs might be appropriate. To 

deal with the uncertainty of the potential costs of additional security steps, DEA used an 

estimate of $125,000 for the first year and $100,000 for later years. DEA notes that many 

firms may decide to obtain a full audit, covering all elements, but the added costs would not 

accrue to this rule. 

A final uncertainty of system provider costs relates to the proposed requirement for a back-up 

system for pharmacy records that would have to be at a separate location. Some pharmacy 

service providers already provide this, but it is possible that not all do. Nonetheless, DEA 

considers that the requirement may be standard business practice simply because the loss of 

the business records could have serious consequences unrelated to any DEA concerns. 

7.2 COSTS AND BENEFITS 

The costs of three of the four options considered ($19 million to $38 million annualized over 

15 years at 7 percent) are far lower than the potential cost savings even if all of those savings 

are not realized. For the Base Case, about two thirds of the costs are attributed to a single 

requirement – that the practitioner review a log of controlled substance prescriptions once a 

month. The cost of this proposed requirement is so great because, although the time required 

is low, the cost of a practitioner’s time and the number of practitioners are high. The cost of 

identity proofing in Options 1 and 2 is higher, because the cost of practitioner travel time. In 

Option 2, the cost of digital certificates is high because it is an annual cost. The costs to the 

service provider are mainly the costs of the annual third-party audit. DEA assumes that the 

service providers will recover their costs from the practitioners or pharmacies. 

The cost savings that may occur could total $900 million a year although this is an upper 

bound estimate. It is unlikely, especially in the early years, that all of public wait time 

savings will be gained. Until pharmacies receive a substantial percentage of prescriptions 

electronically and learn to check the incoming prescription records, there may be a 

substantial lag between system receipt and pharmacist action. There may also still be 

April 2008 54 
callbacks although some of these could be sent electronically. One uncertainty associated 

with callbacks is the frequency with which pharmacists will identify problems with electronic 

prescriptions. Although the prescriptions will be legible, pharmacists may find keying errors 

(e.g., wrong drug, wrong dosage unit, wrong form, etc.) and need to contact the practitioner 

to clarify the prescriptions. If practitioners have not checked formularies, either because they 

have turned off the function or because the particular formulary is not available to them, 

pharmacies will still need to do callbacks for formulary issues. In addition, the ability of eprescribing systems to identify contraindication problems depends on the system having a 

complete record of a patient’s medications and medical problems. Until EMR systems can 

interoperate with EMR systems at other practitioner offices to develop a complete medical 

history, the pharmacy will continue to be a principal means of identifying these issues. 

Needed contacts between a pharmacy and practitioner, whether electronic or telephone, will 

lower the cost savings for callbacks and for public wait time. 

The benefits of the security requirements would be a reduction in diversion of controlled 

substances that are obtained from forged, altered, or invalid prescriptions. DEA has no basis 

for estimating the current level of diversion from these activities and, therefore, no basis for 

an estimate of a potential reduction. The cost of misuse of prescription controlled 

substances, however, is extremely high. Misuse of prescription controlled substances in 

2003 was involved in almost 5,000 deaths in metropolitan areas that cover 25 percent of the 

United States population. The value of those deaths alone is above $10 billion. These drugs 

were also involved in more than 350,000 emergency room visits in 2005, a number that was 

more than 20 percent higher than the 2004 number. If the requirements of this rule reduce 

even 0.5 percent of these costs, the benefits will far outweigh the costs. DEA notes that a 

system that did not have the security controls DEA is proposing could lead to an upsurge of 

deaths and illness because it would facilitate diversion rather than limit it and make it far 

more difficult for law enforcement agencies to bring cases against the criminals involved. 

7.3 SMALL ENTITY IMPACTS 

DEA determined that this rule would affect a substantial number of small entities because 

almost all practitioners and all independent pharmacies are small businesses. The costs to 

these entities, however, are very low and would not impose a significant economic impact on 

them, being far below one percent of their annual revenues. DEA also notes that the 

proposed rule is voluntary; no practitioner or pharmacy would be required to handle 

electronic prescriptions for controlled substances. 

The service providers are not directly regulated by DEA and would be expected to recover 

their costs from DEA registrants. DEA nonetheless considered their costs. Many of these 

firms are small entities and may find complying with the security requirements, particularly 

the audit, a burden. The cost, however, is not so great that they will not be able to pass it on 

to customers. DEA considers it unlikely that any provider would attempt to market a product 

or service that could not be used for controlled substance records and, therefore, no provider 

will be disadvantaged by complying because all providers will incur costs and recover them 

from customers. The situation may be similar to certification of EMRs by CCHIT. Some 

were concerned that the standards would create barriers, but most of the companies certified 

April 2008 55 
have been small. The chairman of CCHIT, Mark Leavitt stated that the data on the revenues 

of firms that gained certification “laid to rest this concern that it was going to squeeze out 

small vendors. It actually seems to have done the opposite. It’s created a level playing 

field.”50

 

50 California HealthCare Foundation, “Gauging the Progress of the National Health Information Technology 

Initiative: Perspectives from the Field.” January 2008. 

April 2008 56 
April 2008 57 
APPENDIX A: WAGES, FRINGE BENEFITS, AND WEIGHTED 

AVERAGES 

Average hourly wages for following occupations: 

Physicians: $111.90 (June 2003) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $130.41 

Source: Allied Physicians Survey 

http://www.allied-physicians.com/salary_surveys/physician-salaries.htm

Hourly wage is based on weighted average annual salary of $223,808 divided by 2,000 to 

obtain hourly wage. Average was weighted based on total number of physicians in 

specialties likely to prescribe controlled substances, earnings of each specialty, and each 

specialty’s percentage share of total physicians in this universe. 

Dentists: $93.00 (reported for 2004, treated as June 2004 for indexing) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $103.78 

Source: “What Can a Career in Dentistry Offer You?” 

http://www.ada.org/public/careers/team/dentistry_fact.pdf

The online fact sheet is, in turn, based on ADA 2004 Survey of Dental Practice, 

Characteristics of Dentists in Private Practice and their Patients, American Dental 

Association. 

Hourly wage is based on reported average earnings of $185,940 of a dentist with his own 

practice, divided by 2,000. 

Mid-level practitioners: $35.64 (May 2006, treated as June 2006 for indexing) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $37.30 

Source: Office of Employment Statistics, May 2006 National Industry-Specific Occupational 

Employment and Wage Estimates. 

http://www.bls.gov/oes/current/naics4_621100.htm#b29-0000

Hourly wage for physicians’ assistants (Standard Occupational Classification (SOC) Code 

29-1071), taken as wage for all mid-level practitioners. 

Medical secretaries: $14.05 (May 2006, treated as June 2006 for indexing) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $14.70 

Source: Office of Employment Statistics, May 2006 National Industry-Specific Occupational 

Employment and Wage Estimates. 

http://www.bls.gov/oes/current/oes436013.htm

Hourly wage for medical secretaries in physicians’ offices (SOC Code 43-6013). 

Hospital human-resource assistants: $15.73 (May 2006, treated as June 2006 for indexing) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $16.56 

Source: Office of Employment Statistics, May 2006 National Industry-Specific Occupational 

Employment and Wage Estimates. 

http://www.bls.gov/oes/current/naics4_622100.htm#b43-0000

Hourly wage for hospital human-resource assistants (SOC Code 43-4161). 

April 2008 58 
Pharmacy technicians: $12.04 (May 2006, treated as June 2006 for indexing) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $12.60 

Source: Office of Employment Statistics, May 2006 National Industry-Specific Occupational 

Employment and Wage Estimates. 

http://www.bls.gov/oes/current/naics5_446110.htm#b29-0000

Hourly wage for pharmacy technicians (SOC Code 29-2052). 

Service provider support/sales staff: $39.21 (May 2006, treated as June 2006 for indexing) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $40.70 

Source: Office of Employment Statistics, May 2006 National Industry-Specific Occupational 

Employment and Wage Estimates. 

http://www.bls.gov/oes/current/oes414011.htm#nat

Hourly wage for sales representatives for computer-system design and related services (SOC 

Code 41-4011). 

Service provider information clerks: $15.70 (May 2006, treated as June 2006 for indexing) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $16.46 

Source: Office of Employment Statistics, May 2006 National Industry-Specific Occupational 

Employment and Wage Estimates. 

http://www.bls.gov/oes/current/oes434199.htm

Hourly wage for information and record clerks for computer-system design and related 

services (SOC Code 43-4199) 

Computer programmers: $33.42 (May 2006, treated as June 2006 for indexing) 

Adjusted to December 2007 (based on BLS Employment Cost Index): $35.19 

Source: Office of Employment Statistics, May 2006 National Industry-Specific Occupational 

Employment and Wage Estimates. 

http://www.bls.gov/oes/current/naics4_621100.htm#b15-0000

Hourly wage for computer programmers (SOC Code 15-1021). 

Fringe Benefits and Overhead 

Fringe benefits for health workers (except hospitals): 38.0 percent of wages 

Fringe benefits for hospital staff: 44.0 percent of wages 

Fringe benefits for service provider staff: 38.0 percent of wages 

Fringe benefits for computer programmers and pharmacy staff: 40.0 percent of wages 

Source: BLS Employer Cost of Employee Compensation, Table 14 for health workers, Table 

9 for others. 

http://www.bls.gov/news.release/pdf/ecec.pdf

Overhead for all offices in study: 49.0 percent 

Source: Grant Thornton, LLP, 12th Annual Government Contractor Industry Survey, 2006, p. 

8. 

April 2008 59 
The overhead is applied as a multiplier to wages plus fringes. Therefore, the multiplier to 

convert hourly wages to fully loaded hourly cost is: 

Health workers (except hospitals) and provider staff—1.38 x 1.49 = 2.06 

Hospital staff—1.44 x 1.49 = 2.15 

Computer programmers and pharmacy staff—1.40 x 1.49 = 2.09. 

Thus, fully loaded hourly costs are: 

 

Physicians 2.06 x 130.41 = $269.00 

Dentists 2.06 x 103.78 = $214.07 

Mid-level practitioners 2.06 x 37.30 = $76.94 

Medical secretaries 2.06 x 14.70 = $30.33 

Hospital HR staff 2.15 x 16.56 = $35.55 

Pharmacy technicians 2.09 x 12.60 = $26.23 

Service provider representatives 2.06 x 40.70 = $83.80 

Service provider clerks 2.06 x 16.46 = $33.89 

Computer programmers 2.09 x 35.19 = $73.24 

To obtain hourly cost for all practitioners and for all dentists and physicians together, average 

costs were weighted by each group’s percentage share of the total. A separate wage rate was 

calculated for physicians and dentists because turnover rates for these practitioners are 

assumed to be different from turnover rates for mid-level practitioners and are, therefore, 

costed separately. 

% all practitioners % all MDs and dentists 

Physicians 54.0 65.0 

Dentists 30.0 35.0 

Mid-levels 16.0 

Weighted growth rate for practitioners’ offices was based on the relative population shares of 

physicians and dentists in the affected universe as shown above. 

April 2008 60 
APPENDIX B: BIBLIOGRAPHY 

Bell, D.S. et al., “A Conceptual Framework for Evaluating Outpatient Electronic Prescribing 

Systems Based on their Functional Capabilities,” J. Am. Med. Inform Assoc. 2004; 11:60-70. 

Bell, D.S. et al., “Recommendations for Comparing Electronic Prescribing Systems: Results 

of An Expert Consensus Process,” Health Affairs, May 25, 2004, W4-305-317. 

Bergin, T.J, “The Proliferation and Consolidation of Word Processing Software: 1985-1995.” 

IEEE Annals of the History of Computing. Volume 28, Issue 4, Oct.-Dec. 2006 Page(s):48 – 

63. 

Bower, A.G., The Diffusion and Value of Healthcare Information Technology, Rand Health, 

2005. 

Bureau of Labor Statistics, Office of Employment Statistics, May 2006 National IndustrySpecific Occupational Employment and Wage Estimates. 

Bureau of Labor Statistics, Employer Costs of Employee Compensation – September 2007, 

December 11, 2007. 

California HealthCare Foundation, “Gauging the Progress of the National Health Information 

Technology Initiative: Perspectives from the Field.” January 2008. 

California HealthCare Foundation, Snapshot: The State of Health Information Technology in 

California, 2008. 

Centers for Disease Control and Prevention, “Electronic Medical Record Use by OfficeBased Physicians and Their Practices: United States 2006.” Advance Data from Vital and 

Health Statistics, Number 393, October 26, 2007. 

Certification Commission for Healthcare Information Technology, CCHIT Ambulatory 

Functionality 2007 Final Criteria – March 16, 2007. 

Certification Commission for Healthcare Information Technology, CCHIT Security Criteria 

2007 Final Criteria – March 16, 2007. 

Drug Abuse Warning Network, 2003: Area Profiles of Drug-Related Mortality DAWN 

Series D-27, DHHS Publication No. (SMA) 05-4023, Rockville, MD, March 2005. 

Drug Abuse Warning Network, 2005: National Estimates of Drug-Related Emergency 

Department Visits DAWN Series D-29, DHHS Publication No. (SMA) 07-4256, Rockville, 

MD, March 2007. 

April 2008 61 
Fonkych, K., Taylor, R. “The State and Pattern of Health Information Technology Adoption, 

Rand Health, 2005. 

Foundation of Research and Education, American Health Information Management 

Association. “Report on the Use of Health Information Technology to Enhance and Expand 

Health Care Anti-Fraud Activities,” prepared for the Office of the National Coordinator, US 

Department of Health and Human Services, September 30, 2005. 

Girosi, F. et al., Extrapolating Evidence of Health Information Technology Savings and 

Costs, Rand Health, 2005. 

Grant Thornton, LLP, 12th Annual Government Contractor Industry Survey, 2006. 

Grossman, Joy M. et al., “Physicians’ Experiences Using Commercial E-Prescribing 

Systems,” Health Affairs, 26, no. 3 (2007), w393-w404. 

Hing, E., Burt, CW. “Characteristics of Office-Based Physicians and their Practices: United 

States, 2003-2004,” Series 13, Number 164. Hyattsville, MD: National Center for Health 

Statistics. January 2007. 

Hing, E. et al. “Electronic medical record use by office-based physicians and their practices: 

United States, 2006.” Advance data from vital and health statistics; no. 393. Hyattsville, MD: 

National Center for Health Statistics. 2007. 

National Association of Chain Drug Stores, “The Chain Pharmacy Industry Profile 2003.” 

National Center for Health Statistics, Health, United States, 2007 With Chartbook on Trends 

in the Health of Americans, Hyattsville, MD: 2007. 

National Institute of Standards and Technology. Special Publication 800-63-1, Information 

Security: Electronic Authentication Guideline. February 2008. 

Rand Health, “Electronic Prescribing Systems: Making it safer to take your medicine?” 

Research Highlights, 2005. 

Rand Health, “Health Information Technology: Can HIT Lower Costs and Improve 

Quality?” 2005. 

Small Business Administration. Small Business Size Standards. North American Industry 

Classification System (NAICS). 

Substance Abuse and Mental Health Services Administration. (2007). Results from the 2006 

National Survey on Drug Use and Health: National Findings (Office of Applied Studies, 

NSDUH Series H-32, DHHS Publication No. SMA 07-4293). Rockville, MD. 

April 2008 62 
The DAWN Report – Opiate-related Drug Misuse Deaths in Six States, 2003. Issue 19, 

2006. 

The DAWN Report – Emergency Department Visits Involving Non-medical Use of Selected 

Pharmaceuticals. Issue 23, 2006. 

U.S. Bureau of Labor Statistics, 2006 National Occupational Employment and Wage 

Estimates. 

U.S. Census Bureau, Economic Census 2002. http://www.census.gov/econ/census02/. 

U.S. Department of Health and Human Services. “HIPAA Security Guidance.” Issued 

12/28/2006. 

U.S. Drug Enforcement Administration, Economic Impact of the Electronic Orders Rule, 

March 2005, http://www.deadiversion.usdoj.gov/ecomm/csos/csos_eia_03112005.pdf. 

Wang, CJ. Et al. “Functional Characteristics of Commercial Ambulatory Electronic 

Prescribing Systems: A Field Study,” Journal of the American Medical Informatics 

Associations, Vol. 12, No. 3, May/June 2005. 

www.ada.org/ada/prod/survey/faq.asp, accessed 1/16/2008. 

www.allied-physicians.com/salary-surveys, accessed 1/16/2008. 

www.cchit.org/choose/ambulatory/2007/index.asp, accessed 12/7/07. 

www.ffiec.gov/ffiecinfobase/booklets/audit/audit_06_3_party.html, accessed 12/7/07. 

www.nacds.org/user-assets/pdfs/facts_resources/2006/Retail_Outlets2006.pdf, accessed 

1/18/2008. 

www.nacds.org/wmspage.cfm?parm1=507, accessed 1/18/2008. 

www.surescripts.com/get-connected.aspx?ptype=physician, accessed 12/5/07. 

April 2008 63