# ECONOMIC IMPACT ANALYSIS

OF THE

INTERIM FINAL ELECTRONIC PRESCRIPTION RULE

Drug Enforcement Administration U.S. Department of Justice

March 20 1 0

### i

### ii



## Table of Contents

EXECUTIVE SUMMARY

................................ ................................ ................................ 1

CHAPTER 1: INTRODUCTION

................................ ................................ ....................... 5

1.1 BACK GROUND

................................ ................................ .............................. 5

1.2 ELECTRONIC PRESCRIPTIONS

................................ ................................ ...... 6

1.3 OPTIONS CONSIDERED

................................ ................................ ............... 8

1.4 OR GANIZATION OF THIS ANALYSIS

................................ ....................... 9

CHAPTER 2: AFFECTED UNIVERSE

................................ ................................ .......... 11

2.1 PHYSICIANS, MID

- LEVEL PRACTITIONERS, AND DENTISTS

.......... 11

2.2 PHYSICIANS’ AND DENTISTS’ OFFICES

................................ ............... 13

2.3 HOSPITALS, CLINICS, AND PHARMACIES

................................ ............ 14

2.4 APPLICATION PROVIDERS

................................ ................................ ....... 15

2.5 PRESCRIPTIONS

................................ ................................ .............................. 15

CHAPTER 3: UNIT COSTS

................................ ................................ ............................ 17

3.1 WAGE RATES

................................ ................................ ................................ .. 17

3.2 UNIT LABOR COSTS

................................ ................................ ...................... 18

3.3 BASIS OF COSTS OTHER THAN TIME

................................ ........................ 20

3.4 SUMMARY OF UNIT COSTS

................................ ................................ ......... 21

CHAPTER 4: TOTAL COSTS

................................ ................................ ......................... 23

4.1 OFFICES OF PHYSICIANS AND DENTISTS

................................ ................ 23

4.2 HOSPITALS AND CLINICS

................................ ................................ ........ 38

4.3 PHARMACIES

................................ ................................ ................................ .. 41

4.4 APPLICATION PROVIDERS

................................ ................................ .......... 43

4.5 O PTIONS

................................ ................................ ................................ ........... 46

4.5.1 Option 2

– Required Use of Biometrics

................................ ...................... 46

4.5.2 Option 3

- Callbacks

................................ ................................ ................... 48

4.5.3 Summary of cost of options

................................ ................................ ........ 51

CHAPTER 5: SMALL ENTITY ANALYSIS

................................ ................................ . 53

5.1 CHARACTERISTICS OF SMALL ENTITIES

................................ ............. 53

5.2 SMALL ENTITY COSTS

................................ ................................ .............. 54

CHAPTER 6: BENEFITS

................................ ................................ ............................... 57

6.1 INTRODUCTION

................................ ................................ .............................. 57

6.2 QUANTIFIED BENEFITS

................................ ................................ ................ 57

6.3 QUALITATIVE BENEFITS

................................ ................................ ............. 65

6.3.1 Reduction in Controlled Substance Prescription Forgery

........................... 65

6.3.2 Cost of Diversion and Abuse of Prescription Drugs

................................ ... 66

6.3.3 Medication Errors

................................ ................................ ....................... 67

6.4 CONC LUSION

................................ ................................ ................................ .. 69

CHAPTER 7: CONCLUSIONS

................................ ................................ ...................... 71

7.1 UNCERTAINTIES

................................ ................................ ............................ 71

7.1.1 Rates of Adoption

................................ ................................ ....................... 71

7.1.2 Co sts to Application Providers

................................ ................................ ... 71

7.1.3 Practitioner Costs

................................ ................................ ........................ 72

### iii

7.2 COSTS AND BENEFITS

................................ ................................ .................. 72

7.3 SMALL ENTITY IMPACTS

................................ ................................ ............. 74

7.4 OTHER ISSUES

................................ ................................ ................................ 74

### iv



## List of Exhibits

Exhibit ES

- 1: Annualized Costs by Option

................................ ................................ ........ 2

Exhibi t 2

- 1: Number of Practitioners

................................ ................................ ................ 13

Exhibit 2

- 2: Practitioner Growth Rate

................................ ................................ ............. 13

Exhibit 2

- 3: Dental Office Estimate

................................ ................................ ................ 14

Exhibit 2

- 4: Practice Growth Rates

................................ ................................ ................. 14

Exhibit 2

- 5: Number of Hospitals/Clinics and Pharmacies

................................ ............. 15

Exhibit 2

- 6: Application Provider Estimates

................................ ................................ ... 15

Exhibit 2

- 7: Prescription Estimates

– Year 1

................................ ................................ ... 16

Exhibit 3

- 1: Compensation Rates

................................ ................................ .................... 17

Exhibit 3

- 2: Unit Costs

................................ ................................ ................................ .... 21

Exhibit 4

- 1: Cost Elements for Practitioners

................................ ................................ ... 23

Exhibit 4

- 2: Growth Rates for Practitioners

................................ ................................ ..... 24

Exhibit 4

- 3: Implementation Rates for Practitioners

................................ ........................ 24

Exhibit 4

- 4: Cumulative Offices and Registrants

................................ ............................. 25

Exhibit 4

- 5: Cumulative Registrants

................................ ................................ ................ 26

Exhibit 4

- 6: Present and Annualized Value of Identity Proofing

................................ ..... 27

Exhibit 4

- 7: Present Value of Application for Identity Proofing

................................ ..... 29

Exhibit 4

- 8: Number of Registrants over Time

................................ ............................... 30

Exhibit 4

- 9: Present and Annualized Cost of Regis tration Checks

................................ . 31

Exhibit 4

- 10: Unit Training Cost by Office Size and Type

................................ .............. 32

Exhibit 4

- 11: Number of Start

- Ups per Year

................................ ................................ ... 32

Exhibit 4

- 12: Present and Annualized Value of Logical Access Control Training

.......... 33

Exhibit 4

- 13: Cost of Granting Access by Size and Office Type and Occasion for Granting

................................ ................................ ................................ ............................ 34

Exhibit 4

- 14: Estimated Number of New Offices, Offices with EPCS by Year

.............. 35

Exhibit 4

- 15: Present and Annualized Value of Granting of Access

................................ 36

Exhibit 4

- 16: Offices of Physicians and Dentists with Implemented EPCS

.................... 36

Exhibit 4

- 17: Present Value of Security Log Review

................................ ....................... 37

Exhibit 4

- 18: Cost Summary for Practitioners’ Offices

................................ ................... 37

Exhibit 4

- 19: Hospital/Clinic Implementation Schedule

................................ .................. 38

Exhibit 4

- 20: Hospitals/Clinics and Practitioners in Hospitals Starting EPCS

................ 39

Exhibit 4

- 21: Costs for a Hospital/Clinic ID Check

................................ ......................... 39

Exhibit 4

- 22: Hospital/Clinic Costs Undiscounted Future Values

................................ .. 40

Exhibit 4

- 23: Hospital/Clinic Present and Annualized Values

................................ ......... 41

Exhibit 4

- 24: Pharmacy Costs Present and Annualized Values

................................ ...... 43

Exhibit 4

- 25: Number of Application Providers

................................ .............................. 44

Exhibit 4

- 26: Undiscounted Future Values of Application Provider Costs

..................... 45

Exhibit 4

- 27: Present and Annualized Values of Application Provider Costs

................ 45

Exhibit 4

- 28: Annualized Costs by Item and by Sector

-- 7.0 percent

.............................. 46

Exhibit 4

- 29: Annualized Costs by Item and by Sector

-- 3.0 percent

.............................. 46

Exhibit 4

- 30: Phase

- in of Hospital Beds and Clinics

................................ ....................... 47

Exhibit 4

- 31: Present Value and Annualized Costs for Biometric Option

...................... 48

Exhibit 4

- 32: Number of Calls to Physicians and Dentists

................................ ............. 49

Exhibit 4

- 33: Costs for Callbacks by Office Type

................................ ........................... 50

### v

Exhibit 4

- 34: Costs for Callbacks by Year Present Value and Annualized

..................... 50

Exhibit 4

- 35: Annualized Costs by Option

................................ ................................ ...... 51

Exhibit 5

- 1: SBA Definitions of Small Entities

................................ ................................ 53

Exhibit 6

- 1: Cost Savings of Callbacks Avoided

................................ ............................ 59

Exhibit 6

- 2: Present Value and Annualized Cost Savings for Callbacks

........................ 60

Exhibit 6

- 3: Costs Savings for Public Wait Time

................................ ............................ 61

Exhibit 6

- 4: Annualized Gross Benefits

................................ ................................ .......... 62

Exhibit 6

- 5: Estimated Prescription Paper Records

................................ ......................... 63

Exhibit 6

- 6: Estimated Prescription Storage Cost with and without Electronic Prescriptions

................................ ................................ ................................ ...................... 64

Exhibit 6

- 7: Annualized and Discount Value of Reduced Storage Cost

......................... 64

### 1



## EXECUTIVE SUMMARY

Under the Controlled Substances Act (CSA), DEA is required to maintain a closed system of controls on controlled substances. For Schedule II controlled substances,

which have the highest potential for abuse and dependenc e of those drugs with an accepted medical use in treatment in the United States, the CSA mandates that, with very limited exceptions, a pharmacist may only dispense a Schedule II controlled substance if

there is an original written prescription from a practitioner. For Schedule III through IV controlled substances, the pharmacist may dispense if there is a written (original or fax of original ) or oral prescription from a practitioner. DEA is giv ing practitioner s the option of signing and transmitting controlled substance prescriptions electronically; pharmacies

will maintain records of these prescriptions electronically. The interim final rule for electronic prescriptions for controlled substances is an additio n to, not a replacement of, the existing rules for controlled substance prescriptions. Practitioners will continue to be

able to issue controlled substance prescriptions on paper or, for Schedule III

- V substances, fax or call in prescriptions.

DEA is all ow ing, but not requiring , electronic prescriptions for controlled substances if

the application s used to create, sign, transmit, and process controlled substance prescriptions meet certain requirements that DEA has identified as being necessary to

prevent the misuse of the applications for diversion and to ensure that the records will be usable in legal actions if needed. DEA examined three options. Under Option 1, practitioners must obtain identity proofing and a two

- factor credential from a third

- party that is recognized by a federal authority as conducting identity proofing that meets NIST Special Publication 800

- 63

- 1 Level 3. Institutional practitioners can conduct this identity proofing in

- house, as part of their credentialing. The two

- factor creden tial must meet

NIST SP 800

- 63

- 1 Level 3; if one of the factors is a hard token, it must be separate from the computer to which the practitioner is gaining access. Once the practitioner has the

two

- factor credential, two people at the practice must set acc ess controls to ensure that only DEA registrants are allowed to approve and sign controlled substance prescriptions; one of the people must be a registrant. The two

- factor authentication protocol will be used to sign the prescription; the application must digitally sign the record at signing. Alternatively, the practitioner could use his own digital certificate to digitally sign the prescription content required by DEA. Information not required by DEA may be added to a prescription after signing and befo re transmission. Pharmacies (or the last intermediary) would also have to digitally sign the controlled substance prescription on receipt and archive that record. Pharmacy and prescription applications have to maintain

an internal audit trail. All appli cation providers will have to obtain a third

- party audit every second year to confirm that the application meets DEA’s requirements; if a DEA

approved certification organization tests applications for compliance, that certification may replace the third pa rty audit. Practices and pharmacies must review computer

generated logs of security incidents, when they occur.

### 2

Option 2 differs from Option 1 only in that it would require that the two

- factor authentication be a hard token and biometric. Option 3 would impose no security requirements on the application providers or users. Some application providers might need to reprogram their applications to capture or transmit all of the basic information that DEA requires on a prescription, but costs for this repro gramming have not been estimated. Because there is no indication on electronic prescriptions that they have been signed and no assurance that the practitioner listed on the prescription in fact issued it, Option 3 would require pharmacies to phone the pra ctitioner to verify each electronic controlled substance prescription received.

COSTS

DEA estimates the pharmacies will implement electronic prescribing in the first year, hospitals and clinics over the first five years, and practitioners over seven year s. For practitioners, implementation after the seventh year accounts for the addition of new offices and practitioners. DEA estimates that the costs of the options range from $43 million for Option 1 to $1.54 billion for Option 3, annualized over 15 year s at 7 percent

discount rate . Exhibit ES

- 1 presents the estimated annualized costs of all options.

Exhibit ES

- 1 : Annualized Costs by Option

7.0 percent 3.0 percent

Option 1 $43,329,829 $41,778,910

Option 2

– Required Use of Biometrics $53,864,576 $51,092,582

Option 3

– Callbacks $1,535,922,056 $1,604,555,706



### Most of the direct practitioner cost in Options 1 and 2 is driven by the requirement to obtain identity proofing and renew the credential every three years and by the requirement to check security incident logs. The application provider costs are primarily

the costs of the initial reprogramming.

BENEFITS

One benefit of the rule that can be quantified and monetized

– reductions in callbacks ($420 million) (at 7.0 percent)

– if fully reali zed, far exceed s the cost of two of the three options considered. (The reduction in callbacks does not apply to Option 3.) These benefits are, however, gross benefits that accrue to the use of any electronic prescription application and should be compare d to the total cost of such applications rather than the incremental cost of compliance with DEA’s requirements. Pharmacies will also achieve

cost

- savings from the reduced need to store paper prescriptions; DEA estimates the

annualized cost

- savings of $1. 38 million, which offsets 70 percent of the annualized cost of pharmacy requirements ($2.04 million) (both at 7 percent).

DEA expects that there will be reduced medication errors linked to more readable prescriptions, but decided that it did not have a re asonable basis for quantifying the

benefits. Another benefit of electronic prescriptions for controlled substances that is

### 3

ascribable to the rule, but not easily quantified and monetized, will come from reductions in controlled substance prescription forg ery and alteration and, therefore, the reduction in diversion and abuse of controlled substances, with all of its consequences for public health and safety.

SMALL ENTITY IMPACTS

The rule will have an impact on a substantial number of small entities. The economic impact on those directly regulated by this rule will not be significant under Options 1 and

2 . DEA estimates that the direct first

- year costs to practitioners for identity proofing will range from about $138, with periodic costs for renewal of a bout $50 , which represents

less than 0. 2 percent of the net income of the lowest paid physician. For pharmacies, the

incremental cost that their application providers may pass on will be less than $ 100 in the first year and less than $ 40 a year in the out years, which represents less than 0.01 percent of the average independent pharmacy’s annual sales. DEA, therefore, has determined

that the rule w ill not impose a significant economic impact on small entities directly regulated by DEA.

Application providers are not directly regulated by DEA. The rule indirectly affects them

because DEA w ill require that its registrants use only application s and application providers that meet its requirements. DEA recognizes that the requirements may impose a sig nificant impact on application providers, many of which are small entities, but the costs are not so great that a n application provider will not be able to recover them from customers or that the incremental price increase will discourage customers from

pu rchasing a n application

.

### 4

### 5



## CHAPTER 1: INTRODUCT ION

1.1 BACKGROUND

Under the Controlled Substances Act (CSA) 1 

### , DEA is required to maintain a closed system of distribution for controlled substances. DEA publishes the implementing regulations in Tit le 21 of the Code of Federal Regulations. 2 

### These regulations are designed to ensure an adequate supply of controlled substances for legitimate medical and other purposes, and to deter the diversion of controlled substances to illegal purposes.

Controlled substances include narcotics, stimulants, depressants, hallucinogens, and anabolic steroids that have a potential for abuse and psychological and physical dependenc e . DEA divides controlled substances into Schedules I through V. Schedule I

sub stances have a high potential for abuse and no accepted medical use in treatment in

the United States and, therefore, may not be dispensed. Schedule II through V substances have accepted medical uses and also have potential for abuse and dependence. They may be dispensed; except for Schedule V substances, controlled substances cannot generally be dispensed except in response to a prescription.

For Schedule II controlled substances, which have the highest potential for abuse and dependenc e of the medicati ons with accepted medical uses in treatment in the United

States , the CSA mandates that, except in emergency circumstances, a pharmacist may only dispense a Schedule II controlled substance if there is a written prescription from a practitioner. For patie nts in long term care facilities or hospices, prescriptions for Schedule II substances may be written and manually signed and faxed with the fax serving as the original prescription. Most Schedule II prescription s , however, are written with the original p rescription presented to the pharmacy before dispensing. Schedule II prescriptions may not be refilled; a new prescription must be issued. For Schedule III and IV controlled substances, the pharmacist may dispense if there is a written or oral prescripti on from a practitioner; faxed prescriptions may serve as the original prescription, but must be written and signed prior to being faxed . Regulations implementing the prescription requirements are found in 21 CFR part 1306.

Under the regulations, a prescr iption for a controlled substance may be issued only by an individual practitioner who is authorized to prescribe by the S tate in which he is licensed to practice and is registered with DEA, or exempted from registration. To be valid, the prescription mus t be written for a legitimate medical purpose by an individual practitioner acting in the usual course of professional practice. Every controlled substance prescription must contain the name and address of the patient, the drug name, strength, dosage form and quantity, directions for use, and the name, address, and DEA registration number of the practitioner. Every prescription that is written must be dated as of, and signed on, the day it is issued

.

1 21 U.S.C. 801 et seq.

2 21 CFR parts 1300

- 1316.

### 6

A prescription may be filled only by a pharmacist acti ng in the usual course of professional practice who is employed in a registered pharmacy. The prescribing practitioner is responsible in case the prescription does not conform in all essential respects to the law and regulations. A corresponding liabilit y rests upon the pharmacist who fills a prescription not prepared in the form prescribed by DEA regulations.

With respect to records, the pharmacy must maintain a paper file of all prescriptions, consisting of the original prescriptions, or, where allowed , the facsimiles of the original written prescriptions , or written documentation of oral prescriptions. The pharmacy must also maintain records of when the prescription was filled and by whom, for both original prescriptions and any partial fillings or re fillings. Practitioners are not required to maintain copies of prescriptions written or other records of prescriptions (unless issued

for maintenance or detoxification treatment). Consequently, although practitioners create the record, pharmacies maintai n it. This division between the person who creates the record and the person who retains it makes the integrity of the record particularly important.

Diversion of controlled substances may occur in a number of ways. With prescriptions, diversion may tak e place if a practitioner knowingly or otherwise writes a prescription for a person who does not have a legitimate need for it. Prescriptions may also be altered (e.g., changing a ―10‖ to ―40‖ or ―100‖) or forged. Prescription pads may be stolen to

creat e forgeries or prescriptions may be used to create fake prescription forms. Pharmacy records can be altered to hide illegal dispensing or theft by pharmacy employees

. Practitioners and pharmacists may illegally dispense substances.

DEA’s recordkeeping r equirements and its concern about its ability to determine the integrity of the prescription record are directed toward preventing diversion and having a legally defensible record to prove that diversion has occurred. With paper prescriptions, the signed prescription provides a provable link to the prescribing practitioner. Forgeries can usually be detected by handwriting experts. As a result, a practitioner whose prescriptions are altered or forged can prove that he or she did not issue the suspect

pres criptions, but a practitioner who issues prescriptions for other than legitimate

purposes cannot deny them and can be subject to administrative, civil, and criminal penalties. Similarly, paper records held at pharmacies can be compared with pharmacy

inven tories to determine if all drugs dispensed were dispensed legally.

1.2 ELECTRONIC PRESCRIPT IONS

Industry has asked DEA to develop regulations that will allow the creation and transmission of electronic prescriptions for controlled substances

. Many partie s in the healthcare industry are encouraging the adoption of electronic prescriptions because such prescriptions have the potential to improve patient safety by reducing medical errors that arise from misread or misunderstood prescriptions. From DEA’s per spective, electronic prescriptions have distinct advantages, if created in a way that reduces the possibility of forgery or alteration. The reality of the speed of electronic communications, however, is

### 7

that e lectronic prescriptions could also open a new avenue for rapid diversion, which could leave no trail that DEA could use to act against those diverting controlled substances. A study conducted for the Department of Health and Human Services ( HHS ) by the American Health Information Management Associati on, ―Report on the Use of Health Information Technology to Enhance and Expand Health Care Anti

- Fraud Activities,‖ noted that ― With regard to fraud, e

- prescribing presents a new vulnerability because of the increased velocity of authenticated automated tran sactions.‖ 3 

### The report indicated that electronic systems may help identify fraud over the long term, when there are integrated health record networks with anti

- fraud analytical tools built into them.

Electronic records are easy to create and relatively easy to alter without the alteration being detectable. Without proper protections, a criminal could open an account, use a practitioner’s DEA number to generate a fake prescription, send it to multiple pharmacies over a wide area, have confederates pick up the drugs, and close the account within a few

hours. Because DEA registration numbers are publicly available, criminals could do this repeatedly without using any one DEA registration number more than once, making it unlikely that p harmacists would notice a pattern. Without proper controls, electronic prescriptions could create the potential for organized, widespread, and undetected

dive rsion of controlled substances.

To the extent that electronic pr escriptions for noncontrolled substances are being issued at present, they are signed , if at all, electronically, with personal identification numbers (PINs) or using some combination of passwords and user IDs and transmitted over closed

networks or the In ternet through three to five intermediaries who may open the prescription files to convert them and add information, such as routing and payer data.

Convert ing may be required if the pharmacy application is not compatible with the practitioner’s prescribing application

. 4 

### The application providers authorize the practitioners to use the application

. Some provider s allow practitioners to enroll online, without any assurance that the person is who he claims to be. Some application s authorize anyon e in the practice to use the application so that the application cannot link a specific practitioner to a prescription. Some applications allow one practitioner to create a prescription and other practitioners to sign it. None of the applications transmi ts an indication that the prescription was, in fact, signed. At the pharmacy, the prescription translates directly into the pharmacy application , and the records are maintained electronically. Electronic prescriptions are generally created to conform to the format developed by the National Council for Prescription Drug Programs (NCPDP), SCRIPT. Although SCRIPT includes all of the standard DEA data elements, it does not mandate their use. Studies of electronic prescriptions have found that the transmitte d prescriptions sometimes are missing data, which indicates that the applications are not necessarily establishing required fields for transmission.

3 Foundation of Research and Education, American Health Information Management Association. ― R eport on the Use of Health Information Technology to Enhance and Expand Health Care Anti

- Fraud Activities,”

prepar ed for the Office of the National Coordinator, US Department of Health and Human Services, September 30, 2005.

4 The ability to open and read a file depends on having a standard format for the file and on being able to read the opening instructions accura tely. A standard format, by itself, does not ensure interoperability.

### 8

This existing e lectronic prescription system is not sufficient to protect the transactions as the CSA requ ires. From DEA’s perspective

, the existing system has several fundamental

flaws.

 The system relies on application providers to authenticate practitioners and

control the integrity of the transaction without ensuring that the application providers check t he identity of the practitioner, limit access for prescription signing, or use credential s that allow only authorized practitioners to sign a prescription. In addition, the application providers are not subject to security requirements for their own appli cation s. DEA would have to prove that the third party was not at fault before it could successfully take action against a registrant who had been a party to diversion. For example, if a practitioner denied issuing prescriptions and claimed they had been forged, DEA would have to prove that the third party had not issued authorization to someone else to use the practitioner’s name and DEA registration number and that none of the third party’s employees or outside hackers had used the application to
generat e false prescriptio ns in the practitioner’s name.

 The application does not provide for record integrity. Even a closed transmission network does not protect against insider actions. Many computer crimes, such as identity thefts, are committed by insiders who have the knowledge to overcome internal protections. Electronic prescriptions are currently routed through three to five parties between the practitioner and pharmacy; although this movement is usually entirely automatic, insiders at any of the inter mediary firms have the ability and the opportunity to alter or add records. The existing security requirements for these parties are focused on preventing disclosure of the information rather than ensuring the integrity

of the records.

 The application p rovides limited protection of the record’s integrity once it reaches the pharmacy.

Overall, the existing electronic prescription applications provide no assurance of security against identity theft, insider attacks, or outsider attacks. Although some exis ting applications might have voluntarily implemented effective security measures, they are not legally obligated to do so and

– in the absence of binding regulatory requirements

– there is no way to ensure that they or others who might enter the market wil l have effective measures in the future. With prescriptions moving through multiple parties from creation to dispensing, a security failure at any link in the chain could undermine the entire system, often leaving no evidence of the problem.

1.3 OPTIONS CONSIDERED

DEA has developed estimates for three options.

### 9

Option 1

Under Option 1, each registrant is required to obtain identity proofing and an credential from a federally recognized credential service provider (CSP). The registrant must complete and submit an application to the CSP, which may require in

- person identity proofing or conduct remote identity proofing. The CSP will then issue either a credential

or the means to download a two

- factor credential. For institutional practitioners (i.e., hospitals and clinics), identity proofing may be conducted by the credentialing office within the institutional practitioner.

The electronic prescription application must allow the setting of logical access controls. Two persons, one of whom must be a r egistrant (for private practices), must enter the

data to activate the access controls that limit who can indicate that a controlled substance prescription is ready to sign and sign the prescription. The application must meet certain requirements for info rmation displayed and require that the registrant use his two

- factor authentication to sign the prescription. The application must have an internal audit trail and run a daily check for any security events. When such an event occurs, the application

must generate a report, which a person designated to set logical access controls must review to determine whether the use of the application has been compromised. The pharmacy application must also conduct checks for security events. Application providers mu st obtain a third

- party audit to determine whether the application meets the requirements of the rule. If a certification organization conducts checks to make this determination, DEA may approve their certification as a substitute for a third

- party audit.

Option 2

Option 2 is the same as Option 1 except that the two

- factor credential requires a

biometric and a hard token.

Option 3

Option 3 imposes no requirements for identity proofing, authentication, or application security attributes. Sole reliance for security is placed on a requirement for a callback from the pharmacy to the practitioner office to confirm the legitimacy of the prescription for every electronic prescription for a controlled substance.

1.4 ORGANIZATION OF THIS ANALYSIS

The remain der of this document is organized into the following chapters:

 Chapter 2

– Affected Universe

 Chapter 3

– Unit Costs

 Chapter 4

– Total Costs

 Chapter 5

– Small Entity Analysis

### 10

 Chapter 6

– Benefits

 Chapter 7

– Conclusions

### 11



## CHAPTER 2: AFFECTED UNIVERSE

The rule potentially affects any person authorized under State law to prescribe controlled substances and registered with DEA as an individual practitioner or a practitioner exempt

from the requirement of registration. It also directly affects pharmacies, ho spitals /clinics

, and provider s of the software applications that enable electronic prescription s at the practitioner and pharmacy . Some costs vary with individual registrants; other costs vary with number of firms, institutions, or individual pharmac ies

. Accordingly, DEA has developed estimates for numbers of entities in the following groups.

 Physicians

 Mid

- level practitioners

 Dentists

 Pharmacists

 Pharmacy technicians

 Physicians’ and dentists’ offices

 Hospitals and clinics

 Pharmacies

 Application providers

This chapter discusses estimates of the number of entities that will incur costs for compliance if they elect to issue or receive electronic prescriptions for controlled substances. The rule will not require any registrant to issue or accept el ectronic prescriptions for controlled substances; paper and, where permitted, oral and faxed prescriptions are still allowed.

2.1 PHYSICIANS, MID

- LEVEL PRACTITIONERS, AND DENTISTS

As of February 2009, DEA had 1.23 million registered individual practitio ners. 5 

### Not all of these, however, are likely to prescribe controlled substances or do so often enough to justify any investment in an electronic prescription application. For example, veterinarians, optometrists, animal shelters, ambulance services, etc. rarely if ever prescribe controlled substances. Similarly, many physician specialties either do not prescribe any controlled substances (anesthesiologists, radiologists, pathologists) or do not often prescribe controlled substances as part of their usual practices (dermatologists, obstetricians/gynecologists, ophthalmologists).

For physicians and mid

- level practitioners, it is necessary to estimate separately those in practice offices and those working in hospitals. Regarding physicians, the latter grou p does not include physicians in practice who have hospital privileges.

5 DEA based its number on a run of its CSA database on February 24, 2009. The number of registrants varies from day to day based on renewal dates so it was necessary to take the numbe r from a single date rather than adjust it continually.

### 12

Physicians

DEA regularly updates its own data on number of registrants but used these data, only in part, for estimates of numbers of physicians in offices and numbers of dentists. These data do not distinguish between practice and hospital

- based physicians. In addition, many practitioners hold multiple DEA registrations because they practice in more than

one S tate or dispense or administer controlled substances at multiple location s in a single

State. Finally, many practitioners retain their registrations when they retire.

For this analysis, the estimate of physicians in offices is based on a study of office

- based physicians done by the Centers for Disease Control and Prevention ( CDC). 6 

### That estimate is an average of 308,900 physicians practicing in offices in 2005

- 2006. To bring that to a current number, DEA treated it as a 2006 number and applied a growth rate derived from DEA’s number of registrants. From data for number of p hysicians in November 2006 and February 2009, DEA obtained an annual growth rate of 2.1 percent. This leads to a current estimate of 328,772 physicians in offices (308,900 x 1.021 3 

### = 328,772).

For physicians in hospitals (and clinics), DEA relied on data from a 2009 publication of

the American Medical Association 7 

### that yielded an estimate of 169,337 physicians employed in hospitals. Since current data indicate number of hospitals is steady or declining, DEA assumes no growth in number of physicians in ho spitals.

Mid

- level practitioners

Of the mid

- level registrants, only nurse practitioners and physician’s assistants are likely to prescribe controlled substances routinely. For estimating the number of mid

- level practitioners, DEA had two data sources to choose from: its own data on registrants and Bureau of Labor Statistics (BLS) data on occupational specialties. DEA considered the BLS number to be too high because it includes mid

- level practitioners who are not authorized to prescribe controlled substa nces. In addition, BLS does not disaggregate nurse practitioners from nurses. DEA also judged that its registration data would have significantly less over

- counting for mid

- level practitioners than for physicians and dentists, primarily because mid

- level practitioners are not likely to have multiple registrations. DEA did use the BLS data on physicians’ assistants to apportion mid

- level practitioners between practices and hospitals. For February 2009, DEA showed 131,420

mid

- level practitioners. As of M ay 2008, BLS showed 63.0 percent of physicians’ assistants in offices and 37.0 percent in hospitals. Using these percentages, DEA estimates that there are 82,579 mid

- level practitioners in offices and 48,841 in hospitals.

6 Hing, E., Burt, C.W. ―Characteristics of Office

- Based Physicians and their Practices: United States, 2005

- 2006,‖ Series 13, Number 166. Hyattsville, MD: National Center for Health Statistics. April 2008.

7 American Medical Association, Physician characteristics and distribution in the US, 2009 Edition.

### 13

Dentists

The American Dental Association reports 164,864 dentists in active practice in 2006. 8


### From its data on registrants, DEA derived an annual growth rate of 1.3 percent. Applying this rate to the 2006 population yields an estimate of a current population of 171,378 (164,864 x 1 .013 3 

### = 171,328). Virtually all dentists are in offices. 9 

### DEA did not use its registration data for this number because of the multiple registration problem.

Summary

The following exhibit summarizes DEA’s estimate of practitioners in the first year of the analysis.

Exhibit 2

- 1: Number of Practitioners

Offices Hospitals

Physicians 328,772 169,337

Mid

- levels 82,579 48,841

Dentists 171,328 N/A

Total 582,729 218,178



### As noted above, the universe does not include DEA registered individual practitioners who do not, as part of their regular practice, prescribe controlled substances. For example, veterinarians, optometrists, and ambulance services may administer controlled substances, but they do not, as a rule, issue prescriptions.

Growth r ates for practitioners are shown below.

Exhibit 2

- 2: Practitioner Growth Rate

Growth Rate

Physicians 2.1 percent

Mid

- levels 2.2 percent

Dentists 1.3 percent
All practitioners 1.9 percent



### This rate does not include physician s in hospitals. DEA assumes zero growth for physician s based in hospital s because the number of hospitals is declining

.



### 2.2 PHYSICIANS’ AND DENT ISTS’ OFFICES

The CDC study of physicians in practices estimated number of offices at 163,800 in

2005

- 2006. 10 

### The ADA website did not provide a direct estimate of dentists’ offices, but

8 American Dental Association web site, http://www.ada.org/ada/prod/survey/faq.asp

9 DEA has not attempted to disaggregate dentists who work at Federal hospitals because it has no basis for identifying them as such.

10 Hing and Burt, op. cit.

### 14

DEA was able to derive an estimate from ADA’s data on number of dentists in 2006 and distribution of dentists across office size. This is shown in the following exhibit.

Exhibit 2

- 3: Dental Off ice Estimate

Office size Percentage

of dentists Number of

dentists Number of

offices Calculation

1 dentist 63.0 percent 104,029 104,029 Same as number of dentists.

2 dentists 20.0 percent 32,973 16,486 Half the number of dentists

>2 dentists 16.9 percent 27,862 8,707 Assumes 3.2 dentists per office

Totals 164,864 129,222



### DEA obtained growth rates for physicians’ and dentists’ offices from the Economic Census by comparing number of offices in 1997 and 2006: 1.25 percent for physicians’
offices, 1.1 percent for dentists’ offices. 11 

### Adjusting with these rates leads to the following results for current offices.

Exhibit 2

- 4: Practice Growth Rates

Growth rates 2006 offices 2009 offices
Physician offices 1.25 percent 163,800 170,020

Dentist offices 1.1 percent 129,222 133,534

All offices 1.2 percent 293,022 303,553



### The same growth rates were used to project future numbers of offices.

2.3 HOSPITALS, CLINICS, AND PHARMACIES

Hospitals and clinics are estimated together, as both are treated as institutional practitioners under the rule. DEA’s current estimate from the registrant data is 12,412 hospitals and clinics. 12 

### DEA does not expect any future growth in this number. This estimate is conservative because it is based on locations, not f irms. According to the American Hospital Association, more than half of community hospitals are part of systems that may include multiple hospitals or a single hospital with associated outpatient

clinics. 13 

### The one activity estimated on a per

- hospital bas is, security incident log checking, may often be performed at the system level, but DEA chose to use a per

hospital basis as a conservative estimate.

On the basis of its registrant data, DEA estimates 65,421 pharmacies in 2009. Costs are

calculated on th e basis of number of pharmacies, rather than number of firms. (None of the pharmacy costs are based on numbers of people.) DEA assumes no further growth in number of pharmacies. The number of retail pharmacies has declined slightly in recent

11 Bureau of Census, 1997 Economic Census and Statistics of U.S. Business 2006 http://www.census .gov/epcd/susb/latest/us/US62.HTM

. 12 This estimate removes those institutional practitioner registrants that are Federal facilities, institutions (prisons, jails, etc.), private physicians, veterinarians, ambulance services, etc. Federal facilities genera lly have to meet more stringent requirements than DEA is imposing; the other registrants are unlikely to be issuing prescriptions or are already counted as private practices.

13 Fast Facts, American Hospital Association, www.aha.org , accessed June 15, 2009.

### 15

years accor ding to industry data from the National Association of Chain Drug Stores. 14


### Using the number of registrants is conservative because some chain pharmacies may do security incident log checks at the chain rather than store level.

Exhibit 2

- 5: Number of Ho spitals/Clinics and Pharmacies

Number

2009 Growth

Hospitals and
Clinics 12,412 DEA assumes no future growth. Pharmacies 65,421



### 2.4 APPLICATION PROVIDER S

DEA currently estimates firms that provide applications to practice offices at 170 and

those that provide applications to pharmacies at 40. 15 

### Because most pharmacies have had electronic applications for managing prescription data for years, DEA expects the number providing applications to pharmacies to remain stable and the number selling to pract ice offices to rise and then fall as shown below. DEA expects that the number of electronic prescription application providers will continue to decline after YEAR 5, but that decline has not been estimated because it does not affect the analysis. As disc ussed below, DEA assumes that after the fifth year, application providers will substitute certifications

obtained for other reasons for the third

- party audit and, therefore, incur no costs

associated with this rule after YEAR 5.

Exhibit 2

- 6: Application P rovider Estimates

Providers to

Practices Pharmacies

YEAR 1 170 40

YEAR 2 190 40

YEAR 3 200 40

YEAR 4 170 40

YEAR 5 150 40



### 2.5 PRESCRIPTIONS

The number of controlled substance prescriptions written is relevant to the estimate of

cost

- savings presented in Chapter 6. DEA estimates the number of prescriptions based

14 The number of retail pharmacies is about 55,000 according to the National Association of Chain Drug Stores. The remaining pharmacies include mail order, central fill pharmacies that service other pharmacies, and cap tive pharmacies that service long term care facilities or similar facilities.

15 Estimates based on providers currently certified by either the Certification Commission for Healthcare Information Technology or SureScripts/RxHub; the number of pharmacy appli cations was increased from the 27 certified to 40 to account for chain pharmacies that may have developed their own applications.

These firms will incur costs for third

- party audits.

### 16

on the assumption that the percentage of controlled substance prescriptions in the top 200 brand name and top 200 generic drug prescriptions is the same as it is for the remainder of the prescriptions. 16 

### According to data from SDI/Verispan, in 2008, controlled substances represented about 12 percent of prescriptions for the top 400 drug s. 17 

### IMS Health data reported a total of 3.8431 billion prescriptions in 2008. 18 

### Based on these data, DEA estimates that, with a three percent growth rate for prescriptions, there will be about 475 million controlled substance prescriptions in Year 1 of th e analysis. IMS Health data indicate that about 86 percent of prescriptions are filled at retail outlets, which is relevant to estimating public wait time as long

- term care prescriptions and mail order prescriptions will not be affected. Previous DEA ana lysis has indicated that 75 percent of controlled substance prescriptions are original prescriptions or 356 million prescriptions in Year 1. DEA has previously estimated that about 19 percent of prescriptions are currently faxed or phoned into pharmacies. Applying both the 86 percent and 19 percent to the number of original prescriptions results in an estimate of 247 million prescriptions that may have reduced public wait time as electronic prescriptions for controlled substances is implemented. Exhibit 2

- 7 presents the prescription data.

Exhibit 2

- 7: Prescription Estimates

– Year 1

Total Controlled substance prescriptions 475,007,160

Original controlled substance prescriptions 356,255,370

Paper controlled substance prescriptions presented

to retail pharmacies (not mail order) 247,584,365

16 The top 400 drugs represent about 87% of all prescriptions dispensed a t retail.

17 See www.drugtopics.com for the top 200 generic and top 200 brand name drugs.

18 See www.imshealth.com . IMS Health data are used for total prescriptions because t he data include prescriptions for long

- term care and mail order.

### 17



## CHAPTER 3: UNIT COST S

Unit costs are estimated for the following requirements:

 Identity proofing and obtaining an credential

 Renewal application for protocol

 Registration check

 Training for granting logical access control

 Granting logical access

 Updates for logical access control

 Review of security incident logs

 ID check, face

- to

- face (institutional practitioners)

 Reprogramming of existing applications

 Obtaining initial certification or third

- party audit of applications

 Follow

- up third

- party audits of applications

3.1 WAGE RATES

Estimates of hourly cost for a position, e.g., mid

- level practitioner, pharmacy technician, are based on wage rates from BLS Industry

- Specific Occupational Employment (SOE) and Wage Estimates. 19 

### Dentist and physician rates are weighted across specialties listed by BLS. These wages and all others are brought up to March 2009 dollars with the BLS Employment Cost Index, Table 9. 20 

### Fringe benefits are calculated from BLS Employer

Costs for Employee Compensation, March 2009, Table 9. 21 

### Overhead rate is from Grant

Thornton. 22 

### Fully loaded, hourly labor costs as of March 2009 are as follows:

Exhibit 3

- 1: Compensation Rates

Wage Rate Loaded Cost

Dentist $79.12 $166.74

Dental assistant $16.58 $34.38

Physician (office) $91.19 $192.16

Physician (hospital) $55.74 $117.46

Mid

- level (office) 23 $40.00 $84.30

Mid

- level (hospital) $40.87 $86.13

Nurse (office) $31.88 $67.18

19 http://www.bls.gov/oes/current/oessrci.htm#48

- 49

20 ftp://ftp.bls.gov/pub/suppl/eci.echistrynaics.txt

21 http://www.bls.gov/news.release/pdf/ecec.pdf

22 Grant Thornton, 14 th Annual Governmen t Contractor Industry Survey, 2008.

23 Mid

- level rates are based on physicians’ assistants. These and nurse practitioners make up the majority

of mid

- level registrants. BLS does not disaggregate nurse practitioners from nurses, but the AMGA mid

level com pensation survey indicates that their salaries are similar (median of $81,245 for physician assistants and $82,513 for nurse practitioners).

### 18

Wage Rate Loaded Cost

System administrator (hospital) $32.42 $68.32

HR person (hospital) $17.11 $36.06
Application provider engineer $43.70 $92.10

Pharmacist $51.60 $108.74

Pharmacy technician $13.28 $27.99



### For some estimates, DEA used weighted wages across all practitioners ($169.40) or all physicians and dentists ($183.45).

3.2 UNIT LABOR COSTS

When a task in a physician’s office does not require a registrant, the analysis assumes it is done by a nurse. Depending on physician practice size, the registrant doing the work is either a physician or a mid

- level pract itioner. In a dental practice, the dentist is always the registrant, as there are few, if any, mid

- level practitioners in dental offices. A non

registrant task in a dentist’s office is done by a dental assistant. In hospitals, human

resource staff and I T system administrators perform non

- registrant tasks, as do pharmacy technicians in pharmacies. 24



### Practitioners will have to complete an application to apply for identity proofing and a credential. As these applications generally ask for standard inform ation that practitioners will be able to fill in without needing to collect documents that they would not carry with them (e.g., credit cards, driver’s licenses), DEA estimates that it will take them 10 minutes to complete the form. Credential providers g enerally require subscribers to renew the credential periodically. This renewal can take the form of an e

- mail request that is signed with the credential. To be conservative, DEA estimates that it will take 5

minutes to renew.

For hospitals and clinics, DEA estimates that practitioners and someone at the credentialing office will spend two minutes to verify the identity document presented.

Practitioners are assumed to take 30 minutes total for this process because they will need to go to the credentiali ng office. This review will occur only when the hospital or clinic first implements controlled substance electronic prescribing and will involve only those practitioners that already work at or have privileges at the hospital or clinic. All practitioners that are hired or gain privileges later will have this step done as part of their regular initial credentialing.

Prior to granting access, someone at each office must verify that each practitioner has a valid DEA registration and State license to practic e. As this requires nothing more than checking the expiration date, DEA estimates that this will take an average of one minute.

24 For hospitals, clinics, and pharmacies, the registrant is the firm, not an individual.

### 19

In small practices, which are the majority of offices, it may take no time because the registrant will be one of the people gr anting access and the status of every registrant will be known. Even in larger practices, it is likely that any problems with a practitioner’s DEA registration or State license will be known as it affects their ability to practice. Checking registrations and licenses is done as part of credentialing at hospitals and clinics and is, therefore, not a cost of the rule.

Prior to granting access, those who will be given this responsibility will need to be

trained to do so. DEA estimates the time at one hour per person at practices. This estimate may be high, particularly for smaller offices. It may also be the case that in some larger practices, people already perform this task for other reasons and training may be unnecessary. Because it is likely that in larger pharmacies, access controls are already being set, DEA estimates that the training time will be five minutes.

DEA estimates that it will take, on average, five minutes to enter the data to grant access for the first time at a practice or a pharmacy. The approval of the data entry is estimated to take one minute. The actual approval may take only a few seconds, but the approver may take time away from some other work, but would presumably do it when using the computer for other tasks. DEA has not estimated costs for granting access to new hires as that should occur routinely. Similarly, for practitioners, registrations of new hires should be checked as part of the hiring process and should not require a separate action.

DEA has not estima ted the cost of setting logical access controls at hospitals because hospital applications should already do this. The Certification Commission for Healthcare Information Technology (CCHIT) criteria for in

- patient applications include logical access contr ols; the HL7 standard used by most hospitals includes logical access controls. In addition, an application used by as many different departments as exist at hospitals necessarily will impose limits on who can carry out certain functions. Consequently, DE A’s requirements should not entail any actions not already being performed.

Auditable events reported on security incident logs should be rare once the application has been implemented and staff understand their permission levels. Because of the size

of hospitals and clinics and the volume of controlled substance prescriptions at pharmacies, DEA estimates that each of them will review security incident logs monthly; DEA estimates that the review will take hospitals ten minutes per month and pharmacies

fiv e minutes per month. Because of the smaller size of private practices and the much lower volume of controlled substance prescriptions issued, DEA estimates that a review will be needed only once a quarter. The review time remains at 5 minutes. Clearly, if an actual security incident occurs, the review and action to address the issue will take more time, but most reported auditable events are likely to be minor mistakes that did not result in any breach of security. As noted previously, DEA does not beli eve that such incidents will occur on a routine basis, thus limiting the number of incident logs to be reviewed.

DEA estimates that reprogramming for electronic prescription applications will take, on average, 2,000 hours, an estimate based on industry in formation obtained during the

### 20

development of DEA’s Controlled Substances Ordering System rule. 25 

### There may be wide variation among providers. Some applications already have many of the functions; for example, any EHR application that is CCHIT

- certified sh ould have the logical access control functionalities. A few applications already include digital signature functionality. DEA expects that adding two

- factor authentication may be the main new requirement for electronic prescription applications that have been CCHIT certified. Other applications that do not provide review screens or capture and transmit all of the DEA

- required information will require more reprogramming. The requirements for pharmacy applications are simpler and include functionalities t hat the industry has indicated that it already has, so DEA assumes an average of 1,000 hours of reprogramming for pharmacy applications. The hours for pharmacy applications cover adding digital signature capability (about a third of all pharmacies have th is capability for DEA’s Controlled Substances Ordering System) and for adding a list of auditable events and the ability to run daily checks for any such events. Over the long run, pharmacy applications will need to be reprogrammed to accept extension dat a for practitioners who prescribe under an institutional practitioner’s DEA registration. DEA expects that this update will be accomplished as part of routine upgrades that application providers make to keep current with changes to the National Council fo r Prescription Drug Programs SCRIPT standard.

3.3 BASIS OF COSTS OTHER THAN TIME

To estimate the cost of obtaining identity proofing from a credential service provider, DEA used the fee SAFE BioPharma charges for a three

- year digital certificate and a har d token using remote identity proofing ($110). 26 

### This figure may be high because it assumes a medium rather than the basic assurance level that DEA is requiring. Based on standard industry practice for digital certificates, DEA estimates that the credenti al will need to be renewed every three years, but that a complete reapplication will not be required until the ninth year. These assumptions are based on the standards incorporated in the Federal PKI Policy Authority Common Policy, which is used to determ ine the requirements for Certification Authorities, such as SAFE. The cost for the three

- year renewal is estimated to be $35.00, which is what SAFE charges for a three

- year digital certificate at the basic assurance level. Hospitals and clinics are assum ed to use or adapt their existing access cards to store the credential and, therefore, incur no additional costs

for the credential.

In the initial years, application providers may have to obtain a third

- party audit to determine whether the application me ets the requirements of the rule. Application providers may obtain a SysTrust, WebTrust, or SAS 70 audit or may hire a Certified Information System Analyst to conduct a more focused audit. DEA estimates the cost of this audit at $15,000. This estimated cost is about 50 percent of the application fee for

25 ―Electronic Orders for Controlled Substances‖ 70 FR 16901, April 1, 2005; Economic Impact Analysis

of the Electronic Orders Rule available at http://www.DEAdiversion.usdoj.gov/fed_regs/rules/2005/index.html

26 http://www.safe

- biopharma.org/digitalidentity.htm , accessed June 15, 2009. SAFE

- BioPharma is a certification authority established by the pharmaceutical industry and cross

- certified with the Federal Bridge Certification Authority.

### 21

CCHIT testing and certification of a full ambulatory electronic health record application ($29,000). Compliance with DEA requirements will presumably be a subset of this cost, just as the electronic pres cription functions are a subset of the full EHR. CCHIT has not yet published prices for certification of a stand

- alone electronic prescription application.

DEA chose to use the CCHIT fees as a basis because the interim final rule narrows the scope of the third

- party audit and allows a larger number of auditors to conduct the audit. The higher cost estimates in the NPRM were based on obtaining particular types of audits and having the audits cover functions that will not be subject to auditing for install ed applications. In addition, the one commenter that already obtained the third

- party audits specified in the NPRM stated that the costs were much lower than DEA had estimated.

DEA estimates that within five years, all electronic prescription applicati on providers will obtain certification from an approved certification organization; because the providers already seek these certifications for other reasons, the cost of continuing to obtain certifications will not accrue to the rule after that point. 27



### 3. 4 SUMMARY OF UNIT COST S

Exhibit 3

- 2 presents the unit costs for both labor

- based costs and fees.

Exhibit 3

- 2: Unit Costs

Requirement Item, or labor, required. Unit Cost

Non

- Labor Costs Identity proofing and

credential Remote identity proofing and downloadable code for registrant (includes hard token)

. $1 10 .00

Renewal of credential Three

- year renewal $35.00

Nine

- year renewal $1 10 .00

Initial audit of application Certification that application meets DEA requirements. $15,000.00

Reaudit of application Certification that application still meets DEA requirements. $15,000.00

Labor Costs Application for identity proofing and credential Registrant must fill out form; 1 0 minutes required. $28.23

Renewal application for

credential Registrant must only fill out parts where information has changed; 5 minutes needed. $ 14.12

Registration check Requires one minute for a non

- registrant. Physician office

— nurse $1.12

Dental office

— dental assistant $0.57

Access control

— training (practice office) One hour per person; one is a registrant Physician plus nurse $259.35

Mid

- level plus nurse $151.49 Dentist plus dental assistant $201.01

Access control

— granting (practice office) Requires one minute for registrant, five minutes
for non

- registrant (nurse) Physician plus nurse $ 8.66

Mid

- level plus nurse $7.00

27 T he subsidies that will be available for EHRs under ARRA will require that the application be certified.

### 22

Requirement Item, or labor, required. Unit Cost

Dentist plus dental assistant $ 5.64

Access control

— training (pharmacy) Requires five minutes for pharmacy technician $2.33

Access control

— granting (pharmacy) Requires five minutes for pharmacy technician $2.33

Review of security logs (practice office) Requires five minutes per quarter ; 20 minutes per year for nurse. $22.39

Review of security logs (pharmacy) Requires five minutes per quarter ; 20 minutes per year for ph armacy tech. $11.43

Review of security logs (hospital) Requires ten minutes per month per year for system administrator. $136.64

ID check, face to face (hospital only) Requires two minutes for HR person AND Thirty minutes per hospital practitioner OR Thirty minutes per private physician. $1.20 $55.22 $96.08 Reprogramming applications for practices Requires 2,000 hours of application provider engineer’s time. $184,197

Reprogramming pharmacy applications Requires 1,000 hours of application provider engineer’s time. $92,099

### 23



## CHAPTER 4: TOTAL COS TS

To proceed from unit costs to total costs, it is necessary to establish the frequency of

occurrence of cost items and the distribution of those occurrences , and thus of costs, over time. Frequency of occurrence may vary with numbers of registrants or with numbers of entities, e.g., physicians’ offices or hospitals. In Chapter 2, DEA presented estimates of the universe of affected registrants and entities. To obtain total costs over time, it is

necess ary to estimate future growth rates for affected individuals

— physicians, dentists,

mid

- level practitioners, and pharmacy personnel

— and entities

— offices of physicians and dentists, hospitals, pharmacies, and application providers. These, and related, estim ates will be set out in this chapter to show how DEA obtained its estimate of total costs. A

15

- year time horizon is used for all estimates. The material in this chapter is organized according to the four affected healthcare sectors:

 Offices of physicia ns and dentists

 Hospitals and clinics

 Pharmacies

 Application providers.

4.1 OFFICES OF PHYSICIAN S AND DENTISTS

Some costs are incurred at start

- up when an office implements electronic prescriptions for

controlled substances. Some costs recur over time after initial implementation. In this latter group, some costs are linked to ongoing operation of the office. Total amounts of some costs depend on number of registrants; others vary with number of offices. The following exhibit shows these characterist ics of the costs that apply to practice offices.

Exhibit 4

- 1: Cost Elements for Practitioners

Cost Element Incurred for Varies with

Start

- up Ongoing

Operation New

Hires Registrants Offices

ID proofing and protocol X X X X Application for proofing and credential X X X X Registration check X X Training for logical access controls X X Granting

Access At start

- up X X

Re

- granting X X Security

- log review X X

### 24

Growth rates and implementation rate

In Chapter 2, DEA presented growth rates for practitioners and offices. They are repeated here for ease of reference.

Exhibit 4

- 2: Growth Rates for Practitioners

Growth rates Percentages Practitioners Offices

Physicians Dentists Mid

- levels Physicians Dentists

2.1 1.3 2.2 1.25 1.1



### The cost estimates are often based on either the number of offices implementing electronic prescriptions for controlled substances in a given year or the cumulative number of offices that have adopted the requirements, so it is necessary to estimate an implementation rate for offices. DEA assumes that the implementation rate for offices will also apply to the number of registrants working in offices. 28 

### The same implementation rate is used for both dentists’ and physicians’ offic es. As the following exhibit shows, DEA assumes rapid implementation in the early years tapering off later with full implementation in 15 years. Because of the growth rate assumed for practitioner offices, implementation is, in effect, complete by year 7 for existing offices; after that the new offices largely represent growth.

Exhibit 4

- 3: Implementation Rates for Practitioners

Implementation Rate (percentage) Cumulative

Percentage

YEAR 1 6.0 6.0

YEAR 2 10.0 16.0

YEAR 3 20.0 36.0

YEAR 4 20.0 56.0

YEAR 5 20.0 76.0

YEAR 6 10.0 86.0

YEAR 7 5.0 91.0

YEAR 8 2.0 93.0

YEAR 9 1.0 94.0

YEAR 10 1.0 95.0

YEAR 11 1.0 96.0

YEAR 12 1.0 97.0

YEAR 13 1.0 98.0

YEAR 14 1.0 99.0

YEAR 15 1.0 100.0

28 This assumption implies that the size distribution of offices adopting electronic prescriptions for controlled substances is the same in every year. This is likely not true, but DEA believes it is a satisfactory assumption for this purpose. If larger offices implement faster than others, the effect of the assumption will be a slight understatement of the present value of costs depending on number of r egistrants. In any event, the implementation rate, itself, is an arbitrary assumption.

### 25

Applying both the growth rates and the implementation rate, DEA obtained the following results for offices starting electronic prescriptions for controlled substances year by year, cumulative offices with electronic prescriptions for controlled substances, and registrants working in those offices, as well as total numbers of offices and registrants.

Exhibit 4

- 4: Cumulative Offices and Registrants

Offices Registrants in Offices

Total Starts Cumulative Total Starts Cumulative

YEAR 1 304,287 18,257 18,257 582,729 34,964 34,964

YEAR 2 307,935 31,012 49,270 593,678 60,025 94,988

YEAR 3 311,626 62,916 112,185 604,832 122,751 217,740

YEAR 4 315,361 64,417 176,602 616,196 127,330 345,070

YEAR 5 319,141 65,945 242,547 627,774 132,038 477,108

YEAR 6 322,966 35,204 277,751 639,569 72,921 550,030

YEAR 7 326,837 19,671 297,422 651,586 42,914 592,943

YEAR 8 330,754 10,180 307,602 663,829 24,417 617,361

YEAR 9 334,719 7,034 314,636 676,301 18,363 635,723

YEAR 10 338,731 7,159 321,794 689,008 18,835 654,558

YEAR 11 342,791 7,285 329,079 701,954 19,318 673,876

YEAR 12 346,900 7,413 336,493 715,143 19,813 693,689

YEAR 13 351,057 7,544 344,036 728,580 20,319 714,008

YEAR 14 355,265 7,676 351,713 742,269 20,838 734,846

YEAR 15 359,523 7,811 359,523 756,216 21,369 756,216



### As noted, these numbers are for all practice offices and all registrants in offices. For some of the analyses of the individual cost elements, it is necessary to make these projections for various sub

- sets of the totals. These are presented in the following analyses of the cost elements.

Identity proofing and credentials

For the purpose of the analysis, DEA assumes that all registrants

— all physicians and

mid

- level practitioners in a physician’s office and all dentists in a dentist’s office

— will acquire authority to use the application whe n the office adopts electronic prescriptions for controlled substances. The identity proofing process is done by an off

- site service that provides a downloadable credential at a price of $110.00 per registrant. The cost of this requirement depends on num ber of registrants. For the purpose of the analysis, DEA assumes that the credentials must be renewed every three years. For example, registrants whose identities have been verified in YEAR 1 must repeat the process in YEARs 4, 7, 10, and 13. The trienn ial renewals are less involved and less costly than the initial protocol. DEA estimates the cost of the renewals at $35.00, with the exception of

### 26

renewals on the ninth anniversary of the initial credential . The nine

- year renewals are as costly as initial applications

-- $110.00. 29



### The process must also take place whenever a newly hired registrant enters the office. Even though the registrant may have been through the process in his previous office, DEA assumes that the complete process will be required again. DEA assumes that 2.5 percent of physicians and dentists and 5.0 percent of mid

- level practitioners in offices that have adopted electronic prescriptions for controlled substances will be new hires each year. A ―new hire‖ means someone newly hired in an office. He could be a person newly entering this workforce or a person transferring from another office. 30 

### The new

hire numbers do not affect the total number of registrants. Rather, they are an estimate of turnover in the population. The total si zes of populations are driven by the growth rates

shown above.

The new

- hire percentages are applied to the cumulative totals of registrants in offices that have adopted electronic prescriptions for controlled substances. Because of the assumption of diff

erent turnover rates, separate future projections must be made for physicians and dentists on the one hand and mid

- level practitioners on the other. (DEA assumes no costs for new hires in YEAR 1, because all registrants will be getting identity proofing f

or the first time.)

Exhibit 4

- 5: Cumulative Registrants

Cumulative Registrants in EPCS

- adopted Offices and New Hires All Registrants Physicians/Dentists Mid

- levels

Total New Hires Total New Hires Total New Hires

YEAR 1 34,964 0 30,009 0 4,955 0

YEAR 2 94,988 2,712 81,485 2,037 13,503 675

YEAR 3 217,740 6,220 186,692 4,667 31,051 1,553

YEAR 4 345,070 9,861 295,720 7,393 49,364 2,468

YEAR 5 477,108 13,640 408,679 10,217 68,468 3,423

YEAR 6 550,030 15,732 470,923 11,773 79,181 3,959

YEAR 7 592,943 16,967 507,435 12,686 85,628 4,281

YEAR 8 617,361 17,674 528,100 13,203 89,435 4,472

YEAR 9 635,723 18,209 543,578 13,589 92,386 4,619

YEAR 10 654,558 18,757 559,453 13,986 95,422 4,771

YEAR 11 673,876 19,321 575,735 14,393 98,548 4,927

YEAR 12 693,689 19,899 592,436 14,811 101,766 5,088

YEAR 13 714,008 20,493 609,564 15,239 105,077 5,254

YEAR 14 734,846 21,102 627,131 15,678 108,484 5,424

YEAR 15 756,216 21,728 645,146 16,129 111,991 5,600



### Cost calculation:

29 The nine

- year period for repeating the identity proofing is based on the requirements of the Federal Bridge Certification Authority.

30 A new hire in a solo practic e reflects someone taking over a practice from someone leaving the field or someone opening a new office.

### 27

YEARs 2, 5, and 11 are offered as examples. In YEAR 2 there is no cost for credential renewal, because the initial credentials are still valid. In YEAR 5, there are costs for triennial renewals; in YEAR 11, there are nine

- year renewals.

YEAR 2: 60,025 registrants in start

- up offices (Exhibit 4

- 4) 2,712 new hires (Exhibit 4

- 5) 60,025 + 2,712 = 62,737 new credentials

Cost: 62,737 x $110 = $ 6,901,070

YEAR 5: Start

- ups: 132,038 registrants Renewals: 60,025 registrants New hires: 13,640 registrants 132,038 + 13,640 = 145,678 new credentials

Cost: 145,678 x $110 = $ 16,024,580 60,025 x $35 = $2,100,875 Total cost: $ 18

, 125, 455

YEAR 11: Start

- ups 19,318 registrants

Renewals: 156, 456 registrants

Nine

- year renewals: 60,025 registrants New hires: 19,321 registrants

1 9,318 + 60,025 + 19,321 = 98,663 new registrants and 9

- year renewals

Cost: 98,663 x $1 10 = $ 10,852,930

156,456 x $35 = $5,475,949

Total C ost: $ 16,328,879

The following exhibit shows present and annualized value of future cost of identity proofing and protocols. The cost, even when discounted, stays high in the out years because of the requirement for renewal every three years.

Exhibit 4

- 6: Present and Annualized Value of Identity Proofing

Present Value

7.0 percent 3.0 percent

YEAR 1 $3,846,010 $3,846,010

YEAR 2 $6,449,597 $6,700,067

YEAR 3 $12,391,310 $13,372,430

YEAR 4 $13,317,739 $14,930,356

YEAR 5 $13,827,872 $16,104,290

YEAR 6 $10,016,149 $12,118,073

YEAR 7 $8,174,161 $10,273,596

YEAR 8 $7,069,632 $9,230,446

YEAR 9 $6,327,241 $8,581,967

YEAR 10 $7,582,266 $10,683,609

### 28

Present Value

7.0 percent 3.0 percent

YEAR 11 $8,300,802 $12,150,260

YEAR 12 $10,008,251 $15,218,445

YEAR 13 $9,715,263 $15,346,635

YEAR 14 $9,448,444 $15,504,775

YEAR 15 $7,133,697 $12,160,919

Total $133,608,434 $176,221,878

Annualized $14,669,488 $14,761,504



### Application for identity proofing and credential

A registrant must fill out an application to be submitted to the service that performs identity proofing and issues credentials. The task requires 10 minutes. DEA estimates that, for renewal of the credential, the task requires five minutes as the applicant need only submit a request signed with the two

- factor credential. Thus, a pplications for renewals must be separated in the cost calculation from applications at start

- up and applications for new hires. (It is assumed that new hires must complete the full application, even when they are moving from another office.) The future projection of registrants in Exhibits 4

- 4 and 4

- 5 can be used for this estimate.

Cost calculation:

Costs per registrant for start

- up application and for renewals are based on weighted hourly cost for all registrants. For new hires, costs are based on we ighted average of hourly cost for physicians and dentists and hourly cost for mid

- level practitioners. This yields the following unit costs for the different cases. (All data on wage rates and full hourly costs are in Chapter 3.)

Start

- up applications

— a ll registrants: weighted hourly cost $169.40 10 minutes is 0.167 hours. 0.167 x $169.40 = $28.23 Renewal applications

— all registrants 5 minutes is 0.0833 hours. 0.0833 x $169.40 = $14.12

New

- hire applications

— physicians and dentists: weighted hourly cost is $183.45 0.167 x $183.45 = $30.57

New

- hire applications

— mid

- level practitioners: hourly cost is $84.30 0.167 x $84.30 = $14.05

YEAR 2:

Start

- ups: 60,025 registrants New hires: 2,037 physicians/dentists, 675 mid

- levels 60,025 x $28.23 = 1,694,506
2,037 x $30.57 = 62,271 675 x $14.05 = 9,484 Total: $1,766,261

### 29

Note that the costs listed above and the costs in the following exhibits will not match because the actual calculations are not based on rounded numbers. The following exhibit shows present and a nnualized value of future cost of applying for identity proofing and protocols.

Exhibit 4

- 7: Present Value of Application for Identity Proofing

Present Value

7.0 percent 3.0 percent

YEAR 1 $987,149 $987,149

YEAR 2 $1,650,916 $1,715,030

YEAR 3 $3,170,771 $3,421,826

YEAR 4 $3,550,309 $3,980,209

YEAR 5 $3,765,458 $4,385,348

YEAR 6 $2,999,722 $3,629,224

YEAR 7 $2,632,521 $3,308,652

YEAR 8 $2,408,295 $3,144,384

YEAR 9 $2,188,997 $2,969,051

YEAR 10 $2,134,021 $3,006,891

YEAR 11 $2,089,687 $3,058,769

YEAR 12 $1,950,354 $2,965,689

YEAR 13 $1,898,685 $2,999,243

YEAR 14 $1,855,979 $3,045,639

YEAR 15 $1,735,992 $2,959,371

Total $35,018,858 $45,576,474

Annualized $3,844,882 $3,817,785



### These numbers do not show costs falling much in the future, even though discounted. That is because of the renewal every three years. In YEAR 13, for example, registrants in the offices that started in YEARs 1, 4, 7, and 10 are all renewing.

Registration checks

Before a practitioner may use the electron ic prescription application for controlled substance prescriptions, a person in the office who has been authorized to grant access to the electronic prescription application must verify that the DEA registration and State authorization(s) to practice and, where applicable, dispense (including prescribe) controlled substances are current and in good standing. This task requires one minute per practitioner and does not have to be performed by a registrant. DEA assumes this will not be necessary in a small o ffice where all workers will be aware of the State authorization and DEA registration status of practitioners. For this purpose, DEA considers an office as small if it has two or fewer physicians or dentists.

The registration check is required for regist rants in an office starting electronic prescriptions for controlled substances. After the start

- up, registration checking for new

### 30

hires is part of routine process of checking credentials for a new employee and is not an additional cost. The following exhi bit shows registrants at start

- up and cumulative registrants in offices with more than two physicians or dentists.

Exhibit 4

- 8: Number of Registrants over Time

Registrants in Offices

Offices with >2 Physicians Offices with >2 Dentists

Starts Cumulative Starts Cumulative

YEAR 1 14,108 14,108 1,738 1,738

YEAR 2 24,310 38,418 2,957 4,694

YEAR 3 49,855 88,272 6,005 10,699

YEAR 4 51,951 140,223 6,161 16,860

YEAR 5 54,114 194,338 6,319 23,179

YEAR 6 30,233 224,571 3,391 26,570

YEAR 7 18,094 242,665 1,910 28,480

YEAR 8 10,591 253,256 1,004 29,484

YEAR 9 8,150 261,406 704 30,189

YEAR 10 8,382 269,788 718 30,906

YEAR 11 8,620 278,408 731 31,638

YEAR 12 8,864 287,272 745 32,383

YEAR 13 9,115 296,387 759 33,142

YEAR 14 9,372 305,759 773 33,916

YEAR 15 9,636 315,395 788 34,703



### Cost calculation:

In a dentist’s office, the registration check will be performed by a dental assistant

— by a nurse in a physician’s office. Time is one minute.

Cost in dentist’s office: $0.57

Cost in physician’s office: $1.12

The calculation is the same in all years.

YEAR 2:

Dental offices:

Start

- ups: 2,957 registrants 2,957 x $0.57 = $1,685 Physicians’ offices:

Start

- ups: 24,310 registrants 24,310 x $1.12 = $27,227 Total: 1,685 + 27,227 = $28,913

### 31

The following exhibit shows present value and annualized cost of registration checks.

Exhibit 4

- 9: Present and Annualized Cost of Registration Checks

Present Value 7.0 percent 3.0 percent

YEAR 1 $16,789 $16,789

YEAR 2 $27,019 $28,068

YEAR 3 $51,755 $55,853

YEAR 4 $50,358 $56,456

YEAR 5 $48,981 $57,044

YEAR 6 $25,518 $30,873

YEAR 7 $14,228 $17,882

YEAR 8 $7,743 $10,109

YEAR 9 $5,546 $7,522

YEAR 10 $5,328 $7,507

YEAR 11 $5,119 $7,493

YEAR 12 $4,918 $7,478

YEAR 13 $4,724 $7,463

YEAR 14 $4,538 $7,447

YEAR 15 $4,359 $7,431

Total $276,922 $325,415

Annualized $30,405 $27,259



### Training for logical access controls

Two people are needed to set the logical access controls in an office so that registrants can gain access to the application. One of the two must be a registrant. Training is required to perform this task. Training may be done by the application provide rs, either in person or through on

- line training or manuals, and their cost is included in the fee they charge practitioners’ offices for the application. In addition, there is a cost of the time of the people being trained. DEA estimates the time at one hour per person, registrant or

non

- registrant.

Offices will select the least

- cost combination of job classes to be trained. Which job categories are used varies with type and size of office. A physician’s office will choose a

nurse as the non

- registran t. Mid

- level practitioner is the least

- cost choice for registrant in a physician’s office, but many small offices will not have a mid

- level practitioner, and a physician will have to do the work instead. Dentists’ offices have no mid

- level practitioners; dentists are the only registrants in such offices. Dentists’ offices rarely
have nurses; therefore, DEA assumes that dental assistants will do this work.

Regarding physicians’ offices, DEA assumes that offices with one physician will not

have mid

- level practitioners and that all offices with two or more physicians will have at

least one mid

- level practitioner. Clearly, some solo physicians will employ a mid

- level practitioner, and some practices with two or three physicians will not. Nonetheless, DEA j udges that this is a sound assumption, because the absence of mid

- level practitioners in some practices with more than one physician will offset the presence of mid

- level practitioners in some solo practices.

### 32

An office must have at least two people traine d to administer logical access controls, else it cannot use the electronic prescription application for controlled substance prescriptions. But the training is not costly on a per

- office basis because it will take limited time and is a routine part of lea rning how to use new applications and upgrades to applications. Larger offices will likely have more than two people trained to provide some redundancy in this skill. For this estimate, DEA assumes that offices with more than two physicians

or dentists w ill have four people trained. DEA believes this is a reasonable average; very large offices might have more than four trained people, smaller offices might have fewer.

With these considerations, it is necessary to estimate training costs for five differe nt categories of office. The exhibit below shows the per

- office cost of training for each

category.

Exhibit 4

- 10: Unit Training Cost by Office Size and Type

Size and type

of office >2

Physicians 2

Physicians 1

Physician >2 Dentists 1 or 2
Dentists Registrant Mid

- level Mid

- level Physician Dentist Dentist

Non

- registrant Nurse Nurse Nurse Dental

assistant Dental

assistant

Two trained $151.49 $259.35 $201.01

Four trained $302.98 $402.02



### Training for setting the logical access controls will occur only at start

- up. Once some people in the office have the requisite skills, they will be passed along when necessary as part of office routine. Number of start

- ups, for each category, year by year, is in the following exhibit.

Exhibit 4

- 11: Numbe r of Start

- Ups per Year

>2 Physicians 2

Physicians 1

Physician >2

Dentists 1 or 2

Dentists

YEAR 1 1,969 1,163 7,069 543 7,517

YEAR 2 3,347 1,977 12,017 921 12,748

YEAR 3 6,794 4,013 24,393 1,866 25,833

YEAR 4 6,963 4,113 25,000 1,907 26,398

YEAR 5 7,136 4,215 25,618 1,949 26,974

YEAR 6 3,819 2,256 13,712 1,035 14,326

YEAR 7 2,143 1,266 7,694 574 7,941

YEAR 8 1,118 660 4,014 292 4,044

YEAR 9 779 460 2,795 199 2,751

YEAR 10 793 468 2,846 202 2,796

YEAR 11 807 477 2,898 205 2,842

YEAR 12 822 486 2,951 209 2,889

YEAR 13 837 494 3,005 212 2,936

YEAR 14 852 503 3,060 216 2,984

YEAR 15 868 513 3,115 219 3,033

### 33

Cost calculation: Calculation is the same for all years.

YEAR 2:

Offices Unit Cost Total Cost
>2 Physicians 3347 $303 $1,014,045

2 Physicians 1,977 $151 $299,487 1 Physician 12,017 $259 $3,116,600

>2 Dentist 921 $402 $370,269

1

- 2 Dentist 12,748 $201 $2,562,532

Total $7,362,933

The following exhibit shows present value and annualized cost of training for access

controls.

Exhibit 4

- 12: Present and Annualized Value of Logical Access Control Training

Present Value
7.0 percent 3.0 percent

YEAR 1 $4,335,170 $4,335,170

YEAR 2 $6,881,189 $7,148,419

YEAR 3 $13,045,528 $14,078,448

YEAR 4 $12,480,973 $13,992,267

YEAR 5 $11,939,283 $13,904,790

YEAR 6 $5,954,140 $7,203,636

YEAR 7 $3,107,312 $3,905,387

YEAR 8 $1,500,943 $1,959,702

YEAR 9 $968,078 $1,313,055

YEAR 10 $920,683 $1,297,266

YEAR 11 $875,581 $1,281,627

YEAR 12 $832,663 $1,266,139

YEAR 13 $791,826 $1,250,801

YEAR 14 $752,969 $1,235,613

YEAR 15 $715,998 $1,220,573

Total $65,102,335 $75,392,895

Annualized $7,147,886 $6,315,405



### Granting access

Granting registrants in practice offices access to the electronic prescription application to sign controlled substances prescriptions occurs on two occasions:

o Start

- up of electronic prescriptions for controlled substances in an office

o Re

- granting of access if access is revoked.

When an office adopts electronic prescriptions for controlled substances, access to the electronic prescription application is granted to the registrants in the office. This will be

done in one batch. The non

- registrant will enter a list of names, registration numbers,

### 34

and other required data; a registrant will review the inf ormation and authorize access. It takes an average of five minutes for the non

- registrant to enter the information and one minute for the registrant to review it. This cost will vary according to number of offices starting electronic prescriptions for co ntrolled substances in a given year. Access control for newly hired staff should occur as part of routine practice when they join and, therefore, is not a cost of the rule.

A registrant’s access must be revoked under certain circumstances. If, for example, access is revoked because of a lost or stolen token, or because an individual’s registration has expired, the office will re

- grant access when a new credential has been issued or a registration has been renewed. Such occasions will be quite rare. DEA estimates an average occurrence of one per year in offices with more than two physicians or dentists. The task will require one minute for the non

- registrant and one minute for the registrant authorized to administer logical access controls. This c ost will vary with the number of offices with electronic prescriptions for controlled substances in place and with more than two physicians or dentists.

As with training for access controls, job classes of people doing the work vary with size and type of office. The following exhibit shows cost per granting action by size and type of office and occasion for granting.

Exhibit 4

- 13: Cost of Granting Access by Size and Office Type and Occasion for Granting

Size and Type of Office >1 Physician 1 Physician D entists Registrant Mid

- level Physician Dentist

Non

- registrant Nurse Nurse Dental assistant Cost per action

Start

- up

— 5 minutes for non

- registrant,

1 minute for registrant $7.00 $ 8.80 $ 5.64

R e

- grants
1 minute for non

- registrant

1 minute for registrant $2.52 $ 4.32 $ 3.35



### Calculation of total cost requires, year by year:

o for start

- up, number of start

- up offices by size and type of office

o for re

- grants, number of physicians’ and dentists’ offices with electronic prescriptions for controlled substances with more than two physicians or dentists

### 35

Exhibit 4

- 14: Estimated Number of New Offices, Offices with EPCS by Year

Start

- up Offices Offices with EPCS >1 Physician 1 Physician Dentists >2 Physicians >2 Dentists

YEAR 1 3,133 7,069 8,060 1,969 543

YEAR 2 5,325 12,017 13,669 5,316 1,464

YEAR 3 10,810 24,393 27,699 12,110 3,330

YEAR 4 11,079 25,000 28,306 19,073 5,238

YEAR 5 11,353 25,618 28,922 26,209 7,186

YEAR 6 6,077 13,712 15,361 30,028 8,221

YEAR 7 3,410 7,694 8,514 32,171 8,795

YEAR 8 1,779 4,014 4,336 33,289 9,087

YEAR 9 1,239 2,795 2,950 34,068 9,286

YEAR 10 1,261 2,846 2,998 34,861 9,488

YEAR 11 1,284 2,898 3,048 35,668 9,693

YEAR 12 1,308 2,951 3,098 36,490 9,902

YEAR 13 1,332 3,005 3,148 37,327 10,114

YEAR 14 1,356 3,060 3,200 38,179 10,330

YEAR 15 1,381 3,115 3,252 39,047 10,549



### Cost calculation: The cost calculation is the same for all years.

YEAR 2:

Start

- ups 5,325 offices with more than one physician Cost per office: $7.00
12,017 office s with one physician Cost per office: $8.80 13,669 dentists’ offices Cost per office: $5.64

Start

- up cost: 5,325 x $7.00 + 12,017 x $8.80 + 13,669 x $6.64 = $233,787

Re

- grants 5,316 offices with more than two physicians Cost per office: $2.52
1,464 offices with more than two dentists Cost per office: $3.35

Re

- grant cost: 5,316 x $2.52 + 1,464 x $3.35 = $18,301

Total access

- granting cost in YEAR 2: $233,787 + $18,301 = $252,088

The following exhibit shows present value and annualized cost of granting of access to

si gn controlled substance prescriptions.

### 36

Exhibit 4

- 15: Present and Annualized Value of Granting of Access

Present Value 7.0 percent 3.0 percent

YEAR 1 $129,574 $129,574

YEAR 2 $222,822 $231,475

YEAR 3 $426,446 $460,211

YEAR 4 $426,803 $478,484

YEAR 5 $425,873 $495,982

YEAR 6 $251,807 $304,650

YEAR 7 $166,766 $209,598

YEAR 8 $116,278 $151,818

YEAR 9 $97,209 $131,850

YEAR 10 $92,787 $130,739

YEAR 11 $88,559 $129,628

YEAR 12 $84,517 $128,515

YEAR 13 $80,653 $127,402

YEAR 14 $76,959 $126,289

YEAR 15 $73,430 $125,176

Total $2,760,481 $3,361,391

Annualized $303,086 $281,572



### Review of security logs

Security logs must be reviewed whenever an auditable event occurs. DEA assumes that this will occur once a quarter although auditable events should be rare. The task requires 5 minutes per quarter

— 20 minutes per year. A person designated to administer logical access controls is required to review the security incident log, but a registrant is not required for the task. A security log will b e generated only when an auditable event occurs (e.g., an unauthorized person attempts to sign a controlled substance prescription). Relatively few events are expected to occur. The reviewer will need to determine if the reported event represented a secu rity problem or a simple mistake (e.g., a nurse clicked on the ―sign‖ button and was warned that he was not authorized to perform the function). In a physician’s office, the review will be done by a nurse; in a dentist’s office, by a

dental assistant. Tw enty minutes of the nurse’s time is $22.39; for the dental assistant,
$11.43.

This is an ongoing operational cost, and it varies with number of offices that have implemented electronic prescriptions for controlled substances. The number of physician

offi ces and of dental offices with electronic prescriptions for controlled substances is required for the cost calculation.

Exhibit 4

- 16: Offices of Physicians and Dentists w ith I mplemented EPCS

Physicians Dentists

YEAR 1 10,201 8,060

YEAR 2 27,543 21,729

YEAR 3 62,747 49,428

YEAR 4 98,826 77,733

YEAR 5 135,798 106,656

YEAR 6 155,587 122,017

### 37

Physicians Dentists

YEAR 7 166,690 130,531

YEAR 8 172,483 134,868

YEAR 9 176,517 137,817

YEAR 10 180,625 140,815

YEAR 11 184,808 143,863

YEAR 12 189,067 146,961

YEAR 13 193,404 150,109

YEAR 14 197,820 153,309

YEAR 15 202,316 156,561



### The calculation is the same for all years.

YEAR 2:

27,543 physicians’ offices $22.39 per office 21,729 dentists’ offices $11.43 per office Cost of log review in YEAR 2: 27,543 x $22.39 + 21,729 x $11.43 = $ 858,532

Exhibit 4

- 17: Present Value of Security Log Review

Present Value 7.0 percent 3.0 percent

YEAR 1 $320,544 $320,544

YEAR 2 $808,506 $839,904

YEAR 3 $1,720,649 $1,856,887

YEAR 4 $2,531,655 $2,838,208

YEAR 5 $3,249,803 $3,784,803

YEAR 6 $3,478,317 $4,208,253

YEAR 7 $3,481,283 $4,375,410

YEAR 8 $3,365,181 $4,393,740

YEAR 9 $3,217,223 $4,363,686

YEAR 10 $3,075,423 $4,333,350

YEAR 11 $2,939,548 $4,302,750

YEAR 12 $2,809,373 $4,271,903

YEAR 13 $2,684,678 $4,240,830

YEAR 14 $2,565,252 $4,209,545

YEAR 15 $2,450,889 $4,178,068

Total $38,698,325 $52,517,882

Annualized $4,248,868 $4,399,243



### Exhibit 4

- 18 summarizes costs for practitioners’ offices over 15 years.

Exhibit 4

- 18: Cost Summary for Practitioners’ Offices

7.0 percent 3.0 percent

Present value Annualized Present value Annualized

ID and protocol $133,608,434 $14,669,488 $176,221,878 $14,761,504

### 38

7.0 percent 3.0 percent

Present value Annualized Present value Annualized

Application for protocol $35,018,858 $3,844,882 $45,576,474 $3,817,785
Checking registration $276,922 $30,405 $325,415 $27,259
Training for access $65,102,335 $7,147,886 $75,392,895 $6,315,405
Granting access $2,760,481 $303,086 $3,361,391 $281,572

Security log review $38,698,325 $4,248,868 $52,517,882 $4,399,243

Totals $275,465,355 $30,244,615 $353,395,934 $29,602,769



### 4.2 HOSPITALS AND CLINIC S

DEA treats hospitals and clinics as a single group for this analysis. In both groups, there will be credentialing procedures already in place that eliminate some of the requirements imposed on practices. Specifically, the hospital, which is a registrant, already conducts identity proofing as part of its credentialing process for both staff practitioners and practitioners who are being granted p rivileges. Once the current practitioners have a brief

face

- to

- face identity verification, they are provided with a two

- factor credential, or an existing protocol is enabled to sign electronic prescriptions for controlled substances. New practitioners wi ll receive this check as part of the standard credentialing process. Similarly, the hospital will make, or will have made, for reasons beyond this analysis, arrangements for its practitioners to access the hospital’s electronic applications for, among oth er purposes, prescription transmission. There will be no costs for training related to, or granting of, logical access controls. The costs that are incurred by hospitals and are analyzed here are:

 Identity check

 Security log review

Impl ementation rate

As noted in Chapter 2, DEA assumes zero future growth for the number of hospitals and clinics. But DEA does not assume that all hospitals will implement electronic prescriptions for controlled substances in the first year. It is, thus, necessary to assu me an implementation rate. DEA judges that hospitals will implement in the first five years. They may believe they have a more compelling need to adopt procedures for electronic records and prescriptions than many practice offices. The following exhibit shows the implementation schedule.

Exhibit 4

- 19: Hospital/Clinic Implementation Schedule

Implementation Rate (percentage) Cumulative

Percentage

YEAR 1 25.0 percent 25.0 percent

YEAR 2 25.0 percent 50.0 percent

YEAR 3 20.0 percent 70.0 percent

YEAR 4 20.0 percent 90.0 percent

### 39

Implementation Rate (percentage) Cumulative

Percentage

YEAR 5 10.0 percent 100.0 percent



### Costs of identity verification will vary both with number of practitioners on staff in hospitals and numbers of physicians with hospital privileges. It is necessary to project

numbers of staff practitioners and private physicians as their hospitals implement electronic prescriptions for controlled substances over the phase

- in period. DEA assumes that all physicians in offices will have privileges in some hospital or clinic. Numbers of hospita ls, staff practitioners, and physicians in practice in hospitals as they adopt electronic prescriptions for controlled substances are shown below.

Exhibit 4

- 20 : Hospitals /Clinics and Practitioners in Hospitals Starting EPCS

Hospitals Staff

Practitioners P hysicians

in Practice All

Practitioners

YEAR 1 3,103 54,545 82,193 136,738

YEAR 2 3,103 56,857 85,645 142,502

YEAR 3 2,482 47,867 72,117 119,984

YEAR 4 2,482 49,847 75,099 124,946

YEAR 5 1,241 28,161 42,428 70,589

Totals 12,412 237,277 357,482 594,759
Numbers may not add due to rounding.



### Identity verification

The identity verification will require, for each practitioner, thirty minutes for the practitioner to visit the credentialing office and two minutes for a human resource staff

person to check the photographic identification. The labor cost will be the time of a human resources staff person performing the verification and the time of the practitioner whose identity is being verified. The value of the time of the practitioner is differen t for hospital staff and private physicians. Below are costs for identity verification for a hospital

- based physician and for a private physician.

Exhibit 4

- 21: Costs for a Hospital/Clinic ID Check

Cost per

Hour Cost of 2 /

30
Minutes Cost of

ID Check

HR Associate $36.06 $1.20

Hospital

- based Practitioner $110.45 $55.22 $56.42

Private Physician $192.17 $96.08 $97.28

Weighted average for hospital mid

- level practitioners and hospital physicians.



### Cost calculation:

YEAR 2: Identity verification : 56,857 x $5 6 .42 + 85,645 x $97.28 = $11,540,240

### 40

After a hospital’s first year using electronic prescriptions for controlled substances, costs of identity verification will disappear. Identity verification will be incorporated in a hospital’s routine credential ing procedures at no incremental cost. Thus, these costs will be zero after YEAR 5. Costs for the identity verification, over time, are shown in

Exhibits 4

- 22 and 4

- 23.

Security log review

An information technology system administrator must review the security log once a month. DEA believes a reasonable estimate is ten minutes for the monthly review (compared to five minutes per quarter in a physician’s office). Ten minutes per month per year is two hours. The hourly cost of the systems administrator is $68.32, so the annual cost of the log review is $136.64 per hospital.

Cost calculation:

YEAR 2:

Since this is an ongoing operational cost, it will vary with the cumulative total of hospitals that have implemented electronic prescriptions for controll ed substances, rather than with the number starting electronic prescriptions for controlled substances in a given year. The number of hospitals implemented in YEAR 2 is 6,776

.

6,206 x $136.64 = $ 848,014

Because hospitals have fully implemented electroni c prescriptions for controlled substances by YEAR 5, this cost will not change from YEAR 5 on. In light of the great difference in time distribution among hospital costs, it is useful to show them over time undiscounted as well as the present values.

Exh ibit 4

- 22: Hospital/Clinic Costs Undiscounted F uture V alues

ID Check Log review

YEAR 1 $11,073,901 $424,007

YEAR 2 $11,540,240 $848,014

YEAR 3 $9,716,868 $1,187,220

YEAR 4 $10,118,713 $1,526,426

YEAR 5 $5,716,598 $1,696,029

YEAR 6 $0 $1,696,029

YEAR 7 $0 $1,696,029

YEAR 8 $0 $1,696,029

YEAR 9 $0 $1,696,029

YEAR 10 $0 $1,696,029

YEAR 11 $0 $1,696,029

YEAR 12 $0 $1,696,029

YEAR 13 $0 $1,696,029

YEAR 14 $0 $1,696,029

YEAR 15 $0 $1,696,029

### 41

Exhibit 4

- 23: Hospital/Clinic Present and Annualized Values

7% 3%

ID Check Log review ID
Check Log

review

YEAR 1 $11,073,901 $424,007 $11,073,901 $424,007

YEAR 2 $10,785,271 $792,537 $11,204,117 $823,315

YEAR 3 $8,487,089 $1,036,964 $9,159,080 $1,119,069

YEAR 4 $8,259,884 $1,246,018 $9,260,056 $1,396,896

YEAR 5 $4,361,165 $1,293,892 $5,079,123 $1,506,900

YEAR 6 $0 $1,209,245 $0 $1,463,009

YEAR 7 $0 $1,130,136 $0 $1,420,398

YEAR 8 $0 $1,056,202 $0 $1,379,027

YEAR 9 $0 $987,104 $0 $1,338,861

YEAR 10 $0 $922,527 $0 $1,299,865

YEAR 11 $0 $862,175 $0 $1,262,005

YEAR 12 $0 $805,771 $0 $1,225,247

YEAR 13 $0 $753,057 $0 $1,189,561

YEAR 14 $0 $703,792 $0 $1,154,913

YEAR 15 $0 $657,749 $0 $1,121,275

Total $42,967,310 $13,881,177 $45,776,277 $18,124,347

Annual ized $4,717,580 $1,524,079 $3,834,522 $1,518,215



### 4.3 PHARMACIES

The rule imposes costs on pharmacies for logical access controls and security log reviews. For logical access controls there is cost for both training and granting of access. Training cost depends on number of pharmacies, as does cost of granting access in the first year. After YEAR 1, there are no training costs. DEA believes that all pharmacies will enable electronic prescriptions for controlled substances in the first year, and there will be no repeat train ing costs. Using the logical access controls will be simpler in a pharmacy than in a practice office, and the skills can be readily passed on to new hires as occasion requires. Further, pharmacies have been declining in number; DEA does not

expect any ne w entrants after YEAR 1.

While recent experience shows number of pharmacies declining, data also indicate growth rates for pharmacists and pharmacy technicians of 2.1 and 2.8 percent, respectively. Growth in personnel as number of stores declines occurs because of steady disappearance of smaller stores while sales are growing.

Granting of access in the first year will be a cost per pharmacy location, as a pharmacy technician enters the required information for those to have access in one batch when

elect ronic prescriptions for controlled substances is implemented.

Since the number of pharmacies is projected as constant, there is no change in log review

cost over time.

### 42

Training for access controls

There are 65,421 pharmacies in DEA’s data on registrants. Training for access controls will have a low cost per pharmacy location; DEA expects that an average of three pharmacy technicians per store will be trained. That results in 196,263 technicians

re ceiving training. Training takes five minutes (1/12 hour) and the hourly cost of a pharmacy technician is $ 27.99 ; the training, thus, costs $2.33 (27.99 ÷ 12) for one pharmacy technician.

Cost calculation:

YEAR 1 only:

196,263 x $27.99 ÷ 12 = $ 457,720

Granting access

There are 65,421 pharmacies in DEA’s data on registrants. In YEAR 1, DEA assumes they all adopt electronic prescriptions for controlled substances and access is granted for all pharmacists and technicians. As this is done in a single batch per location, a pharmacy technician can perform the task in an average of five minutes per store. As with practitioner offices, access control for new hires after the initial implementation should be done routinely. Cost calculation:

In the first year, access granting requires five minutes per store for a pharmacy

technicia n.

65,421 x $27.99 ÷ 12 = $ 152,573

Security Log Reviews

This cost depends on number of pharmacies. It is constant over time, since the number of pharmacies is not expected to increase. It requires five minutes per month, one hour per year, for a pharm acy technician. Five minutes could well be a high estimate, since security incidents could be rare, especially in a small store.

65,421 x $27.99 = $ 1,830,878

Below are the present values and annualized cost.

### 43

Exhibit 4

- 24: Pharmacy Costs Present and Annualized Values

7.0 percent 3.0 percent

Access training Access

granting Log review Access training Access

granting Log review

YEAR 1 $457,720 $152,573 $1,830,878 $457,720 $152,573 $1,830,878

YEAR 2 $0 $0 $1,711,101 $0 $0 $1,777,551

YEAR 3 $0 $0 $1,599,160 $0 $0 $1,725,778

YEAR 4 $0 $0 $1,494,542 $0 $0 $1,675,513

YEAR 5 $0 $0 $1,396,768 $0 $0 $1,626,711

YEAR 6 $0 $0 $1,305,391 $0 $0 $1,579,331

YEAR 7 $0 $0 $1,219,991 $0 $0 $1,533,332

YEAR 8 $0 $0 $1,140,179 $0 $0 $1,488,671

YEAR 9 $0 $0 $1,065,588 $0 $0 $1,445,312

YEAR 10 $0 $0 $995,876 $0 $0 $1,403,216

YEAR 11 $0 $0 $930,726 $0 $0 $1,362,345

YEAR 12 $0 $0 $869,837 $0 $0 $1,322,665

YEAR 13 $0 $0 $812,932 $0 $0 $1,284,141

YEAR 14 $0 $0 $759,749 $0 $0 $1,246,739

YEAR 15 $0 $0 $710,046 $0 $0 $1,210,426

Total $457,720 $152,573 $17,842,763 $457,720 $152,573 $22,512,610

Annual ized $50,255 $ 16,752 $1,959,040 $38,342 $ 12,781 $1,885,804



### 4.4 APPLICATION PROVIDER S

Costs incurred by application providers are in two forms: reprogramming of applications to meet DEA’s requirements for electronic prescriptions for controlled substances and auditing of applications to ensure compliance. Reprogramming will occur only in YEAR 1. All existing application providers will reprogram then, so they can be ready to sell to practice offices and pharmacies. Some providers will enter the market after that, but they will not need to reprogram, as they will write software applications for the new market.

Electronic prescription and pharmacy applications mus t be audited before providers can offer them for sale, and they must be audited thereafter on a biennial basis. New application providers entering the market after the first year will require initial audits.

Both practice offices and pharmacies will requ ire applications. Application providers generally specialize in either applications for offices or applications for pharmacies. DEA estimates that there are approximately 170 providers now selling to practices and 40 selling to pharmacies. DEA expects t hat the number of providers to pharmacies will remain constant at 40. Providers to practices will increase in YEARs 2 and 3 as firms enter the market for electronic health record applications. Thereafter, the number will decline as competition forces som e firms out of the market and consolidation of other ones. For this analysis, DEA projects number of application providers for the first five years as follows.

### 44

Exhibit 4

- 25: Number of Application Providers

Providers to
Practice Offices Providers to

Pha rmacies

YEAR 1 170 40

YEAR 2 190 40

YEAR 3 200 40

YEAR 4 170 40

YEAR 5 150 40



### DEA does not project number of application providers after YEAR 5. Providers to pharmacies remain constant at 40, and providers to practices will incur no costs after YEAR 5. There will be no initial audits after YEAR 3, because there will be no new providers after YEAR 3. The ongoing cost for these providers is the biennial audit. After five years, and the increasing use of electronic applications for medical purpos es, providers to practice offices will have strong commercial reasons, apart from electronic prescriptions for controlled substances, for seeking and retaining certification of their applications. Costs for audits of pharmacy applications will continue be cause at present no organization certifies pharmacy applications nor is there reason to think that certification will develop.

Cost calculation:

Reprogramming of practice applications require 2,000 hours of work by an application provider engineer; for p harmacy applications, 1,000 hours. Hourly cost of the engineer is $ 92.10 . Audits, both initial and ongoing, are $15,000 per audit for both practice and pharmacy applications.

Examples are offered for YEARs 1 and 3.

YEAR 1: Reprogramming Practice applic ations 170 x 2,000 x $92.10 = $ 31,313,493 Pharmacy applications 40 x 1,000 x $92.10 = $ 3,683,940 Initial audits (170 + 40) 210 x $15,000 = $ 3,150,000

YEAR 3: No reprogramming Initial audits for ten new providers to practices 10 x $15,000 = $150,000

Biennial audits Practice applications 200 x $15,000 = $3,000,000 Pharmacy applications 40 x $15,000 = $600,000

### 45

Below are the undiscounted future projections of cost, as well as present values and

annualized cost.

Exhibit 4

- 26: Undiscounted Future Values of Application Provider Costs

Reprogramming

Practices Reprogramming

Pharmacies Initial

Audits Biennial

Audits

YEAR 1 $31,313,493 $3,683,940 $3,150,000 $0

YEAR 2 $0 $0 $300,000 $0

YEAR 3 $0 $0 $150,000 $3,600,000

YEAR 4 $0 $0 $0 $0

YEAR 5 $0 $0 $0 $2,850,000

YEAR 6 $0 $0 $0 $0

YEAR 7 $0 $0 $0 $600,000

YEAR 8 $0 $0 $0 $0

YEAR 9 $0 $0 $0 $600,000

YEAR 10 $0 $0 $0 $0

YEAR 11 $0 $0 $0 $600,000

YEAR 12 $0 $0 $0 $0

YEAR 13 $0 $0 $0 $600,000

YEAR 14 $0 $0 $0 $0

YEAR 15 $0 $0 $0 $600,000



### Exhibit 4

- 27: Present and Annualized Values of Application Provider Costs

7.0 percent 3.0 percent Reprogram ming Initial

Audits Biennial

Audits Reprogrammi

ng Initial

Audits Biennial

Audits

YEAR 1 $34,997,433 $3,150,000 $0 $34,997,433 $3,150,000 $0

YEAR 2 $0 $280,374 $0 $0 $291,262 $0

YEAR 3 $0 $131,016 $3,144,379 $0 $141,389 $3,393,345

YEAR 4 $0 $0 $0 $0 $0 $0

YEAR 5 $0 $0 $2,174,251 $0 $0 $2,532,188

YEAR 6 $0 $0 $0 $0 $0 $0

YEAR 7 $0 $0 $399,805 $0 $0 $502,491

YEAR 8 $0 $0 $0 $0 $0 $0

YEAR 9 $0 $0 $349,205 $0 $0 $473,646

YEAR 10 $0 $0 $0 $0 $0 $0

YEAR 11 $0 $0 $305,010 $0 $0 $446,456

YEAR 12 $0 $0 $0 $0 $0 $0

YEAR 13 $0 $0 $266,407 $0 $0 $420,828

YEAR 14 $0 $0 $0 $0 $0 $0

YEAR 15 $0 $0 $232,690 $0 $0 $396,671

Total $34,997,433 $3,561,390 $5,318,631 $34,997,433 $3,582,652 $5,925,533

Annual ized $3,842,530 $391,021 $583,957 $3,842,530 $393,356 $650,592



### Summary of costs

Exhibits 4

- 28 and 4

- 29 summarize the annualized costs by item and sector at 7 percent and 3 percent discount rate, respectively.

### 46

Exhibit 4

- 28: Annual ized Costs by Item and by Sector

-- 7.0 percent

Practitioners' Application

Offices Hospitals Pharmacies Providers Totals

Credential $14,669,488 $14,669,488

Credential application $3,844,882 $3,844,882
Registration check $30,405 $30,405 Granting access $303,086 $16,752 $319,838
Training for granting $7,147,886 $50,255 $7,198,142
Review security logs $4,248,868 $1,524,079 $1,959,040 $7,731,986

ID verification $4,717,580 $4,717,580
Reprogram applications $3,842,530 $3,842,530

Obtain certification $391,021 $391,021
Audit of applications $583,957 $583,957

Totals $30,244,615 $6,241,658 $2,026,046 $4,817,509 $43,329,829



### Exhibit 4

- 29: Annual ized Costs by Item and by Sector

-- 3 .0 percent

Practitioners' Application

Offices Hospitals Pharmacies Providers Totals

Credential $14,761,504 $14,761,504

Credential application $3,817,785 $3,817,785
Registration check $27,259 $27,259
Granting access $281,572 $12,781 $294,353
Training for granting $6,315,405 $38,342 $6,353,747
Review security logs $4,399,243 $1,518,215 $1,885,804 $7,803,262

ID verification $3,834,522 $3,834,522
Reprogram applications $3,842,530 $3,842,530

Obtain certification $393,356 $393,356
Audit of applications $650,592 $650,592

Totals $29,602,769 $5,352,737 $1,936,927 $4,886,478 $41,778,910



### 4.5 OPTIONS



## 4.5.1 Option 2

– Required Use of Biometrics

This is the same as Option 1, except that the two

- factor authentication provision is changed to require a biometric identifier and a hard token. Passwords would not be permitted for authentication. The cost items are:

 Biometric readers for practitioners’ offices, hospitals, and clinics

 Software packages for practitioners’ o ffices and clinics

 Reprogramming of applications for hospitals

A biometric reader would be needed for every practitioner’s computer. DEA estimates that hospitals would need one for every 15 beds, and each clinic would need an average

### 47

of two readers. DEA estimates 802,658 hospital beds 31 

### with zero future growth (4,927 community hospitals). The number of clinics is estimated at 7,485 with zero future growth. There are 20 firms providing applications to hospitals, and their number is not expected to change

. 32 

### All of these firms would reprogram their applications in YEAR 1. Costs of readers and software packages would be incurred as hospitals and clinics adopt electronic prescriptions for controlled substances. Hospital beds and clinics are phased

into the analysis over five years at the rate shown for hospitals in Section 4.2. This is reflected in the following exhibit.

Exhibit 4

- 30: Phase

- in of Hospital Beds and Clinics

Beds Clinics

YEAR 1 200,665 1,871

YEAR 2 200,665 1,871

YEAR 3 160,532 1,497

YEAR 4 160,532 1,497

YEAR 5 80,266 749



### There are no costs for hospitals and clinics after YEAR 5. All reprogramming costs are in YEAR 1. Costs for practitioners’ offices and registrants extend over 15 years following the projected start

- up of electronic prescriptions for controlled substances in practitioners’ offices and number of registrants in practitioners’ offices starting electronic prescriptions for controlled substances as shown in Exhibit 4

- 4 i n Section 4.1.

A biometric reader that meets the requirements costs $114.00. 33 

### The software package for clinics and offices is $86.00. 34 

### Reprogramming of applications for hospitals would require 200 hours for an application provider’s engineer at $92.10 per hour. Cost is
$ 18,420 per application provider.

Cost calculations:

YEAR 1:

Readers: 1 3,378 in hospitals; 3,743 in clinics, 34,964 in offices. Total: 5 2,084 x $ 113 = $ 5,937,560 Software packages: 18,257 in offices, 1,871 in clinics. Total:
20,128 x $ 84 = $ 1,731,051 Reprogramming: 20 x $18,420 = $368,400 Total: $ 5,937,560 + $ 1,731,051 + $ 368,400 = $ 8,037,011

The following exhibit shows present value and annualized costs.

31 American Hospital Association Fast Facts, community hospital beds.

32 The estimate is based on the number of application providers that have obtain ed CCHIT certification for inpatient EHRs.

33 Based on the cost of BioTouch 500, which is a separate reader. Where the reader is part of keyboard, the bundled reader and software is available for $200. The software cost was derived from this price.

34 http://secugen.com/purchase/store_us.htm , accessed 11/24/2008.

### 48

Exhibit 4

- 31: Present Value and Annualized Costs for Biometric Option

7.0 percent 3.0 percent

YEAR 1 $8,037,011 $8,037,011

YEAR 2 $10,862,145 $11,283,976

YEAR 3 $18,424,735 $19,883,569

YEAR 4 $17,750,891 $19,900,309

YEAR 5 $16,454,640 $19,163,490

YEAR 6 $8,085,656 $9,782,458

YEAR 7 $4,387,114 $5,513,892

YEAR 8 $2,278,677 $2,975,149

YEAR 9 $1,570,416 $2,130,037

YEAR 10 $1,502,772 $2,117,445

YEAR 11 $1,437,996 $2,104,861

YEAR 12 $1,375,970 $2,092,286

YEAR 13 $1,316,578 $2,079,722

YEAR 14 $1,259,712 $2,067,171

YEAR 15 $1,205,265 $2,054,634

Total $95,949,579 $111,186,009

Annual ized $10,534,748 $9,313,672 Annualized plus Option 1 $53,864,576 $51,092,582



### The cost of the biometrics requirement is additive to the interim final rule cost, since no other requirements are eliminated.



## 4.5.2 Option 3

- Callbacks

Under this option the security requirements of the interim final rule are set aside a nd sole reliance for security is placed on a requirement that, on receipt of an electronic prescription for a controlled substance, a pharmacy must call the practitioner’s office for verification of the prescription. For the sake of simplicity, DEA has no t included in this option estimates of the time that will be required to reprogram existing applications to conform to the basic information included on every controlled substance prescription. DEA has no basis for determining how many existing applicatio ns do not include or do not transmit all of this information. Similarly, there may be some pharmacy applications that will require reprogramming to incorporate the requirements for annotations. The costs of reprogramming, however, will be relatively smal l compared with the primary cost of this option.

The cost of this option depends on the number of prescriptions to be verified. There were 461,172,000 controlled substance prescriptions in 2008. 35 

### Annual growth rate has been 3.0 percent. Therefore, DEA expects 475,007,160 prescriptions in YEAR 1 and growth thereafter at 3.0 percent annually. Of these prescriptions, 75.0 percent will be original prescriptions, requiring verification if electronic; the remainder are refills that are

35 In 2008, controlled substances represented 12.15% of the top 400 brand name and generic drugs sold at retail. The estimated number of controlled substance prescriptions is based on the assumption that 12% of all prescriptions (3.8431 billion according t o IMS Health data) are for controlled substances.

### 49

authorized on the orig inal prescription and require no contact between the pharmacy and practitioner.

Industry estimates indicate that 30 percent of original prescriptions generate callbacks to deal with formulary issues, requests to change to generic forms of the prescribed d rug, illegibility, and other problems. Based on data from a 2004 Medical Group Management Association survey, 34 percent of callbacks on original prescriptions were for formulary issues, 31 percent were about generic drugs, and 35 percent were on other is sues. 36 

### The callback rate for controlled substance prescriptions is likely to be lower than 30 percent because more than 85 percent of controlled substance prescriptions are for generic drugs. Adjusting for a lower number of calls related to generic drugs , DEA estimates that currently 22 percent of controlled substance prescriptions require callbacks. The callback option applies only to new calls that would need to be placed, or 78 percent of the original prescriptions: 277,879,189 (0.78 x 0.75 x 475,007 ,160). For the 22 percent of prescriptions that already require callbacks, the confirmation would simply be part of a call that is being made anyway and, therefore, is not an additional cost. The number of electronic prescriptions each year requiring cal ls will be determined by the rate of adoption of electronic prescriptions for controlled substances.

Costs will be somewhat different between dentists’ and physicians’ offices. Taking physicians and dentists as a whole, 66.0 percent are physicians, and 3 4.0 percent are

dentists. 37 

### There are no available data on relative number of prescriptions from physicians and dentists. Nonetheless, it is certainly the case that dentists will originate prescriptions at a lower rate than physicians. For this analysis, DEA assumes that dentists prescribe at half the rate per practitioner as physicians. On that basis, 83.0 percent of controlled substance prescriptions will be from physicians, 17.0 percent from

dentists.

Number of calls, year by year, to physicians and dentists is shown in Exhibit 4

- 32.

Exhibit 4

- 32: Number of Calls to Physicians and Dentists

Incremental

calls Calls to EPCS

offices Physicians Dentists

YEAR 1 277,879,189 16,672,751 13,816,271 2,856,481

YEAR 2 286,215,564 45,794,490 37,948,690 7,845,800

YEAR 3 294,802,031 106,128,731 87,946,090 18,182,642

YEAR 4 303,646,092 170,041,812 140,909,179 29,132,632

YEAR 5 312,755,475 237,694,161 196,970,903 40,723,258

YEAR 6 322,138,139 277,038,800 229,574,771 47,464,029

YEAR 7 331,802,283 301,940,078 250,209,805 51,730,273

YEAR 8 341,756,352 317,833,407 263,380,189 54,453,218

YEAR 9 352,009,042 330,888,500 274,198,602 56,689,898

YEAR 10 362,569,314 344,440,848 285,429,076 59,011,772

YEAR 11 373,446,393 358,508,537 297,086,601 61,421,937

YEAR 12 384,649,785 373,110,291 309,186,690 63,923,601

36 http://www.mgma.com/WorkArea/DownloadAsset.aspx?id=19248 , accessed 08/06/09.

37 Mid

- level practitioners also write prescriptions, bu t to be conservative, the analysis assigns these prescriptions to practitioners.

### 50

Incremental

calls Calls to EPCS

offices Physicians Dentists

YEAR 13 396,189,278 388,265,493 321,745,407 66,520,085

YEAR 14 408,074,957 403,994,207 334,779,379 69,214,828

YEAR 15 420,317,205 420,317,205 348,305,819 72,011,386



### At the pharmacy, a call requires three minutes of the time of a pharmacy technician. In a physician’s office it requires three minutes for a medical assistant and one minute for a physician; in a dentist’s office, a call requires three minutes for a dental assistant and one

minu te for a dentist. Costs per office and per pharmacy are shown in the following exhibit. Because the callback is only to confirm the prescription, it will not require the time that callbacks related to formulary, drug substitution, or contraindications ta ke.

Exhibit 4

- 33: Costs for Callbacks by Office Type

Pharmacy Physician Office Dental Office

Time 3 minutes

pharmacy tech 3 minutes med. asst.

1 minute physician 3 minutes dent. asst.

1 minute dentist

Cost .05 x 27.99 .05 x 29.66 +

.017 x 192.16 .05 x 34.28 +

.017 x 166.74

Total cost $1.40 $4.69 $4.49



### Cost calculation: The calculation is the same for all years.

YEAR 1:

Pharmacies 16,672,751 x $1.40 = $23,330,257 Physicians 13,816,271 x $4.69 = $64,738,971 Dentists 2,856,481 x $4.49 = $12,833,952 Total cost: $100,903,179

Exhibit 4

- 34: Costs for Callbacks by Year Present Value and Annualized

7.0 percent 3.0 percent

YEAR 1 $100,903,179 $100,903,179

YEAR 2 $259,016,261 $269,075,145

YEAR 3 $561,000,172 $605,419,076

YEAR 4 $840,043,872 $941,763,006

YEAR 5 $1,097,440,492 $1,278,106,937

YEAR 6 $1,195,416,611 $1,446,278,903

YEAR 7 $1,217,630,938 $1,530,364,885

YEAR 8 $1,197,872,728 $1,563,999,278

YEAR 9 $1,165,491,283 $1,580,816,475

YEAR 10 $1,133,856,850 $1,597,633,671

YEAR 11 $1,102,958,833 $1,614,450,868

YEAR 12 $1,072,786,380 $1,631,268,065

YEAR 13 $1,043,328,425 $1,648,085,261

YEAR 14 $1,014,573,713 $1,664,902,458

YEAR 15 $986,510,832 $1,681,719,654

Total $13,988,830,568 $19,154,786,861

Annualized $1,535,922,056 $1,604,555,706

### 51

These are the total annualized costs of the callback option, as other security requirements

are eliminated.



## 4.5.3 Summary of cost of options

The following summarizes annualized costs of the three options.

Exhibit 4

- 35: Annualized Costs b y Option

7.0 percent 3.0 percent

Option 1 $43,329,829 $41,778,910

Option 2

– Required Use of Biometrics $53,864,576 $51,092,582

Option 3

– Callbacks $1,535,922,056 $1,604,555,706

### 52

### 53



## CHAPTER 5: SMALL ENT ITY ANALYSIS

Under the Regulatory Flexibility Act of 1980 (5 U.S.C. 601

- 612) (RFA), Federal agencies must evaluate the impact of rules on small entities and determine whether the rule will have a significant economic impact on a substantial number of small entities.

This section discusses DEA’s analysis of the impact on small entities. DEA emphasizes that the rule is voluntary. No businesses are required to comply with this rule unless they elect to issue or process controlled substance prescriptions as electronic data files; practitione rs and pharmacies have the option to continue to use paper and

, for Schedule

III

- V substances, oral prescriptions.

5 .1 CHARACTERISTICS OF S MALL ENTITIES

As discussed in previous chapters , the small entities directly affected by the rule are practitioner s and

, to a limited extent

, pharmacies. The firms marketing services and

software applications are not directly affected by the rule because they will recover t heir costs from practitioners and pharmacies. Exhibit 5

- 1 shows Small Business

Administration’ s standards for these firms.

Exhibit 5

- 1: SBA Definitions of Small Entities

Affected Entity Industry Description NAICS
Code Small Business Definition

(sales in $)

Practitioner

and Mid

Level

Practitioner Offices of Physicians 62111 $10,000,000

Offices of Dentists 621210 $7,000,000

Institutional

Practitioner Hospitals 62211 $34,500,000

Freestanding Ambulatory Surgical and

Emergency Centers 621493 $10,000,000

Pharmacy Pharmacies and Drug Stores 44611 $7,000,000

Supermarkets and Other Grocery Stores 44511 $27,000,000

General Merchandise Stores 45291 $27,000,000

Mail Order Houses 454113 $25,000,000



### Although some practitioners are part of large practices that may qualify as large

business es , so few practitioners fall into the large category that it is simpler to assume that they are all small entities. It is also the case that the application providers generally charge on a per practitioner basis rather than a per practice basis so that the costs may be considered as applying to individual practitioners. Mid

- level practitioners are generally

### 54

employed by a practice so their costs will be incurred by the practice, not the individual. They are not, therefore, small businesses.

The lowest sta rting compensation for a physician in private practice listed in the Medical Group Management 2008 Physician Compensation Survey was $130,000 for pediatrics. 38


### The 2002 Economic Census data indicate that the smallest physician practice (less than five emplo yees) had average revenues of about $400,000 (2002 dollars). The American Dental Association states that the average net income of a dentist in private practice is $ 202,930 for a general practitioner. The average gross billings for a dentist in general practice per dentist are $ 670,100

. 39 

### For pharmacies, the 1 6,920 independent pharmacies are small entities; the other pharmacies belong to about 200 chains that are mostly large

firms

. T here may be a few chains with fewer than 3 pharmacies, which could be small.

In 200 8

, National Association of Chain Drug Stores data indicate that the average independent pharmacy had prescription sales of $2. 58 million a year; average total sales are about $ 3.056 million. 40



### 5 .2 SMALL ENTITY COSTS

The costs to DEA registrants are relatively small. As discussed in Chapter 4, the initial

costs to the smallest practitioner (in solo practice) will be about $400 ($110 for identity proofing and credential, and $290 in labor costs to complete the applicat ion , receive access control training, and set logical access controls). (Note that this cost is probably overstated because access control training for a very small office is unlikely to take an hour.) The main ongoing costs for the rule will be the rene wal of the credential ($49 every three years) and checking security logs ($22 per year) plus any incremental cost of the software or application. The initial costs for the basic rule elements represent about

0.3 percent of the annual income of the lowest paid practitioner and 0.1 percent of

average revenues

. The ongoing costs are considerably lower. For practices with a physician and a mid

- level practitioner, the costs would be lower because access control training would not need to involve the physician

.

Determining the incremental cost of the application requirements per practitioner is difficult because it depends on the number of providers, the number of customers, the number of application requirements that an application provider does not already m eet, and how costs are recovered (in the year in which the money is spent or over time). For example, an electronic health record application that had to reprogram to the full extent will have incremental application costs of $199,000 ($15,000 for the thi rd

- party audit and $184,000 for reprogramming). If the provider recovered the costs from its 1,000 customers, the incremental cost to those customers will be $199 or about $17 a month. The costs in the out years will be much lower ($15,000 every two year s) because no further programming is needed. Even if the provider did not add customers and

38 http://www.cejkasearch.com/compensation/amga_physician_compensation_survey.htm

, accessed

08/06/09.

39 www.ada.org/ada/prod/survey/faq.asp , accessed 6/15/09.

40 http://www.nacds.org/wmspage.cfm?parm1=507 , accessed 6/17/2009.

### 55

continued to obtain a third

- party audit rather than rely on certification, the incremental cost to practitioners will be less than a dollar a month.

For pharmac ies, the costs will be the incremental cost that their application provider charges to cover the costs of reprogramming and audits ($92,000 plus $15,000) plus the cost of reviewing the security log ($11.43 per year) and initial access control training and initial access control setting ($4.66) . In the first year, if the application providers recover the programming costs and initial audit costs in a single year, the average incremental cost to a pharmacy for these two activities w ill be $ 65 ($4,284,900 fir st year cost divided by 65,421 pharmacies)

. The total first year cost will, therefore, be less than $100. After that, the incremental charge to recover the cost of the third

- party audit w ill be $ 9 per pharmacy every two years , assuming the cost is evenly distributed across all pharmacies. The pharmacy will have continuing labor costs for reviewing security logs ($11.43). The first year charge represents less than 0.01 percent of an independent pharmacy’s annual

sales . The annual cost is less than $0.01 per controlled substance prescription . It also represents a far lower cost than the pharmacy will pay its application provider to cover

the SureScripts /RxHub or another intermediary for processing the prescriptions. According to comments DEA received to its notice of proposed rulemaking, SureScripts /RxHub charges a transaction fee of $0. 30 41 

### per electronic prescription to route and, where necessary convert, prescriptions to ensure that the pharmacy system will be able to capture the data electronically

. 42 

### Based on N ational A ssociation of C hain D rug S tores data on the average price of prescriptions ($ 71.69 ) and the average value of prescription sales, an independent pharmacy processes about 36, 000 prescriptions a year

and will have to pay about $10,800 to c over the transaction fee. 43



### The average annualized cost to hospitals and clinics is about $180, which does not represent a significant impact. Most of the hospital tasks are part of their routine business practices related to credentialing.

Application providers are not directly regulated by the rule and, therefore, are not covered by the requirements of the RFA. DEA notes, however, that the costs of the rule are not so high that any of these firms will not be able to recover them from their customers. Reprogramming is a routine practice in the software industry; applications are updated with some frequency to add features and fix problems. The additional requirements of the rule can be incorporated during the update cycle. Many of these

f irms are already spending more than DEA has estimated to obtain CCHIT certification; in time, DEA expects that this certification (or a similar certification) will replace the

third

- party audit, further reducing their costs.

41 Comment from the Pharmacy Society of Rochester.

42 S ureScripts/RxHub and other intermediaries check records to ensure that the format meets the requirements of NCPDP SCRIPT. If the record was generated using a version of SCRIPT that differs from the version used by the receiving pharmacy, the intermediarie s may translate the record so that the receiving pharmacy application can read it properly.

43 http://www.nacds.org/wmspage.cfm?parm1=507 , accessed 6/17/09.

### 56

Based on the above analysis, DEA has determined that although the rule w ill impact a subst antial number of small entities, it will not impose a significant economic impact on any small entity directly subject to the rule.

### 57



## CHAPTER 6: BENEFITS

6.1 INTRODUCTION

Electronic prescriptions are widely expected to reduce errors in medication dispensing because they will eliminate illegible written prescriptions and misunderstood oral prescriptions. They are also expected to reduce the number of callbacks from pharmacy to practitioner to address legibility, formulary, and contraindication issues. E lectronic prescriptions may also reduce processing time at the pharmacy and wait time for patients. These benefits are likely to be mitigated to some extent. As a Rand stud y suggested, practitioners may fail to review the prescription and notice errors that occur when the wrong item is selected from one or more drop

- down menus; pharmacists may be less likely to question a legible electronic prescription. 44 

### T he formulary and c ontraindication checks are functions that practitioners sometimes disable because they do not work as they should or take too much time. 45 

### The contraindication checks do not always work as

intended. 46 

### In addition, recent studies indicate that electronic pre scriptions sometimes are missing information, particularly directions for use and dosing errors. 47 

### Nonetheless,

e lectronic prescriptions may provide benefits in avoided medication errors, reduced processing time, and reduced callbacks. These benefits of electronic prescriptions are not directly attributable to this rule except to the extent the rule facilitates implementation of electronic prescribing of controlled substances

.

6.2 QUANTIFIED BENEFITS

DEA has quantified three types of benefits: reduced n umber of callbacks to clarify prescriptions, the reduction in wait time for patients picking up prescriptions, and the

cost

- savings pharmacies will realize from eliminating storage of paper records. One of the greatest burdens in the paper system is the n eed for callbacks to clarify prescriptions. Clarifications and changes may be required for several reasons: the prescription is not legible; required information is not included on the prescription; the prescribed dosage unit does not exist; the particul ar medication is not approved by the patient’s health insurance; and the drug prescribed is contraindicated because it reacts with other medications the patient is taking or because it negatively affects other conditions from which the patient suffers. Ea ch callback involves the pharmacy staff and one or more

44 Bell, D.S. et al., ―Recommendations for C omparing Electronic Prescribing Systems: Results of An Expert Consensus Process,‖ Health Affairs , May 25, 2004, W4

- 305

- 317.

45 Grossman, Joy M. et al., ―Physicians’ Experiences Using Commercial E

- Prescribing Systems,‖ Health Affairs , 26, no. 3 (2007), w393

- w404.

46 Fernando, B. et al., ―Prescribing safety features of general practice computer systems: evaluation using simulated test cases.‖ BMJ 2004;328: 1171

- 3.

47 Warholak, TL, Rupp, MT, ―Analysis of community chain pharmacists’ interventions on electr onic prescriptions.‖ Journal of American Pharm Association, 2009, Jan

- Feb; 49(1): 59

- 64. Astrand et al., ―Assessment of ePrescription Quality: an observational study at three mail order pharmacies.‖ BMC Med Inform Decis Mak, 2009 Jan 26; 9:8.

### 58

staff at the practitioner’s office, often including the practitioner. Electronic prescriptions will eliminate illegible prescriptions and could eliminate those with missing information

or unavailable dosage units or forms. A recent study of pharmacy experience with e

prescriptions, however, found that the most common reason for pharmacy intervention for these prescriptions was missing information, especially missing directions. 48 

### Some of the problem c ould be solved if applications made the required information mandatory for transmission. The missing directions problem may be resolved once a standard format and codes are developed for directions.

Whether formulary and contraindication callbacks are el iminated will depend on the functions of the electronic prescription applications and the accuracy of the drug databases that they use. A study of physicians’ use of electronic prescribing found that the number of formularies, some of which are specific t o a particular company, made the use of the function frustrating. 49 

### A study of four applications used by about 75 percent of general practitioners in Great Britain found that none identified as many as half of the

contraindications tested and three of the four applications identified less than 25 percent

of them. 50



### The public is also affected by the current system. For the majority of controlled substance prescriptions, the patient (or someone acting for the patient) presents a paper prescription to the pharmacy and then waits for the pharmacy to fill it. The time between the point when the prescription is handed to the pharmacist and the point when it is ready for pick

- up is a cost to the public.

To estimate the part of these benefits that may accrue t o the rule, DEA has estimated the number of controlled substance prescriptions that may require callbacks. Although there are widely varying estimates for callbacks, the best available data, based on the operation of the two largest mail order prescriptio n pharmacies, support an estimate of 30 percent of original prescriptions. 51 

### As discussed in Chapter 4, DEA has reduced this to 22 percent for controlled substances because calls related to switching to generic forms make up about 31 percent of all callbac ks on original prescriptions and more than 85 percent of controlled substance prescriptions are already for generic drugs.

The percentage of callbacks that will be eliminated by electronic prescribing is unclear. 52


### Electronic prescriptions should elimin ate callbacks related to illegible prescriptions, but

48 Warho lak, TL, Rupp, MT, ―Analysis of community chain pharmacists’ interventions on electronic prescriptions.‖ Journal of American Pharm Association, 2009, Jan

- Feb; 49(1): 59

- 64.

49 Grossman, Joy M. et al., ―Physicians’ Experiences Using Commercial E

- Prescribin g Systems,‖ Health Affairs , 26, no. 3 (2007), w393

- w404.

50 Fernando, B. et al., ―Prescribing safety features of general practice computer systems: evaluation using simulated test cases.‖ BMJ 2004;328: 1171

- 3.

51 ―Company Pushes the Envelope to Get Prescrip tions in the Mailbox,‖ St. Petersburg Times, September 15, 2002. Story reports on Medco’s mail order pharmacy operation. Barrett Toan, CEO of Express Scripts, also reported a 30 percent callback rate. Express Scripts and Medco process about 600 million prescriptions.

52 See the report on HHS’s pilot testing of electronic prescription standards, where various testers reported declines in callbacks or no change.

### 59

may not eliminate calls related to missing information if the applications allow a prescription to be transmitted without all of the information. 53 

### Formulary callbacks could be reduced if the practition er uses that function and if the application can access the correct formulary. As noted above, some research has found that the number of formularies that are specific to a single company can make it difficult to ensure that the

correct data are used. Th e ability to identify contraindications requires up

- to

- date and comprehensive databases and a complete list of other medications that the patient is taking and of the patient’s other medical conditions. Even when every patient has an

EHR and these are int eroperable, it is likely that some information will not be included,

such as over

- the

- counter drug use, which will limit the ability to identify all

contraindications.

The Centers for Medicare and Medicaid Services, in its November 16, 2007, proposed

ru le on formulary and generic transactions estimated a 25 percent reduction in time spent

on callbacks. 54 

### DEA similarly assumes that callbacks will be reduced by 25 percent. For these callbacks, which require more effort than the simple confirmation require d for Option 3, DEA used the time estimates from the MGMA survey (6.9 minutes of staff time per call and 4.2 minutes of practitioner time). 55



### The analysis of avoided callbacks as benefits must be consonant with the treatment of callbacks as costs (Chapter 4, Section 4.5). Costs are different for a pharmacy ($3.22), for a physician’s office ($21.18), and for a dentist’s office ($15.69). For this purpose, DEA assumes that dentists prescribe at 50.0 percent of the per

- capita rate of physicians.

The result for the analysis is an estimate of 83.0 percent of prescriptions coming from physicians’ offices and 17.0 percent from dentists’ offices.

Exhibit 6

- 1 presents the annualized undiscounted cost

- savings from callbacks avoided over the 15 year implementation period. Exhibit 6

- 2 presents the present value of the costs at 7.0 and 3.0 percent discount rates.

Exhibit 6

- 1: Cost Savings of Callbacks Avoided

Year # Callbacks #
Callbacks

Avoided Cost Savings

Pharmacies Physicians Dentists Total

YEAR 1 78,376,181 1,175,643 $3,783,689 $20,631,845 $3,160,286 $27,575,819

YEAR 2 80,727,467 3,229,099 $10,392,533 $56,668,801 $8,680,251 $75,741,584

YEAR 3 83,149,291 7,483,436 $24,084,694 $131,329,945 $20,116,482 $175,531,121

YEAR 4 85,643,770 11,990,128 $38,589,032 $210,419,757 $32,231,074 $281,239,863

YEAR 5 88,213,083 16,760,486 $53,941,955 $294,136,760 $45,054,437 $393,133,151

YEAR 6 90,859,475 19,534,787 $62,870,768 $342,824,134 $52,512,132 $458,207,034

http://healthit.ahrq.gov/portal/server.pt/gateway/PTARGS_0_1248_227312_0_0_18/eRxReport_041607.pd

f

53 DEA’s rule requires the application to be capable of including all of the required information, but places the responsibility on the practitioner to ensure that all of the information is included.

54 72 FR 64900, November 16, 2007.

55 http://www.mgma.com/WorkArea/DownloadAsset.aspx?id=19248 , accessed 08/06/09.

### 60

Year # Callbacks #
Callbacks

Avoided Cost Savings

Pharmacies Physicians Dentists Total

YEAR 7 93,585,259 21,290,647 $68,521,826 $373,638,443 $57,232,118 $499,392,387

YEAR 8 96,392,817 22,411,330 $72,128,634 $393,305,785 $60,244,665 $525,679,085

YEAR 9 99,284,602 23,331,881 $75,091,337 $409,460,926 $62,719,231 $547,271,495

YEAR 10 102,263,140 24,287,496 $78,166,887 $426,231,400 $65,288,051 $569,686,338

YEAR 11 105,331,034 25,279,448 $81,359,387 $443,639,588 $67,954,552 $592,953,527

YEAR 12 108,490,965 26,309,059 $84,673,087 $461,708,659 $70,722,284 $617,104,030

YEAR 13 111,745,694 27,377,695 $88,112,386 $480,462,598 $73,594,921 $642,169,905

YEAR 14 115,098,065 28,486,771 $91,681,836 $499,926,236 $76,576,267 $668,184,339

YEAR 15 118,551,007 29,637,752 $95,386,153 $520,125,276 $79,670,257 $695,181,686



### Exhibit 6

- 2: Present Value and Annualized Cost Savings for Callbacks

Year 7.0 percent 3.0 percent

YEAR 1 $27,575,819 $27,575,819

YEAR 2 $70,786,527 $73,535,519

YEAR 3 $153,315,679 $165,454,917

YEAR 4 $229,575,503 $257,374,315

YEAR 5 $299,919,399 $349,293,713

YEAR 6 $326,695,282 $395,253,412

YEAR 7 $332,766,234 $418,233,262

YEAR 8 $327,366,514 $427,425,202

YEAR 9 $318,516,993 $432,021,171

YEAR 10 $309,871,622 $436,617,141

YEAR 11 $301,427,506 $441,213,111

YEAR 12 $293,181,679 $445,809,081

YEAR 13 $285,131,118 $450,405,051

YEAR 14 $277,272,745 $455,001,021

YEAR 15 $269,603,444 $459,596,991

Total $3,823,006,064 $5,234,809,727

Annualized $419,745,516 $438,502,110



### Assuming that electronic controlled substance prescriptions phase in over 15 years, as

described above, the annualized time

- saving for eliminating 25 percent of these callbacks would be $420 million (at 7% discount) or $439 million (at 3% discount). It should be noted that these savings will not be realized unless there is either productive work tha t is currently not being done that can be done in the time saved or the time savings are great enough to eliminate staff positions.

Electronic prescriptions could also reduce the patient’s wait time at the pharmacy. The number of original controlled subs tance prescriptions that could require public wait time is based on the estimated number of original prescriptions (approximately 356 million in

### 61

2009), reduced by 19 percent, to account for those prescriptions phoned to the pharmacy 56 

### plus another 14 percen t to remove those that are currently filled by mail order pharmacies or long

- term care facilities. 57 

### Assuming the average wait time is 15 minutes for the 81 percent of original prescriptions that are presented on paper to retail pharmacies (not mail order or long

- term care prescriptions), at the current United States average hourly wage ($20.49) 58 

### , Exhibit 6

- 3 presents the annualized estimates.

Exhibit 6

- 3: Costs Savings for Public Wait Time

Year Original Paper

Prescriptions Paper Prescriptions

Avoided Hour s Saved Cost

- Savings

YEAR 1 247,584,365 14,855,062 3,713,765 $76,095,055

YEAR 2 255,011,896 40,801,903 10,200,476 $209,007,750

YEAR 3 262,662,253 94,558,411 23,639,603 $484,375,461

YEAR 4 270,542,121 151,503,587 37,875,897 $776,077,127

YEAR 5 278,658,384 211,780,372 52,945,093 $1,084,844,955

YEAR 6 287,018,136 246,835,597 61,708,899 $1,264,415,344

YEAR 7 295,628,680 269,022,099 67,255,525 $1,378,065,700

YEAR 8 304,497,540 283,182,712 70,795,678 $1,450,603,444

YEAR 9 313,632,466 294,814,518 73,703,630 $1,510,187,370

YEAR 10 323,041,440 306,889,368 76,722,342 $1,572,040,789

YEAR 11 332,732,684 319,423,376 79,855,844 $1,636,246,245

YEAR 12 342,714,664 332,433,224 83,108,306 $1,702,889,191

YEAR 13 352,996,104 345,936,182 86,484,045 $1,772,058,092

YEAR 14 363,585,987 359,950,127 89,987,532 $1,843,844,527

YEAR 15 374,493,567 374,493,567 93,623,392 $1,918,343,295

Total $16,760,751,048



### The annualized savings over 15 years would be $1.08 billion (at 7% discount) or $1.1 billion (at 3% discount).

The estimate for public wait time is an upper bound, as such it is not included in the primary estimate for the benefits of the rule. It assu mes that the practitioner will transmit the prescription and that the pharmacist will open the record and fill it before the patient arrives at the pharmacy. Recent research on electronic prescriptions found that 28 percent of electronic prescriptions tra nsmitted were never picked up by patients; for painkillers, more than 50 percent were not picked up. 59 

### If pharmacies prepared electronic prescriptions before the patient arrives, the pharmacy will have spent time for which it

will not be reimbursed if the patient does not pick up the prescription and will spend further time returning the drugs to stock and correcting records. It is possible, therefore, that pharmacies will not be willing to fill prescriptions until they are certain that the

56 A 1999 Drugtopics.com survey indicated that 36% of all prescriptions were phoned in; because refills are usually authorized on the original prescription and do not require second calls, and slightly less than half of prescriptions are refills, the analysis uses 19% for phoned in prescriptions.

57 Based on IMS Health 2008 channel distribution by U.S. dispensed prescriptions. http://imshealth.com

, accessed June 16, 2009.

58 BLS, ―Employer Costs for Employee Compensation,‖ December 2008, March 12, 2009. Table 2. All

civilian workers.

59 Solomon, M. and S. R. Majumdar. ― Primary Non

- adherence of Medications: lifting the veil on prescription

- filling behaviors,‖ Journal of General Internal Medicine, March 2, 2010

.

### 62

patient wants t o fill the prescription. The primary estimate for public wait time, therefore, is zero.

Exhibit 6

- 4 presents the annualized benefits at a 7.0 percent and 3.0 percent discount rate.

Exhibit 6

- 4 : Annualized Gross Benefits

7% 3%

Callbacks Avoided $419,745,516 $438,502,110



### These benefits are gross rather than net benefits, but it is not possible to compare these

cost

- savings to the costs of the rule or to estimate net benefits. These savings will accrue to any electronic prescription application. The only way to assess net benefits is to compare them with the costs of the full application and its implementation, not the incremental costs of DEA’s requirements.

DEA has not attempted to estimate the cost of changing from paper prescriptions to

ele ctronic prescriptions for several reasons. First, electronic prescription applications will be part of larger electronic health record applications; the subsidies provided under the American Recovery and Reinvestment Act apply only to electronic health re cord applications, which is likely to eliminate the use of stand

- alone electronic prescription applications. It is unclear what part of the cost of an electronic health record application and its implementation should be assigned to electronic prescribing . EHR purchase costs have been estimated at between $99,000 to $180,000 for a three

- doctor practice with two

year maintenance costs of between $24,750 and $45,000. 60 

### A University of California health economist estimated the total cost of installing and ru nning EHRs at hospitals, long term care facilities, and practices at $150 billion over 8 years. 61 

### These estimates do not include the cost of training office staff and the cost of migrating existing records to the EHR application. Most of these costs are n ot specific to electronic prescriptions, but apportioning costs among the various functions of an EHR is not feasible.

Second, the costs of the applications and implementation alone do not address

distributional issues that arise from the shift to elect ronic health record applications. With paper prescriptions, formulary and contraindication issues are usually dealt with by the pharmacist. If practitioners use these functions of their electronic prescription application, the time currently spent by the pharmacists will shift to practitioners. That is an increased cost to the practitioner, a time

- savings for the pharmacy, and an increased cost to the system as a whole because a practitioner’s time is generally more expensive than a pharmacist’s or pharm acy technician’s time. The studies of electronic prescribing have identified savings, but these savings accrue mainly to insurance companies because of formulary adherence and secondarily to patients, in the form of lower costs for formulary and generic d rugs. Neither the pharmacy nor the practitioner, who incurs the

60 Pricewaterhouse Coopers Health Research Institute, ―Rock and a Hard Place: An analysis of the $36 billion impact from health IT stimu lus funding,‖ May 2009.

61 Robert Miller, quoted at http://govhealthit.com/articles/2008/07/nationwide

- ehr

- implementation

- price

tag

- estimated

- at

- 150

- billion.aspx , accessed June 22, 2009.

### 63

highest costs, benefit from electronic prescribing except to the extent that it reduces callbacks and, for the pharmacies, reduces data entry costs.

Third, the cost estimates do not includ e the processing fees associated with the use of intermediaries (indicated to be $0.30 per prescription by a commenter to DEA’s notice of proposed rulemaking) and the cost to the pharmacy of filling prescriptions that are not picked up. If patients fail t o pick up prescriptions transmitted electronically at the same rate they are assumed to fail to fill paper prescriptions, the costs to pharmacies could be high. In its comments on the proposed rule, the National Community Pharmacists

Association stated th at it costs a pharmacy $10.98 to fill a prescription. If the time

savings associated with electronic prescriptions (less data entry, fewer callbacks) are simply offset by the processing fee and the time associated with returning the drugs to

stock and cor

recting the electronic records, the cost of filling the electronic prescriptions for controlled substances that are currently issued on paper, but never presented to pharmacies could be more than $1 billion a year. 62



### Pharmacy Cost Savings

Pharmacies are required to retain all original controlled substance prescriptions, including oral prescriptions that the pharmacist reduces to writing, on paper for two years. As electronic prescriptions replace paper records, pharmacies will be able to eliminate the

fi le cabinets, freeing up space for other uses. The annualized cost of a prescription file cabinet is $78.50 ($715 annualized over 15 years at 7%); the cost of the floor space is $55.34 per cabinet (2.77 square feet times $20/square feet rental price for re tail space).

Exhibits 6

- 5 through 6

- 7 present the number of prescriptions that would have to be stored with and without the rule, the costs associated with the storage, and the annualized cost savings.

Exhibit 6

- 5: Estimated Prescription Paper Records

Original Prescriptions Electronic

Prescriptions Paper

Prescriptions
Stored with

Rule Paper

Prescriptions
Stored

without Rule

YEAR 1 356,255,370 21,375,322 680,759,048 702,134,370

YEAR 2 366,943,031 58,710,885 643,112,194 723,198,401

YEAR 3 377,951,322 136,062,476 550,120,992 744,894,353

YEAR 4 389,289,862 218,002,323 413,176,385 767,241,184

YEAR 5 400,968,558 304,736,104 267,519,993 790,258,419

YEAR 6 412,997,614 355,177,948 154,052,120 813,966,172

YEAR 7 425,387,543 387,102,664 96,104,545 838,385,157

YEAR 8 438,149,169 407,478,727 68,955,321 863,536,712

YEAR 9 451,293,644 424,216,025 57,748,060 889,442,813

62 Estimated using the phase

- in of controlled substances and assuming a $0.25 processing fee per controlled substance pre scription and 20% of the prescriptions written being unfilled (2006 study by Cutting Edge Information, ―Patient Compliance, Disease Management and Consumer Outreach) at $12/prescription to fill, return to stock, and correct records. Cost annualized at 7% over 15 years is $1.057

billion.

### 64

Original Prescriptions Electronic

Prescriptions Paper

Prescriptions
Stored with

Rule Paper

Prescriptions
Stored

without Rule

YEAR 10 464,832,453 441,590,831 50,319,241 916,126,097

YEAR 11 478,777,427 459,626,330 42,392,720 943,609,880

YEAR 12 493,140,750 478,346,527 33,945,320 971,918,177

YEAR 13 507,934,972 497,776,273 24,952,922 1,001,075,722

YEAR 14 523,173,021 517,941,291 15,390,430 1,031,107,994

YEAR 15 538,868,212 538,868,212 5,231,730 1,062,041,234



### Exhibit 6

- 6: Estimated Prescription Storage Cost with and without Electronic Prescriptions

Cost Cost Savings

With Rule Without Rule

YEAR 1 $1,446,253 $1,491,664 $45,411

YEAR 2 $1,366,273 $1,536,414 $170,141

YEAR 3 $1,168,716 $1,582,507 $413,790

YEAR 4 $877,781 $1,629,982 $752,201

YEAR 5 $568,339 $1,678,881 $1,110,543

YEAR 6 $327,279 $1,729,248 $1,401,969

YEAR 7 $204,171 $1,781,125 $1,576,954

YEAR 8 $146,494 $1,834,559 $1,688,065

YEAR 9 $122,684 $1,889,596 $1,766,912

YEAR 10 $106,902 $1,946,284 $1,839,382

YEAR 11 $90,062 $2,004,672 $1,914,610

YEAR 12 $72,116 $2,064,812 $1,992,697

YEAR 13 $53,012 $2,126,757 $2,073,745

YEAR 14 $32,697 $2,190,559 $2,157,863

YEAR 15 $11,115 $2,256,276 $2,245,162

Total $21,149,444



### Exhibit 6

- 7: Annualized and Discount Value of Reduced Storage Cost

7.0 percent 3.0 percent

YEAR 1 $45,411 $45,411

YEAR 2 $170,141 $170,141

YEAR 3 $386,720 $401,738

YEAR 4 $657,001 $709,021

YEAR 5 $906,534 $1,016,304

YEAR 6 $1,069,555 $1,245,631

YEAR 7 $1,124,346 $1,360,294

YEAR 8 $1,124,829 $1,413,728

YEAR 9 $1,100,344 $1,436,661

YEAR 10 $1,070,537 $1,452,025

YEAR 11 $1,041,421 $1,467,389

YEAR 12 $1,012,986 $1,482,753

YEAR 13 $985,221 $1,498,117

YEAR 14 $958,117 $1,513,482

YEAR 15 $931,662 $1,528,846

### 65

7.0 percent 3.0 percent

Total 12,584,826 16,741,542

Annualized $1,381,746 $1,402,382



### 6.3 QUALITATIVE BENEFITS

DEA is establishing additional security requirements for electronic controlled substance prescriptions to ensure that e lectronic prescriptions for controlled substances do not become an easy route for widespread and undetectable diversion of controlled substances. Properly secure e lectronic prescri ption applications have the potential to reduce prescription forgeries, which will protect practitioners from identity theft and misuse of

their DEA registration numbers by practice staff and others. Secure pharmacy systems may help identi f

y divers ion that occurs at pharmacies.

DEA has not attempted to quantify or monetize the benefits of the rule that relate to

diversion because of a lack of data on the extent of diversio n of controlled substances through forged or altered prescriptions and alteration of pharmacy records. These benefits are, however, discussed qualitatively in this section. The immediate cost of misuse of prescription controlled substances is also reviewed in terms of data on deaths and emergency room (ER) visits that result from non medical use of these drugs.



## 6.3.1 Reduction i n Controlled Substance Prescription Forgery

Controlled substances are diverted in a number of ways, some of which will not be affected by electronic prescriptions. For example, diversion occurs when:

 Controlled substances are stolen from practitioners and pharmacies or in

transit

.

 Practitioners knowingly write non

- legitimate prescriptions.

 Practitioners write prescriptions for people who have lied about symptoms to obtain the drugs. A commonly used term for these patients is ―doctor shoppers,‖ people who routinely visit different doctors with the same ailment to obtain multiple prescriptions for controlled substances, usual ly pain relievers. These prescriptions are then filled at various pharmacies and the drugs are abused or sold on the illicit market.

Although DEA does not expect the rule to eliminate these problems, it may act as a deterrent to practitioners who write non

- legitimate prescriptions and to doctor shoppers because it will be easier for States to monitor prescriptions when they are electronic through the use of State prescription monitoring programs

. Digitally signed prescription records will make it very d ifficult for a practitioner to claim that a prescription has been forged or altered. Many States are already using prescription drug monitoring programs to identify practitioners who prescribe unusual quantities of controlled substances and patients filli ng multiple prescriptions at different pharmacies.

### 66

Electronic prescriptions for controlled substances will directly affect the following types

of diversion:

 Stealing prescription pads or printing them, and writing non

- legitimate prescriptions.

 Altering a legitimate prescription to obtain a higher dose or more dosage units (e.g., changing a ―10‖ to a ―40‖).

 Phoning in non

- legitimate prescriptions late in the day when it is difficult for a pharmacy to complete a confirmation call to the practitioner’s offi ce.

 Altering a prescription record at the pharmacy to hide diversion from pharmacy stock.

These are examples of prescription forgery that contribute significantly to the overall problem of drug diversion. DEA expects this rule to reduce significantly thes e types of forgeries because only practitioners with secure prescription

- writing applications will be able to issue electronic prescriptions for controlled substances and because any alteration of the prescription at the pharmacy will be discernible from t he audit log and a comparison of the digitally signed records. DEA expects that over time, as electronic prescribing become s the norm, practitioners issuing paper prescriptions for controlled substances may find that their prescriptions are examined more closely.



## 6.3.2 Cost o f Diversion a nd Abuse o f Prescription Drugs

A reduction in forged controlled substance prescriptions could result in a reduction in drug

- related deaths and medical care. The 200 8 National Survey on Drug Use and Health (NSDUH) found t hat 6. 2 million people in the United States currently use prescription

- type therapeutic drugs for nonmedical reasons. 63 

### This nonmedical use of prescription drugs can lead to death and emergency room visits. The Substance Abuse

and Mental Health Services A dministration (SAMHSA) runs the Drug Abuse Warning Network (DAWN), a public health surveillance system that monitors drug

- related visits to hospital emergency departments and drug

- related deaths investigated by medical examiners and coroners. SAMHSA repor ted that in 2003, in six States (Maine, Maryland, New Hampshire, New Mexico, Utah, and Vermont) there were 352 deaths from misuse of oxycodone and hydrocodone, both prescription controlled substances. 64



### In the latest data, Drug Abuse Warning Network (DAW N), 2006: National Estimates of Drug

- Related Emergency Department Visits 65 

### , SAMHSA estimates that about 741,000

63 Substance Abuse and Mental Health Services Administration. (2009). Results from the 2008 National Survey on Drug Use and Health: National Findings (Office of Applied Studies, NSDUH Series H

- 36,

DHHS Publication No. SMA 09

- 4434). Rockville, MD. http://www.oas.samhsa.gov/nsduh/2k8nsduh/2k8Results.pdf

64 The DAWN Report

– Opiate

- related Drug Misuse Deaths in Six States, 2003. Issue 19, 2006.

65 Substance Abuse and Mental Health Services Administration, Office of Applied Studi es. Drug Abuse Warning Network, 2006: National Estimates of Drug

- Related Emergency Department Visits . DAWN

Series D

- 30, DHHS Publication No. (SMA) 08

- 4339, Rockville, MD, 2007. http://dawninfo.samhsa.gov/

.

### 67

emergency department visits involved nonmedical use of prescription or over

- the

- counter drugs or dietary supplements, a 38 percent increase over 2004. Of the 741,000 visits, 195,000 involved benzodiazepines (Schedule IV) and 248,000 involved opioids (Schedule II and III). Overall, controlled substances represented 65 percent of the estimated emergency department visits. Between 2004 and 2006, th e number of visits involving opioids increased 43 percent and the number involving benzodiazepines increased 36 percent. Of all visits involving nonmedical use of pharmaceuticals, about 224,000 resulted in admission to the hospital; about 65,000 of those individuals were admitted to critical care units; 1,574 of the visits ended with the death of the patient. More than half of the visits involved patients 35 and older.

Using a value per life of $ 5.8 million, the costs of the 2003 deaths from misuse of prescription controlled substances in the six States is more than $ 2 billion. 66 

### The cost of

the 200 6 emergency room visits is above $350 million (at $1,000 per visit), not including

the cost of further in

- patient care for those admitted. These costs are s ome fraction of the

total cost to the nation. DEA has no basis for estimating what percentage of these costs could be addressed by the rule. If, however, the rule prevents even a small fraction of the deaths and emergency care the benefits will far excee d the costs. DEA notes that, at 7.0 percent, the total annualized cost of the rule is $35 million.

These costs also do not represent all of the costs of drug abuse to society. Drug abuse is associated with crime and lost productivity. Crime imposes cos ts on the victims as well as on government. DEA does not track information on controlled substance prescription drug diversion because enforcement is generally handled by State and local authorities. The cost of enforcement is, however, considerable. In 2007, DEA spent between $2,700

for a small case and $147,000 for a large diversion case just for the primary investigators; adjudication costs and support staff are additional. It is reasonable to assume that State and local law enforcement agencies are spending similar sums per case. Some cases

involve m ultiple jurisdictions, all of which bear costs for collecting data and deposing witnesses. The rule could reduce the number of cases and, therefore, reduce the costs to governments at all levels. A reduction in forgeries will also benefit practitioners w ho

will be less likely to be at risk of being accused of diverting controlled substances and of then having to prove that they we re not responsible.



## 6.3.3 Medication Errors

Reducing adverse drug events that result from medication errors is frequently cit ed as a benefit of electronic prescriptions. Illegible prescriptions and misunderstood oral prescriptions can result in the dispensing of the wrong drug, which may cause medical problems and, at the very least, fails to provide the treatment a practitione r has determined is necessary. Once a practitioner has access to a patient’s complete medication list, electronic prescription applications hold the promise of identifying contraindication problems so that a patient is not prescribed drugs that taken toge ther

66 The DAWN mortality data from 2005 indicate th at almost 4,900 people died with prescription opioids in their bloodstream; about 600 were not using any other drug or alcohol. These numbers, however, do not indicate how many of the people were using the drugs for non

- medical purposes.

### 68

cause health problems or cancel the benefits. Allergy alerts will also warn practitioners of potential medication concerns.

DEA has not attempted to estimate the extent of these benefits for two reasons. First,

there are few data that indicate the extent of the problem as it relates to prescriptions. The data most frequently cited on medication errors and adverse drug events (1.5 million preventable adverse drug events) are from two literature reviews conducted by the

Institute of Medicine. 67 

### Simil arly, a 2008 review of studies found fewer errors with electronic medication orders, but at least 24 of the 27 studies reviewed covered only inpatient medication orders, which DEA does not regulate. 68 69 

### Many of the studies cover

errors that will not be addr essed by electronic prescribing, such as inpatient administration errors (i.e., either the chart was incorrect or the chart was correct, but the wrong drug or dosage was administered or the drug was given to the wrong patient), pharmacy dispensing errors ( i.e., the prescription was correct, but the wrong drug was given to the patient), failure to include the dosage or other information on the label, and failure to include informational inserts with the dispensed drug. All of these may cause adverse drug ev ents, but will not be addressed by electronic prescribing. Other errors, such as selection of the wrong dose, wrong drug, or wrong frequency of use, may or may not be addressed by electronic prescribing.

DEA has no basis to determine what number of adv erse drug events could be prevented by the use of an electronic prescription application. In addition, the assumption that the use of electronic prescription applications will alert practitioners to contraindications and allergies is based on the assumpti on that the patient’s medical record will be complete. Although this may be the case when every patient has an EHR and all of the applications are interoperable so that a practitioner can access pharmacy records, until that time the

medical record will be only as complete as the patient is willing or able to make it, which will limit the ability of the application to alert the practitioner to potential problems. In addition, as discussed above, programming applications to identify drug interactions and

co ntraindications is difficult and many such problems may not be identified. For allergies, DEA has not been able to identify any data that disaggregates those allergic reactions that should have been known and those that are only discovered when the patien t takes the drug for the first time. Similarly, until EHRs have databases that link drug names to diagnostic codes and dosage units to age and weight, the applications will have no way to prevent a practitioner from issuing a prescription with an inapprop riate drug name or dosage.

Second, the use of electronic prescription applications and transmission systems may introduce errors. Keystroke and data entry errors may replace some of the errors that occur with illegible handwriting. A comment on the pr oposed rule from a State

67 ―To Err is Hum an: Building a Safer Health System,‖ IOM 2000; ―Preventing Medication Errors,‖ IOM

2007. www.nap.edu

. 68 Ammenwerth et al. ―The Effect of Electronic Prescribing on Medication Errors and Adverse Drug Events: A Systematic R eview.‖ Jour. Am. Medical Informatics Assn., June 25, 2008.

69 Most of the studies label all medical orders as prescriptions, whether they are included on a patient’s chart in a hospital or LTCF or are written and given to a patient to fill at a pharmac y.

### 69

pharmacy board indicated that, at least at this early stage of implementation, the translation of the electronic data file to the pharmacies has caused data to be placed in the wrong fields and, in some cases, in the wrong patient’ s file. Studies of pharmacy experience in the U.S. and Sweden have found an increase in the number of errors. 70



### DEA believes that electronic prescribing will reduce the number of prescription errors, but it has no basis for estimating the scope of the pro blem or the extent of reduction that

will occur.

6.4 CONCLUSION

Electronic prescriptions for controlled substances will produce cost savings that may be greater than the costs of the rule for two of the three options considered. I f the rule reduces diversion, it may also produce benefits in terms of reduced numbers of deaths

and medical costs that exceed the cost of the rule. The rule will also protect practitioners from misuse of their DEA registrations and reduce the costs to la w enforcement. In contrast, a less secure electronic prescription system could greatly increase diversion, the deaths and medical costs associated with drug misuse, and the number of diversion cases. A less secure system would dramatically increase inves tigation costs because every provider and intermediary involved in a transaction would have to provide test imony to attempt to demonstrate that a prescription was not altered during transmission. The costs of such testimony would fall on law enforcement, application providers, and

intermediaries. Finally, a less secure system would expose practitioners to the risk of identity theft, with the considerable costs associated with resolving those problems.

70 Warholak, TL, Rupp, MT, ―Analysis of community chain pharmacists’ interventions on electronic prescriptions.‖ Journal of American Pharm Association, 2009, Jan

- Feb; 49(1): 59

- 64. Astrand et al., ―Assessment of ePrescription Quality: an observatio nal study at three mail order pharmacies.‖ BMC Med Inform Decis Mak, 2009 Jan 26; 9:8.

### 70

### 71



## C HAPTER 7: CONCLUSIONS

This chapter discusses t he limitations of the analysis and presents the overall conclusions.

7.1 UNCERTAINTIES

Any economic analysis involves some level of uncertainty about elements of the analysis. This is particularly true for this analysis, which must estimate costs for imple mentation of a new technology and project voluntary adoption rates. This section discusses the elements that have the greatest level of uncertainty associated with them.



## 7.1.1 Rates of Adoption

The American Recovery and Reinvestment Act (Public Law 111

- 5 ) provides incentives for practitioners to adopt electronic health record applications; the incentives are scheduled to end after 2016. The analysis assumes that practitioners will adopt electronic prescribing by that time; after that point all of the imp lementation occurs with new entrants. Whether adoption is, in fact, that rapid will depend on a number of factors unrelated to this rulemaking. The barriers to adoption continue to be the high cost of the applications, which may be greater than the subsi dies; the disruption that implementation creates in a practice; and uncertainty about the applications themselves. 71 

### The pattern with software applications is that a large number of firms enter a market, but the vast majority of them fail, leaving a very f ew dominant providers. 72 

### The health IT market is still in the early phases of this process. DEA has no basis for estimating when dominant players will emerge. The 7

- year implementation period projected may be too conservative or too optimistic.



## 7.1.2 Costs to Application Providers

The time for reprogramming existing applications is estimated to be between 1,000 hours and 2,000 hours. DEA based the upper estimate on information provided by the industry for DEA’s rulemaking regarding electronic orders for contr olled substances. The actual cost to existing application providers is likely to vary widely. Some providers may meet all or virtually all of the requirements and need little reprogramming. Many of the requirements are standard practice for software (e. g., logical access controls for hospitals) and should need minimal adjustments. Most electronic prescription applications appear to present the data DEA will require on prescriptions. Any software firm that uses the Internet for any transaction will have digital signature capability. Electronic health record applications must control access to gain Certification Commission for Healthcare Information Technology certification. Nonetheless, DEA expects that for some existing

71 California HealthCare Foundation, Snapshot: The State of Health Information Technology in California,

2008.

72 Bergin, T.J, ― The Proliferation and Consolidation of Wo rd Processing Software: 1985

- 1995. ‖ IEEE Annals of the History of Computing. Volume 28, Issue 4, Oct.

- Dec. 2006 Page(s):48

– 63.

### 72

providers, the requirements may take more than the estimated time. The extent to which this requires additional time will also depend on whether the changes are incorporated into other updates to the application or are done on a different schedule.

Another uncertainty of application p rovider costs relates to the third

- party audit and the time that will elapse before a certification organization is able to certify compliance with DEA’s requirements. If the Certification Commission for Healthcare Information Technology includes DEA’s re quirements in its criteria, the costs for third

- party audits may be eliminated sooner than estimated. The interim final rule provides more options for obtaining a third

- party audit, which should reduce its cost. DEA has not assumed that any organization will certify pharmacy applications because no organization currently does so except for determining whether the pharmacy application can read a SCRIPT

format.



## 7.1.3 Practitioner Costs

The single largest cost for practitioners is obtaining identity proofing and an

authentication credential. DEA used the cost of a three

- year digital certificate at a medium assurance level from the SAFE BioPharma Certification Authority for the cost

estim ate. SAFE meets the criteria set in the rule. Other firms that meet the criteria provide digital certificates and other credentials for more and for less. The actual cost will not be known until the rule is implemented and practitioners and providers de cide on the type of credential they will use. Some commenters on the proposed rule stated that remote identity proofing, which is allowable, can be done very quickly, which could lower the cost. The firms providing the service, however, may impose other requirements beyond those of DEA, which could increase the cost.

There will also be costs associated with lost or compromised credentials. DEA has not attempted to estimate those costs because the frequency with which this will occur and the requirements that credential providers will impose is not known. Some practitioners will never incur these costs while others may incur them multiple times. Credential providers may require a practitioner to go through identity proofing or may impose lesser requirem ents. If one of the two factors is a password, credential providers may deal with password resets as they do now; password resets do not usually involve issuing a new

token or a fee.

7.2 COSTS AND BENEFITS

The costs of two of the options considered ($34 to $44 million annualized over 15 years at 7 percent) are far lower than the potential cost savings even if all of those savings are

not realized.

The cost savings that may occur could total $1.4 billion a year although this is an upper

bound estimate and n ot necessarily associated with the rule. It is unlikely, especially in the early years, that all of public wait time savings will be gained. Until pharmacies receive a substantial percentage of prescriptions electronically and learn to check the

### 73

incoming prescription records, there may be a substantial lag between system receipt and pharmacist action. There may also still be callbacks although some of these could be sent electronically. One uncertainty associated with callbacks is the frequency with whi ch pharmacists will identify problems with electronic prescriptions. Although the prescriptions will be legible, pharmacists may find keying errors (e.g., wrong drug, wrong dosage unit, wrong form, etc.) and need to contact the practitioner to clarify the prescriptions. If practitioners have not checked formularies, either because they have turned off the function or because the particular formulary is not available to them, pharmacies will still need to do callbacks for formulary issues. In addition, th e ability of electronic prescription applications to identify contraindication problems depends on the application having a complete record of a patient’s medications and medical problems. Until electronic health record applications at one practice settin g can interoperate with electronic health record applications at other practitioner offices to develop a complete medical history, the pharmacy will continue to be a principal means of identifying these issues. Needed contacts between a pharmacy and pract itioner, whether electronic or telephone, will lower the cost savings for callbacks and for public wait time.

As discussed in Chapter 6, the cost savings accrue to any electronic prescription application and should, therefore, be compared with the cost of those applications, not just with the incremental costs of DEA’s requirements. DEA has not attempted to estimate the cost of the applications because of the difficulty of determining what part of the cost of an EHR should be ascribed to electronic pres cribing, which is only one of many functions of an EHR. It is also difficult to determine the costs of EHRs, which must include both the purchase cost plus training and implementation costs. Finally, it is not possible to determine how many practitioners already have applications that include electronic prescribing that transmits data files rather than printing out or faxing prescriptions.

The benefits of the security requirements will be a reduction in diversion of controlled

substances that are obtaine d from forged, altered, or invalid prescriptions. DEA has no basis for estimating the current level of diversion from these activities and, therefore, no basis for an estimate of a potential reduction. The cost of misuse of prescription

controlled substa nces, however, is extremely high. These drugs were involved in more than 350,000 emergency room visits in 2006, a number that was more than 20 percent higher than the 2004 number. If the requirements of this rule reduce these costs, the benefits may outw eigh the costs. DEA notes that an application that did not have the security controls DEA is implementing could lead to an upsurge of deaths and illness

because it would facilitate diversion rather than limit it and make it far more difficult for

law enfo rcement agencies to bring cases against the criminals involved.

Option 2 could result from the elimination of passwords if the practitioner used the two

factor credential for all of his access to the EHR rather than just to sign controlled substance presc riptions. Industry studies put the cost of password resets at between $10 and $31 each and estimate the average calls per user is 1.5 per year. 73 

### These estimates

73 www.quest.com/password_manager/roi/Password_Manager.htm , accessed July 7, 2009, citing Gartner Group study G00123531.

### 74

would be low for practitioners because of their higher wages. Using a weighted wage

rate for practitioners ($169) and assuming that the call and reset took no more of their time than it does of the help desk (15 minutes), the annualized benefits of eliminating passwords would be about $34 million. This would offset the cost of the biometric, but only if the practices switched to biometrics for all access. If a practice retained passwords for other functions, these benefits would not occur.

7.3 SMALL ENTITY IMPACTS

DEA determined that this rule will affect a substantial number of small entities beca use almost all practitioners and all independent pharmacies are small businesses. The costs to these entities, however, are very low and will not impose a significant economic impact on them, being far below one percent of their annual revenues. DEA also notes that the rule is voluntary; no practitioner or pharmacy will be required to handle electronic prescriptions for controlled substances.

The application providers are not directly regulated by DEA and are expected to recover their costs from DEA regi strants.

7.4 OTHER ISSUES

DEA considered whether the incremental costs might affect practitioners’ decisions about purchasing an application that provides electronic prescribing, an issue raised by many

commenters. The cost of an electronic health reco rd application for the functionalities that the Certification Commission for Healthcare Information Technology requires ranges from $20,000 to $50,000 per practitioner with a usual annual maintenance charge of $6,000 per practitioner. (There are some less expensive applications marketed as electronic health record applications that have only some of the functions; some appear to provide billing, scheduling, and simple records, but none of the more complex functions such as electronic prescriptions, databas e links, etc.) Even in the first year, where the incremental cost of adding DEA’s requirements might be about $200 per practitioner, this additional charge is unlikely to affect the decision to invest in an electronic health record application, where the first year cost would be, at the low end $26,000 ($20,000 plus the $6,000 maintenance fee). The incremental costs would add less than 1 percent of the cost of the application; in the out

- years, the incremental costs would similarly be a small

fraction of the annual application maintenance cost. For stand

- alone electronic prescription applications, the initial incremental costs will be higher because they are expected to need more programming. After the initial year, however, their incremental

costs shoul d be similar. These costs will represent a greater percentage increase in their monthly charges, which average $50 per month, but this is unlikely to affect the initial decision because most of these systems are being provided free to practitioners by

ins urers that want to encourage electronic prescribing. In addition, because the Recovery Act subsidies are available only for EHRs, it is likely that stand

- alone electronic prescription applications will be incorporated into or linked to EHR applications.

### 75

DEA notes that the barriers to adoption of electronic prescribing cited in various government studies relate to the high cost of the applications, the disruption caused by implementing these applications, and the relatively early stage of application

devel opment and interoperability provided by the existing systems. Despite the benefits of legible prescriptions, both in terms of patient safety and fewer callbacks from pharmacies, practitioners , particularly in small practices, have resisted adoption of

e le ctronic prescriptions. Insurance companies that have offered the systems for free have had difficulty finding practitioners willing to accept them because

, while the service is free, the cost of additional hardware, training, and staff disruption is a barrier to adoption. In 2005, Wellpoint offered physicians $42 million in hardware, software

, and support. "Of the 25,000 physicians contacted, only 19,000 accepted these free gifts," Wellpoint

then

- CEO Leonard Schaeffer said. "And of those 19,000, only 2, 700 physicians chose e

prescribing PDAs. The rest selected a paperwork reduction package.

. .. Free is not cheap enough

, " Schaeffer concluded. 74 

### The Recovery Act subsidies, which should encourage adoption, will not be available until the standards that will identify which applications are eligible are set.

A study of physicians’ experiences with commercial electronic prescription applications that was funded by HHS and published in Health Affairs on April 3, 2007, examined the implementation of electronic prescribing. 75 

### The study focused on larger medical practices (12 of the 21 practices had more than 50 doctors; none had fewer than 5), which meant that many of the practices had information technology staff and support. Many of the problems encountered involved not the basic function of writing a prescription, but other functions that are designed to improve patient safety (e.g., medication hi stories, clinical decision support) and formulary compliance. Connectivity with pharmacies was also a problem. Practice estimates of the number of prescriptions printed out for the patient ranged from 10 percent to close to 100 percent. Despite the theo retical level of pharmacy readiness for electronic prescriptions, ―most practices using electronic fax or EDI [electronic data interchange] reported spending substantial time educating pharmacies about e

- prescribing.‖ Many practices noted that ―at least s ome of the mail

order PBMs [pharmacy benefit managers] routinely rejected prescriptions sent via

electronic fax or EDI...‖ 76



### Implementing a system was reported to be very complicated. One physician reported working with the IT department 4 hours a week for 6 months to iron out the ―kinks‖ in the electronic prescribing module before the system could be tested. Maintenance of the system continued to demand staff resources. The study concluded:

Much of the literature assessing barriers to electronic pres cribing adoption and use has focused on cost, physician resistance, and changing practice workflow.

74 Schaeffer, L. WellPoint Health Networks, Thousand Oaks, CA. Transforming an IT

- Enabled Health Care System: The Health Plan Role. Prese ntation at the Second Annual National Health Information Summit. Washington DC, October 20, 2004. http://www.managedcaremag.com/archives/0504/0504.pharmacy.html

75 Grossman, Joy M. et al., ―Physicians’ Experiences Using Commercial E

- Prescribing Systems,‖ Health

Affairs , 26, no. 3 (2007), w393

- w404.

76 Application providers that commented on the proposed rule indicated that 20 percent of the prescriptions that they transmitted had to be converted to facsimiles because of problems with pharmacies.

### 76

Our findings highlight the role of product limitations, external implementation challenges, and physicians’ preferences for how to use system features and are consistent with several other assessments of e

- prescribing system functionality and provider pharmacy connectivity.

Respondents’ implementation hurdles belie the view that electronic prescribing products are relatively simple ―plug

- and

- play‖ applicati ons. It is hard to imagine

that e

- prescribing as it exists today can be the ―killer app‖ that will drive further IT adoption. All of the practices we examined, regardless of size, IT expertise, geographic location, or vendor, had invested many financial and human resources in implementing and maintaining e

- prescribing.

These findings are consistent with the CDC study cited above, which found that electronic prescribing was one of the less used functions in a fully or partially electronic EMR system. A m ore recent study by HealthLeaders

- InterStudy found that there is a high rate of deinstallation where physician groups cancel EHR contracts as a result of training, functionality, or affordability issues, particularly among smaller practices. 77



### Creating a n electronic prescription takes more time than writing a paper prescription and handing it to a patient. The electronic prescription system shifts some responsibility from the pharmacy to the practitioners. At present, it is the pharmacy that checks to s ee if a particular drug is covered by the patient’s insurance and that checks for drug interactions by examining other medications the patient is taking. With electronic prescriptions, all of these checks may occur before the practitioner signs the prescr iption. While this process may significantly reduce processing time at the pharmacy and ensure that more prescribed drugs are on the insurance companies’ formularies, it may increase the time a practitioner must spend to create a prescription. Rather tha n spending a few seconds writing a prescription while talking to the patient, the practitioner has to move through a series of drop

- down menus to select the patient, drug, dosage unit, and directions, then determine whether the insurance company will cover it and at what level of co

- pay. 78


### Finally, the practitioner or his staff will have to find the pharmacy from a drop

- down menu. Electronic prescriptions are likely to save practices staff time in reduced callbacks, but the practitioners may initially see mainly the additional time that needs to be spent creating the prescription and the office disruption that occurs when staff need to be trained on new applications. (An earlier Rand study noted that although electronic prescriptions will eliminate errors caused by misread or misunderstood prescriptions, practitioners may not review the prescription to check that the right items from successive menus have been selected. Electronic prescriptions may introduce new errors through application design flaws. Th ey may also reduce the likelihood that the pharmacy will check the prescription for errors.) 79

77 http://home.healthleaders

- interstudy.com , accessed June 24, 2009.

78 Practitioners may ignore this information when they make decisions about the prescription, but if they do, the number of callbacks will not decline as much as indicated because pharmacies may still call to ask about substituting a formulary drug for the prescribed drug.

79 Bell, D.S. et al., ―Recommendations for Comparing Electronic Prescribing Systems: Results of An Expert Consensus Process ,‖ Health Affairs , May 25, 2004, W4

- 305

- 317.

### 77

Overall, DEA concluded that the costs of its rule, while not trivial, are not great enough to discourage adoption of electronic prescribing.