ECONOMIC IMPACT ANALYSIS

OF THE

INTERIM FINAL ELECTRONIC PRESCRIPTION RULE

Drug Enforcement Administration

U.S. Department of Justice

March 2010
i
ii

Table of Contents

EXECUTIVE SUMMARY ................................................................................................ 1

CHAPTER 1: INTRODUCTION....................................................................................... 5

1.1 BACKGROUND.............................................................................................. 5

1.2 ELECTRONIC PRESCRIPTIONS...................................................................... 6

1.3 OPTIONS CONSIDERED............................................................................... 8

1.4 ORGANIZATION OF THIS ANALYSIS....................................................... 9

CHAPTER 2: AFFECTED UNIVERSE .......................................................................... 11

2.1 PHYSICIANS, MID-LEVEL PRACTITIONERS, AND DENTISTS .......... 11

2.2 PHYSICIANS’ AND DENTISTS’ OFFICES ............................................... 13

2.3 HOSPITALS, CLINICS, AND PHARMACIES............................................ 14

2.4 APPLICATION PROVIDERS....................................................................... 15

2.5 PRESCRIPTIONS.............................................................................................. 15

CHAPTER 3: UNIT COSTS ............................................................................................ 17

3.1 WAGE RATES .................................................................................................. 17

3.2 UNIT LABOR COSTS ...................................................................................... 18

3.3 BASIS OF COSTS OTHER THAN TIME........................................................ 20

3.4 SUMMARY OF UNIT COSTS......................................................................... 21

CHAPTER 4: TOTAL COSTS......................................................................................... 23

4.1 OFFICES OF PHYSICIANS AND DENTISTS................................................ 23

4.2 HOSPITALS AND CLINICS ........................................................................ 38

4.3 PHARMACIES .................................................................................................. 41

4.4 APPLICATION PROVIDERS .......................................................................... 43

4.5 OPTIONS........................................................................................................... 46

4.5.1 Option 2 – Required Use of Biometrics...................................................... 46

4.5.2 Option 3 - Callbacks ................................................................................... 48

4.5.3 Summary of cost of options........................................................................ 51

CHAPTER 5: SMALL ENTITY ANALYSIS ................................................................. 53

5.1 CHARACTERISTICS OF SMALL ENTITIES............................................. 53

5.2 SMALL ENTITY COSTS.............................................................................. 54

CHAPTER 6: BENEFITS ............................................................................................... 57

6.1 INTRODUCTION.............................................................................................. 57

6.2 QUANTIFIED BENEFITS................................................................................ 57

6.3 QUALITATIVE BENEFITS ............................................................................. 65

6.3.1 Reduction in Controlled Substance Prescription Forgery........................... 65

6.3.2 Cost of Diversion and Abuse of Prescription Drugs................................... 66

6.3.3 Medication Errors ....................................................................................... 67

6.4 CONCLUSION.................................................................................................. 69

CHAPTER 7: CONCLUSIONS ...................................................................................... 71

7.1 UNCERTAINTIES ............................................................................................ 71

7.1.1 Rates of Adoption ....................................................................................... 71

7.1.2 Costs to Application Providers ................................................................... 71

7.1.3 Practitioner Costs........................................................................................ 72
iii

7.2 COSTS AND BENEFITS .................................................................................. 72

7.3 SMALL ENTITY IMPACTS............................................................................. 74

7.4 OTHER ISSUES ................................................................................................ 74
iv

List of Exhibits

Exhibit ES-1: Annualized Costs by Option ........................................................................ 2

Exhibit 2-1: Number of Practitioners................................................................................ 13

Exhibit 2-2: Practitioner Growth Rate ............................................................................. 13

Exhibit 2-3: Dental Office Estimate ................................................................................ 14

Exhibit 2-4: Practice Growth Rates ................................................................................. 14

Exhibit 2-5: Number of Hospitals/Clinics and Pharmacies............................................. 15

Exhibit 2-6: Application Provider Estimates................................................................... 15

Exhibit 2-7: Prescription Estimates – Year 1................................................................... 16

Exhibit 3-1: Compensation Rates .................................................................................... 17

Exhibit 3-2: Unit Costs.................................................................................................... 21

Exhibit 4-1: Cost Elements for Practitioners................................................................... 23

Exhibit 4-2: Growth Rates for Practitioners ..................................................................... 24

Exhibit 4-3: Implementation Rates for Practitioners........................................................ 24

Exhibit 4-4: Cumulative Offices and Registrants............................................................. 25

Exhibit 4-5: Cumulative Registrants................................................................................ 26

Exhibit 4-6: Present and Annualized Value of Identity Proofing ..................................... 27

Exhibit 4-7: Present Value of Application for Identity Proofing..................................... 29

Exhibit 4-8: Number of Registrants over Time ............................................................... 30

Exhibit 4-9: Present and Annualized Cost of Registration Checks ................................. 31

Exhibit 4-10: Unit Training Cost by Office Size and Type .............................................. 32

Exhibit 4-11: Number of Start-Ups per Year................................................................... 32

Exhibit 4-12: Present and Annualized Value of Logical Access Control Training.......... 33

Exhibit 4-13: Cost of Granting Access by Size and Office Type and Occasion for 

Granting ............................................................................................................................ 34

Exhibit 4-14: Estimated Number of New Offices, Offices with EPCS by Year .............. 35

Exhibit 4-15: Present and Annualized Value of Granting of Access................................ 36

Exhibit 4-16: Offices of Physicians and Dentists with Implemented EPCS .................... 36

Exhibit 4-17: Present Value of Security Log Review....................................................... 37

Exhibit 4-18: Cost Summary for Practitioners’ Offices ................................................... 37

Exhibit 4-19: Hospital/Clinic Implementation Schedule.................................................. 38

Exhibit 4-20: Hospitals/Clinics and Practitioners in Hospitals Starting EPCS ................ 39

Exhibit 4-21: Costs for a Hospital/Clinic ID Check ......................................................... 39

Exhibit 4-22: Hospital/Clinic Costs Undiscounted Future Values.................................. 40

Exhibit 4-23: Hospital/Clinic Present and Annualized Values......................................... 41

Exhibit 4-24: Pharmacy Costs Present and Annualized Values ...................................... 43

Exhibit 4-25: Number of Application Providers.............................................................. 44

Exhibit 4-26: Undiscounted Future Values of Application Provider Costs..................... 45

Exhibit 4-27: Present and Annualized Values of Application Provider Costs ................ 45

Exhibit 4-28: Annualized Costs by Item and by Sector--7.0 percent .............................. 46

Exhibit 4-29: Annualized Costs by Item and by Sector--3.0 percent .............................. 46

Exhibit 4-30: Phase-in of Hospital Beds and Clinics....................................................... 47

Exhibit 4-31: Present Value and Annualized Costs for Biometric Option ...................... 48

Exhibit 4-32: Number of Calls to Physicians and Dentists ............................................. 49

Exhibit 4-33: Costs for Callbacks by Office Type........................................................... 50
v

Exhibit 4-34: Costs for Callbacks by Year Present Value and Annualized..................... 50

Exhibit 4-35: Annualized Costs by Option...................................................................... 51

Exhibit 5-1: SBA Definitions of Small Entities................................................................ 53

Exhibit 6-1: Cost Savings of Callbacks Avoided ............................................................ 59

Exhibit 6-2: Present Value and Annualized Cost Savings for Callbacks ........................ 60

Exhibit 6-3: Costs Savings for Public Wait Time............................................................ 61

Exhibit 6-4: Annualized Gross Benefits.......................................................................... 62

Exhibit 6-5: Estimated Prescription Paper Records......................................................... 63

Exhibit 6-6: Estimated Prescription Storage Cost with and without Electronic 

Prescriptions...................................................................................................................... 64

Exhibit 6-7: Annualized and Discount Value of Reduced Storage Cost ......................... 64
1

EXECUTIVE SUMMARY

Under the Controlled Substances Act (CSA), DEA is required to maintain a closed 

system of controls on controlled substances. For Schedule II controlled substances, 

which have the highest potential for abuse and dependence of those drugs with an 

accepted medical use in treatment in the United States, the CSA mandates that, with very 

limited exceptions, a pharmacist may only dispense a Schedule II controlled substance if 

there is an original written prescription from a practitioner. For Schedule III through IV 

controlled substances, the pharmacist may dispense if there is a written (original or fax of 

original) or oral prescription from a practitioner. DEA is giving practitioners the option 

of signing and transmitting controlled substance prescriptions electronically; pharmacies 

will maintain records of these prescriptions electronically. The interim final rule for 

electronic prescriptions for controlled substances is an addition to, not a replacement of, 

the existing rules for controlled substance prescriptions. Practitioners will continue to be 

able to issue controlled substance prescriptions on paper or, for Schedule III-V 

substances, fax or call in prescriptions.

DEA is allowing, but not requiring, electronic prescriptions for controlled substances if 

the applications used to create, sign, transmit, and process controlled substance 

prescriptions meet certain requirements that DEA has identified as being necessary to 

prevent the misuse of the applications for diversion and to ensure that the records will be 

usable in legal actions if needed. DEA examined three options. Under Option 1, 

practitioners must obtain identity proofing and a two-factor credential from a third-party 

that is recognized by a federal authority as conducting identity proofing that meets NIST 

Special Publication 800-63-1 Level 3. Institutional practitioners can conduct this identity 

proofing in-house, as part of their credentialing. The two-factor credential must meet 

NIST SP 800-63-1 Level 3; if one of the factors is a hard token, it must be separate from 

the computer to which the practitioner is gaining access. Once the practitioner has the 

two-factor credential, two people at the practice must set access controls to ensure that 

only DEA registrants are allowed to approve and sign controlled substance prescriptions; 

one of the people must be a registrant. The two-factor authentication protocol will be 

used to sign the prescription; the application must digitally sign the record at signing. 

Alternatively, the practitioner could use his own digital certificate to digitally sign the 

prescription content required by DEA. Information not required by DEA may be added 

to a prescription after signing and before transmission. Pharmacies (or the last 

intermediary) would also have to digitally sign the controlled substance prescription on 

receipt and archive that record. Pharmacy and prescription applications have to maintain 

an internal audit trail. All application providers will have to obtain a third-party audit 

every second year to confirm that the application meets DEA’s requirements; if a DEAapproved certification organization tests applications for compliance, that certification 

may replace the third party audit. Practices and pharmacies must review computergenerated logs of security incidents, when they occur.
2

Option 2 differs from Option 1 only in that it would require that the two-factor 

authentication be a hard token and biometric. Option 3 would impose no security 

requirements on the application providers or users. Some application providers might 

need to reprogram their applications to capture or transmit all of the basic information 

that DEA requires on a prescription, but costs for this reprogramming have not been 

estimated. Because there is no indication on electronic prescriptions that they have been 

signed and no assurance that the practitioner listed on the prescription in fact issued it, 

Option 3 would require pharmacies to phone the practitioner to verify each electronic 

controlled substance prescription received.

COSTS

DEA estimates the pharmacies will implement electronic prescribing in the first year, 

hospitals and clinics over the first five years, and practitioners over seven years. For 

practitioners, implementation after the seventh year accounts for the addition of new 

offices and practitioners. DEA estimates that the costs of the options range from $43 

million for Option 1 to $1.54 billion for Option 3, annualized over 15 years at 7 percent 

discount rate. Exhibit ES-1 presents the estimated annualized costs of all options.

Exhibit ES-1: Annualized Costs by Option

7.0 percent 3.0 percent

Option 1 $43,329,829 $41,778,910

Option 2 – Required Use of Biometrics $53,864,576 $51,092,582

Option 3 – Callbacks $1,535,922,056 $1,604,555,706

Most of the direct practitioner cost in Options 1 and 2 is driven by the requirement to 

obtain identity proofing and renew the credential every three years and by the 

requirement to check security incident logs. The application provider costs are primarily 

the costs of the initial reprogramming.

BENEFITS

One benefit of the rule that can be quantified and monetized – reductions in callbacks 

($420 million) (at 7.0 percent) – if fully realized, far exceeds the cost of two of the three 

options considered. (The reduction in callbacks does not apply to Option 3.) These 

benefits are, however, gross benefits that accrue to the use of any electronic prescription 

application and should be compared to the total cost of such applications rather than the 

incremental cost of compliance with DEA’s requirements. Pharmacies will also achieve 

cost-savings from the reduced need to store paper prescriptions; DEA estimates the 

annualized cost-savings of $1.38 million, which offsets 70 percent of the annualized cost 

of pharmacy requirements ($2.04 million) (both at 7 percent).

DEA expects that there will be reduced medication errors linked to more readable 

prescriptions, but decided that it did not have a reasonable basis for quantifying the 

benefits. Another benefit of electronic prescriptions for controlled substances that is 
3

ascribable to the rule, but not easily quantified and monetized, will come from reductions 

in controlled substance prescription forgery and alteration and, therefore, the reduction in 

diversion and abuse of controlled substances, with all of its consequences for public 

health and safety.

SMALL ENTITY IMPACTS

The rule will have an impact on a substantial number of small entities. The economic 

impact on those directly regulated by this rule will not be significant under Options 1 and 

2. DEA estimates that the direct first-year costs to practitioners for identity proofing will 

range from about $138, with periodic costs for renewal of about $50, which represents 

less than 0.2 percent of the net income of the lowest paid physician. For pharmacies, the 

incremental cost that their application providers may pass on will be less than $100 in the 

first year and less than $40 a year in the out years, which represents less than 0.01 percent 

of the average independent pharmacy’s annual sales. DEA, therefore, has determined 

that the rule will not impose a significant economic impact on small entities directly 

regulated by DEA.

Application providers are not directly regulated by DEA. The rule indirectly affects them 

because DEA will require that its registrants use only applications and application 

providers that meet its requirements. DEA recognizes that the requirements may impose 

a significant impact on application providers, many of which are small entities, but the 

costs are not so great that an application provider will not be able to recover them from 

customers or that the incremental price increase will discourage customers from 

purchasing an application. 
4
5

CHAPTER 1: INTRODUCTION

1.1 BACKGROUND

Under the Controlled Substances Act (CSA)1, DEA is required to maintain a closed 

system of distribution for controlled substances. DEA publishes the implementing 

regulations in Title 21 of the Code of Federal Regulations.2 These regulations are 

designed to ensure an adequate supply of controlled substances for legitimate medical 

and other purposes, and to deter the diversion of controlled substances to illegal purposes.

Controlled substances include narcotics, stimulants, depressants, hallucinogens, and 

anabolic steroids that have a potential for abuse and psychological and physical 

dependence. DEA divides controlled substances into Schedules I through V. Schedule I 

substances have a high potential for abuse and no accepted medical use in treatment in 

the United States and, therefore, may not be dispensed. Schedule II through V substances 

have accepted medical uses and also have potential for abuse and dependence. They may 

be dispensed; except for Schedule V substances, controlled substances cannot generally 

be dispensed except in response to a prescription.

For Schedule II controlled substances, which have the highest potential for abuse and 

dependence of the medications with accepted medical uses in treatment in the United 

States, the CSA mandates that, except in emergency circumstances, a pharmacist may 

only dispense a Schedule II controlled substance if there is a written prescription from a 

practitioner. For patients in long term care facilities or hospices, prescriptions for 

Schedule II substances may be written and manually signed and faxed with the fax 

serving as the original prescription. Most Schedule II prescriptions, however, are written 

with the original prescription presented to the pharmacy before dispensing. Schedule II 

prescriptions may not be refilled; a new prescription must be issued. For Schedule III 

and IV controlled substances, the pharmacist may dispense if there is a written or oral 

prescription from a practitioner; faxed prescriptions may serve as the original

prescription, but must be written and signed prior to being faxed. Regulations 

implementing the prescription requirements are found in 21 CFR part 1306.

Under the regulations, a prescription for a controlled substance may be issued only by an 

individual practitioner who is authorized to prescribe by the State in which he is licensed 

to practice and is registered with DEA, or exempted from registration. To be valid, the 

prescription must be written for a legitimate medical purpose by an individual 

practitioner acting in the usual course of professional practice. Every controlled 

substance prescription must contain the name and address of the patient, the drug name, 

strength, dosage form and quantity, directions for use, and the name, address, and DEA 

registration number of the practitioner. Every prescription that is written must be dated 

as of, and signed on, the day it is issued.

 

1

21 U.S.C. 801 et seq.

2

21 CFR parts 1300-1316.
6

A prescription may be filled only by a pharmacist acting in the usual course of 

professional practice who is employed in a registered pharmacy. The prescribing 

practitioner is responsible in case the prescription does not conform in all essential 

respects to the law and regulations. A corresponding liability rests upon the pharmacist 

who fills a prescription not prepared in the form prescribed by DEA regulations.

With respect to records, the pharmacy must maintain a paper file of all prescriptions, 

consisting of the original prescriptions, or, where allowed, the facsimiles of the original 

written prescriptions, or written documentation of oral prescriptions. The pharmacy must 

also maintain records of when the prescription was filled and by whom, for both original 

prescriptions and any partial fillings or refillings. Practitioners are not required to 

maintain copies of prescriptions written or other records of prescriptions (unless issued 

for maintenance or detoxification treatment). Consequently, although practitioners create 

the record, pharmacies maintain it. This division between the person who creates the 

record and the person who retains it makes the integrity of the record particularly 

important.

Diversion of controlled substances may occur in a number of ways. With prescriptions, 

diversion may take place if a practitioner knowingly or otherwise writes a prescription for 

a person who does not have a legitimate need for it. Prescriptions may also be altered 

(e.g., changing a ―10‖ to ―40‖ or ―100‖) or forged. Prescription pads may be stolen to 

create forgeries or prescriptions may be used to create fake prescription forms. Pharmacy 

records can be altered to hide illegal dispensing or theft by pharmacy employees. 

Practitioners and pharmacists may illegally dispense substances.

DEA’s recordkeeping requirements and its concern about its ability to determine the 

integrity of the prescription record are directed toward preventing diversion and having a 

legally defensible record to prove that diversion has occurred. With paper prescriptions, 

the signed prescription provides a provable link to the prescribing practitioner. Forgeries 

can usually be detected by handwriting experts. As a result, a practitioner whose 

prescriptions are altered or forged can prove that he or she did not issue the suspect 

prescriptions, but a practitioner who issues prescriptions for other than legitimate 

purposes cannot deny them and can be subject to administrative, civil, and criminal 

penalties. Similarly, paper records held at pharmacies can be compared with pharmacy 

inventories to determine if all drugs dispensed were dispensed legally.

1.2 ELECTRONIC PRESCRIPTIONS

Industry has asked DEA to develop regulations that will allow the creation and 

transmission of electronic prescriptions for controlled substances. Many parties in the 

healthcare industry are encouraging the adoption of electronic prescriptions because such 

prescriptions have the potential to improve patient safety by reducing medical errors that 

arise from misread or misunderstood prescriptions. From DEA’s perspective, electronic 

prescriptions have distinct advantages, if created in a way that reduces the possibility of 

forgery or alteration. The reality of the speed of electronic communications, however, is 
7

that electronic prescriptions could also open a new avenue for rapid diversion, which 

could leave no trail that DEA could use to act against those diverting controlled 

substances. A study conducted for the Department of Health and Human Services (HHS)

by the American Health Information Management Association, ―Report on the Use of 

Health Information Technology to Enhance and Expand Health Care Anti-Fraud 

Activities,‖ noted that ―With regard to fraud, e-prescribing presents a new vulnerability 

because of the increased velocity of authenticated automated transactions.‖3The report 

indicated that electronic systems may help identify fraud over the long term, when there 

are integrated health record networks with anti-fraud analytical tools built into them. 

Electronic records are easy to create and relatively easy to alter without the alteration 

being detectable. Without proper protections, a criminal could open an account, use a 

practitioner’s DEA number to generate a fake prescription, send it to multiple pharmacies 

over a wide area, have confederates pick up the drugs, and close the account within a few 

hours. Because DEA registration numbers are publicly available, criminals could do this 

repeatedly without using any one DEA registration number more than once, making it 

unlikely that pharmacists would notice a pattern. Without proper controls, electronic 

prescriptions could create the potential for organized, widespread, and undetected 

diversion of controlled substances.

To the extent that electronic prescriptions for noncontrolled substances are being issued 

at present, they are signed, if at all, electronically, with personal identification numbers 

(PINs) or using some combination of passwords and user IDs and transmitted over closed 

networks or the Internet through three to five intermediaries who may open the 

prescription files to convert them and add information, such as routing and payer data. 

Converting may be required if the pharmacy application is not compatible with the 

practitioner’s prescribing application.

4

 The application providers authorize the 

practitioners to use the application. Some providers allow practitioners to enroll online, 

without any assurance that the person is who he claims to be. Some applications 

authorize anyone in the practice to use the application so that the application cannot link 

a specific practitioner to a prescription. Some applications allow one practitioner to 

create a prescription and other practitioners to sign it. None of the applications transmits 

an indication that the prescription was, in fact, signed. At the pharmacy, the prescription 

translates directly into the pharmacy application, and the records are maintained 

electronically. Electronic prescriptions are generally created to conform to the format 

developed by the National Council for Prescription Drug Programs (NCPDP), SCRIPT. 

Although SCRIPT includes all of the standard DEA data elements, it does not mandate 

their use. Studies of electronic prescriptions have found that the transmitted prescriptions 

sometimes are missing data, which indicates that the applications are not necessarily 

establishing required fields for transmission.

 

3

Foundation of Research and Education, American Health Information Management Association. ―Report 

on the Use of Health Information Technology to Enhance and Expand Health Care Anti-Fraud Activities,” 

prepared for the Office of the National Coordinator, US Department of Health and Human Services, 

September 30, 2005.

4

 The ability to open and read a file depends on having a standard format for the file and on being able to 

read the opening instructions accurately. A standard format, by itself, does not ensure interoperability.
8

This existing electronic prescription system is not sufficient to protect the transactions as 

the CSA requires. From DEA’s perspective, the existing system has several fundamental 

flaws.

 The system relies on application providers to authenticate practitioners and 

control the integrity of the transaction without ensuring that the application 

providers check the identity of the practitioner, limit access for prescription 

signing, or use credentials that allow only authorized practitioners to sign a 

prescription. In addition, the application providers are not subject to security 

requirements for their own applications. DEA would have to prove that the 

third party was not at fault before it could successfully take action against a 

registrant who had been a party to diversion. For example, if a practitioner 

denied issuing prescriptions and claimed they had been forged, DEA would 

have to prove that the third party had not issued authorization to someone else 

to use the practitioner’s name and DEA registration number and that none of 

the third party’s employees or outside hackers had used the application to 

generate false prescriptions in the practitioner’s name.

 The application does not provide for record integrity. Even a closed 

transmission network does not protect against insider actions. Many computer 

crimes, such as identity thefts, are committed by insiders who have the 

knowledge to overcome internal protections. Electronic prescriptions are 

currently routed through three to five parties between the practitioner and 

pharmacy; although this movement is usually entirely automatic, insiders at 

any of the intermediary firms have the ability and the opportunity to alter or 

add records. The existing security requirements for these parties are focused 

on preventing disclosure of the information rather than ensuring the integrity 

of the records. 

 The application provides limited protection of the record’s integrity once it 

reaches the pharmacy.

Overall, the existing electronic prescription applications provide no assurance of security 

against identity theft, insider attacks, or outsider attacks. Although some existing 

applications might have voluntarily implemented effective security measures, they are 

not legally obligated to do so and – in the absence of binding regulatory requirements –

there is no way to ensure that they or others who might enter the market will have 

effective measures in the future. With prescriptions moving through multiple parties 

from creation to dispensing, a security failure at any link in the chain could undermine 

the entire system, often leaving no evidence of the problem.

1.3 OPTIONS CONSIDERED

DEA has developed estimates for three options. 
9

Option 1

Under Option 1, each registrant is required to obtain identity proofing and an credential 

from a federally recognized credential service provider (CSP). The registrant must 

complete and submit an application to the CSP, which may require in-person identity 

proofing or conduct remote identity proofing. The CSP will then issue either a credential 

or the means to download a two-factor credential. For institutional practitioners (i.e.,

hospitals and clinics), identity proofing may be conducted by the credentialing office 

within the institutional practitioner.

The electronic prescription application must allow the setting of logical access controls. 

Two persons, one of whom must be a registrant (for private practices), must enter the 

data to activate the access controls that limit who can indicate that a controlled substance 

prescription is ready to sign and sign the prescription. The application must meet certain 

requirements for information displayed and require that the registrant use his two-factor 

authentication to sign the prescription. The application must have an internal audit trail 

and run a daily check for any security events. When such an event occurs, the application 

must generate a report, which a person designated to set logical access controls must 

review to determine whether the use of the application has been compromised. The 

pharmacy application must also conduct checks for security events. Application 

providers must obtain a third-party audit to determine whether the application meets the 

requirements of the rule. If a certification organization conducts checks to make this 

determination, DEA may approve their certification as a substitute for a third-party audit.

Option 2

Option 2 is the same as Option 1 except that the two-factor credential requires a 

biometric and a hard token.

Option 3

Option 3 imposes no requirements for identity proofing, authentication, or application 

security attributes. Sole reliance for security is placed on a requirement for a callback 

from the pharmacy to the practitioner office to confirm the legitimacy of the prescription 

for every electronic prescription for a controlled substance.

1.4 ORGANIZATION OF THIS ANALYSIS

The remainder of this document is organized into the following chapters:

 Chapter 2 – Affected Universe

 Chapter 3 – Unit Costs

 Chapter 4 – Total Costs

 Chapter 5 – Small Entity Analysis
10

 Chapter 6 – Benefits

 Chapter 7 – Conclusions
11

CHAPTER 2: AFFECTED UNIVERSE

The rule potentially affects any person authorized under State law to prescribe controlled 

substances and registered with DEA as an individual practitioner or a practitioner exempt 

from the requirement of registration. It also directly affects pharmacies, hospitals/clinics, 

and providers of the software applications that enable electronic prescriptions at the 

practitioner and pharmacy. Some costs vary with individual registrants; other costs vary 

with number of firms, institutions, or individual pharmacies. Accordingly, DEA has 

developed estimates for numbers of entities in the following groups.

 Physicians

 Mid-level practitioners

 Dentists

 Pharmacists

 Pharmacy technicians

 Physicians’ and dentists’ offices

 Hospitals and clinics

 Pharmacies

 Application providers

This chapter discusses estimates of the number of entities that will incur costs for 

compliance if they elect to issue or receive electronic prescriptions for controlled 

substances. The rule will not require any registrant to issue or accept electronic 

prescriptions for controlled substances; paper and, where permitted, oral and faxed 

prescriptions are still allowed.

2.1 PHYSICIANS, MID-LEVEL PRACTITIONERS, AND DENTISTS

As of February 2009, DEA had 1.23 million registered individual practitioners.

5

 Not all 

of these, however, are likely to prescribe controlled substances or do so often enough to 

justify any investment in an electronic prescription application. For example, 

veterinarians, optometrists, animal shelters, ambulance services, etc. rarely if ever 

prescribe controlled substances. Similarly, many physician specialties either do not 

prescribe any controlled substances (anesthesiologists, radiologists, pathologists) or do 

not often prescribe controlled substances as part of their usual practices (dermatologists, 

obstetricians/gynecologists, ophthalmologists).

For physicians and mid-level practitioners, it is necessary to estimate separately those in 

practice offices and those working in hospitals. Regarding physicians, the latter group 

does not include physicians in practice who have hospital privileges.

 

5

 DEA based its number on a run of its CSA database on February 24, 2009. The number of registrants 

varies from day to day based on renewal dates so it was necessary to take the number from a single date 

rather than adjust it continually.
12

Physicians

DEA regularly updates its own data on number of registrants but used these data, only in 

part, for estimates of numbers of physicians in offices and numbers of dentists. These 

data do not distinguish between practice and hospital-based physicians. In addition, 

many practitioners hold multiple DEA registrations because they practice in more than 

one State or dispense or administer controlled substances at multiple locations in a single 

State. Finally, many practitioners retain their registrations when they retire.

For this analysis, the estimate of physicians in offices is based on a study of office-based 

physicians done by the Centers for Disease Control and Prevention (CDC).6 That 

estimate is an average of 308,900 physicians practicing in offices in 2005-2006. To bring 

that to a current number, DEA treated it as a 2006 number and applied a growth rate 

derived from DEA’s number of registrants. From data for number of physicians in 

November 2006 and February 2009, DEA obtained an annual growth rate of 2.1 percent. 

This leads to a current estimate of 328,772 physicians in offices (308,900 x 1.0213 = 

328,772).

For physicians in hospitals (and clinics), DEA relied on data from a 2009 publication of 

the American Medical Association7that yielded an estimate of 169,337 physicians 

employed in hospitals. Since current data indicate number of hospitals is steady or 

declining, DEA assumes no growth in number of physicians in hospitals.

Mid-level practitioners

Of the mid-level registrants, only nurse practitioners and physician’s assistants are likely 

to prescribe controlled substances routinely. For estimating the number of mid-level 

practitioners, DEA had two data sources to choose from: its own data on registrants and 

Bureau of Labor Statistics (BLS) data on occupational specialties. DEA considered the 

BLS number to be too high because it includes mid-level practitioners who are not 

authorized to prescribe controlled substances. In addition, BLS does not disaggregate 

nurse practitioners from nurses. DEA also judged that its registration data would have 

significantly less over-counting for mid-level practitioners than for physicians and 

dentists, primarily because mid-level practitioners are not likely to have multiple 

registrations. DEA did use the BLS data on physicians’ assistants to apportion mid-level 

practitioners between practices and hospitals. For February 2009, DEA showed 131,420 

mid-level practitioners. As of May 2008, BLS showed 63.0 percent of physicians’ 

assistants in offices and 37.0 percent in hospitals. Using these percentages, DEA 

estimates that there are 82,579 mid-level practitioners in offices and 48,841 in hospitals.

 

6 Hing, E., Burt, C.W. ―Characteristics of Office-Based Physicians and their Practices: United States, 2005-

2006,‖ Series 13, Number 166. Hyattsville, MD: National Center for Health Statistics. April 2008.

7

 American Medical Association, Physician characteristics and distribution in the US, 2009 Edition.
13

Dentists

The American Dental Association reports 164,864 dentists in active practice in 2006.8 

From its data on registrants, DEA derived an annual growth rate of 1.3 percent. Applying 

this rate to the 2006 population yields an estimate of a current population of 171,378 

(164,864 x 1.0133= 171,328). Virtually all dentists are in offices.9 DEA did not use its 

registration data for this number because of the multiple registration problem.

Summary

The following exhibit summarizes DEA’s estimate of practitioners in the first year of the 

analysis.

Exhibit 2-1: Number of Practitioners

Offices Hospitals

Physicians 328,772 169,337

Mid-levels 82,579 48,841

Dentists 171,328 N/A

Total 582,729 218,178

As noted above, the universe does not include DEA registered individual practitioners 

who do not, as part of their regular practice, prescribe controlled substances. For 

example, veterinarians, optometrists, and ambulance services may administer controlled 

substances, but they do not, as a rule, issue prescriptions.

Growth rates for practitioners are shown below.

Exhibit 2-2: Practitioner Growth Rate

Growth Rate

Physicians 2.1 percent

Mid-levels 2.2 percent

Dentists 1.3 percent

All practitioners 1.9 percent

This rate does not include physicians in hospitals. DEA assumes zero growth for physicians 

based in hospitals because the number of hospitals is declining.

2.2 PHYSICIANS’ AND DENTISTS’ OFFICES

The CDC study of physicians in practices estimated number of offices at 163,800 in 

2005-2006.10 The ADA website did not provide a direct estimate of dentists’ offices, but 

 

8 American Dental Association web site, http://www.ada.org/ada/prod/survey/faq.asp

9

 DEA has not attempted to disaggregate dentists who work at Federal hospitals because it has no basis for 

identifying them as such. 

10 Hing and Burt, op. cit.
14

DEA was able to derive an estimate from ADA’s data on number of dentists in 2006 and 

distribution of dentists across office size. This is shown in the following exhibit.

Exhibit 2-3: Dental Office Estimate

Office size Percentage

of dentists

Number of

dentists

Number of

offices Calculation

1 dentist 63.0 percent 104,029 104,029 Same as number of dentists.

2 dentists 20.0 percent 32,973 16,486 Half the number of dentists

>2 dentists 16.9 percent 27,862 8,707 Assumes 3.2 dentists per office

Totals 164,864 129,222

DEA obtained growth rates for physicians’ and dentists’ offices from the Economic 

Census by comparing number of offices in 1997 and 2006: 1.25 percent for physicians’ 

offices, 1.1 percent for dentists’ offices.11 Adjusting with these rates leads to the 

following results for current offices.

Exhibit 2-4: Practice Growth Rates

Growth rates 2006 offices 2009 offices

Physician offices 1.25 percent 163,800 170,020

Dentist offices 1.1 percent 129,222 133,534

All offices 1.2 percent 293,022 303,553

The same growth rates were used to project future numbers of offices.

2.3 HOSPITALS, CLINICS, AND PHARMACIES

Hospitals and clinics are estimated together, as both are treated as institutional 

practitioners under the rule. DEA’s current estimate from the registrant data is 12,412 

hospitals and clinics.12 DEA does not expect any future growth in this number. This 

estimate is conservative because it is based on locations, not firms. According to the 

American Hospital Association, more than half of community hospitals are part of 

systems that may include multiple hospitals or a single hospital with associated outpatient 

clinics.13 The one activity estimated on a per-hospital basis, security incident log 

checking, may often be performed at the system level, but DEA chose to use a perhospital basis as a conservative estimate.

On the basis of its registrant data, DEA estimates 65,421 pharmacies in 2009. Costs are 

calculated on the basis of number of pharmacies, rather than number of firms. (None of 

the pharmacy costs are based on numbers of people.) DEA assumes no further growth in 

number of pharmacies. The number of retail pharmacies has declined slightly in recent 

 

11 Bureau of Census, 1997 Economic Census and Statistics of U.S. Business 2006 

http://www.census.gov/epcd/susb/latest/us/US62.HTM.

12 This estimate removes those institutional practitioner registrants that are Federal facilities, institutions 

(prisons, jails, etc.), private physicians, veterinarians, ambulance services, etc. Federal facilities generally 

have to meet more stringent requirements than DEA is imposing; the other registrants are unlikely to be 

issuing prescriptions or are already counted as private practices.

13

 Fast Facts, American Hospital Association, www.aha.org, accessed June 15, 2009.
15

years according to industry data from the National Association of Chain Drug Stores.14 

Using the number of registrants is conservative because some chain pharmacies may do 

security incident log checks at the chain rather than store level.

Exhibit 2-5: Number of Hospitals/Clinics and Pharmacies

Number

2009 Growth

Hospitals and

Clinics 12,412 DEA assumes no future 

growth. Pharmacies 65,421

2.4 APPLICATION PROVIDERS

DEA currently estimates firms that provide applications to practice offices at 170 and 

those that provide applications to pharmacies at 40.15 Because most pharmacies have had 

electronic applications for managing prescription data for years, DEA expects the number 

providing applications to pharmacies to remain stable and the number selling to practice 

offices to rise and then fall as shown below. DEA expects that the number of electronic 

prescription application providers will continue to decline after YEAR 5, but that decline 

has not been estimated because it does not affect the analysis. As discussed below, DEA 

assumes that after the fifth year, application providers will substitute certifications 

obtained for other reasons for the third-party audit and, therefore, incur no costs 

associated with this rule after YEAR 5.

Exhibit 2-6: Application Provider Estimates

Providers to

Practices Pharmacies

YEAR 1 170 40

YEAR 2 190 40

YEAR 3 200 40

YEAR 4 170 40

YEAR 5 150 40

2.5 PRESCRIPTIONS

The number of controlled substance prescriptions written is relevant to the estimate of 

cost-savings presented in Chapter 6. DEA estimates the number of prescriptions based 

 

14

 The number of retail pharmacies is about 55,000 according to the National Association of Chain Drug 

Stores. The remaining pharmacies include mail order, central fill pharmacies that service other pharmacies, 

and captive pharmacies that service long term care facilities or similar facilities.

15 Estimates based on providers currently certified by either the Certification Commission for Healthcare 

Information Technology or SureScripts/RxHub; the number of pharmacy applications was increased from 

the 27 certified to 40 to account for chain pharmacies that may have developed their own applications. 

These firms will incur costs for third-party audits.
16

on the assumption that the percentage of controlled substance prescriptions in the top 200 

brand name and top 200 generic drug prescriptions is the same as it is for the remainder 

of the prescriptions.16 According to data from SDI/Verispan, in 2008, controlled 

substances represented about 12 percent of prescriptions for the top 400 drugs.17 IMS 

Health data reported a total of 3.8431 billion prescriptions in 2008.18 Based on these 

data, DEA estimates that, with a three percent growth rate for prescriptions, there will be 

about 475 million controlled substance prescriptions in Year 1 of the analysis. IMS 

Health data indicate that about 86 percent of prescriptions are filled at retail outlets, 

which is relevant to estimating public wait time as long-term care prescriptions and mail 

order prescriptions will not be affected. Previous DEA analysis has indicated that 75 

percent of controlled substance prescriptions are original prescriptions or 356 million 

prescriptions in Year 1. DEA has previously estimated that about 19 percent of 

prescriptions are currently faxed or phoned into pharmacies. Applying both the 86 

percent and 19 percent to the number of original prescriptions results in an estimate of 

247 million prescriptions that may have reduced public wait time as electronic 

prescriptions for controlled substances is implemented. Exhibit 2-7 presents the 

prescription data.

Exhibit 2-7: Prescription Estimates – Year 1

Total

Controlled substance prescriptions 475,007,160

Original controlled substance prescriptions 356,255,370

Paper controlled substance prescriptions presented 

to retail pharmacies (not mail order) 247,584,365

 

16 The top 400 drugs represent about 87% of all prescriptions dispensed at retail. 

17

 See www.drugtopics.com for the top 200 generic and top 200 brand name drugs.

18

 See www.imshealth.com. IMS Health data are used for total prescriptions because the data include 

prescriptions for long-term care and mail order. 
17

CHAPTER 3: UNIT COSTS

Unit costs are estimated for the following requirements:

 Identity proofing and obtaining an credential

 Renewal application for protocol

 Registration check

 Training for granting logical access control

 Granting logical access

 Updates for logical access control 

 Review of security incident logs

 ID check, face-to-face (institutional practitioners)

 Reprogramming of existing applications

 Obtaining initial certification or third-party audit of applications

 Follow-up third-party audits of applications

3.1 WAGE RATES

Estimates of hourly cost for a position, e.g., mid-level practitioner, pharmacy technician, 

are based on wage rates from BLS Industry-Specific Occupational Employment (SOE) 

and Wage Estimates.19 Dentist and physician rates are weighted across specialties listed 

by BLS. These wages and all others are brought up to March 2009 dollars with the BLS 

Employment Cost Index, Table 9.20 Fringe benefits are calculated from BLS Employer 

Costs for Employee Compensation, March 2009, Table 9.21 Overhead rate is from Grant 

Thornton.22 Fully loaded, hourly labor costs as of March 2009 are as follows:

Exhibit 3-1: Compensation Rates

Wage Rate Loaded Cost

Dentist $79.12 $166.74

Dental assistant $16.58 $34.38

Physician (office) $91.19 $192.16

Physician (hospital) $55.74 $117.46

Mid-level (office)23 $40.00 $84.30

Mid-level (hospital) $40.87 $86.13

Nurse (office) $31.88 $67.18

 

19 http://www.bls.gov/oes/current/oessrci.htm#48-49

20 ftp://ftp.bls.gov/pub/suppl/eci.echistrynaics.txt

21 http://www.bls.gov/news.release/pdf/ecec.pdf

22 Grant Thornton, 14th Annual Government Contractor Industry Survey, 2008.

23

 Mid-level rates are based on physicians’ assistants. These and nurse practitioners make up the majority 

of mid-level registrants. BLS does not disaggregate nurse practitioners from nurses, but the AMGA midlevel compensation survey indicates that their salaries are similar (median of $81,245 for physician 

assistants and $82,513 for nurse practitioners).
18

Wage Rate Loaded Cost

System administrator 

(hospital) $32.42 $68.32

HR person (hospital) $17.11 $36.06

Application provider 

engineer $43.70 $92.10

Pharmacist $51.60 $108.74

Pharmacy technician $13.28 $27.99

For some estimates, DEA used weighted wages across all practitioners ($169.40) or all 

physicians and dentists ($183.45).

3.2 UNIT LABOR COSTS

When a task in a physician’s office does not require a registrant, the analysis assumes it is 

done by a nurse. Depending on physician practice size, the registrant doing the work is 

either a physician or a mid-level practitioner. In a dental practice, the dentist is always 

the registrant, as there are few, if any, mid-level practitioners in dental offices. A nonregistrant task in a dentist’s office is done by a dental assistant. In hospitals, human 

resource staff and IT system administrators perform non-registrant tasks, as do pharmacy 

technicians in pharmacies.24 

Practitioners will have to complete an application to apply for identity proofing and a 

credential. As these applications generally ask for standard information that practitioners 

will be able to fill in without needing to collect documents that they would not carry with 

them (e.g., credit cards, driver’s licenses), DEA estimates that it will take them 10 

minutes to complete the form. Credential providers generally require subscribers to 

renew the credential periodically. This renewal can take the form of an e-mail request 

that is signed with the credential. To be conservative, DEA estimates that it will take 5 

minutes to renew.

For hospitals and clinics, DEA estimates that practitioners and someone at the 

credentialing office will spend two minutes to verify the identity document presented. 

Practitioners are assumed to take 30 minutes total for this process because they will need 

to go to the credentialing office. This review will occur only when the hospital or clinic 

first implements controlled substance electronic prescribing and will involve only those 

practitioners that already work at or have privileges at the hospital or clinic. All 

practitioners that are hired or gain privileges later will have this step done as part of their 

regular initial credentialing.

Prior to granting access, someone at each office must verify that each practitioner has a 

valid DEA registration and State license to practice. As this requires nothing more than 

checking the expiration date, DEA estimates that this will take an average of one minute. 

 

24 For hospitals, clinics, and pharmacies, the registrant is the firm, not an individual.
19

In small practices, which are the majority of offices, it may take no time because the 

registrant will be one of the people granting access and the status of every registrant will 

be known. Even in larger practices, it is likely that any problems with a practitioner’s 

DEA registration or State license will be known as it affects their ability to practice. 

Checking registrations and licenses is done as part of credentialing at hospitals and 

clinics and is, therefore, not a cost of the rule.

Prior to granting access, those who will be given this responsibility will need to be 

trained to do so. DEA estimates the time at one hour per person at practices. This 

estimate may be high, particularly for smaller offices. It may also be the case that in 

some larger practices, people already perform this task for other reasons and training may 

be unnecessary. Because it is likely that in larger pharmacies, access controls are already 

being set, DEA estimates that the training time will be five minutes.

DEA estimates that it will take, on average, five minutes to enter the data to grant access 

for the first time at a practice or a pharmacy. The approval of the data entry is estimated 

to take one minute. The actual approval may take only a few seconds, but the approver 

may take time away from some other work, but would presumably do it when using the 

computer for other tasks. DEA has not estimated costs for granting access to new hires 

as that should occur routinely. Similarly, for practitioners, registrations of new hires 

should be checked as part of the hiring process and should not require a separate action.

DEA has not estimated the cost of setting logical access controls at hospitals because 

hospital applications should already do this. The Certification Commission for 

Healthcare Information Technology (CCHIT) criteria for in-patient applications include 

logical access controls; the HL7 standard used by most hospitals includes logical access 

controls. In addition, an application used by as many different departments as exist at 

hospitals necessarily will impose limits on who can carry out certain functions. 

Consequently, DEA’s requirements should not entail any actions not already being 

performed.

Auditable events reported on security incident logs should be rare once the application 

has been implemented and staff understand their permission levels. Because of the size 

of hospitals and clinics and the volume of controlled substance prescriptions at 

pharmacies, DEA estimates that each of them will review security incident logs monthly; 

DEA estimates that the review will take hospitals ten minutes per month and pharmacies 

five minutes per month. Because of the smaller size of private practices and the much 

lower volume of controlled substance prescriptions issued, DEA estimates that a review 

will be needed only once a quarter. The review time remains at 5 minutes. Clearly, if an 

actual security incident occurs, the review and action to address the issue will take more 

time, but most reported auditable events are likely to be minor mistakes that did not result 

in any breach of security. As noted previously, DEA does not believe that such incidents 

will occur on a routine basis, thus limiting the number of incident logs to be reviewed.

DEA estimates that reprogramming for electronic prescription applications will take, on 

average, 2,000 hours, an estimate based on industry information obtained during the 
20

development of DEA’s Controlled Substances Ordering System rule.25 There may be 

wide variation among providers. Some applications already have many of the functions; 

for example, any EHR application that is CCHIT-certified should have the logical access 

control functionalities. A few applications already include digital signature functionality. 

DEA expects that adding two-factor authentication may be the main new requirement for 

electronic prescription applications that have been CCHIT certified. Other applications 

that do not provide review screens or capture and transmit all of the DEA-required 

information will require more reprogramming. The requirements for pharmacy 

applications are simpler and include functionalities that the industry has indicated that it 

already has, so DEA assumes an average of 1,000 hours of reprogramming for pharmacy 

applications. The hours for pharmacy applications cover adding digital signature 

capability (about a third of all pharmacies have this capability for DEA’s Controlled 

Substances Ordering System) and for adding a list of auditable events and the ability to 

run daily checks for any such events. Over the long run, pharmacy applications will need 

to be reprogrammed to accept extension data for practitioners who prescribe under an 

institutional practitioner’s DEA registration. DEA expects that this update will be 

accomplished as part of routine upgrades that application providers make to keep current 

with changes to the National Council for Prescription Drug Programs SCRIPT standard.

3.3 BASIS OF COSTS OTHER THAN TIME

To estimate the cost of obtaining identity proofing from a credential service provider, 

DEA used the fee SAFE BioPharma charges for a three-year digital certificate and a hard 

token using remote identity proofing ($110).26 This figure may be high because it 

assumes a medium rather than the basic assurance level that DEA is requiring. Based on 

standard industry practice for digital certificates, DEA estimates that the credential will 

need to be renewed every three years, but that a complete reapplication will not be 

required until the ninth year. These assumptions are based on the standards incorporated 

in the Federal PKI Policy Authority Common Policy, which is used to determine the 

requirements for Certification Authorities, such as SAFE. The cost for the three-year 

renewal is estimated to be $35.00, which is what SAFE charges for a three-year digital 

certificate at the basic assurance level. Hospitals and clinics are assumed to use or adapt 

their existing access cards to store the credential and, therefore, incur no additional costs 

for the credential.

In the initial years, application providers may have to obtain a third-party audit to 

determine whether the application meets the requirements of the rule. Application 

providers may obtain a SysTrust, WebTrust, or SAS 70 audit or may hire a Certified 

Information System Analyst to conduct a more focused audit. DEA estimates the cost of 

this audit at $15,000. This estimated cost is about 50 percent of the application fee for 

 

25 ―Electronic Orders for Controlled Substances‖ 70 FR 16901, April 1, 2005; Economic Impact Analysis 

of the Electronic Orders Rule available at 

http://www.DEAdiversion.usdoj.gov/fed_regs/rules/2005/index.html

26

 http://www.safe-biopharma.org/digitalidentity.htm, accessed June 15, 2009. SAFE-BioPharma is a 

certification authority established by the pharmaceutical industry and cross-certified with the Federal 

Bridge Certification Authority.
21

CCHIT testing and certification of a full ambulatory electronic health record application 

($29,000). Compliance with DEA requirements will presumably be a subset of this cost, 

just as the electronic prescription functions are a subset of the full EHR. CCHIT has not 

yet published prices for certification of a stand-alone electronic prescription application. 

DEA chose to use the CCHIT fees as a basis because the interim final rule narrows the 

scope of the third-party audit and allows a larger number of auditors to conduct the audit. 

The higher cost estimates in the NPRM were based on obtaining particular types of audits 

and having the audits cover functions that will not be subject to auditing for installed 

applications. In addition, the one commenter that already obtained the third-party audits 

specified in the NPRM stated that the costs were much lower than DEA had estimated. 

DEA estimates that within five years, all electronic prescription application providers will 

obtain certification from an approved certification organization; because the providers 

already seek these certifications for other reasons, the cost of continuing to obtain 

certifications will not accrue to the rule after that point.27

3.4 SUMMARY OF UNIT COSTS

Exhibit 3-2 presents the unit costs for both labor-based costs and fees.

Exhibit 3-2: Unit Costs

Requirement Item, or labor, required. Unit Cost

Non-Labor Costs

Identity proofing and 

credential

Remote identity proofing and downloadable 

code for registrant (includes hard token).

$110.00

Renewal of credential Three-year renewal $35.00

Nine-year renewal $110.00

Initial audit of application Certification that application meets DEA 

requirements. $15,000.00

Reaudit of application Certification that application still meets DEA 

requirements. $15,000.00

Labor Costs

Application for identity 

proofing and credential

Registrant must fill out form; 10 minutes 

required. $28.23

Renewal application for 

credential

Registrant must only fill out parts where 

information has changed; 5 minutes needed. $14.12

Registration check

Requires one minute for a non-registrant.

Physician office—nurse $1.12

Dental office—dental assistant $0.57

Access control —training 

(practice office)

One hour per person; one is a registrant

Physician plus nurse $259.35

Mid-level plus nurse $151.49

Dentist plus dental assistant $201.01

Access control—granting

(practice office)

Requires one minute for registrant, five minutes 

for non-registrant (nurse)

Physician plus nurse $8.66

Mid-level plus nurse $7.00

 

27

 The subsidies that will be available for EHRs under ARRA will require that the application be certified.
22

Requirement Item, or labor, required. Unit Cost

Dentist plus dental assistant $5.64

Access control—training

(pharmacy) Requires five minutes for pharmacy technician $2.33

Access control—granting

(pharmacy) Requires five minutes for pharmacy technician $2.33

Review of security logs

(practice office)

Requires five minutes per quarter; 20 minutes 

per year for nurse. $22.39

Review of security logs

(pharmacy)

Requires five minutes per quarter; 20 minutes

per year for pharmacy tech. $11.43

Review of security logs

(hospital)

Requires ten minutes per month per year for 

system administrator. $136.64

ID check, face to face

(hospital only)

Requires two minutes for HR person AND

Thirty minutes per hospital practitioner OR

Thirty minutes per private physician.

$1.20

$55.22

$96.08

Reprogramming applications 

for practices

Requires 2,000 hours of application provider 

engineer’s time. $184,197

Reprogramming pharmacy 

applications

Requires 1,000 hours of application provider 

engineer’s time. $92,099
23

CHAPTER 4: TOTAL COSTS

To proceed from unit costs to total costs, it is necessary to establish the frequency of 

occurrence of cost items and the distribution of those occurrences, and thus of costs, over 

time. Frequency of occurrence may vary with numbers of registrants or with numbers of 

entities, e.g., physicians’ offices or hospitals. In Chapter 2, DEA presented estimates of 

the universe of affected registrants and entities. To obtain total costs over time, it is 

necessary to estimate future growth rates for affected individuals—physicians, dentists, 

mid-level practitioners, and pharmacy personnel—and entities—offices of physicians and 

dentists, hospitals, pharmacies, and application providers. These, and related, estimates 

will be set out in this chapter to show how DEA obtained its estimate of total costs. A 

15-year time horizon is used for all estimates. The material in this chapter is organized 

according to the four affected healthcare sectors:

 Offices of physicians and dentists

 Hospitals and clinics

 Pharmacies

 Application providers.

4.1 OFFICES OF PHYSICIANS AND DENTISTS

Some costs are incurred at start-up when an office implements electronic prescriptions for 

controlled substances. Some costs recur over time after initial implementation. In this 

latter group, some costs are linked to ongoing operation of the office. Total amounts of 

some costs depend on number of registrants; others vary with number of offices. The 

following exhibit shows these characteristics of the costs that apply to practice offices.

Exhibit 4-1: Cost Elements for Practitioners

Cost Element

Incurred for Varies with

Start-up

Ongoing

Operation

New

Hires Registrants Offices

ID proofing and protocol X X X X

Application for proofing and credential X X X X

Registration check X X

Training for logical access controls X X

Granting

Access

At start-up X X

Re-granting X X

Security-log review X X
24

Growth rates and implementation rate

In Chapter 2, DEA presented growth rates for practitioners and offices. They are 

repeated here for ease of reference.

Exhibit 4-2: Growth Rates for Practitioners

Growth rates

Percentages

Practitioners Offices

Physicians Dentists Mid-levels Physicians Dentists

2.1 1.3 2.2 1.25 1.1

The cost estimates are often based on either the number of offices implementing 

electronic prescriptions for controlled substances in a given year or the cumulative 

number of offices that have adopted the requirements, so it is necessary to estimate an 

implementation rate for offices. DEA assumes that the implementation rate for offices 

will also apply to the number of registrants working in offices.28 The same 

implementation rate is used for both dentists’ and physicians’ offices. As the following 

exhibit shows, DEA assumes rapid implementation in the early years tapering off later 

with full implementation in 15 years. Because of the growth rate assumed for 

practitioner offices, implementation is, in effect, complete by year 7 for existing offices; 

after that the new offices largely represent growth.

Exhibit 4-3: Implementation Rates for Practitioners

Implementation

Rate (percentage)

Cumulative

Percentage

YEAR 1 6.0 6.0

YEAR 2 10.0 16.0

YEAR 3 20.0 36.0

YEAR 4 20.0 56.0

YEAR 5 20.0 76.0

YEAR 6 10.0 86.0

YEAR 7 5.0 91.0

YEAR 8 2.0 93.0

YEAR 9 1.0 94.0

YEAR 10 1.0 95.0

YEAR 11 1.0 96.0

YEAR 12 1.0 97.0

YEAR 13 1.0 98.0

YEAR 14 1.0 99.0

YEAR 15 1.0 100.0

 

28 This assumption implies that the size distribution of offices adopting electronic prescriptions for 

controlled substances is the same in every year. This is likely not true, but DEA believes it is a satisfactory 

assumption for this purpose. If larger offices implement faster than others, the effect of the assumption will 

be a slight understatement of the present value of costs depending on number of registrants. In any event, 

the implementation rate, itself, is an arbitrary assumption.
25

Applying both the growth rates and the implementation rate, DEA obtained the following 

results for offices starting electronic prescriptions for controlled substances year by year, 

cumulative offices with electronic prescriptions for controlled substances, and registrants 

working in those offices, as well as total numbers of offices and registrants.

Exhibit 4-4: Cumulative Offices and Registrants

Offices Registrants in Offices

Total Starts Cumulative Total Starts Cumulative

YEAR 1 304,287 18,257 18,257 582,729 34,964 34,964

YEAR 2 307,935 31,012 49,270 593,678 60,025 94,988

YEAR 3 311,626 62,916 112,185 604,832 122,751 217,740

YEAR 4 315,361 64,417 176,602 616,196 127,330 345,070

YEAR 5 319,141 65,945 242,547 627,774 132,038 477,108

YEAR 6 322,966 35,204 277,751 639,569 72,921 550,030

YEAR 7 326,837 19,671 297,422 651,586 42,914 592,943

YEAR 8 330,754 10,180 307,602 663,829 24,417 617,361

YEAR 9 334,719 7,034 314,636 676,301 18,363 635,723

YEAR 10 338,731 7,159 321,794 689,008 18,835 654,558

YEAR 11 342,791 7,285 329,079 701,954 19,318 673,876

YEAR 12 346,900 7,413 336,493 715,143 19,813 693,689

YEAR 13 351,057 7,544 344,036 728,580 20,319 714,008

YEAR 14 355,265 7,676 351,713 742,269 20,838 734,846

YEAR 15 359,523 7,811 359,523 756,216 21,369 756,216

As noted, these numbers are for all practice offices and all registrants in offices. For 

some of the analyses of the individual cost elements, it is necessary to make these 

projections for various sub-sets of the totals. These are presented in the following 

analyses of the cost elements.

Identity proofing and credentials

For the purpose of the analysis, DEA assumes that all registrants—all physicians and 

mid-level practitioners in a physician’s office and all dentists in a dentist’s office—will 

acquire authority to use the application when the office adopts electronic prescriptions for 

controlled substances. The identity proofing process is done by an off-site service that 

provides a downloadable credential at a price of $110.00 per registrant. The cost of this 

requirement depends on number of registrants. For the purpose of the analysis, DEA 

assumes that the credentials must be renewed every three years. For example, registrants 

whose identities have been verified in YEAR 1 must repeat the process in YEARs 4, 7, 

10, and 13. The triennial renewals are less involved and less costly than the initial 

protocol. DEA estimates the cost of the renewals at $35.00, with the exception of 
26

renewals on the ninth anniversary of the initial credential. The nine-year renewals are as 

costly as initial applications--$110.00.29

The process must also take place whenever a newly hired registrant enters the office. 

Even though the registrant may have been through the process in his previous office, 

DEA assumes that the complete process will be required again. DEA assumes that 2.5 

percent of physicians and dentists and 5.0 percent of mid-level practitioners in offices 

that have adopted electronic prescriptions for controlled substances will be new hires 

each year. A ―new hire‖ means someone newly hired in an office. He could be a person 

newly entering this workforce or a person transferring from another office.30 The newhire numbers do not affect the total number of registrants. Rather, they are an estimate of 

turnover in the population. The total sizes of populations are driven by the growth rates 

shown above.

The new-hire percentages are applied to the cumulative totals of registrants in offices that 

have adopted electronic prescriptions for controlled substances. Because of the 

assumption of different turnover rates, separate future projections must be made for 

physicians and dentists on the one hand and mid-level practitioners on the other. (DEA 

assumes no costs for new hires in YEAR 1, because all registrants will be getting identity 

proofing for the first time.)

Exhibit 4-5: Cumulative Registrants

Cumulative Registrants in EPCS-adopted Offices and New Hires

All Registrants Physicians/Dentists Mid-levels

Total New Hires Total New Hires Total New Hires

YEAR 1 34,964 0 30,009 0 4,955 0

YEAR 2 94,988 2,712 81,485 2,037 13,503 675

YEAR 3 217,740 6,220 186,692 4,667 31,051 1,553

YEAR 4 345,070 9,861 295,720 7,393 49,364 2,468

YEAR 5 477,108 13,640 408,679 10,217 68,468 3,423

YEAR 6 550,030 15,732 470,923 11,773 79,181 3,959

YEAR 7 592,943 16,967 507,435 12,686 85,628 4,281

YEAR 8 617,361 17,674 528,100 13,203 89,435 4,472

YEAR 9 635,723 18,209 543,578 13,589 92,386 4,619

YEAR 10 654,558 18,757 559,453 13,986 95,422 4,771

YEAR 11 673,876 19,321 575,735 14,393 98,548 4,927

YEAR 12 693,689 19,899 592,436 14,811 101,766 5,088

YEAR 13 714,008 20,493 609,564 15,239 105,077 5,254

YEAR 14 734,846 21,102 627,131 15,678 108,484 5,424

YEAR 15 756,216 21,728 645,146 16,129 111,991 5,600

Cost calculation:

 

29

 The nine-year period for repeating the identity proofing is based on the requirements of the Federal 

Bridge Certification Authority. 

30 A new hire in a solo practice reflects someone taking over a practice from someone leaving the field or 

someone opening a new office.
27

YEARs 2, 5, and 11 are offered as examples. In YEAR 2 there is no cost for credential 

renewal, because the initial credentials are still valid. In YEAR 5, there are costs for 

triennial renewals; in YEAR 11, there are nine-year renewals.

YEAR 2: 60,025 registrants in start-up offices (Exhibit 4-4)

 2,712 new hires (Exhibit 4-5)

 60,025 + 2,712 = 62,737 new credentials

 Cost: 62,737 x $110 = $ 6,901,070

YEAR 5: Start-ups: 132,038 registrants

 Renewals: 60,025 registrants

 New hires: 13,640 registrants

 132,038 + 13,640 = 145,678 new credentials

Cost: 145,678 x $110 = $16,024,580

 60,025 x $35 = $2,100,875

Total cost: $18,125, 455

YEAR 11: Start-ups 19,318 registrants

 Renewals: 156,456 registrants

 Nine-year renewals: 60,025 registrants

 New hires: 19,321 registrants

 19,318 + 60,025 + 19,321 = 98,663 new registrants and 9-year renewals

Cost: 98,663 x $110 = $10,852,930

 156,456 x $35 = $5,475,949

Total Cost: $16,328,879

The following exhibit shows present and annualized value of future cost of identity 

proofing and protocols. The cost, even when discounted, stays high in the out years 

because of the requirement for renewal every three years.

Exhibit 4-6: Present and Annualized Value of Identity Proofing

Present Value

7.0 percent 3.0 percent

YEAR 1 $3,846,010 $3,846,010

YEAR 2 $6,449,597 $6,700,067

YEAR 3 $12,391,310 $13,372,430

YEAR 4 $13,317,739 $14,930,356

YEAR 5 $13,827,872 $16,104,290

YEAR 6 $10,016,149 $12,118,073

YEAR 7 $8,174,161 $10,273,596

YEAR 8 $7,069,632 $9,230,446

YEAR 9 $6,327,241 $8,581,967

YEAR 10 $7,582,266 $10,683,609
28

Present Value

7.0 percent 3.0 percent

YEAR 11 $8,300,802 $12,150,260

YEAR 12 $10,008,251 $15,218,445

YEAR 13 $9,715,263 $15,346,635

YEAR 14 $9,448,444 $15,504,775

YEAR 15 $7,133,697 $12,160,919

Total $133,608,434 $176,221,878

Annualized $14,669,488 $14,761,504

Application for identity proofing and credential

A registrant must fill out an application to be submitted to the service that performs 

identity proofing and issues credentials. The task requires 10 minutes. DEA estimates 

that, for renewal of the credential, the task requires five minutes as the applicant need 

only submit a request signed with the two-factor credential. Thus, applications for 

renewals must be separated in the cost calculation from applications at start-up and 

applications for new hires. (It is assumed that new hires must complete the full 

application, even when they are moving from another office.) The future projection of 

registrants in Exhibits 4-4 and 4-5 can be used for this estimate.

Cost calculation:

Costs per registrant for start-up application and for renewals are based on weighted 

hourly cost for all registrants. For new hires, costs are based on weighted average of 

hourly cost for physicians and dentists and hourly cost for mid-level practitioners. This 

yields the following unit costs for the different cases. (All data on wage rates and full 

hourly costs are in Chapter 3.)

Start-up applications—all registrants: weighted hourly cost $169.40

10 minutes is 0.167 hours. 0.167 x $169.40 = $28.23

Renewal applications—all registrants

5 minutes is 0.0833 hours. 0.0833 x $169.40 = $14.12

New-hire applications—physicians and dentists: weighted hourly cost is $183.45

0.167 x $183.45 = $30.57

New-hire applications—mid-level practitioners: hourly cost is $84.30

0.167 x $84.30 = $14.05

YEAR 2: 

Start-ups: 60,025 registrants

New hires: 2,037 physicians/dentists, 675 mid-levels

60,025 x $28.23 = 1,694,506

2,037 x $30.57 = 62,271

675 x $14.05 = 9,484

Total: $1,766,261
29

Note that the costs listed above and the costs in the following exhibits will not match 

because the actual calculations are not based on rounded numbers. The following exhibit 

shows present and annualized value of future cost of applying for identity proofing and 

protocols.

Exhibit 4-7: Present Value of Application for Identity Proofing

Present Value

7.0 percent 3.0 percent

YEAR 1 $987,149 $987,149

YEAR 2 $1,650,916 $1,715,030

YEAR 3 $3,170,771 $3,421,826

YEAR 4 $3,550,309 $3,980,209

YEAR 5 $3,765,458 $4,385,348

YEAR 6 $2,999,722 $3,629,224

YEAR 7 $2,632,521 $3,308,652

YEAR 8 $2,408,295 $3,144,384

YEAR 9 $2,188,997 $2,969,051

YEAR 10 $2,134,021 $3,006,891

YEAR 11 $2,089,687 $3,058,769

YEAR 12 $1,950,354 $2,965,689

YEAR 13 $1,898,685 $2,999,243

YEAR 14 $1,855,979 $3,045,639

YEAR 15 $1,735,992 $2,959,371

Total $35,018,858 $45,576,474

Annualized $3,844,882 $3,817,785

These numbers do not show costs falling much in the future, even though discounted. 

That is because of the renewal every three years. In YEAR 13, for example, registrants 

in the offices that started in YEARs 1, 4, 7, and 10 are all renewing.

Registration checks

Before a practitioner may use the electronic prescription application for controlled 

substance prescriptions, a person in the office who has been authorized to grant access to 

the electronic prescription application must verify that the DEA registration and State 

authorization(s) to practice and, where applicable, dispense (including prescribe) 

controlled substances are current and in good standing. This task requires one minute per 

practitioner and does not have to be performed by a registrant. DEA assumes this will 

not be necessary in a small office where all workers will be aware of the State 

authorization and DEA registration status of practitioners. For this purpose, DEA 

considers an office as small if it has two or fewer physicians or dentists.

The registration check is required for registrants in an office starting electronic 

prescriptions for controlled substances. After the start-up, registration checking for new 
30

hires is part of routine process of checking credentials for a new employee and is not an 

additional cost. The following exhibit shows registrants at start-up and cumulative 

registrants in offices with more than two physicians or dentists.

Exhibit 4-8: Number of Registrants over Time

Registrants in Offices

Offices with >2 Physicians Offices with >2 Dentists

Starts Cumulative Starts Cumulative

YEAR 1 14,108 14,108 1,738 1,738

YEAR 2 24,310 38,418 2,957 4,694

YEAR 3 49,855 88,272 6,005 10,699

YEAR 4 51,951 140,223 6,161 16,860

YEAR 5 54,114 194,338 6,319 23,179

YEAR 6 30,233 224,571 3,391 26,570

YEAR 7 18,094 242,665 1,910 28,480

YEAR 8 10,591 253,256 1,004 29,484

YEAR 9 8,150 261,406 704 30,189

YEAR 10 8,382 269,788 718 30,906

YEAR 11 8,620 278,408 731 31,638

YEAR 12 8,864 287,272 745 32,383

YEAR 13 9,115 296,387 759 33,142

YEAR 14 9,372 305,759 773 33,916

YEAR 15 9,636 315,395 788 34,703

Cost calculation:

In a dentist’s office, the registration check will be performed by a dental assistant—by a 

nurse in a physician’s office. Time is one minute.

Cost in dentist’s office: $0.57

Cost in physician’s office: $1.12

The calculation is the same in all years.

YEAR 2:

Dental offices: 

Start-ups: 2,957 registrants

2,957 x $0.57 = $1,685

Physicians’ offices:

Start-ups: 24,310 registrants

24,310 x $1.12 = $27,227

Total: 1,685 + 27,227 = $28,913
31

The following exhibit shows present value and annualized cost of registration checks.

Exhibit 4-9: Present and Annualized Cost of Registration Checks

Present Value

7.0 percent 3.0 percent

YEAR 1 $16,789 $16,789

YEAR 2 $27,019 $28,068

YEAR 3 $51,755 $55,853

YEAR 4 $50,358 $56,456

YEAR 5 $48,981 $57,044

YEAR 6 $25,518 $30,873

YEAR 7 $14,228 $17,882

YEAR 8 $7,743 $10,109

YEAR 9 $5,546 $7,522

YEAR 10 $5,328 $7,507

YEAR 11 $5,119 $7,493

YEAR 12 $4,918 $7,478

YEAR 13 $4,724 $7,463

YEAR 14 $4,538 $7,447

YEAR 15 $4,359 $7,431

Total $276,922 $325,415

Annualized $30,405 $27,259

Training for logical access controls

Two people are needed to set the logical access controls in an office so that registrants 

can gain access to the application. One of the two must be a registrant. Training is 

required to perform this task. Training may be done by the application providers, either 

in person or through on-line training or manuals, and their cost is included in the fee they 

charge practitioners’ offices for the application. In addition, there is a cost of the time of 

the people being trained. DEA estimates the time at one hour per person, registrant or 

non-registrant.

Offices will select the least-cost combination of job classes to be trained. Which job 

categories are used varies with type and size of office. A physician’s office will choose a 

nurse as the non-registrant. Mid-level practitioner is the least-cost choice for registrant in 

a physician’s office, but many small offices will not have a mid-level practitioner, and a 

physician will have to do the work instead. Dentists’ offices have no mid-level 

practitioners; dentists are the only registrants in such offices. Dentists’ offices rarely 

have nurses; therefore, DEA assumes that dental assistants will do this work.

Regarding physicians’ offices, DEA assumes that offices with one physician will not 

have mid-level practitioners and that all offices with two or more physicians will have at 

least one mid-level practitioner. Clearly, some solo physicians will employ a mid-level 

practitioner, and some practices with two or three physicians will not. Nonetheless, DEA 

judges that this is a sound assumption, because the absence of mid-level practitioners in 

some practices with more than one physician will offset the presence of mid-level 

practitioners in some solo practices.
32

An office must have at least two people trained to administer logical access controls, else 

it cannot use the electronic prescription application for controlled substance prescriptions. 

But the training is not costly on a per-office basis because it will take limited time and is 

a routine part of learning how to use new applications and upgrades to applications. 

Larger offices will likely have more than two people trained to provide some redundancy 

in this skill. For this estimate, DEA assumes that offices with more than two physicians 

or dentists will have four people trained. DEA believes this is a reasonable average; very 

large offices might have more than four trained people, smaller offices might have fewer.

With these considerations, it is necessary to estimate training costs for five different 

categories of office. The exhibit below shows the per-office cost of training for each 

category.

Exhibit 4-10: Unit Training Cost by Office Size and Type

Size and type 

of office

>2 

Physicians

2 

Physicians

1 

Physician >2 Dentists 1 or 2Dentists

Registrant Mid-level Mid-level Physician Dentist Dentist

Non-registrant Nurse Nurse Nurse Dental 

assistant

Dental 

assistant

Two trained $151.49 $259.35 $201.01

Four trained $302.98 $402.02

Training for setting the logical access controls will occur only at start-up. Once some 

people in the office have the requisite skills, they will be passed along when necessary as 

part of office routine. Number of start-ups, for each category, year by year, is in the 

following exhibit.

Exhibit 4-11: Number of Start-Ups per Year

>2 

Physicians

2 

Physicians

1 

Physician

>2 

Dentists

1 or 2

Dentists

YEAR 1 1,969 1,163 7,069 543 7,517

YEAR 2 3,347 1,977 12,017 921 12,748

YEAR 3 6,794 4,013 24,393 1,866 25,833

YEAR 4 6,963 4,113 25,000 1,907 26,398

YEAR 5 7,136 4,215 25,618 1,949 26,974

YEAR 6 3,819 2,256 13,712 1,035 14,326

YEAR 7 2,143 1,266 7,694 574 7,941

YEAR 8 1,118 660 4,014 292 4,044

YEAR 9 779 460 2,795 199 2,751

YEAR 10 793 468 2,846 202 2,796

YEAR 11 807 477 2,898 205 2,842

YEAR 12 822 486 2,951 209 2,889

YEAR 13 837 494 3,005 212 2,936

YEAR 14 852 503 3,060 216 2,984

YEAR 15 868 513 3,115 219 3,033
33

Cost calculation: Calculation is the same for all years.

YEAR 2:

Offices Unit Cost Total Cost

>2 Physicians 3347 $303 $1,014,045

2 Physicians 1,977 $151 $299,487

1 Physician 12,017 $259 $3,116,600

>2 Dentist 921 $402 $370,269

1-2 Dentist 12,748 $201 $2,562,532

Total $7,362,933

The following exhibit shows present value and annualized cost of training for access 

controls.

Exhibit 4-12: Present and Annualized Value of Logical Access Control Training

Present Value

7.0 percent 3.0 percent

YEAR 1 $4,335,170 $4,335,170

YEAR 2 $6,881,189 $7,148,419

YEAR 3 $13,045,528 $14,078,448

YEAR 4 $12,480,973 $13,992,267

YEAR 5 $11,939,283 $13,904,790

YEAR 6 $5,954,140 $7,203,636

YEAR 7 $3,107,312 $3,905,387

YEAR 8 $1,500,943 $1,959,702

YEAR 9 $968,078 $1,313,055

YEAR 10 $920,683 $1,297,266

YEAR 11 $875,581 $1,281,627

YEAR 12 $832,663 $1,266,139

YEAR 13 $791,826 $1,250,801

YEAR 14 $752,969 $1,235,613

YEAR 15 $715,998 $1,220,573

Total $65,102,335 $75,392,895

Annualized $7,147,886 $6,315,405

Granting access

Granting registrants in practice offices access to the electronic prescription application to 

sign controlled substances prescriptions occurs on two occasions:

o Start-up of electronic prescriptions for controlled substances in an office

o Re-granting of access if access is revoked.

When an office adopts electronic prescriptions for controlled substances, access to the 

electronic prescription application is granted to the registrants in the office. This will be 

done in one batch. The non-registrant will enter a list of names, registration numbers, 
34

and other required data; a registrant will review the information and authorize access. It 

takes an average of five minutes for the non-registrant to enter the information and one 

minute for the registrant to review it. This cost will vary according to number of offices 

starting electronic prescriptions for controlled substances in a given year. Access control 

for newly hired staff should occur as part of routine practice when they join and, 

therefore, is not a cost of the rule.

A registrant’s access must be revoked under certain circumstances. If, for example, 

access is revoked because of a lost or stolen token, or because an individual’s registration 

has expired, the office will re-grant access when a new credential has been issued or a 

registration has been renewed. Such occasions will be quite rare. DEA estimates an 

average occurrence of one per year in offices with more than two physicians or dentists. 

The task will require one minute for the non-registrant and one minute for the registrant

authorized to administer logical access controls. This cost will vary with the number of 

offices with electronic prescriptions for controlled substances in place and with more than 

two physicians or dentists.

As with training for access controls, job classes of people doing the work vary with size 

and type of office. The following exhibit shows cost per granting action by size and type 

of office and occasion for granting.

Exhibit 4-13: Cost of Granting Access by Size and Office Type and Occasion for 

Granting

Size and Type of Office >1 Physician 1 Physician Dentists

Registrant Mid-level Physician Dentist

Non-registrant Nurse Nurse Dental assistant

Cost per action

Start-up—5 minutes for non-registrant,

 1 minute for registrant $7.00 $8.80 $5.64

Re-grants

1 minute for non-registrant

1 minute for registrant

$2.52 $4.32 $3.35

Calculation of total cost requires, year by year:

o for start-up, number of start-up offices by size and type of office

o for re-grants, number of physicians’ and dentists’ offices with electronic 

prescriptions for controlled substances with more than two physicians or dentists
35

Exhibit 4-14: Estimated Number of New Offices, Offices with EPCS by Year

Start-up Offices Offices with EPCS

>1 Physician 1 Physician Dentists >2 Physicians >2 Dentists

YEAR 1 3,133 7,069 8,060 1,969 543

YEAR 2 5,325 12,017 13,669 5,316 1,464

YEAR 3 10,810 24,393 27,699 12,110 3,330

YEAR 4 11,079 25,000 28,306 19,073 5,238

YEAR 5 11,353 25,618 28,922 26,209 7,186

YEAR 6 6,077 13,712 15,361 30,028 8,221

YEAR 7 3,410 7,694 8,514 32,171 8,795

YEAR 8 1,779 4,014 4,336 33,289 9,087

YEAR 9 1,239 2,795 2,950 34,068 9,286

YEAR 10 1,261 2,846 2,998 34,861 9,488

YEAR 11 1,284 2,898 3,048 35,668 9,693

YEAR 12 1,308 2,951 3,098 36,490 9,902

YEAR 13 1,332 3,005 3,148 37,327 10,114

YEAR 14 1,356 3,060 3,200 38,179 10,330

YEAR 15 1,381 3,115 3,252 39,047 10,549

Cost calculation: The cost calculation is the same for all years.

YEAR 2:

Start-ups

5,325 offices with more than one physician

Cost per office: $7.00

12,017 offices with one physician

Cost per office: $8.80

13,669 dentists’ offices

Cost per office: $5.64

Start-up cost: 5,325 x $7.00 + 12,017 x $8.80 + 13,669 x $6.64 = $233,787

Re-grants

5,316 offices with more than two physicians

Cost per office: $2.52

1,464 offices with more than two dentists

Cost per office: $3.35

Re-grant cost: 5,316 x $2.52 + 1,464 x $3.35 = $18,301

Total access-granting cost in YEAR 2: $233,787 + $18,301 = $252,088

The following exhibit shows present value and annualized cost of granting of access to 

sign controlled substance prescriptions.
36

Exhibit 4-15: Present and Annualized Value of Granting of Access

Present Value

7.0 percent 3.0 percent

YEAR 1 $129,574 $129,574

YEAR 2 $222,822 $231,475

YEAR 3 $426,446 $460,211

YEAR 4 $426,803 $478,484

YEAR 5 $425,873 $495,982

YEAR 6 $251,807 $304,650

YEAR 7 $166,766 $209,598

YEAR 8 $116,278 $151,818

YEAR 9 $97,209 $131,850

YEAR 10 $92,787 $130,739

YEAR 11 $88,559 $129,628

YEAR 12 $84,517 $128,515

YEAR 13 $80,653 $127,402

YEAR 14 $76,959 $126,289

YEAR 15 $73,430 $125,176

Total $2,760,481 $3,361,391

Annualized $303,086 $281,572

Review of security logs

Security logs must be reviewed whenever an auditable event occurs. DEA assumes that 

this will occur once a quarter although auditable events should be rare. The task requires 

5 minutes per quarter —20 minutes per year. A person designated to administer logical 

access controls is required to review the security incident log, but a registrant is not 

required for the task. A security log will be generated only when an auditable event 

occurs (e.g., an unauthorized person attempts to sign a controlled substance prescription). 

Relatively few events are expected to occur. The reviewer will need to determine if the 

reported event represented a security problem or a simple mistake (e.g., a nurse clicked 

on the ―sign‖ button and was warned that he was not authorized to perform the function). 

In a physician’s office, the review will be done by a nurse; in a dentist’s office, by a 

dental assistant. Twenty minutes of the nurse’s time is $22.39; for the dental assistant, 

$11.43.

This is an ongoing operational cost, and it varies with number of offices that have 

implemented electronic prescriptions for controlled substances. The number of physician 

offices and of dental offices with electronic prescriptions for controlled substances is 

required for the cost calculation.

Exhibit 4-16: Offices of Physicians and Dentists with Implemented EPCS

Physicians Dentists

YEAR 1 10,201 8,060

YEAR 2 27,543 21,729

YEAR 3 62,747 49,428

YEAR 4 98,826 77,733

YEAR 5 135,798 106,656

YEAR 6 155,587 122,017
37

Physicians Dentists

YEAR 7 166,690 130,531

YEAR 8 172,483 134,868

YEAR 9 176,517 137,817

YEAR 10 180,625 140,815

YEAR 11 184,808 143,863

YEAR 12 189,067 146,961

YEAR 13 193,404 150,109

YEAR 14 197,820 153,309

YEAR 15 202,316 156,561

The calculation is the same for all years.

YEAR 2:

27,543 physicians’ offices

$22.39 per office

21,729 dentists’ offices

$11.43 per office

Cost of log review in YEAR 2: 27,543 x $22.39 + 21,729 x $11.43 = $858,532

Exhibit 4-17: Present Value of Security Log Review

Present Value

7.0 percent 3.0 percent

YEAR 1 $320,544 $320,544

YEAR 2 $808,506 $839,904

YEAR 3 $1,720,649 $1,856,887

YEAR 4 $2,531,655 $2,838,208

YEAR 5 $3,249,803 $3,784,803

YEAR 6 $3,478,317 $4,208,253

YEAR 7 $3,481,283 $4,375,410

YEAR 8 $3,365,181 $4,393,740

YEAR 9 $3,217,223 $4,363,686

YEAR 10 $3,075,423 $4,333,350

YEAR 11 $2,939,548 $4,302,750

YEAR 12 $2,809,373 $4,271,903

YEAR 13 $2,684,678 $4,240,830

YEAR 14 $2,565,252 $4,209,545

YEAR 15 $2,450,889 $4,178,068

Total $38,698,325 $52,517,882

Annualized $4,248,868 $4,399,243

Exhibit 4-18 summarizes costs for practitioners’ offices over 15 years.

Exhibit 4-18: Cost Summary for Practitioners’ Offices 

7.0 percent 3.0 percent

Present value Annualized Present value Annualized

ID and protocol $133,608,434 $14,669,488 $176,221,878 $14,761,504 
38

7.0 percent 3.0 percent

Present value Annualized Present value Annualized

Application for protocol $35,018,858 $3,844,882 $45,576,474 $3,817,785 

Checking registration $276,922 $30,405 $325,415 $27,259

Training for access $65,102,335 $7,147,886 $75,392,895 $6,315,405

Granting access $2,760,481 $303,086 $3,361,391 $281,572

Security log review $38,698,325 $4,248,868 $52,517,882 $4,399,243

Totals $275,465,355 $30,244,615 $353,395,934 $29,602,769

4.2 HOSPITALS AND CLINICS

DEA treats hospitals and clinics as a single group for this analysis. In both groups, there 

will be credentialing procedures already in place that eliminate some of the requirements 

imposed on practices. Specifically, the hospital, which is a registrant, already conducts 

identity proofing as part of its credentialing process for both staff practitioners and 

practitioners who are being granted privileges. Once the current practitioners have a brief 

face-to-face identity verification, they are provided with a two-factor credential, or an 

existing protocol is enabled to sign electronic prescriptions for controlled substances. 

New practitioners will receive this check as part of the standard credentialing process. 

Similarly, the hospital will make, or will have made, for reasons beyond this analysis, 

arrangements for its practitioners to access the hospital’s electronic applications for, 

among other purposes, prescription transmission. There will be no costs for training 

related to, or granting of, logical access controls. The costs that are incurred by hospitals 

and are analyzed here are:

 Identity check

 Security log review

Implementation rate

As noted in Chapter 2, DEA assumes zero future growth for the number of hospitals and 

clinics. But DEA does not assume that all hospitals will implement electronic 

prescriptions for controlled substances in the first year. It is, thus, necessary to assume an 

implementation rate. DEA judges that hospitals will implement in the first five years. 

They may believe they have a more compelling need to adopt procedures for electronic 

records and prescriptions than many practice offices. The following exhibit shows the 

implementation schedule.

Exhibit 4-19: Hospital/Clinic Implementation Schedule

Implementation

Rate (percentage)

Cumulative

Percentage

YEAR 1 25.0 percent 25.0 percent

YEAR 2 25.0 percent 50.0 percent

YEAR 3 20.0 percent 70.0 percent

YEAR 4 20.0 percent 90.0 percent
39

Implementation

Rate (percentage)

Cumulative

Percentage

YEAR 5 10.0 percent 100.0 percent

Costs of identity verification will vary both with number of practitioners on staff in 

hospitals and numbers of physicians with hospital privileges. It is necessary to project 

numbers of staff practitioners and private physicians as their hospitals implement 

electronic prescriptions for controlled substances over the phase-in period. DEA assumes 

that all physicians in offices will have privileges in some hospital or clinic. Numbers of 

hospitals, staff practitioners, and physicians in practice in hospitals as they adopt 

electronic prescriptions for controlled substances are shown below.

Exhibit 4-20: Hospitals/Clinics and Practitioners in Hospitals Starting EPCS

Hospitals Staff

Practitioners

Physicians

in Practice

All 

Practitioners

YEAR 1 3,103 54,545 82,193 136,738

YEAR 2 3,103 56,857 85,645 142,502

YEAR 3 2,482 47,867 72,117 119,984

YEAR 4 2,482 49,847 75,099 124,946

YEAR 5 1,241 28,161 42,428 70,589

Totals 12,412 237,277 357,482 594,759

Numbers may not add due to rounding.

Identity verification

The identity verification will require, for each practitioner, thirty minutes for the 

practitioner to visit the credentialing office and two minutes for a human resource staff 

person to check the photographic identification. The labor cost will be the time of a 

human resources staff person performing the verification and the time of the practitioner 

whose identity is being verified. The value of the time of the practitioner is different for 

hospital staff and private physicians. Below are costs for identity verification for a 

hospital-based physician and for a private physician.

Exhibit 4-21: Costs for a Hospital/Clinic ID Check

Cost per

Hour

Cost of 2/30

Minutes

Cost of

ID Check

HR Associate $36.06 $1.20

Hospital-based Practitioner $110.45 $55.22 $56.42

Private Physician $192.17 $96.08 $97.28

Weighted average for hospital mid-level practitioners and hospital physicians.

Cost calculation:

YEAR 2:

Identity verification: 56,857 x $56.42 + 85,645 x $97.28 = $11,540,240
40

After a hospital’s first year using electronic prescriptions for controlled substances, costs 

of identity verification will disappear. Identity verification will be incorporated in a 

hospital’s routine credentialing procedures at no incremental cost. Thus, these costs will 

be zero after YEAR 5. Costs for the identity verification, over time, are shown in 

Exhibits 4-22 and 4-23.

Security log review

An information technology system administrator must review the security log once a 

month. DEA believes a reasonable estimate is ten minutes for the monthly review 

(compared to five minutes per quarter in a physician’s office). Ten minutes per month 

per year is two hours. The hourly cost of the systems administrator is $68.32, so the 

annual cost of the log review is $136.64 per hospital.

Cost calculation:

YEAR 2:

Since this is an ongoing operational cost, it will vary with the cumulative total of 

hospitals that have implemented electronic prescriptions for controlled substances, rather 

than with the number starting electronic prescriptions for controlled substances in a given 

year. The number of hospitals implemented in YEAR 2 is 6,776.

6,206 x $136.64 = $848,014

Because hospitals have fully implemented electronic prescriptions for controlled 

substances by YEAR 5, this cost will not change from YEAR 5 on. In light of the great 

difference in time distribution among hospital costs, it is useful to show them over time 

undiscounted as well as the present values.

Exhibit 4-22: Hospital/Clinic Costs Undiscounted Future Values

ID Check Log review

YEAR 1 $11,073,901 $424,007

YEAR 2 $11,540,240 $848,014

YEAR 3 $9,716,868 $1,187,220

YEAR 4 $10,118,713 $1,526,426

YEAR 5 $5,716,598 $1,696,029

YEAR 6 $0 $1,696,029

YEAR 7 $0 $1,696,029

YEAR 8 $0 $1,696,029

YEAR 9 $0 $1,696,029

YEAR 10 $0 $1,696,029

YEAR 11 $0 $1,696,029

YEAR 12 $0 $1,696,029

YEAR 13 $0 $1,696,029

YEAR 14 $0 $1,696,029

YEAR 15 $0 $1,696,029
41

Exhibit 4-23: Hospital/Clinic Present and Annualized Values

7% 3%

ID Check Log review ID

Check

Log

review

YEAR 1 $11,073,901 $424,007 $11,073,901 $424,007

YEAR 2 $10,785,271 $792,537 $11,204,117 $823,315

YEAR 3 $8,487,089 $1,036,964 $9,159,080 $1,119,069

YEAR 4 $8,259,884 $1,246,018 $9,260,056 $1,396,896

YEAR 5 $4,361,165 $1,293,892 $5,079,123 $1,506,900

YEAR 6 $0 $1,209,245 $0 $1,463,009

YEAR 7 $0 $1,130,136 $0 $1,420,398

YEAR 8 $0 $1,056,202 $0 $1,379,027

YEAR 9 $0 $987,104 $0 $1,338,861

YEAR 10 $0 $922,527 $0 $1,299,865

YEAR 11 $0 $862,175 $0 $1,262,005

YEAR 12 $0 $805,771 $0 $1,225,247

YEAR 13 $0 $753,057 $0 $1,189,561

YEAR 14 $0 $703,792 $0 $1,154,913

YEAR 15 $0 $657,749 $0 $1,121,275

Total $42,967,310 $13,881,177 $45,776,277 $18,124,347

Annualized $4,717,580 $1,524,079 $3,834,522 $1,518,215

4.3 PHARMACIES

The rule imposes costs on pharmacies for logical access controls and security log 

reviews. For logical access controls there is cost for both training and granting of access. 

Training cost depends on number of pharmacies, as does cost of granting access in the 

first year. After YEAR 1, there are no training costs. DEA believes that all pharmacies 

will enable electronic prescriptions for controlled substances in the first year, and there 

will be no repeat training costs. Using the logical access controls will be simpler in a 

pharmacy than in a practice office, and the skills can be readily passed on to new hires as 

occasion requires. Further, pharmacies have been declining in number; DEA does not 

expect any new entrants after YEAR 1.

While recent experience shows number of pharmacies declining, data also indicate 

growth rates for pharmacists and pharmacy technicians of 2.1 and 2.8 percent, 

respectively. Growth in personnel as number of stores declines occurs because of steady 

disappearance of smaller stores while sales are growing.

Granting of access in the first year will be a cost per pharmacy location, as a pharmacy 

technician enters the required information for those to have access in one batch when 

electronic prescriptions for controlled substances is implemented. 

Since the number of pharmacies is projected as constant, there is no change in log review 

cost over time.
42

Training for access controls

There are 65,421 pharmacies in DEA’s data on registrants. Training for access controls 

will have a low cost per pharmacy location; DEA expects that an average of three 

pharmacy technicians per store will be trained. That results in 196,263 technicians 

receiving training. Training takes five minutes (1/12 hour) and the hourly cost of a 

pharmacy technician is $27.99; the training, thus, costs $2.33 (27.99 ÷ 12) for one 

pharmacy technician.

Cost calculation:

YEAR 1 only:

196,263 x $27.99 ÷ 12 = $457,720

Granting access

There are 65,421 pharmacies in DEA’s data on registrants. In YEAR 1, DEA assumes 

they all adopt electronic prescriptions for controlled substances and access is granted for 

all pharmacists and technicians. As this is done in a single batch per location, a 

pharmacy technician can perform the task in an average of five minutes per store. 

As with practitioner offices, access control for new hires after the initial implementation 

should be done routinely. Cost calculation:

In the first year, access granting requires five minutes per store for a pharmacy 

technician.

65,421 x $27.99 ÷ 12 = $152,573

Security Log Reviews

This cost depends on number of pharmacies. It is constant over time, since the number of 

pharmacies is not expected to increase. It requires five minutes per month, one hour per 

year, for a pharmacy technician. Five minutes could well be a high estimate, since 

security incidents could be rare, especially in a small store.

65,421 x $27.99 = $1,830,878

Below are the present values and annualized cost.
43

Exhibit 4-24: Pharmacy Costs Present and Annualized Values

7.0 percent 3.0 percent

Access 

training

Access 

granting Log review Access training

Access 

granting Log review

YEAR 1 $457,720 $152,573 $1,830,878 $457,720 $152,573 $1,830,878

YEAR 2 $0 $0 $1,711,101 $0 $0 $1,777,551

YEAR 3 $0 $0 $1,599,160 $0 $0 $1,725,778

YEAR 4 $0 $0 $1,494,542 $0 $0 $1,675,513

YEAR 5 $0 $0 $1,396,768 $0 $0 $1,626,711

YEAR 6 $0 $0 $1,305,391 $0 $0 $1,579,331

YEAR 7 $0 $0 $1,219,991 $0 $0 $1,533,332

YEAR 8 $0 $0 $1,140,179 $0 $0 $1,488,671

YEAR 9 $0 $0 $1,065,588 $0 $0 $1,445,312

YEAR 10 $0 $0 $995,876 $0 $0 $1,403,216

YEAR 11 $0 $0 $930,726 $0 $0 $1,362,345

YEAR 12 $0 $0 $869,837 $0 $0 $1,322,665

YEAR 13 $0 $0 $812,932 $0 $0 $1,284,141

YEAR 14 $0 $0 $759,749 $0 $0 $1,246,739

YEAR 15 $0 $0 $710,046 $0 $0 $1,210,426

Total $457,720 $152,573 $17,842,763 $457,720 $152,573 $22,512,610

Annualized $50,255 $16,752 $1,959,040 $38,342 $12,781 $1,885,804

4.4 APPLICATION PROVIDERS

Costs incurred by application providers are in two forms: reprogramming of applications 

to meet DEA’s requirements for electronic prescriptions for controlled substances and 

auditing of applications to ensure compliance. Reprogramming will occur only in YEAR 

1. All existing application providers will reprogram then, so they can be ready to sell to 

practice offices and pharmacies. Some providers will enter the market after that, but they 

will not need to reprogram, as they will write software applications for the new market.

Electronic prescription and pharmacy applications must be audited before providers can 

offer them for sale, and they must be audited thereafter on a biennial basis. New 

application providers entering the market after the first year will require initial audits.

Both practice offices and pharmacies will require applications. Application providers 

generally specialize in either applications for offices or applications for pharmacies. 

DEA estimates that there are approximately 170 providers now selling to practices and 40 

selling to pharmacies. DEA expects that the number of providers to pharmacies will 

remain constant at 40. Providers to practices will increase in YEARs 2 and 3 as firms 

enter the market for electronic health record applications. Thereafter, the number will 

decline as competition forces some firms out of the market and consolidation of other 

ones. For this analysis, DEA projects number of application providers for the first five 

years as follows.
44

Exhibit 4-25: Number of Application Providers

Providers to

Practice Offices

Providers to

Pharmacies

YEAR 1 170 40

YEAR 2 190 40

YEAR 3 200 40

YEAR 4 170 40

YEAR 5 150 40

DEA does not project number of application providers after YEAR 5. Providers to 

pharmacies remain constant at 40, and providers to practices will incur no costs after 

YEAR 5. There will be no initial audits after YEAR 3, because there will be no new 

providers after YEAR 3. The ongoing cost for these providers is the biennial audit. After 

five years, and the increasing use of electronic applications for medical purposes, 

providers to practice offices will have strong commercial reasons, apart from electronic 

prescriptions for controlled substances, for seeking and retaining certification of their 

applications. Costs for audits of pharmacy applications will continue because at present 

no organization certifies pharmacy applications nor is there reason to think that 

certification will develop.

Cost calculation:

Reprogramming of practice applications require 2,000 hours of work by an application 

provider engineer; for pharmacy applications, 1,000 hours. Hourly cost of the engineer is 

$92.10. Audits, both initial and ongoing, are $15,000 per audit for both practice and 

pharmacy applications.

Examples are offered for YEARs 1 and 3.

YEAR 1:

Reprogramming

Practice applications

170 x 2,000 x $92.10 = $31,313,493

Pharmacy applications

40 x 1,000 x $92.10 = $3,683,940

Initial audits (170 + 40)

210 x $15,000 = $3,150,000

YEAR 3:

No reprogramming

Initial audits for ten new providers to practices

10 x $15,000 = $150,000

Biennial audits

Practice applications

200 x $15,000 = $3,000,000

Pharmacy applications

40 x $15,000 = $600,000
45

Below are the undiscounted future projections of cost, as well as present values and 

annualized cost.

Exhibit 4-26: Undiscounted Future Values of Application Provider Costs

Reprogramming

Practices

Reprogramming

Pharmacies

Initial

Audits

Biennial

Audits

YEAR 1 $31,313,493 $3,683,940 $3,150,000 $0

YEAR 2 $0 $0 $300,000 $0

YEAR 3 $0 $0 $150,000 $3,600,000

YEAR 4 $0 $0 $0 $0

YEAR 5 $0 $0 $0 $2,850,000

YEAR 6 $0 $0 $0 $0

YEAR 7 $0 $0 $0 $600,000

YEAR 8 $0 $0 $0 $0

YEAR 9 $0 $0 $0 $600,000

YEAR 10 $0 $0 $0 $0

YEAR 11 $0 $0 $0 $600,000

YEAR 12 $0 $0 $0 $0

YEAR 13 $0 $0 $0 $600,000

YEAR 14 $0 $0 $0 $0

YEAR 15 $0 $0 $0 $600,000

Exhibit 4-27: Present and Annualized Values of Application Provider Costs

7.0 percent 3.0 percent

Reprogram

ming

Initial

Audits

Biennial

Audits

Reprogrammi

ng

Initial

Audits

Biennial

Audits

YEAR 1 $34,997,433 $3,150,000 $0 $34,997,433 $3,150,000 $0

YEAR 2 $0 $280,374 $0 $0 $291,262 $0

YEAR 3 $0 $131,016 $3,144,379 $0 $141,389 $3,393,345

YEAR 4 $0 $0 $0 $0 $0 $0

YEAR 5 $0 $0 $2,174,251 $0 $0 $2,532,188

YEAR 6 $0 $0 $0 $0 $0 $0

YEAR 7 $0 $0 $399,805 $0 $0 $502,491

YEAR 8 $0 $0 $0 $0 $0 $0

YEAR 9 $0 $0 $349,205 $0 $0 $473,646

YEAR 10 $0 $0 $0 $0 $0 $0

YEAR 11 $0 $0 $305,010 $0 $0 $446,456

YEAR 12 $0 $0 $0 $0 $0 $0

YEAR 13 $0 $0 $266,407 $0 $0 $420,828

YEAR 14 $0 $0 $0 $0 $0 $0

YEAR 15 $0 $0 $232,690 $0 $0 $396,671

Total $34,997,433 $3,561,390 $5,318,631 $34,997,433 $3,582,652 $5,925,533

Annualized $3,842,530 $391,021 $583,957 $3,842,530 $393,356 $650,592

Summary of costs

Exhibits 4-28 and 4-29 summarize the annualized costs by item and sector at 7 percent 

and 3 percent discount rate, respectively.
46

Exhibit 4-28: Annualized Costs by Item and by Sector--7.0 percent

Practitioners' Application

Offices Hospitals Pharmacies Providers Totals

Credential $14,669,488 $14,669,488

Credential application $3,844,882 $3,844,882

Registration check $30,405 $30,405

Granting access $303,086 $16,752 $319,838

Training for granting $7,147,886 $50,255 $7,198,142

Review security logs $4,248,868 $1,524,079 $1,959,040 $7,731,986

ID verification $4,717,580 $4,717,580

Reprogram 

applications $3,842,530 $3,842,530

Obtain certification $391,021 $391,021

Audit of applications $583,957 $583,957

Totals $30,244,615 $6,241,658 $2,026,046 $4,817,509 $43,329,829

Exhibit 4-29: Annualized Costs by Item and by Sector--3.0 percent

Practitioners' Application

Offices Hospitals Pharmacies Providers Totals

Credential $14,761,504 $14,761,504

Credential application $3,817,785 $3,817,785

Registration check $27,259 $27,259

Granting access $281,572 $12,781 $294,353

Training for granting $6,315,405 $38,342 $6,353,747

Review security logs $4,399,243 $1,518,215 $1,885,804 $7,803,262

ID verification $3,834,522 $3,834,522

Reprogram 

applications $3,842,530 $3,842,530

Obtain certification $393,356 $393,356

Audit of applications $650,592 $650,592

Totals $29,602,769 $5,352,737 $1,936,927 $4,886,478 $41,778,910

4.5 OPTIONS

4.5.1 Option 2 – Required Use of Biometrics

This is the same as Option 1, except that the two-factor authentication provision is 

changed to require a biometric identifier and a hard token. Passwords would not be 

permitted for authentication. The cost items are:

 Biometric readers for practitioners’ offices, hospitals, and clinics

 Software packages for practitioners’ offices and clinics

 Reprogramming of applications for hospitals

A biometric reader would be needed for every practitioner’s computer. DEA estimates 

that hospitals would need one for every 15 beds, and each clinic would need an average 
47

of two readers. DEA estimates 802,658 hospital beds31 with zero future growth (4,927 

community hospitals). The number of clinics is estimated at 7,485 with zero future 

growth. There are 20 firms providing applications to hospitals, and their number is not 

expected to change.

32

 All of these firms would reprogram their applications in YEAR 1. 

Costs of readers and software packages would be incurred as hospitals and clinics adopt 

electronic prescriptions for controlled substances. Hospital beds and clinics are phased 

into the analysis over five years at the rate shown for hospitals in Section 4.2. This is 

reflected in the following exhibit.

Exhibit 4-30: Phase-in of Hospital Beds and Clinics

Beds Clinics

YEAR 1 200,665 1,871

YEAR 2 200,665 1,871

YEAR 3 160,532 1,497

YEAR 4 160,532 1,497

YEAR 5 80,266 749

There are no costs for hospitals and clinics after YEAR 5. All reprogramming costs are 

in YEAR 1. Costs for practitioners’ offices and registrants extend over 15 years 

following the projected start-up of electronic prescriptions for controlled substances in 

practitioners’ offices and number of registrants in practitioners’ offices starting electronic 

prescriptions for controlled substances as shown in Exhibit 4-4 in Section 4.1.

A biometric reader that meets the requirements costs $114.00.33 The software package 

for clinics and offices is $86.00.34 Reprogramming of applications for hospitals would 

require 200 hours for an application provider’s engineer at $92.10 per hour. Cost is 

$18,420 per application provider.

Cost calculations:

YEAR 1:

Readers: 13,378 in hospitals; 3,743 in clinics, 34,964 in offices. Total: 52,084

x $113 = $5,937,560

Software packages: 18,257 in offices, 1,871 in clinics. Total: 

20,128 x $84 = $1,731,051

Reprogramming: 20 x $18,420 = $368,400

Total: $5,937,560 + $1,731,051 + $368,400 = $8,037,011

The following exhibit shows present value and annualized costs.

 

31

 American Hospital Association Fast Facts, community hospital beds.

32

 The estimate is based on the number of application providers that have obtained CCHIT certification for 

inpatient EHRs.

33

 Based on the cost of BioTouch 500, which is a separate reader. Where the reader is part of keyboard, 

the bundled reader and software is available for $200. The software cost was derived from this price.

34 http://secugen.com/purchase/store_us.htm, accessed 11/24/2008.
48

Exhibit 4-31: Present Value and Annualized Costs for Biometric Option

7.0 percent 3.0 percent

YEAR 1 $8,037,011 $8,037,011

YEAR 2 $10,862,145 $11,283,976

YEAR 3 $18,424,735 $19,883,569

YEAR 4 $17,750,891 $19,900,309

YEAR 5 $16,454,640 $19,163,490

YEAR 6 $8,085,656 $9,782,458

YEAR 7 $4,387,114 $5,513,892

YEAR 8 $2,278,677 $2,975,149

YEAR 9 $1,570,416 $2,130,037

YEAR 10 $1,502,772 $2,117,445

YEAR 11 $1,437,996 $2,104,861

YEAR 12 $1,375,970 $2,092,286

YEAR 13 $1,316,578 $2,079,722

YEAR 14 $1,259,712 $2,067,171

YEAR 15 $1,205,265 $2,054,634

Total $95,949,579 $111,186,009

Annualized $10,534,748 $9,313,672

Annualized plus Option 1 $53,864,576 $51,092,582

The cost of the biometrics requirement is additive to the interim final rule cost, since no 

other requirements are eliminated. 

4.5.2 Option 3 - Callbacks

Under this option the security requirements of the interim final rule are set aside and sole 

reliance for security is placed on a requirement that, on receipt of an electronic 

prescription for a controlled substance, a pharmacy must call the practitioner’s office for 

verification of the prescription. For the sake of simplicity, DEA has not included in this 

option estimates of the time that will be required to reprogram existing applications to 

conform to the basic information included on every controlled substance prescription. 

DEA has no basis for determining how many existing applications do not include or do 

not transmit all of this information. Similarly, there may be some pharmacy applications 

that will require reprogramming to incorporate the requirements for annotations. The 

costs of reprogramming, however, will be relatively small compared with the primary 

cost of this option.

The cost of this option depends on the number of prescriptions to be verified. There were 

461,172,000 controlled substance prescriptions in 2008.35 Annual growth rate has been 

3.0 percent. Therefore, DEA expects 475,007,160 prescriptions in YEAR 1 and growth 

thereafter at 3.0 percent annually. Of these prescriptions, 75.0 percent will be original 

prescriptions, requiring verification if electronic; the remainder are refills that are 

 

35

 In 2008, controlled substances represented 12.15% of the top 400 brand name and generic drugs sold at 

retail. The estimated number of controlled substance prescriptions is based on the assumption that 12% of 

all prescriptions (3.8431 billion according to IMS Health data) are for controlled substances.
49

authorized on the original prescription and require no contact between the pharmacy and 

practitioner.

Industry estimates indicate that 30 percent of original prescriptions generate callbacks to 

deal with formulary issues, requests to change to generic forms of the prescribed drug, 

illegibility, and other problems. Based on data from a 2004 Medical Group Management 

Association survey, 34 percent of callbacks on original prescriptions were for formulary 

issues, 31 percent were about generic drugs, and 35 percent were on other issues.36 The 

callback rate for controlled substance prescriptions is likely to be lower than 30 percent 

because more than 85 percent of controlled substance prescriptions are for generic drugs. 

Adjusting for a lower number of calls related to generic drugs, DEA estimates that 

currently 22 percent of controlled substance prescriptions require callbacks. The callback 

option applies only to new calls that would need to be placed, or 78 percent of the 

original prescriptions: 277,879,189 (0.78 x 0.75 x 475,007,160). For the 22 percent of 

prescriptions that already require callbacks, the confirmation would simply be part of a 

call that is being made anyway and, therefore, is not an additional cost. The number of 

electronic prescriptions each year requiring calls will be determined by the rate of 

adoption of electronic prescriptions for controlled substances.

Costs will be somewhat different between dentists’ and physicians’ offices. Taking 

physicians and dentists as a whole, 66.0 percent are physicians, and 34.0 percent are 

dentists.37 There are no available data on relative number of prescriptions from 

physicians and dentists. Nonetheless, it is certainly the case that dentists will originate 

prescriptions at a lower rate than physicians. For this analysis, DEA assumes that 

dentists prescribe at half the rate per practitioner as physicians. On that basis, 83.0 

percent of controlled substance prescriptions will be from physicians, 17.0 percent from 

dentists.

Number of calls, year by year, to physicians and dentists is shown in Exhibit 4-32.

Exhibit 4-32: Number of Calls to Physicians and Dentists

Incremental

calls

Calls to EPCS

offices Physicians Dentists

YEAR 1 277,879,189 16,672,751 13,816,271 2,856,481

YEAR 2 286,215,564 45,794,490 37,948,690 7,845,800

YEAR 3 294,802,031 106,128,731 87,946,090 18,182,642

YEAR 4 303,646,092 170,041,812 140,909,179 29,132,632

YEAR 5 312,755,475 237,694,161 196,970,903 40,723,258

YEAR 6 322,138,139 277,038,800 229,574,771 47,464,029

YEAR 7 331,802,283 301,940,078 250,209,805 51,730,273

YEAR 8 341,756,352 317,833,407 263,380,189 54,453,218

YEAR 9 352,009,042 330,888,500 274,198,602 56,689,898

YEAR 10 362,569,314 344,440,848 285,429,076 59,011,772

YEAR 11 373,446,393 358,508,537 297,086,601 61,421,937

YEAR 12 384,649,785 373,110,291 309,186,690 63,923,601

 

36

 http://www.mgma.com/WorkArea/DownloadAsset.aspx?id=19248, accessed 08/06/09.

37

 Mid-level practitioners also write prescriptions, but to be conservative, the analysis assigns these 

prescriptions to practitioners.
50

Incremental

calls

Calls to EPCS

offices Physicians Dentists

YEAR 13 396,189,278 388,265,493 321,745,407 66,520,085

YEAR 14 408,074,957 403,994,207 334,779,379 69,214,828

YEAR 15 420,317,205 420,317,205 348,305,819 72,011,386

At the pharmacy, a call requires three minutes of the time of a pharmacy technician. In a 

physician’s office it requires three minutes for a medical assistant and one minute for a 

physician; in a dentist’s office, a call requires three minutes for a dental assistant and one 

minute for a dentist. Costs per office and per pharmacy are shown in the following 

exhibit. Because the callback is only to confirm the prescription, it will not require the 

time that callbacks related to formulary, drug substitution, or contraindications take.

Exhibit 4-33: Costs for Callbacks by Office Type

Pharmacy Physician Office Dental Office

Time 3 minutes

pharmacy tech

3 minutes med. asst.

1 minute physician

3 minutes dent. asst.

1 minute dentist

Cost .05 x 27.99 .05 x 29.66 +

.017 x 192.16 

.05 x 34.28 +

.017 x 166.74 

Total cost $1.40 $4.69 $4.49

Cost calculation:

The calculation is the same for all years.

YEAR 1:

Pharmacies 16,672,751 x $1.40 = $23,330,257

Physicians 13,816,271 x $4.69 = $64,738,971

Dentists 2,856,481 x $4.49 = $12,833,952

Total cost: $100,903,179

Exhibit 4-34: Costs for Callbacks by Year Present Value and Annualized

7.0 percent 3.0 percent

YEAR 1 $100,903,179 $100,903,179

YEAR 2 $259,016,261 $269,075,145

YEAR 3 $561,000,172 $605,419,076

YEAR 4 $840,043,872 $941,763,006

YEAR 5 $1,097,440,492 $1,278,106,937

YEAR 6 $1,195,416,611 $1,446,278,903

YEAR 7 $1,217,630,938 $1,530,364,885

YEAR 8 $1,197,872,728 $1,563,999,278

YEAR 9 $1,165,491,283 $1,580,816,475

YEAR 10 $1,133,856,850 $1,597,633,671

YEAR 11 $1,102,958,833 $1,614,450,868

YEAR 12 $1,072,786,380 $1,631,268,065

YEAR 13 $1,043,328,425 $1,648,085,261

YEAR 14 $1,014,573,713 $1,664,902,458

YEAR 15 $986,510,832 $1,681,719,654

Total $13,988,830,568 $19,154,786,861

Annualized $1,535,922,056 $1,604,555,706
51

These are the total annualized costs of the callback option, as other security requirements 

are eliminated.

4.5.3 Summary of cost of options

The following summarizes annualized costs of the three options.

Exhibit 4-35: Annualized Costs by Option

7.0 percent 3.0 percent

Option 1 $43,329,829 $41,778,910

Option 2 – Required Use of Biometrics $53,864,576 $51,092,582

Option 3 – Callbacks $1,535,922,056 $1,604,555,706
52
53

CHAPTER 5: SMALL ENTITY ANALYSIS

Under the Regulatory Flexibility Act of 1980 (5 U.S.C. 601-612) (RFA), Federal 

agencies must evaluate the impact of rules on small entities and determine whether the 

rule will have a significant economic impact on a substantial number of small entities. 

This section discusses DEA’s analysis of the impact on small entities. DEA emphasizes 

that the rule is voluntary. No businesses are required to comply with this rule unless they 

elect to issue or process controlled substance prescriptions as electronic data files; 

practitioners and pharmacies have the option to continue to use paper and, for Schedule 

III-V substances, oral prescriptions.

5.1 CHARACTERISTICS OF SMALL ENTITIES

As discussed in previous chapters, the small entities directly affected by the rule are 

practitioners and, to a limited extent, pharmacies. The firms marketing services and 

software applications are not directly affected by the rule because they will recover their 

costs from practitioners and pharmacies. Exhibit 5-1 shows Small Business 

Administration’s standards for these firms.

Exhibit 5-1: SBA Definitions of Small Entities

Affected 

Entity Industry Description NAICS Code

Small Business Definition 

(sales in $)

Practitioner 

and MidLevel 

Practitioner

Offices of Physicians 62111 $10,000,000

Offices of Dentists 621210 $7,000,000

Institutional 

Practitioner

Hospitals 62211 $34,500,000

Freestanding Ambulatory Surgical and 

Emergency Centers 621493 $10,000,000

Pharmacy 

Pharmacies and Drug Stores 44611 $7,000,000

Supermarkets and Other

Grocery Stores 44511 $27,000,000

General Merchandise Stores 45291 $27,000,000

Mail Order Houses 454113 $25,000,000

Although some practitioners are part of large practices that may qualify as large 

businesses, so few practitioners fall into the large category that it is simpler to assume 

that they are all small entities. It is also the case that the application providers generally 

charge on a per practitioner basis rather than a per practice basis so that the costs may be 

considered as applying to individual practitioners. Mid-level practitioners are generally 
54

employed by a practice so their costs will be incurred by the practice, not the individual. 

They are not, therefore, small businesses.

The lowest starting compensation for a physician in private practice listed in the Medical 

Group Management 2008 Physician Compensation Survey was $130,000 for pediatrics.38

The 2002 Economic Census data indicate that the smallest physician practice (less than 

five employees) had average revenues of about $400,000 (2002 dollars). The American 

Dental Association states that the average net income of a dentist in private practice is 

$202,930 for a general practitioner. The average gross billings for a dentist in general 

practice per dentist are $670,100.

39

 For pharmacies, the 16,920 independent pharmacies 

are small entities; the other pharmacies belong to about 200 chains that are mostly large 

firms. There may be a few chains with fewer than 3 pharmacies, which could be small. 

In 2008, National Association of Chain Drug Stores data indicate that the average 

independent pharmacy had prescription sales of $2.58 million a year; average total sales 

are about $3.056 million.40

5.2 SMALL ENTITY COSTS

The costs to DEA registrants are relatively small. As discussed in Chapter 4, the initial 

costs to the smallest practitioner (in solo practice) will be about $400 ($110 for identity 

proofing and credential, and $290 in labor costs to complete the application, receive 

access control training, and set logical access controls). (Note that this cost is probably 

overstated because access control training for a very small office is unlikely to take an 

hour.) The main ongoing costs for the rule will be the renewal of the credential ($49 

every three years) and checking security logs ($22 per year) plus any incremental cost of 

the software or application. The initial costs for the basic rule elements represent about 

0.3 percent of the annual income of the lowest paid practitioner and 0.1 percent of 

average revenues. The ongoing costs are considerably lower. For practices with a 

physician and a mid-level practitioner, the costs would be lower because access control 

training would not need to involve the physician.

Determining the incremental cost of the application requirements per practitioner is 

difficult because it depends on the number of providers, the number of customers, the 

number of application requirements that an application provider does not already meet, 

and how costs are recovered (in the year in which the money is spent or over time). For 

example, an electronic health record application that had to reprogram to the full extent 

will have incremental application costs of $199,000 ($15,000 for the third-party audit and 

$184,000 for reprogramming). If the provider recovered the costs from its 1,000 

customers, the incremental cost to those customers will be $199 or about $17 a month. 

The costs in the out years will be much lower ($15,000 every two years) because no 

further programming is needed. Even if the provider did not add customers and 

 

38

 http://www.cejkasearch.com/compensation/amga_physician_compensation_survey.htm, accessed 

08/06/09. 

39 www.ada.org/ada/prod/survey/faq.asp, accessed 6/15/09.

40http://www.nacds.org/wmspage.cfm?parm1=507, accessed 6/17/2009.
55

continued to obtain a third-party audit rather than rely on certification, the incremental 

cost to practitioners will be less than a dollar a month. 

For pharmacies, the costs will be the incremental cost that their application provider 

charges to cover the costs of reprogramming and audits ($92,000 plus $15,000) plus the 

cost of reviewing the security log ($11.43 per year) and initial access control training and 

initial access control setting ($4.66). In the first year, if the application providers recover 

the programming costs and initial audit costs in a single year, the average incremental 

cost to a pharmacy for these two activities will be $65 ($4,284,900 first year cost divided 

by 65,421 pharmacies). The total first year cost will, therefore, be less than $100. After 

that, the incremental charge to recover the cost of the third-party audit will be $9 per 

pharmacy every two years, assuming the cost is evenly distributed across all pharmacies. 

The pharmacy will have continuing labor costs for reviewing security logs ($11.43). The 

first year charge represents less than 0.01 percent of an independent pharmacy’s annual 

sales. The annual cost is less than $0.01 per controlled substance prescription. It also 

represents a far lower cost than the pharmacy will pay its application provider to cover 

the SureScripts/RxHub or another intermediary for processing the prescriptions. 

According to comments DEA received to its notice of proposed rulemaking, 

SureScripts/RxHub charges a transaction fee of $0.3041 per electronic prescription to 

route and, where necessary convert, prescriptions to ensure that the pharmacy system will 

be able to capture the data electronically.

42 Based on National Association of Chain Drug 

Stores data on the average price of prescriptions ($71.69) and the average value of 

prescription sales, an independent pharmacy processes about 36,000 prescriptions a year 

and will have to pay about $10,800 to cover the transaction fee.43 

The average annualized cost to hospitals and clinics is about $180, which does not 

represent a significant impact. Most of the hospital tasks are part of their routine business 

practices related to credentialing. 

Application providers are not directly regulated by the rule and, therefore, are not 

covered by the requirements of the RFA. DEA notes, however, that the costs of the rule 

are not so high that any of these firms will not be able to recover them from their

customers. Reprogramming is a routine practice in the software industry; applications 

are updated with some frequency to add features and fix problems. The additional 

requirements of the rule can be incorporated during the update cycle. Many of these 

firms are already spending more than DEA has estimated to obtain CCHIT certification; 

in time, DEA expects that this certification (or a similar certification) will replace the 

third-party audit, further reducing their costs. 

 

41

 Comment from the Pharmacy Society of Rochester.

42

 SureScripts/RxHub and other intermediaries check records to ensure that the format meets the 

requirements of NCPDP SCRIPT. If the record was generated using a version of SCRIPT that differs from 

the version used by the receiving pharmacy, the intermediaries may translate the record so that the 

receiving pharmacy application can read it properly.

43 http://www.nacds.org/wmspage.cfm?parm1=507, accessed 6/17/09.
56

Based on the above analysis, DEA has determined that although the rule will impact a 

substantial number of small entities, it will not impose a significant economic impact on 

any small entity directly subject to the rule.
57

CHAPTER 6: BENEFITS

6.1 INTRODUCTION

Electronic prescriptions are widely expected to reduce errors in medication dispensing 

because they will eliminate illegible written prescriptions and misunderstood oral 

prescriptions. They are also expected to reduce the number of callbacks from pharmacy

to practitioner to address legibility, formulary, and contraindication issues. Electronic 

prescriptions may also reduce processing time at the pharmacy and wait time for patients. 

These benefits are likely to be mitigated to some extent. As a Rand study suggested, 

practitioners may fail to review the prescription and notice errors that occur when the 

wrong item is selected from one or more drop-down menus; pharmacists may be less 

likely to question a legible electronic prescription.44 The formulary and contraindication 

checks are functions that practitioners sometimes disable because they do not work as 

they should or take too much time.45 The contraindication checks do not always work as 

intended.46 In addition, recent studies indicate that electronic prescriptions sometimes are 

missing information, particularly directions for use and dosing errors.47 Nonetheless, 

electronic prescriptions may provide benefits in avoided medication errors, reduced 

processing time, and reduced callbacks. These benefits of electronic prescriptions are not 

directly attributable to this rule except to the extent the rule facilitates implementation of 

electronic prescribing of controlled substances.

6.2 QUANTIFIED BENEFITS

DEA has quantified three types of benefits: reduced number of callbacks to clarify 

prescriptions, the reduction in wait time for patients picking up prescriptions, and the 

cost-savings pharmacies will realize from eliminating storage of paper records. One of 

the greatest burdens in the paper system is the need for callbacks to clarify prescriptions. 

Clarifications and changes may be required for several reasons: the prescription is not 

legible; required information is not included on the prescription; the prescribed dosage 

unit does not exist; the particular medication is not approved by the patient’s health 

insurance; and the drug prescribed is contraindicated because it reacts with other 

medications the patient is taking or because it negatively affects other conditions from 

which the patient suffers. Each callback involves the pharmacy staff and one or more 

 

44 Bell, D.S. et al., ―Recommendations for Comparing Electronic Prescribing Systems: Results of An 

Expert Consensus Process,‖ Health Affairs, May 25, 2004, W4-305-317.

45 Grossman, Joy M. et al., ―Physicians’ Experiences Using Commercial E-Prescribing Systems,‖ Health 

Affairs, 26, no. 3 (2007), w393-w404.

46 Fernando, B. et al., ―Prescribing safety features of general practice computer systems: evaluation using 

simulated test cases.‖ BMJ 2004;328: 1171-3.

47

 Warholak, TL, Rupp, MT, ―Analysis of community chain pharmacists’ interventions on electronic 

prescriptions.‖ Journal of American Pharm Association, 2009, Jan-Feb; 49(1): 59-64. 

Astrand et al., ―Assessment of ePrescription Quality: an observational study at three mail order 

pharmacies.‖ BMC Med Inform Decis Mak, 2009 Jan 26; 9:8. 
58

staff at the practitioner’s office, often including the practitioner. Electronic prescriptions 

will eliminate illegible prescriptions and could eliminate those with missing information 

or unavailable dosage units or forms. A recent study of pharmacy experience with eprescriptions, however, found that the most common reason for pharmacy intervention 

for these prescriptions was missing information, especially missing directions.48 Some of 

the problem could be solved if applications made the required information mandatory for 

transmission. The missing directions problem may be resolved once a standard format 

and codes are developed for directions.

Whether formulary and contraindication callbacks are eliminated will depend on the 

functions of the electronic prescription applications and the accuracy of the drug 

databases that they use. A study of physicians’ use of electronic prescribing found that 

the number of formularies, some of which are specific to a particular company, made the 

use of the function frustrating.49 A study of four applications used by about 75 percent of 

general practitioners in Great Britain found that none identified as many as half of the 

contraindications tested and three of the four applications identified less than 25 percent 

of them.50 

The public is also affected by the current system. For the majority of controlled 

substance prescriptions, the patient (or someone acting for the patient) presents a paper 

prescription to the pharmacy and then waits for the pharmacy to fill it. The time between 

the point when the prescription is handed to the pharmacist and the point when it is ready 

for pick-up is a cost to the public.

To estimate the part of these benefits that may accrue to the rule, DEA has estimated the 

number of controlled substance prescriptions that may require callbacks. Although there 

are widely varying estimates for callbacks, the best available data, based on the operation 

of the two largest mail order prescription pharmacies, support an estimate of 30 percent 

of original prescriptions.51 As discussed in Chapter 4, DEA has reduced this to 22 

percent for controlled substances because calls related to switching to generic forms 

make up about 31 percent of all callbacks on original prescriptions and more than 85 

percent of controlled substance prescriptions are already for generic drugs. 

The percentage of callbacks that will be eliminated by electronic prescribing is unclear.52 

Electronic prescriptions should eliminate callbacks related to illegible prescriptions, but 

 

48 Warholak, TL, Rupp, MT, ―Analysis of community chain pharmacists’ interventions on electronic 

prescriptions.‖ Journal of American Pharm Association, 2009, Jan-Feb; 49(1): 59-64.

49

 Grossman, Joy M. et al., ―Physicians’ Experiences Using Commercial E-Prescribing Systems,‖ Health 

Affairs, 26, no. 3 (2007), w393-w404.

50 Fernando, B. et al., ―Prescribing safety features of general practice computer systems: evaluation using 

simulated test cases.‖ BMJ 2004;328: 1171-3.

51 ―Company Pushes the Envelope to Get Prescriptions in the Mailbox,‖ St. Petersburg Times, September 

15, 2002. Story reports on Medco’s mail order pharmacy operation. Barrett Toan, CEO of Express Scripts, 

also reported a 30 percent callback rate. Express Scripts and Medco process about 600 million 

prescriptions.

52

 See the report on HHS’s pilot testing of electronic prescription standards, where various testers reported 

declines in callbacks or no change. 
59

may not eliminate calls related to missing information if the applications allow a 

prescription to be transmitted without all of the information.53 Formulary callbacks could 

be reduced if the practitioner uses that function and if the application can access the 

correct formulary. As noted above, some research has found that the number of 

formularies that are specific to a single company can make it difficult to ensure that the 

correct data are used. The ability to identify contraindications requires up-to-date and 

comprehensive databases and a complete list of other medications that the patient is 

taking and of the patient’s other medical conditions. Even when every patient has an 

EHR and these are interoperable, it is likely that some information will not be included, 

such as over-the-counter drug use, which will limit the ability to identify all 

contraindications. 

The Centers for Medicare and Medicaid Services, in its November 16, 2007, proposed 

rule on formulary and generic transactions estimated a 25 percent reduction in time spent 

on callbacks.54 DEA similarly assumes that callbacks will be reduced by 25 percent. For 

these callbacks, which require more effort than the simple confirmation required for 

Option 3, DEA used the time estimates from the MGMA survey (6.9 minutes of staff 

time per call and 4.2 minutes of practitioner time).55

The analysis of avoided callbacks as benefits must be consonant with the treatment of 

callbacks as costs (Chapter 4, Section 4.5). Costs are different for a pharmacy ($3.22), 

for a physician’s office ($21.18), and for a dentist’s office ($15.69). For this purpose, 

DEA assumes that dentists prescribe at 50.0 percent of the per-capita rate of physicians. 

The result for the analysis is an estimate of 83.0 percent of prescriptions coming from 

physicians’ offices and 17.0 percent from dentists’ offices.

Exhibit 6-1 presents the annualized undiscounted cost-savings from callbacks avoided 

over the 15 year implementation period. Exhibit 6-2 presents the present value of the 

costs at 7.0 and 3.0 percent discount rates.

Exhibit 6-1: Cost Savings of Callbacks Avoided

Year # Callbacks

# 

Callbacks 

Avoided

Cost Savings

Pharmacies Physicians Dentists Total

YEAR 1 78,376,181 1,175,643 $3,783,689 $20,631,845 $3,160,286 $27,575,819

YEAR 2 80,727,467 3,229,099 $10,392,533 $56,668,801 $8,680,251 $75,741,584

YEAR 3 83,149,291 7,483,436 $24,084,694 $131,329,945 $20,116,482 $175,531,121

YEAR 4 85,643,770 11,990,128 $38,589,032 $210,419,757 $32,231,074 $281,239,863

YEAR 5 88,213,083 16,760,486 $53,941,955 $294,136,760 $45,054,437 $393,133,151

YEAR 6 90,859,475 19,534,787 $62,870,768 $342,824,134 $52,512,132 $458,207,034

 

http://healthit.ahrq.gov/portal/server.pt/gateway/PTARGS_0_1248_227312_0_0_18/eRxReport_041607.pd

f

53 DEA’s rule requires the application to be capable of including all of the required information, but places 

the responsibility on the practitioner to ensure that all of the information is included.

54

 72 FR 64900, November 16, 2007. 

55

 http://www.mgma.com/WorkArea/DownloadAsset.aspx?id=19248, accessed 08/06/09.
60

Year # Callbacks

# 

Callbacks 

Avoided

Cost Savings

Pharmacies Physicians Dentists Total

YEAR 7 93,585,259 21,290,647 $68,521,826 $373,638,443 $57,232,118 $499,392,387

YEAR 8 96,392,817 22,411,330 $72,128,634 $393,305,785 $60,244,665 $525,679,085

YEAR 9 99,284,602 23,331,881 $75,091,337 $409,460,926 $62,719,231 $547,271,495

YEAR 10 102,263,140 24,287,496 $78,166,887 $426,231,400 $65,288,051 $569,686,338

YEAR 11 105,331,034 25,279,448 $81,359,387 $443,639,588 $67,954,552 $592,953,527

YEAR 12 108,490,965 26,309,059 $84,673,087 $461,708,659 $70,722,284 $617,104,030

YEAR 13 111,745,694 27,377,695 $88,112,386 $480,462,598 $73,594,921 $642,169,905

YEAR 14 115,098,065 28,486,771 $91,681,836 $499,926,236 $76,576,267 $668,184,339

YEAR 15 118,551,007 29,637,752 $95,386,153 $520,125,276 $79,670,257 $695,181,686

Exhibit 6-2: Present Value and Annualized Cost Savings for Callbacks

Year 7.0 percent 3.0 percent

YEAR 1 $27,575,819 $27,575,819

YEAR 2 $70,786,527 $73,535,519

YEAR 3 $153,315,679 $165,454,917

YEAR 4 $229,575,503 $257,374,315

YEAR 5 $299,919,399 $349,293,713

YEAR 6 $326,695,282 $395,253,412

YEAR 7 $332,766,234 $418,233,262

YEAR 8 $327,366,514 $427,425,202

YEAR 9 $318,516,993 $432,021,171

YEAR 10 $309,871,622 $436,617,141

YEAR 11 $301,427,506 $441,213,111

YEAR 12 $293,181,679 $445,809,081

YEAR 13 $285,131,118 $450,405,051

YEAR 14 $277,272,745 $455,001,021

YEAR 15 $269,603,444 $459,596,991

Total $3,823,006,064 $5,234,809,727

Annualized $419,745,516 $438,502,110

Assuming that electronic controlled substance prescriptions phase in over 15 years, as 

described above, the annualized time-saving for eliminating 25 percent of these callbacks 

would be $420 million (at 7% discount) or $439 million (at 3% discount). It should be 

noted that these savings will not be realized unless there is either productive work that is 

currently not being done that can be done in the time saved or the time savings are great 

enough to eliminate staff positions.

Electronic prescriptions could also reduce the patient’s wait time at the pharmacy. The 

number of original controlled substance prescriptions that could require public wait time 

is based on the estimated number of original prescriptions (approximately 356 million in 
61

2009), reduced by 19 percent, to account for those prescriptions phoned to the 

pharmacy56 plus another 14 percent to remove those that are currently filled by mail order 

pharmacies or long-term care facilities.57 Assuming the average wait time is 15 minutes 

for the 81 percent of original prescriptions that are presented on paper to retail 

pharmacies (not mail order or long-term care prescriptions), at the current United States 

average hourly wage ($20.49)58, Exhibit 6-3 presents the annualized estimates.

Exhibit 6-3: Costs Savings for Public Wait Time

Year

Original Paper 

Prescriptions

Paper Prescriptions 

Avoided Hours Saved Cost-Savings

YEAR 1 247,584,365 14,855,062 3,713,765 $76,095,055

YEAR 2 255,011,896 40,801,903 10,200,476 $209,007,750

YEAR 3 262,662,253 94,558,411 23,639,603 $484,375,461

YEAR 4 270,542,121 151,503,587 37,875,897 $776,077,127

YEAR 5 278,658,384 211,780,372 52,945,093 $1,084,844,955

YEAR 6 287,018,136 246,835,597 61,708,899 $1,264,415,344

YEAR 7 295,628,680 269,022,099 67,255,525 $1,378,065,700

YEAR 8 304,497,540 283,182,712 70,795,678 $1,450,603,444

YEAR 9 313,632,466 294,814,518 73,703,630 $1,510,187,370

YEAR 10 323,041,440 306,889,368 76,722,342 $1,572,040,789

YEAR 11 332,732,684 319,423,376 79,855,844 $1,636,246,245

YEAR 12 342,714,664 332,433,224 83,108,306 $1,702,889,191

YEAR 13 352,996,104 345,936,182 86,484,045 $1,772,058,092

YEAR 14 363,585,987 359,950,127 89,987,532 $1,843,844,527

YEAR 15 374,493,567 374,493,567 93,623,392 $1,918,343,295

Total $16,760,751,048

The annualized savings over 15 years would be $1.08 billion (at 7% discount) or $1.1 

billion (at 3% discount). 

The estimate for public wait time is an upper bound, as such it is not included in the 

primary estimate for the benefits of the rule. It assumes that the practitioner will transmit 

the prescription and that the pharmacist will open the record and fill it before the patient 

arrives at the pharmacy. Recent research on electronic prescriptions found that 28 

percent of electronic prescriptions transmitted were never picked up by patients; for 

painkillers, more than 50 percent were not picked up.59 If pharmacies prepared electronic 

prescriptions before the patient arrives, the pharmacy will have spent time for which it 

will not be reimbursed if the patient does not pick up the prescription and will spend 

further time returning the drugs to stock and correcting records. It is possible, therefore, 

that pharmacies will not be willing to fill prescriptions until they are certain that the 

 

56 A 1999 Drugtopics.com survey indicated that 36% of all prescriptions were phoned in; because refills are 

usually authorized on the original prescription and do not require second calls, and slightly less than half of 

prescriptions are refills, the analysis uses 19% for phoned in prescriptions. 

57 Based on IMS Health 2008 channel distribution by U.S. dispensed prescriptions. http://imshealth.com, 

accessed June 16, 2009.

58 BLS, ―Employer Costs for Employee Compensation,‖ December 2008, March 12, 2009. Table 2. All 

civilian workers.

59

 Solomon, M. and S. R. Majumdar. ―Primary Non-adherence of Medications: lifting the veil on 

prescription-filling behaviors,‖ Journal of General Internal Medicine, March 2, 2010.
62

patient wants to fill the prescription. The primary estimate for public wait time, 

therefore, is zero.

Exhibit 6-4 presents the annualized benefits at a 7.0 percent and 3.0 percent discount rate. 

Exhibit 6-4: Annualized Gross Benefits

7% 3%

Callbacks Avoided $419,745,516 $438,502,110

These benefits are gross rather than net benefits, but it is not possible to compare these 

cost-savings to the costs of the rule or to estimate net benefits. These savings will accrue 

to any electronic prescription application. The only way to assess net benefits is to 

compare them with the costs of the full application and its implementation, not the 

incremental costs of DEA’s requirements.

DEA has not attempted to estimate the cost of changing from paper prescriptions to 

electronic prescriptions for several reasons. First, electronic prescription applications 

will be part of larger electronic health record applications; the subsidies provided under 

the American Recovery and Reinvestment Act apply only to electronic health record 

applications, which is likely to eliminate the use of stand-alone electronic prescription 

applications. It is unclear what part of the cost of an electronic health record application 

and its implementation should be assigned to electronic prescribing. EHR purchase costs 

have been estimated at between $99,000 to $180,000 for a three-doctor practice with twoyear maintenance costs of between $24,750 and $45,000.60

 A University of California 

health economist estimated the total cost of installing and running EHRs at hospitals, 

long term care facilities, and practices at $150 billion over 8 years.61 These estimates do 

not include the cost of training office staff and the cost of migrating existing records to 

the EHR application. Most of these costs are not specific to electronic prescriptions, but 

apportioning costs among the various functions of an EHR is not feasible. 

Second, the costs of the applications and implementation alone do not address 

distributional issues that arise from the shift to electronic health record applications. 

With paper prescriptions, formulary and contraindication issues are usually dealt with by 

the pharmacist. If practitioners use these functions of their electronic prescription 

application, the time currently spent by the pharmacists will shift to practitioners. That is 

an increased cost to the practitioner, a time-savings for the pharmacy, and an increased 

cost to the system as a whole because a practitioner’s time is generally more expensive 

than a pharmacist’s or pharmacy technician’s time. The studies of electronic prescribing 

have identified savings, but these savings accrue mainly to insurance companies because 

of formulary adherence and secondarily to patients, in the form of lower costs for 

formulary and generic drugs. Neither the pharmacy nor the practitioner, who incurs the 

 

60

 Pricewaterhouse Coopers Health Research Institute, ―Rock and a Hard Place: An analysis of the $36 

billion impact from health IT stimulus funding,‖ May 2009. 

61

 Robert Miller, quoted at http://govhealthit.com/articles/2008/07/nationwide-ehr-implementation-pricetag-estimated-at-150-billion.aspx, accessed June 22, 2009.
63

highest costs, benefit from electronic prescribing except to the extent that it reduces 

callbacks and, for the pharmacies, reduces data entry costs. 

Third, the cost estimates do not include the processing fees associated with the use of 

intermediaries (indicated to be $0.30 per prescription by a commenter to DEA’s notice of 

proposed rulemaking) and the cost to the pharmacy of filling prescriptions that are not 

picked up. If patients fail to pick up prescriptions transmitted electronically at the same 

rate they are assumed to fail to fill paper prescriptions, the costs to pharmacies could be 

high. In its comments on the proposed rule, the National Community Pharmacists 

Association stated that it costs a pharmacy $10.98 to fill a prescription. If the timesavings associated with electronic prescriptions (less data entry, fewer callbacks) are 

simply offset by the processing fee and the time associated with returning the drugs to 

stock and correcting the electronic records, the cost of filling the electronic prescriptions 

for controlled substances that are currently issued on paper, but never presented to 

pharmacies could be more than $1 billion a year.62

Pharmacy Cost Savings

Pharmacies are required to retain all original controlled substance prescriptions, including 

oral prescriptions that the pharmacist reduces to writing, on paper for two years. As 

electronic prescriptions replace paper records, pharmacies will be able to eliminate the 

file cabinets, freeing up space for other uses. The annualized cost of a prescription file 

cabinet is $78.50 ($715 annualized over 15 years at 7%); the cost of the floor space is 

$55.34 per cabinet (2.77 square feet times $20/square feet rental price for retail space). 

Exhibits 6-5 through 6-7 present the number of prescriptions that would have to be stored 

with and without the rule, the costs associated with the storage, and the annualized cost 

savings.

Exhibit 6-5: Estimated Prescription Paper Records

Original 

Prescriptions

Electronic 

Prescriptions

Paper 

Prescriptions 

Stored with 

Rule

Paper 

Prescriptions 

Stored 

without Rule

YEAR 1 356,255,370 21,375,322 680,759,048 702,134,370

YEAR 2 366,943,031 58,710,885 643,112,194 723,198,401

YEAR 3 377,951,322 136,062,476 550,120,992 744,894,353

YEAR 4 389,289,862 218,002,323 413,176,385 767,241,184

YEAR 5 400,968,558 304,736,104 267,519,993 790,258,419

YEAR 6 412,997,614 355,177,948 154,052,120 813,966,172

YEAR 7 425,387,543 387,102,664 96,104,545 838,385,157

YEAR 8 438,149,169 407,478,727 68,955,321 863,536,712

YEAR 9 451,293,644 424,216,025 57,748,060 889,442,813

 

62

 Estimated using the phase-in of controlled substances and assuming a $0.25 processing fee per 

controlled substance prescription and 20% of the prescriptions written being unfilled (2006 study by 

Cutting Edge Information, ―Patient Compliance, Disease Management and Consumer Outreach) at 

$12/prescription to fill, return to stock, and correct records. Cost annualized at 7% over 15 years is $1.057 

billion.
64

Original 

Prescriptions

Electronic 

Prescriptions

Paper 

Prescriptions 

Stored with 

Rule

Paper 

Prescriptions 

Stored 

without Rule

YEAR 10 464,832,453 441,590,831 50,319,241 916,126,097

YEAR 11 478,777,427 459,626,330 42,392,720 943,609,880

YEAR 12 493,140,750 478,346,527 33,945,320 971,918,177

YEAR 13 507,934,972 497,776,273 24,952,922 1,001,075,722

YEAR 14 523,173,021 517,941,291 15,390,430 1,031,107,994

YEAR 15 538,868,212 538,868,212 5,231,730 1,062,041,234

Exhibit 6-6: Estimated Prescription Storage Cost with and without Electronic 

Prescriptions

Cost

Cost 

Savings

With Rule Without Rule

YEAR 1 $1,446,253 $1,491,664 $45,411

YEAR 2 $1,366,273 $1,536,414 $170,141

YEAR 3 $1,168,716 $1,582,507 $413,790

YEAR 4 $877,781 $1,629,982 $752,201

YEAR 5 $568,339 $1,678,881 $1,110,543

YEAR 6 $327,279 $1,729,248 $1,401,969

YEAR 7 $204,171 $1,781,125 $1,576,954

YEAR 8 $146,494 $1,834,559 $1,688,065

YEAR 9 $122,684 $1,889,596 $1,766,912

YEAR 10 $106,902 $1,946,284 $1,839,382

YEAR 11 $90,062 $2,004,672 $1,914,610

YEAR 12 $72,116 $2,064,812 $1,992,697

YEAR 13 $53,012 $2,126,757 $2,073,745

YEAR 14 $32,697 $2,190,559 $2,157,863

YEAR 15 $11,115 $2,256,276 $2,245,162

Total $21,149,444

Exhibit 6-7: Annualized and Discount Value of Reduced Storage Cost

7.0 percent 3.0 percent

YEAR 1 $45,411 $45,411

YEAR 2 $170,141 $170,141

YEAR 3 $386,720 $401,738

YEAR 4 $657,001 $709,021

YEAR 5 $906,534 $1,016,304

YEAR 6 $1,069,555 $1,245,631

YEAR 7 $1,124,346 $1,360,294

YEAR 8 $1,124,829 $1,413,728

YEAR 9 $1,100,344 $1,436,661

YEAR 10 $1,070,537 $1,452,025

YEAR 11 $1,041,421 $1,467,389

YEAR 12 $1,012,986 $1,482,753

YEAR 13 $985,221 $1,498,117

YEAR 14 $958,117 $1,513,482

YEAR 15 $931,662 $1,528,846
65

7.0 percent 3.0 percent

Total 12,584,826 16,741,542

Annualized $1,381,746 $1,402,382

6.3 QUALITATIVE BENEFITS

DEA is establishing additional security requirements for electronic controlled substance 

prescriptions to ensure that electronic prescriptions for controlled substances do not 

become an easy route for widespread and undetectable diversion of controlled substances. 

Properly secure electronic prescription applications have the potential to reduce 

prescription forgeries, which will protect practitioners from identity theft and misuse of 

their DEA registration numbers by practice staff and others. Secure pharmacy systems 

may help identify diversion that occurs at pharmacies.

DEA has not attempted to quantify or monetize the benefits of the rule that relate to 

diversion because of a lack of data on the extent of diversion of controlled substances 

through forged or altered prescriptions and alteration of pharmacy records. These 

benefits are, however, discussed qualitatively in this section. The immediate cost of 

misuse of prescription controlled substances is also reviewed in terms of data on deaths 

and emergency room (ER) visits that result from nonmedical use of these drugs.

6.3.1 Reduction in Controlled Substance Prescription Forgery

Controlled substances are diverted in a number of ways, some of which will not be 

affected by electronic prescriptions. For example, diversion occurs when:

 Controlled substances are stolen from practitioners and pharmacies or in 

transit. 

 Practitioners knowingly write non-legitimate prescriptions.

 Practitioners write prescriptions for people who have lied about symptoms to 

obtain the drugs. A commonly used term for these patients is ―doctor 

shoppers,‖ people who routinely visit different doctors with the same ailment 

to obtain multiple prescriptions for controlled substances, usually pain 

relievers. These prescriptions are then filled at various pharmacies and the 

drugs are abused or sold on the illicit market. 

Although DEA does not expect the rule to eliminate these problems, it may act as a 

deterrent to practitioners who write non-legitimate prescriptions and to doctor shoppers 

because it will be easier for States to monitor prescriptions when they are electronic

through the use of State prescription monitoring programs. Digitally signed prescription 

records will make it very difficult for a practitioner to claim that a prescription has been 

forged or altered. Many States are already using prescription drug monitoring programs 

to identify practitioners who prescribe unusual quantities of controlled substances and 

patients filling multiple prescriptions at different pharmacies. 
66

Electronic prescriptions for controlled substances will directly affect the following types 

of diversion:

 Stealing prescription pads or printing them, and writing non-legitimate 

prescriptions.

 Altering a legitimate prescription to obtain a higher dose or more dosage units 

(e.g., changing a ―10‖ to a ―40‖).

 Phoning in non-legitimate prescriptions late in the day when it is difficult for a 

pharmacy to complete a confirmation call to the practitioner’s office.

 Altering a prescription record at the pharmacy to hide diversion from 

pharmacy stock.

These are examples of prescription forgery that contribute significantly to the overall 

problem of drug diversion. DEA expects this rule to reduce significantly these types of 

forgeries because only practitioners with secure prescription-writing applications will be 

able to issue electronic prescriptions for controlled substances and because any alteration 

of the prescription at the pharmacy will be discernible from the audit log and a 

comparison of the digitally signed records. DEA expects that over time, as electronic 

prescribing becomes the norm, practitioners issuing paper prescriptions for controlled 

substances may find that their prescriptions are examined more closely.

6.3.2 Cost of Diversion and Abuse of Prescription Drugs

A reduction in forged controlled substance prescriptions could result in a reduction in 

drug-related deaths and medical care. The 2008 National Survey on Drug Use and 

Health (NSDUH) found that 6.2 million people in the United States currently use 

prescription-type therapeutic drugs for nonmedical reasons.63 This nonmedical use of 

prescription drugs can lead to death and emergency room visits. The Substance Abuse 

and Mental Health Services Administration (SAMHSA) runs the Drug Abuse Warning 

Network (DAWN), a public health surveillance system that monitors drug-related visits 

to hospital emergency departments and drug-related deaths investigated by medical 

examiners and coroners. SAMHSA reported that in 2003, in six States (Maine, 

Maryland, New Hampshire, New Mexico, Utah, and Vermont) there were 352 deaths 

from misuse of oxycodone and hydrocodone, both prescription controlled substances.64 

In the latest data, Drug Abuse Warning Network (DAWN), 2006: National Estimates of 

Drug-Related Emergency Department Visits65, SAMHSA estimates that about 741,000 

 

63 Substance Abuse and Mental Health Services Administration. (2009). Results from the 2008 National 

Survey on Drug Use and Health: National Findings (Office of Applied Studies, NSDUH Series H-36, 

DHHS Publication No. SMA 09-4434). Rockville, MD. 

http://www.oas.samhsa.gov/nsduh/2k8nsduh/2k8Results.pdf

64 The DAWN Report – Opiate-related Drug Misuse Deaths in Six States, 2003. Issue 19, 2006.

65 Substance Abuse and Mental Health Services Administration, Office of Applied Studies. Drug Abuse 

Warning Network, 2006: National Estimates of Drug-Related Emergency Department Visits. DAWN 

Series D-30, DHHS Publication No. (SMA) 08-4339, Rockville, MD, 2007. http://dawninfo.samhsa.gov/.
67

emergency department visits involved nonmedical use of prescription or over-the-counter 

drugs or dietary supplements, a 38 percent increase over 2004. Of the 741,000 visits, 

195,000 involved benzodiazepines (Schedule IV) and 248,000 involved opioids 

(Schedule II and III). Overall, controlled substances represented 65 percent of the 

estimated emergency department visits. Between 2004 and 2006, the number of visits 

involving opioids increased 43 percent and the number involving benzodiazepines 

increased 36 percent. Of all visits involving nonmedical use of pharmaceuticals, about 

224,000 resulted in admission to the hospital; about 65,000 of those individuals were 

admitted to critical care units; 1,574 of the visits ended with the death of the patient. 

More than half of the visits involved patients 35 and older. 

Using a value per life of $5.8 million, the costs of the 2003 deaths from misuse of 

prescription controlled substances in the six States is more than $2 billion.66 The cost of 

the 2006 emergency room visits is above $350 million (at $1,000 per visit), not including 

the cost of further in-patient care for those admitted. These costs are some fraction of the 

total cost to the nation. DEA has no basis for estimating what percentage of these costs 

could be addressed by the rule. If, however, the rule prevents even a small fraction of the 

deaths and emergency care the benefits will far exceed the costs. DEA notes that, at 7.0 

percent, the total annualized cost of the rule is $35 million.

These costs also do not represent all of the costs of drug abuse to society. Drug abuse is 

associated with crime and lost productivity. Crime imposes costs on the victims as well 

as on government. DEA does not track information on controlled substance prescription 

drug diversion because enforcement is generally handled by State and local authorities. 

The cost of enforcement is, however, considerable. In 2007, DEA spent between $2,700 

for a small case and $147,000 for a large diversion case just for the primary investigators; 

adjudication costs and support staff are additional. It is reasonable to assume that State 

and local law enforcement agencies are spending similar sums per case. Some cases 

involve multiple jurisdictions, all of which bear costs for collecting data and deposing 

witnesses. The rule could reduce the number of cases and, therefore, reduce the costs to 

governments at all levels. A reduction in forgeries will also benefit practitioners who 

will be less likely to be at risk of being accused of diverting controlled substances and of 

then having to prove that they were not responsible.

6.3.3 Medication Errors

Reducing adverse drug events that result from medication errors is frequently cited as a 

benefit of electronic prescriptions. Illegible prescriptions and misunderstood oral 

prescriptions can result in the dispensing of the wrong drug, which may cause medical 

problems and, at the very least, fails to provide the treatment a practitioner has 

determined is necessary. Once a practitioner has access to a patient’s complete 

medication list, electronic prescription applications hold the promise of identifying 

contraindication problems so that a patient is not prescribed drugs that taken together 

 

66

 The DAWN mortality data from 2005 indicate that almost 4,900 people died with prescription opioids in 

their bloodstream; about 600 were not using any other drug or alcohol. These numbers, however, do not 

indicate how many of the people were using the drugs for non-medical purposes.
68

cause health problems or cancel the benefits. Allergy alerts will also warn practitioners 

of potential medication concerns.

DEA has not attempted to estimate the extent of these benefits for two reasons. First, 

there are few data that indicate the extent of the problem as it relates to prescriptions. 

The data most frequently cited on medication errors and adverse drug events (1.5 million 

preventable adverse drug events) are from two literature reviews conducted by the 

Institute of Medicine.67 Similarly, a 2008 review of studies found fewer errors with 

electronic medication orders, but at least 24 of the 27 studies reviewed covered only 

inpatient medication orders, which DEA does not regulate.68 69 Many of the studies cover 

errors that will not be addressed by electronic prescribing, such as inpatient 

administration errors (i.e., either the chart was incorrect or the chart was correct, but the 

wrong drug or dosage was administered or the drug was given to the wrong patient), 

pharmacy dispensing errors (i.e., the prescription was correct, but the wrong drug was 

given to the patient), failure to include the dosage or other information on the label, and 

failure to include informational inserts with the dispensed drug. All of these may cause 

adverse drug events, but will not be addressed by electronic prescribing. Other errors, 

such as selection of the wrong dose, wrong drug, or wrong frequency of use, may or may 

not be addressed by electronic prescribing. 

DEA has no basis to determine what number of adverse drug events could be prevented 

by the use of an electronic prescription application. In addition, the assumption that the 

use of electronic prescription applications will alert practitioners to contraindications and 

allergies is based on the assumption that the patient’s medical record will be complete. 

Although this may be the case when every patient has an EHR and all of the applications 

are interoperable so that a practitioner can access pharmacy records, until that time the 

medical record will be only as complete as the patient is willing or able to make it, which 

will limit the ability of the application to alert the practitioner to potential problems. In 

addition, as discussed above, programming applications to identify drug interactions and 

contraindications is difficult and many such problems may not be identified. For 

allergies, DEA has not been able to identify any data that disaggregates those allergic 

reactions that should have been known and those that are only discovered when the 

patient takes the drug for the first time. Similarly, until EHRs have databases that link 

drug names to diagnostic codes and dosage units to age and weight, the applications will 

have no way to prevent a practitioner from issuing a prescription with an inappropriate 

drug name or dosage. 

Second, the use of electronic prescription applications and transmission systems may 

introduce errors. Keystroke and data entry errors may replace some of the errors that 

occur with illegible handwriting. A comment on the proposed rule from a State 

 

67

 ―To Err is Human: Building a Safer Health System,‖ IOM 2000; ―Preventing Medication Errors,‖ IOM 

2007. www.nap.edu. 

68

 Ammenwerth et al. ―The Effect of Electronic Prescribing on Medication Errors and Adverse Drug 

Events: A Systematic Review.‖ Jour. Am. Medical Informatics Assn., June 25, 2008. 

69

 Most of the studies label all medical orders as prescriptions, whether they are included on a patient’s 

chart in a hospital or LTCF or are written and given to a patient to fill at a pharmacy. 
69

pharmacy board indicated that, at least at this early stage of implementation, the 

translation of the electronic data file to the pharmacies has caused data to be placed in the 

wrong fields and, in some cases, in the wrong patient’s file. Studies of pharmacy 

experience in the U.S. and Sweden have found an increase in the number of errors.70

DEA believes that electronic prescribing will reduce the number of prescription errors, 

but it has no basis for estimating the scope of the problem or the extent of reduction that 

will occur.

6.4 CONCLUSION

Electronic prescriptions for controlled substances will produce cost savings that may be 

greater than the costs of the rule for two of the three options considered. If the rule 

reduces diversion, it may also produce benefits in terms of reduced numbers of deaths 

and medical costs that exceed the cost of the rule. The rule will also protect practitioners 

from misuse of their DEA registrations and reduce the costs to law enforcement. In 

contrast, a less secure electronic prescription system could greatly increase diversion, the 

deaths and medical costs associated with drug misuse, and the number of diversion cases. 

A less secure system would dramatically increase investigation costs because every 

provider and intermediary involved in a transaction would have to provide testimony to 

attempt to demonstrate that a prescription was not altered during transmission. The costs 

of such testimony would fall on law enforcement, application providers, and 

intermediaries. Finally, a less secure system would expose practitioners to the risk of 

identity theft, with the considerable costs associated with resolving those problems.

 

70

 Warholak, TL, Rupp, MT, ―Analysis of community chain pharmacists’ interventions on electronic 

prescriptions.‖ Journal of American Pharm Association, 2009, Jan-Feb; 49(1): 59-64. 

Astrand et al., ―Assessment of ePrescription Quality: an observational study at three mail order 

pharmacies.‖ BMC Med Inform Decis Mak, 2009 Jan 26; 9:8.
70
71

CHAPTER 7: CONCLUSIONS

This chapter discusses the limitations of the analysis and presents the overall conclusions. 

7.1 UNCERTAINTIES

Any economic analysis involves some level of uncertainty about elements of the analysis. 

This is particularly true for this analysis, which must estimate costs for implementation of 

a new technology and project voluntary adoption rates. This section discusses the 

elements that have the greatest level of uncertainty associated with them.

7.1.1 Rates of Adoption

The American Recovery and Reinvestment Act (Public Law 111-5) provides incentives 

for practitioners to adopt electronic health record applications; the incentives are 

scheduled to end after 2016. The analysis assumes that practitioners will adopt electronic 

prescribing by that time; after that point all of the implementation occurs with new 

entrants. Whether adoption is, in fact, that rapid will depend on a number of factors 

unrelated to this rulemaking. The barriers to adoption continue to be the high cost of the 

applications, which may be greater than the subsidies; the disruption that implementation 

creates in a practice; and uncertainty about the applications themselves.71 The pattern 

with software applications is that a large number of firms enter a market, but the vast 

majority of them fail, leaving a very few dominant providers.72 The health IT market is 

still in the early phases of this process. DEA has no basis for estimating when dominant 

players will emerge. The 7-year implementation period projected may be too 

conservative or too optimistic.

7.1.2 Costs to Application Providers

The time for reprogramming existing applications is estimated to be between 1,000 hours 

and 2,000 hours. DEA based the upper estimate on information provided by the industry 

for DEA’s rulemaking regarding electronic orders for controlled substances. The actual 

cost to existing application providers is likely to vary widely. Some providers may meet 

all or virtually all of the requirements and need little reprogramming. Many of the 

requirements are standard practice for software (e.g., logical access controls for hospitals) 

and should need minimal adjustments. Most electronic prescription applications appear 

to present the data DEA will require on prescriptions. Any software firm that uses the 

Internet for any transaction will have digital signature capability. Electronic health 

record applications must control access to gain Certification Commission for Healthcare 

Information Technology certification. Nonetheless, DEA expects that for some existing 

 

71 California HealthCare Foundation, Snapshot: The State of Health Information Technology in California, 

2008.

72 Bergin, T.J, ―The Proliferation and Consolidation of Word Processing Software: 1985-1995.‖ IEEE 

Annals of the History of Computing. Volume 28, Issue 4, Oct.-Dec. 2006 Page(s):48 – 63.
72

providers, the requirements may take more than the estimated time. The extent to which 

this requires additional time will also depend on whether the changes are incorporated 

into other updates to the application or are done on a different schedule.

Another uncertainty of application provider costs relates to the third-party audit and the 

time that will elapse before a certification organization is able to certify compliance with 

DEA’s requirements. If the Certification Commission for Healthcare Information 

Technology includes DEA’s requirements in its criteria, the costs for third-party audits 

may be eliminated sooner than estimated. The interim final rule provides more options 

for obtaining a third-party audit, which should reduce its cost. DEA has not assumed that 

any organization will certify pharmacy applications because no organization currently 

does so except for determining whether the pharmacy application can read a SCRIPT 

format.

7.1.3 Practitioner Costs

The single largest cost for practitioners is obtaining identity proofing and an 

authentication credential. DEA used the cost of a three-year digital certificate at a 

medium assurance level from the SAFE BioPharma Certification Authority for the cost 

estimate. SAFE meets the criteria set in the rule. Other firms that meet the criteria 

provide digital certificates and other credentials for more and for less. The actual cost 

will not be known until the rule is implemented and practitioners and providers decide on 

the type of credential they will use. Some commenters on the proposed rule stated that 

remote identity proofing, which is allowable, can be done very quickly, which could 

lower the cost. The firms providing the service, however, may impose other 

requirements beyond those of DEA, which could increase the cost.

There will also be costs associated with lost or compromised credentials. DEA has not 

attempted to estimate those costs because the frequency with which this will occur and 

the requirements that credential providers will impose is not known. Some practitioners 

will never incur these costs while others may incur them multiple times. Credential 

providers may require a practitioner to go through identity proofing or may impose lesser 

requirements. If one of the two factors is a password, credential providers may deal with 

password resets as they do now; password resets do not usually involve issuing a new 

token or a fee. 

7.2 COSTS AND BENEFITS

The costs of two of the options considered ($34 to $44 million annualized over 15 years 

at 7 percent) are far lower than the potential cost savings even if all of those savings are 

not realized.

The cost savings that may occur could total $1.4 billion a year although this is an upper 

bound estimate and not necessarily associated with the rule. It is unlikely, especially in 

the early years, that all of public wait time savings will be gained. Until pharmacies 

receive a substantial percentage of prescriptions electronically and learn to check the 
73

incoming prescription records, there may be a substantial lag between system receipt and 

pharmacist action. There may also still be callbacks although some of these could be sent 

electronically. One uncertainty associated with callbacks is the frequency with which 

pharmacists will identify problems with electronic prescriptions. Although the 

prescriptions will be legible, pharmacists may find keying errors (e.g., wrong drug, 

wrong dosage unit, wrong form, etc.) and need to contact the practitioner to clarify the

prescriptions. If practitioners have not checked formularies, either because they have 

turned off the function or because the particular formulary is not available to them, 

pharmacies will still need to do callbacks for formulary issues. In addition, the ability of 

electronic prescription applications to identify contraindication problems depends on the 

application having a complete record of a patient’s medications and medical problems. 

Until electronic health record applications at one practice setting can interoperate with 

electronic health record applications at other practitioner offices to develop a complete 

medical history, the pharmacy will continue to be a principal means of identifying these 

issues. Needed contacts between a pharmacy and practitioner, whether electronic or 

telephone, will lower the cost savings for callbacks and for public wait time. 

As discussed in Chapter 6, the cost savings accrue to any electronic prescription 

application and should, therefore, be compared with the cost of those applications, not 

just with the incremental costs of DEA’s requirements. DEA has not attempted to 

estimate the cost of the applications because of the difficulty of determining what part of 

the cost of an EHR should be ascribed to electronic prescribing, which is only one of 

many functions of an EHR. It is also difficult to determine the costs of EHRs, which 

must include both the purchase cost plus training and implementation costs. Finally, it is 

not possible to determine how many practitioners already have applications that include 

electronic prescribing that transmits data files rather than printing out or faxing 

prescriptions.

The benefits of the security requirements will be a reduction in diversion of controlled 

substances that are obtained from forged, altered, or invalid prescriptions. DEA has no 

basis for estimating the current level of diversion from these activities and, therefore, no 

basis for an estimate of a potential reduction. The cost of misuse of prescription 

controlled substances, however, is extremely high. These drugs were involved in more 

than 350,000 emergency room visits in 2006, a number that was more than 20 percent 

higher than the 2004 number. If the requirements of this rule reduce these costs, the 

benefits may outweigh the costs. DEA notes that an application that did not have the 

security controls DEA is implementing could lead to an upsurge of deaths and illness 

because it would facilitate diversion rather than limit it and make it far more difficult for 

law enforcement agencies to bring cases against the criminals involved.

Option 2 could result from the elimination of passwords if the practitioner used the twofactor credential for all of his access to the EHR rather than just to sign controlled 

substance prescriptions. Industry studies put the cost of password resets at between $10 

and $31 each and estimate the average calls per user is 1.5 per year.73 These estimates 

 

73

 www.quest.com/password_manager/roi/Password_Manager.htm, accessed July 7, 2009, citing Gartner 

Group study G00123531. 
74

would be low for practitioners because of their higher wages. Using a weighted wage 

rate for practitioners ($169) and assuming that the call and reset took no more of their 

time than it does of the help desk (15 minutes), the annualized benefits of eliminating 

passwords would be about $34 million. This would offset the cost of the biometric, but

only if the practices switched to biometrics for all access. If a practice retained 

passwords for other functions, these benefits would not occur.

7.3 SMALL ENTITY IMPACTS

DEA determined that this rule will affect a substantial number of small entities because 

almost all practitioners and all independent pharmacies are small businesses. The costs to 

these entities, however, are very low and will not impose a significant economic impact 

on them, being far below one percent of their annual revenues. DEA also notes that the 

rule is voluntary; no practitioner or pharmacy will be required to handle electronic 

prescriptions for controlled substances.

The application providers are not directly regulated by DEA and are expected to recover 

their costs from DEA registrants. 

7.4 OTHER ISSUES

DEA considered whether the incremental costs might affect practitioners’ decisions about 

purchasing an application that provides electronic prescribing, an issue raised by many 

commenters. The cost of an electronic health record application for the functionalities 

that the Certification Commission for Healthcare Information Technology requires ranges 

from $20,000 to $50,000 per practitioner with a usual annual maintenance charge of 

$6,000 per practitioner. (There are some less expensive applications marketed as 

electronic health record applications that have only some of the functions; some appear to 

provide billing, scheduling, and simple records, but none of the more complex functions 

such as electronic prescriptions, database links, etc.) Even in the first year, where the 

incremental cost of adding DEA’s requirements might be about $200 per practitioner, this 

additional charge is unlikely to affect the decision to invest in an electronic health record 

application, where the first year cost would be, at the low end $26,000 ($20,000 plus the 

$6,000 maintenance fee). The incremental costs would add less than 1 percent of the cost 

of the application; in the out-years, the incremental costs would similarly be a small 

fraction of the annual application maintenance cost. For stand-alone electronic 

prescription applications, the initial incremental costs will be higher because they are 

expected to need more programming. After the initial year, however, their incremental 

costs should be similar. These costs will represent a greater percentage increase in their 

monthly charges, which average $50 per month, but this is unlikely to affect the initial 

decision because most of these systems are being provided free to practitioners by 

insurers that want to encourage electronic prescribing. In addition, because the Recovery 

Act subsidies are available only for EHRs, it is likely that stand-alone electronic 

prescription applications will be incorporated into or linked to EHR applications.
75

DEA notes that the barriers to adoption of electronic prescribing cited in various 

government studies relate to the high cost of the applications, the disruption caused by 

implementing these applications, and the relatively early stage of application 

development and interoperability provided by the existing systems. Despite the benefits 

of legible prescriptions, both in terms of patient safety and fewer callbacks from 

pharmacies, practitioners, particularly in small practices, have resisted adoption of 

electronic prescriptions. Insurance companies that have offered the systems for free have 

had difficulty finding practitioners willing to accept them because, while the service is 

free, the cost of additional hardware, training, and staff disruption is a barrier to adoption. 

In 2005, Wellpoint offered physicians $42 million in hardware, software, and support.

"Of the 25,000 physicians contacted, only 19,000 accepted these free gifts," Wellpoint 

then-CEO Leonard Schaeffer said. "And of those 19,000, only 2,700 physicians chose eprescribing PDAs. The rest selected a paperwork reduction package. ... Free is not cheap 

enough," Schaeffer concluded.74 The Recovery Act subsidies, which should encourage 

adoption, will not be available until the standards that will identify which applications are 

eligible are set. 

A study of physicians’ experiences with commercial electronic prescription applications 

that was funded by HHS and published in Health Affairs on April 3, 2007, examined the 

implementation of electronic prescribing.75 The study focused on larger medical 

practices (12 of the 21 practices had more than 50 doctors; none had fewer than 5), which 

meant that many of the practices had information technology staff and support. Many of 

the problems encountered involved not the basic function of writing a prescription, but 

other functions that are designed to improve patient safety (e.g., medication histories, 

clinical decision support) and formulary compliance. Connectivity with pharmacies was 

also a problem. Practice estimates of the number of prescriptions printed out for the 

patient ranged from 10 percent to close to 100 percent. Despite the theoretical level of 

pharmacy readiness for electronic prescriptions, ―most practices using electronic fax or 

EDI [electronic data interchange] reported spending substantial time educating 

pharmacies about e-prescribing.‖ Many practices noted that ―at least some of the mailorder PBMs [pharmacy benefit managers] routinely rejected prescriptions sent via 

electronic fax or EDI...‖76 

Implementing a system was reported to be very complicated. One physician reported 

working with the IT department 4 hours a week for 6 months to iron out the ―kinks‖ in 

the electronic prescribing module before the system could be tested. Maintenance of the 

system continued to demand staff resources. The study concluded:

Much of the literature assessing barriers to electronic prescribing adoption and 

use has focused on cost, physician resistance, and changing practice workflow. 

 

74 Schaeffer, L. WellPoint Health Networks, Thousand Oaks, CA. Transforming an IT-Enabled Health Care 

System: The Health Plan Role. Presentation at the Second Annual National Health Information Summit. 

Washington DC, October 20, 2004. http://www.managedcaremag.com/archives/0504/0504.pharmacy.html

75 Grossman, Joy M. et al., ―Physicians’ Experiences Using Commercial E-Prescribing Systems,‖ Health 

Affairs, 26, no. 3 (2007), w393-w404.

76

 Application providers that commented on the proposed rule indicated that 20 percent of the prescriptions 

that they transmitted had to be converted to facsimiles because of problems with pharmacies.
76

Our findings highlight the role of product limitations, external implementation 

challenges, and physicians’ preferences for how to use system features and are 

consistent with several other assessments of e-prescribing system functionality 

and provider pharmacy connectivity.

Respondents’ implementation hurdles belie the view that electronic prescribing 

products are relatively simple ―plug-and-play‖ applications. It is hard to imagine 

that e-prescribing as it exists today can be the ―killer app‖ that will drive further 

IT adoption. All of the practices we examined, regardless of size, IT expertise, 

geographic location, or vendor, had invested many financial and human resources 

in implementing and maintaining e-prescribing.

These findings are consistent with the CDC study cited above, which found that 

electronic prescribing was one of the less used functions in a fully or partially electronic 

EMR system. A more recent study by HealthLeaders-InterStudy found that there is a 

high rate of deinstallation where physician groups cancel EHR contracts as a result of 

training, functionality, or affordability issues, particularly among smaller practices.77 

Creating an electronic prescription takes more time than writing a paper prescription and 

handing it to a patient. The electronic prescription system shifts some responsibility from 

the pharmacy to the practitioners. At present, it is the pharmacy that checks to see if a 

particular drug is covered by the patient’s insurance and that checks for drug interactions 

by examining other medications the patient is taking. With electronic prescriptions, all of 

these checks may occur before the practitioner signs the prescription. While this process 

may significantly reduce processing time at the pharmacy and ensure that more 

prescribed drugs are on the insurance companies’ formularies, it may increase the time a 

practitioner must spend to create a prescription. Rather than spending a few seconds 

writing a prescription while talking to the patient, the practitioner has to move through a 

series of drop-down menus to select the patient, drug, dosage unit, and directions, then 

determine whether the insurance company will cover it and at what level of co-pay.78 

Finally, the practitioner or his staff will have to find the pharmacy from a drop-down 

menu. Electronic prescriptions are likely to save practices staff time in reduced 

callbacks, but the practitioners may initially see mainly the additional time that needs to 

be spent creating the prescription and the office disruption that occurs when staff need to 

be trained on new applications. (An earlier Rand study noted that although electronic 

prescriptions will eliminate errors caused by misread or misunderstood prescriptions, 

practitioners may not review the prescription to check that the right items from 

successive menus have been selected. Electronic prescriptions may introduce new errors 

through application design flaws. They may also reduce the likelihood that the pharmacy 

will check the prescription for errors.)79

 

77

 http://home.healthleaders-interstudy.com, accessed June 24, 2009.

78

 Practitioners may ignore this information when they make decisions about the prescription, but if they 

do, the number of callbacks will not decline as much as indicated because pharmacies may still call to ask 

about substituting a formulary drug for the prescribed drug. 

79 Bell, D.S. et al., ―Recommendations for Comparing Electronic Prescribing Systems: Results of An 

Expert Consensus Process,‖ Health Affairs, May 25, 2004, W4-305-317.
77

Overall, DEA concluded that the costs of its rule, while not trivial, are not great enough 

to discourage adoption of electronic prescribing.