15596 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

1Consistent with the CSA itself, the Ryan Haight 

Act relates solely to controlled substances. 

Controlled substances are those psychoactive drugs 

and other substances—including narcotics, 

stimulants, depressants, hallucinogens, and 

anabolic steroids—that are placed in one of the five 

schedules of the CSA due to their potential for 

abuse and likelihood that they may cause 

psychological or physical dependence when 

abused. 

Controlled substances constitute only a small 

percentage of all pharmaceutical drugs. 

Approximately 10 percent of all drug prescriptions 

written in the United States are for controlled 

substances, with the remaining approximately 90 

percent of prescriptions being written for 

noncontrolled substances. The amendments to the 

CSA made by the Ryan Haight Act, as well as the 

regulations being issued here, do not apply to 

noncontrolled substances. 

DEPARTMENT OF JUSTICE 

Drug Enforcement Administration 

21 CFR Parts 1300, 1301, 1304, 1306 

[Docket No. DEA–322I] 

RIN 1117–AB20 

Implementation of the Ryan Haight 

Online Pharmacy Consumer Protection 

Act of 2008 

AGENCY: Drug Enforcement 

Administration (DEA), Department of 

Justice. 

ACTION: Interim final rule with request 

for comments. 

SUMMARY: The Ryan Haight Online 

Pharmacy Consumer Protection Act, 

which was enacted on October 15, 2008, 

amended the Controlled Substances Act 

and Controlled Substances Import and 

Export Act by adding several new 

provisions to prevent the illegal 

distribution and dispensing of 

controlled substances by means of the 

Internet. DEA is hereby issuing an 

interim rule to amend its regulations to 

implement the legislation and is 

requesting comments on the interim 

rule. 

DATES: This interim rule is effective 

April 13, 2009, except §§ 1300.04, 

1301.19, and 1304.40, which are 

effective April 6, 2009. Section 

1300.04(i) (the definition of ‘‘practice of 

telemedicine’’) has an implementation 

date of January 15, 2010, unless such 

date is superseded by future regulatory 

actions as explained in the 

SUPPLEMENTARY INFORMATION section. 

Written comments must be 

postmarked on or before June 5, 2009, 

and electronic comments must be sent 

on or before midnight Eastern time June 

5, 2009. 

ADDRESSES: To ensure proper handling 

of comments, please reference ‘‘Docket 

No. DEA–322’’ on all written and 

electronic correspondence. Written 

comments being sent via regular or 

express mail should be sent to the Drug 

Enforcement Administration, Attention: 

DEA Federal Register Representative/ 

ODL, 8701 Morrissette Drive, 

Springfield, VA 22152. Comments may 

be sent to DEA by sending an electronic 

message to 

dea.diversion.policy@usdoj.gov. 

Comments may also be sent 

electronically through http:// 

www.regulations.gov using the 

electronic comment form provided on 

that site. An electronic copy of this 

document is also available at the http:// 

www.regulations.gov Web site. DEA will 

accept attachments to electronic 

comments in Microsoft Word, 

WordPerfect, Adobe PDF, or Excel file 

formats only. DEA will not accept any 

file formats other than those specifically 

listed here. 

Please note that DEA is requesting 

that electronic comments be submitted 

before midnight Eastern time on the day 

the comment period closes because 

http://www.regulations.gov terminates 

the public’s ability to submit comments 

at midnight Eastern time on the day the 

comment period closes. Commenters in 

time zones other than Eastern time may 

want to consider this so that their 

electronic comments are received. All 

comments sent via regular or express 

mail will be considered timely if 

postmarked on the day the comment 

period closes. 

FOR FURTHER INFORMATION CONTACT: 

Mark W. Caverly, Chief, Liaison and 

Policy Section, Office of Diversion 

Control, Drug Enforcement 

Administration, 8701 Morrissette Drive, 

Springfield, VA 22152; Telephone: (202) 

307–7297. 

SUPPLEMENTARY INFORMATION: Posting of 

Public Comments: Please note that all 

comments received are considered part 

of the public record and made available 

for public inspection online at http:// 

www.regulations.gov and in the DEA’s 

public docket. Such information 

includes personal identifying 

information (such as your name, 

address, etc.) voluntarily submitted by 

the commenter. 

If you want to submit personal 

identifying information (such as your 

name, address, etc.) as part of your 

comment, but do not want it to be 

posted online or made available in the 

public docket, you must include the 

phrase ‘‘PERSONAL IDENTIFYING 

INFORMATION’’ in the first paragraph 

of your comment. You must also place 

all the personal identifying information 

you do not want posted online or made 

available in the public docket in the first 

paragraph of your comment and identify 

what information you want redacted. 

If you want to submit confidential 

business information as part of your 

comment, but do not want it to be 

posted online or made available in the 

public docket, you must include the 

phrase ‘‘CONFIDENTIAL BUSINESS 

INFORMATION’’ in the first paragraph 

of your comment. You must also 

prominently identify confidential 

business information to be redacted 

within the comment. If a comment has 

so much confidential business 

information that it cannot be effectively 

redacted, all or part of that comment 

may not be posted online or made 

available in the public docket. 

Personal identifying information and 

confidential business information 

identified and located as set forth above 

will be redacted and the comment, in 

redacted form, will be posted online and 

placed in the DEA’s public docket file. 

Please note that the Freedom of 

Information Act applies to all comments 

received. If you wish to inspect the 

agency’s public docket file in person by 

appointment, please see the ‘‘For 

Further Information’’ paragraph. 

Preamble 

I. Legislation Upon Which These 

Regulations Are Based 

The Ryan Haight Online Pharmacy 

Consumer Protection Act of 2008 (Pub. 

L. 110–425) (hereafter, the ‘‘Ryan Haight 

Act’’ or the ‘‘Act’’) was enacted on 

October 15, 2008. The Act amended the 

Controlled Substances Act (CSA) and 

Controlled Substances Import and 

Export Act (CSIEA) by adding various 

provisions to prevent the illegal 

distribution and dispensing of 

controlled substances by means of the 

Internet.1 The law becomes effective 

April 13, 2009 (except for one provision 

relating to telemedicine discussed 

below). Thus, as of April 13, 2009, it 

will be illegal under federal law to 

‘‘deliver, distribute, or dispense a 

controlled substance by means of the 

Internet, except as authorized by [the 

CSA]’’ or to aid or abet such activity. 21 

U.S.C. 841(h)(1). The Act applies to all 

controlled substances in all schedules. 

This document serves three purposes: 

(1) To explain the new legislation; (2) to 

announce the amendments to the DEA 

regulations that implement the new 

legislation; and (3) to request comments 

on the amendments to the regulations, 

which are being issued as an interim 

rule as contemplated in the legislation. 

II. Authority in Ryan Haight Act To 

Issue Regulations 

The Ryan Haight Act contains various 

provisions that call upon the Attorney 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15597 

2Public Law 110–425, sec. 3(k)(1). 

3Functions vested in the Attorney General under 

the CSA have been delegated to the Administrator 

of DEA. 28 CFR 0.100. Accordingly, in this 

document, ‘‘DEA Administrator’’ will be used in 

place of all statutory references to the Attorney 

General. 

4Congress’s express grant of authority under the 

Ryan Haight Act to issue interim rules as the DEA 

Administrator finds necessary to implement the Act 

prior to its effective date forms the basis for the DEA 

Administrator’s conclusion, as is set forth in 

Section X below, that ‘‘good cause’’ exists under the 

Administrative Procedure Act (APA) for the 

issuance of interim rules (those which take effect 

immediately on an interim basis prior to the public 

comment period) because ‘‘notice and public 

procedure thereon are impracticable, * * *[and] 

contrary to the public interest.’’ See 5 U.S.C. 

553(b)(B). 

5Available at http://www.oas.samhsa.gov/nsduh/ 

2k7nsduh/2k7Results.pdf. 

6The study states: ‘‘Psychotherapeutics include 

the nonmedical use of any prescription-type pain 

relievers, tranquilizers, stimulants, or sedatives. 

Over-the-counter substances are not included.’’ Id. 

at 55. 

7 Id. at 1. 

8 Id. 

9Compare 2004 National Survey on Drug Use and 

Health at 1, available at http:// 

www.oas.samhsa.gov/nsduh/2k4nsduh/ 

2k4results.pdf. 

10See id. at 73. 

11 Id. at 4. 

12Partnership for a Drug-Free America; 

Partnership Attitude Tracking Study, Teens in 

grades 7 through 12, 2005; http://www.drugfree.org/ 

Files/Full_Teen_Report (page 21). 

13 Id. at 20–21. 

14 Distributors are required to submit certain 

reports to DEA’s ARCOS unit, as provided in 21 

CFR 1304.33. 

15S. Rep. No. 110–521, at 1 (2008). 

16 Id. at 12. 

17 Id. at 5. 

18 Id. at 5–6. 

General to issue regulations to 

implement the Act. Among these is the 

following general grant of authority: 

The Attorney General may promulgate and 

enforce any rules, regulations, and 

procedures which may be necessary and 

appropriate for the efficient execution of 

functions under this Act or the amendments 

made by this Act, and, with the concurrence 

of the Secretary of Health and Human 

Services where this Act or the amendments 

made by this Act so provide, promulgate any 

interim rules necessary for the 

implementation of this Act or the 

amendments made by this Act, prior to its 

effective date.2

This regulatory authority of the 

Attorney General has been delegated to 

the Administrator of DEA.3 It is evident 

from the foregoing provision of the Act 

that Congress contemplated it would be 

necessary for DEA to issue regulations 

on an interim basis in order to 

implement the Act within the relatively 

short time period between the passage 

of the Act (October 15, 2008) and its 

effective date (April 13, 2009). Indeed, 

Congress envisioned that DEA would 

need to issue interim rules ‘‘prior to its 

effective date’’ (i.e., before April 13, 

2009) to effectively implement the new 

requirements of the Act.4 Accordingly, 

the rules published here are effective 

immediately while at the same time the 

agency is seeking public comment on 

them. Following the comment period, 

DEA will review the comments and 

make any modifications to the interim 

rule that are appropriate. Also, as 

explained below, the Act contemplates 

that DEA will, with the concurrence of 

the Secretary of Health and Human 

Services, promulgate regulations 

governing the issuance to practitioners 

of a special registration relating to the 

practice of telemedicine. Those 

regulations will be issued separately at 

a later date. 

III. Overview of the Legislation 

A. Reasons for the Legislation 

The unlawful use of pharmaceutical 

controlled substances has reached 

alarming levels in the United States in 

recent years, causing a substantial 

detrimental effect on the public health 

and safety. According to the most 

recently published National Survey on 

Drug Use and Health (2007),5 6.9 

million Americans reported using 

psychotherapeutic drugs 6 nonmedically 

during the prior month.7 With specific 

regard to pain relievers, 5.2 million 

respondents reported abusing these 

drugs,8 which is an 18 percent increase 

from 2004.9 This study further indicates 

that, in the United States, the abuse of 

prescription drugs is second only to that 

of marijuana and is higher than the 

abuse of cocaine, heroin and 

hallucinogens combined.10 Among 

persons aged 12 and older who reported 

using illicit drugs for the first time in 

2007, abuse of pain relievers was the 

most common category of first-time 

illicit drug use.11

The false sense of security that some 

associate with the abuse of these 

substances is also alarming. Many 

mistakenly believe that if a drug may be 

prescribed for medical use, abusing that 

drug cannot be as harmful as abusing 

more conventional ‘‘street’’ drugs, such 

as heroin or cocaine. According to the 

2005 Partnership Attitude Tracking 

Study 12, 40 percent of teens surveyed 

believe that prescription medicines are 

‘‘much safer’’ to use than illegal drugs. 

Furthermore, the same study concluded 

that 31 percent believe there is ‘‘nothing 

wrong’’ with using prescription 

medicines without a prescription ‘‘once 

in awhile.’’ 13

One of the main factors contributing 

to the nationwide increase in the 

diversion of pharmaceutical controlled 

substances has been the rise in the 

number of Internet sites that sell or 

facilitate the sale of these drugs for other 

than legitimate medical purposes. While 

in-person ‘‘prescription mills’’ 

(practitioners’ offices that readily 

supply drug seekers with prescriptions 

for controlled substances without 

establishing a legitimate medical basis 

for doing so) have always been, and 

remain, a significant source of 

diversion, the advent of rogue Web sites 

that cater to those who abuse 

pharmaceutical controlled substances 

has allowed the criminal operators of 

these sites to exploit the anonymity of 

the Internet to generate illicit sales of 

controlled substances (and/or 

prescriptions therefor) that far exceed 

those of any in-person prescription mill. 

This is particularly evident when 

examining the data relating to the sales 

of hydrocodone, which is the most 

widely abused pharmaceutical 

controlled substance in the United 

States. According to data registered 

distributors of controlled substances 

provided to DEA 14 in 2006, 34 

pharmacies in the United States that 

were supplying rogue Internet sites 

dispensed a total of more than 98 

million dosage units of hydrocodone. 

Hence, these pharmacies each 

dispensed an average of approximately 

2.9 million dosage units of hydrocodone 

per pharmacy in a single year. By means 

of comparison, the average pharmacy in 

the United States dispenses 

approximately 88,000 dosage units of 

hydrocodone per year. 

Congress passed the Ryan Haight Act 

precisely because of ‘‘the increasing use 

of prescription controlled substances by 

adolescents and others for nonmedical 

purposes, which has been exacerbated 

by drug trafficking on the Internet.’’ 15

The person for whom the Act was 

named, Ryan Haight, was ‘‘a California 

high school honors student and athlete 

who died in 2001 from an overdose of 

controlled substances that he had 

purchased from a rogue online 

pharmacy.’’ 16 According to the Senate 

Report accompanying the legislation, 

‘‘Ease of access to the Internet, 

combined with lack of medical 

supervision, has led to tragic 

consequences in the online purchase of 

prescription controlled substances.’’ 17

The Senate Report then cited a list of 

examples of persons in the United 

States who had died from overdoses of 

controlled substances obtained via the 

Internet.18


pwalker on PROD1PC71 with RULES2
15598 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

19The ‘‘business models’’ described here are not 

the only ones employed by operators of rogue sites; 

methods other than those described above have 

been utilized by those who divert controlled 

substances by means of the Internet. 

20The small percentage of pharmacies who have 

so participated in these rogue Web site schemes 

have, in many cases, filled extraordinary numbers 

of prescriptions for controlled substances that dwarf 

the sales figures of walk-in pharmacies. 

B. Common Methods Employed by 

Operators of Rogue Web Sites That Sell 

Pharmaceutical Controlled Substances 

The rogue Web sites that the Ryan 

Haight Act seeks to eliminate take on a 

variety of appearances and use a variety 

of methods. One common factor is that 

all these Web sites are marketed toward 

drug seekers who are willing to pay a 

premium to obtain pharmaceutical 

controlled substances without having a 

legitimate medical need for them. While 

the ‘‘business models’’ that the 

operators of these sites employ to evade 

detection by law enforcement and/or to 

create the facade of compliance with the 

law have evolved significantly over 

time, there tend to be three categories of 

participants in these schemes: the 

prescribing practitioner; the pharmacy 

that fills the prescriptions; and the 

criminal facilitator (a non-DEA 

registrant) who runs the operation.19

While it has always been illegal to 

dispense a controlled substance without 

a legitimate medical purpose, prior to 

the Act, a rogue operator could design 

a site that would make it clear to drug 

seekers that pharmaceutical controlled 

substances could be obtained through 

the site without a legitimate medical 

purpose. For example, a typical rogue 

site would display prominently on its 

homepage a list of the pharmaceutical 

controlled substances that it sold and 

prompt customers to click on their 

desired drugs. These Web sites could 

easily be found by using any of various 

Internet search engines and entering 

search terms such as ‘‘hydrocodone no 

prescription.’’ Unsolicited e-mails or 

other forms of online advertising and 

marketing often steered potential 

customers to these Web sites; the 

advertisements announced that 

controlled substances could be readily 

obtained through the Web site without 

an in-person medical evaluation and 

sometimes without even a 

prescription—thus insuring a drug 

seeking customer could obtain the 

controlled substance without a 

legitimate medical need. 

Thus, prior to passage of the Act, 

attracting customers was relatively easy 

for these rogue Web sites. However, to 

deliver the goods that the customers 

were seeking (pharmaceutical controlled 

substances and/or prescriptions for 

such), the operator of the rogue Web site 

usually had to enlist the services of two 

types of DEA registrants: a practitioner 

and pharmacy. Thus, the typical 

criminal facilitator had to recruit an 

unscrupulous practitioner willing to 

prescribe controlled substances without 

a legitimate medical evaluation obtained 

through a bona fide doctor-patient 

relationship. While the overwhelming 

majority of practitioners would want no 

part of this type of improper 

arrangement, criminal facilitators were 

able to find some unscrupulous 

practitioners willing to participate. 

Investigations have revealed that these 

facilitators often target practitioners 

who carry significant debt, such as those 

recently graduated from medical school, 

or those who have retired and are 

looking for some ‘‘extra income.’’ 

Regardless of the motivations of the 

participating practitioners, the 

facilitator would persuade them to enter 

into an agreement whereby they would 

agree to write prescriptions for 

controlled substances without adhering 

to the standard professional practices 

employed by practitioners when 

evaluating the medical condition of 

patients and determining the 

appropriate treatment in return for 

payment from the facilitator based on 

the number of prescriptions they would 

write. These arrangements operated in 

several ways. In some instances, the 

facilitator would arrange for a 

practitioner to issue prescriptions for 

controlled substances based solely on 

reviewing online questionnaires the 

customers submitted to the Web site. 

Other schemes involved facilitators 

requiring the customers of the Web site 

to fax some documentation that 

purported to be the customers’ ‘‘medical 

records’’ and then having an 

unscrupulous practitioner issue 

prescriptions for controlled substances 

based on a ‘‘review’’ of these faxed 

documents. A third type of scheme 

involved the facilitator having 

customers of the Web site call a 

telephone number staffed by employees 

of the site, answer a series of questions 

purporting to create a ‘‘medical 

history,’’ and then have unscrupulous 

practitioners write the prescriptions 

based on these answers. Whatever the 

methods employed, these rogue Web 

site operations were merely a sham, as 

every step in the process was designed 

to sell customers controlled substances 

and/or prescriptions for controlled 

substances without regard to actual 

medical need. 

Some criminal facilitators have been 

content to take in the profits associated 

with selling the prescriptions for 

controlled substances. (Some rogue Web 

sites charge customers a separate fee for 

arranging the issuance of prescriptions.) 

Others have sought to increase their 

profits by also having customers fill the 

prescriptions through a pharmacy 

affiliated with the Web site. To achieve 

the latter, the criminal facilitator needed 

to enter into an agreement with an 

unscrupulous pharmacy that was 

willing—for a fee—to fill prescriptions 

for controlled substances with 

essentially no questions asked and for as 

many prescriptions as the Web site 

could steer toward the pharmacy.20 In 

addition to paying the pharmacy for the 

cost of the drugs, the criminal facilitator 

would also typically pay the pharmacy 

an agreed upon amount that, in some 

instances, amounted to millions of 

dollars. Given the amount of money to 

be made from these arrangements, DEA 

has seen pharmacies close their doors 

completely to walk-in customers and 

convert their entire business to filling 

orders generated from rogue Web sites. 

In some instances, criminal facilitators 

have used multiple brick and mortar 

pharmacies to service their list of drug 

seeking customers. In other cases, a 

single pharmacy has supplied multiple 

rogue Web sites. 

These rogue Web sites generally 

provide the customer with a wide 

variety of quick and easy payment 

methods, such as cash-on-delivery, lines 

of credit, and credit ‘‘gift’’ cards. They 

also typically structure the various steps 

of the ordering process so as to link and 

shift the buyer to different Web sites, 

making it difficult for investigators to 

connect payments, products, and Web 

providers together. Rarely do such rogue 

Web sites contain any identifying 

information about where the online 

pharmacy is located or who owns or 

operates the Web site. On the contrary, 

these Web sites frequently fluctuate in 

name and number minute by minute. 

Finally, the typical rogue Web site fails 

to provide any information on how a 

patient may contact the prescribing 

practitioner or the pharmacist to consult 

with them about the drug(s) ordered, 

including drug interactions and adverse 

reactions. 

Recognizing that these rogue Web 

sites fuel the abuse of prescription 

controlled substances and thereby 

increase the number of resulting 

overdoses and other harmful 

consequences, Congress passed the 

Ryan Haight Act to prevent the Internet 

from being exploited to facilitate such 

unlawful drug activity. 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15599 

21 21 CFR 1306.04(a); United States v. Moore, 423 

U.S. 122 (1975). This requirement has been a part 

of federal law since the Harrison Narcotic Act of 

1914. Id. at 131. For a detailed explanation of the 

‘‘legitimate medical purpose requirement,’’ see 71 

FR 52716, 52717 (2006 DEA policy statement). 22 21 U.S.C. 841(h)(1)(A). 

23As set forth in 1 U.S.C. 7, the word ‘‘person’’ 

includes ‘‘corporations, companies, associations, 

firms, partnerships, societies, and joint stock 

companies, as well as individuals.’’ Consistent 

therewith, the DEA regulations define ‘‘person’’ to 

include ‘‘any individual, corporation, government 

or governmental subdivision or agency, business 

trust, partnership, association, or other legal 

entity.’’ 21 CFR 1300.01(b)(34). 

24The Act exempts certain categories of persons 

from the application of 21 U.S.C. 841(h)(1), such as 

Internet service providers and Web hosting services, 

so long as such persons do not act in concert with 

others who violate the Act. 

IV. Brief Summary of Some of the Key 

Provisions of the Legislation 

Before examining the legislation in 

detail, the following is a brief recitation 

of two of the most important new 

statutory requirements: the in-person 

medical evaluation requirement for 

prescribing practitioners and the 

modified registration requirement for 

online pharmacies. 

A. In-person medical evaluation 

requirement—One of the primary ways 

in which the Ryan Haight Act combats 

the use of the Internet to facilitate illegal 

sales of pharmaceutical controlled 

substances is by mandating, with 

limited exceptions, that the dispensing 

of controlled substances by means of the 

Internet be predicated on a valid 

prescription involving at least one inperson medical evaluation. While the 

lack of an in-person medical evaluation 

has always been viewed as a ‘‘red flag’’ 

indicating that diversion might be 

occurring, the Ryan Haight Act makes it 

unambiguous that it is a per se violation 

of the CSA for a practitioner to issue a 

prescription for a controlled substance 

by means of the Internet without having 

conducted at least one in-person 

medical evaluation, except in certain 

specified circumstances. At the same 

time, it is crucial to bear in mind that, 

as Congress expressly stated under the 

Act, the mere fact that the prescribing 

practitioner conducted one in-person 

medical evaluation does not 

demonstrate that the prescription was 

issued for a legitimate medical purpose 

within the usual course of professional 

practice. Even where the prescribing 

practitioner has complied with the 

requirement of at least one in-person 

medical evaluation, a prescription for a 

controlled substance must still satisfy 

the additional, fundamental prerequisite 

that has been legally mandated for more 

than 90 years: it must be issued for a 

legitimate medical purpose by a 

practitioner acting in the usual course of 

professional practice.21

B. Requirement of modified 

registration for online pharmacies— 

Another of the core provisions of the 

Act is the requirement that any person 

who operates a Web site that fits within 

the definition of an ‘‘online pharmacy’’ 

must obtain from DEA a modification of 

its DEA pharmacy registration that 

expressly authorizes such online 

activity. Only DEA-registered 

pharmacies are eligible under the Act to 

obtain such a modification of 

registration. One of the ramifications of 

this requirement is that those who are 

not DEA-registered pharmacies (for 

example, those nonregistrants who have 

heretofore facilitated unlawful Internet 

controlled substance sales by enlisting 

the services of unscrupulous 

pharmacies and/or prescribing 

practitioners) are prohibited from 

operating online pharmacies. 

The Act’s definition of ‘‘online 

pharmacy’’ encompasses more than 

merely legitimate pharmacies that may 

obtain a modification of their DEA 

registrations allowing them to dispense 

controlled substances by means of the 

Internet. As explained below, the 

definition of ‘‘online pharmacy’’ 

includes, among others, those persons 

who operate the types of rogue Web 

sites that the Act was designed to 

eliminate. Consistent with the 

longstanding structure of the CSA (since 

it was enacted in 1970), the Ryan Haight 

Act prohibits all controlled substance 

activities by ‘‘online pharmacies’’ 

except those expressly authorized by the 

Act. Again, only DEA-registered 

pharmacies may obtain a modification 

of their registration authorizing them to 

operate as online pharmacies. In 

addition, a pharmacy that has obtained 

such a modification of its registration 

may not operate as an online pharmacy 

unless it has notified DEA of its intent 

to do so and its Web site contains 

certain declarations designed to provide 

clear assurance that it is operating 

legitimately and in conformity with the 

Act. (These requirements are discussed 

at length below.) 

V. Detailed Explanation of the 

Legislation 

Consistent with the structure of the 

CSA, the Ryan Haight Act sets out 

numerous regulatory requirements and 

other substantive provisions and makes 

it unlawful to ‘‘knowingly or 

intentionally * * * deliver, distribute, 

or dispense a controlled substance by 

means of the Internet, except as 

authorized by [the Act].’’ 22 Thus, this 

explanation of the Act will be divided 

into two main parts: (1) Explaining the 

Act’s regulatory requirements and other 

substantive provisions and (2) 

explaining what it means to ‘‘knowingly 

or intentionally * * * deliver, 

distribute, or dispense a controlled 

substance by means of the Internet.’’ 

A. New definitions under the Act 

The Act adds several new definitions 

to the CSA. These new statutory 

definitions are being added to the DEA 

regulations as part of this Interim Rule. 

While many of the new definitions are 

self-explanatory, some are discussed in 

this preamble to assist in understanding 

the Act. 

The following are two of the key 

definitions in the Act, which are set 

forth in 21 U.S.C. 802: 

(51) The term ‘‘deliver, distribute, or 

dispense by means of the Internet’’ refers, 

respectively, to any delivery, distribution, or 

dispensing of a controlled substance that is 

caused or facilitated by means of the Internet. 

This definition is plainly broad in 

scope, encompassing any activity 

utilizing the Internet that causes or 

facilitates the delivery, distribution, or 

dispensing of a controlled substance. 

This definition is incorporated into the 

Act’s definition of an ‘‘online 

pharmacy’’: 

(52) The term ‘‘online pharmacy’’ * * * 

means [with certain exceptions discussed 

below] a person, entity, or Internet site, 

whether in the United States or abroad, that 

knowingly or intentionally delivers, 

distributes, or dispenses, or offers or attempts 

to deliver, distribute, or dispense, a 

controlled substance by means of the 

Internet. 

The definition of ‘‘online pharmacy’’ is 

also broad in scope. First, it includes 

not only a ‘‘person’’ 23 but also any other 

‘‘entity’’ or ‘‘Internet site’’—‘‘whether in 

the United States or abroad’’—that 

otherwise meets the definition of an 

‘‘online pharmacy.’’ Second, it also 

includes not only any such person, 

entity or Internet site ‘‘that knowingly or 

intentionally delivers, distributes, or 

dispenses * * * a controlled substance 

by means of the Internet,’’ but also any 

such one who ‘‘offers or attempts’’ to do 

so. 

Hence, the term ‘‘online pharmacy’’ 

includes, among other things: (i) Any 

Web site that sells, or offers to sell, any 

controlled substance or a prescription 

therefor to a person in the United States; 

(ii) any person who operates such a Web 

site; 24 (iii) any person who pays a 

practitioner to write prescriptions for 

controlled substances for customers of 

such a Web site; (iv) any person who 

pays a pharmacy to fill prescriptions for 

controlled substances that were issued 


pwalker on PROD1PC71 with RULES2
15600 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

25Under the CSA, a DEA-registered ‘‘distributor’’ 

delivers controlled substances to other DEA 

registrants; it may not administer, dispense, or 

otherwise deliver controlled substances to patients. 

See 21 U.S.C. 802(11), 822(a), 822(b), 828(a). 

26Nearly every pharmaceutical controlled 

substance is a prescription drug under the Federal 

Food, Drug, and Cosmetic Act (FDCA). In the very 

rare instance where a drug contains a controlled 

substance but may be dispensed under the FDCA 

without a prescription, the DEA regulations specify 

the procedures a pharmacist must follow to 

dispense such a drug lawfully to a purchaser. 21 

CFR 1306.26. 

to customers of such a Web site; (v) any 

pharmacy that knowingly or 

intentionally fills prescriptions for 

controlled substances that were issued 

to customers of such a Web site; and (vi) 

any person who sends an e-mail that: 

Offers to sell a controlled substance or 

a prescription for a controlled substance 

in a manner not authorized by the Act; 

directs buyers to a Web site operating in 

violation of the Act; or otherwise causes 

or facilitates the delivery, distribution, 

or dispensing of a controlled substance 

in a manner not authorized by the Act. 

While the general scope of the 

definition of an ‘‘online pharmacy’’ is 

broad, the definition expressly excludes 

the following categories: 

(i) Manufacturers or distributors registered 

under subsection (a), (b), (d), or (e) of [21 

U.S.C. 823] who do not dispense controlled 

substances to an unregistered individual or 

entity; 

(ii) Nonpharmacy practitioners who are 

registered under [21 U.S.C. 823(f)] and whose 

activities are authorized by that registration; 

(iii) Any hospital or other medical facility 

that is operated by an agency of the United 

States (including the Armed Forces), 

provided such hospital or other facility is 

registered under [21 U.S.C. 823(f)]; 

(iv) A health care facility owned or 

operated by an Indian tribe or tribal 

organization, only to the extent such facility 

is carrying out a contract or compact under 

the Indian Self-Determination and Education 

Assistance Act; 

(v) Any agent or employee of any hospital 

or facility referred to in clause (iii) or (iv), 

provided such agent or employee is lawfully 

acting in the usual course of business or 

employment, and within the scope of the 

official duties of such agent or employee, 

with such hospital or facility, and, with 

respect to agents or employees of health care 

facilities specified in clause (iv), only to the 

extent such individuals are furnishing 

services pursuant to the contracts or 

compacts described in such clause; 

(vi) Mere advertisements that do not 

attempt to facilitate an actual transaction 

involving a controlled substance; 

(vii) A person, entity, or Internet site that 

is not in the United States and does not 

facilitate the delivery, distribution, or 

dispensing of a controlled substance by 

means of the Internet to any person in the 

United States; 

(viii) A pharmacy registered under [21 

U.S.C. 823(f)] whose dispensing of controlled 

substances via the Internet consists solely 

of— 

(I) Refilling prescriptions for controlled 

substances in schedule III, IV, or V, as 

defined in paragraph [21 U.S.C. 802(55)]; or 

(II) Filling new prescriptions for controlled 

substances in schedule III, IV, or V, as 

defined in paragraph [21 U.S.C. 802(56)]; or 

(ix) Any other persons for whom the [DEA 

Administrator] and the Secretary [of Health 

and Human Services] have jointly, by 

regulation, found it to be consistent with 

effective controls against diversion and 

otherwise consistent with the public health 

and safety to exempt from the definition of 

an ‘‘online pharmacy’’. 

21 U.S.C. 802(52)(B). 

To elaborate briefly on these 

exceptions, under exception (i), a DEAregistered manufacturer or distributor 25

that uses the Internet to facilitate 

activities permitted by its DEA 

registration does not constitute an 

online pharmacy. Under exception (ii), 

a DEA-registered nonpharmacy 

practitioner (e.g., physician, dentist, 

veterinarian, scientific investigator, 

hospital, or other person authorized by 

his registration to dispense controlled 

substances) may do so by means of the 

Internet without being an online 

pharmacy. Under exceptions (iii) 

through (v), certain hospitals and other 

health care facilities associated with the 

United States government, as well as 

agents and employees acting in the 

course of their duties for such 

institutions, are not online pharmacies. 

Under exception (vi), an advertisement 

is not an online pharmacy, provided the 

advertisement does not ‘‘attempt to 

facilitate an actual transaction involving 

a controlled substance.’’ 

Under exception (vii), a person, 

entity, or Internet site located outside 

the United States is only excepted from 

the definition of an online pharmacy if 

it ‘‘does not facilitate the delivery, 

distribution, or dispensing of a 

controlled substance by means of the 

Internet to any person in the United 

States.’’ (Emphasis added.) Thus, Web 

sites operated by persons located 

abroad, along with persons who operate 

the sites, do fall within the definition of 

an online pharmacy if they sell or offer 

to sell controlled substances to persons 

in the United States or otherwise 

‘‘facilitate the delivery, distribution, or 

dispensing of a controlled substance by 

means of the Internet to any person in 

the United States.’’ 

Under exception (viii), a DEAregistered pharmacy is excepted from 

the definition of an online pharmacy if 

it dispenses controlled substances via 

the Internet solely by ‘‘refilling 

prescriptions for controlled substances 

in schedule III, IV, or V’’ and ‘‘filling 

new prescriptions for controlled 

substances in schedule III, IV, or V’’ (as 

those terms are defined in the Act). 

Finally, under exception (ix), the DEA 

Administrator and the Secretary of 

Health and Human Services have the 

authority to jointly decide to issue 

regulations making further exceptions to 

the definition of an online pharmacy, 

where they determine that doing so is 

‘‘consistent with effective controls 

against diversion and otherwise 

consistent with the public health and 

safety.’’ Pursuant to this clause, the 

regulations being issued here contain 

two exceptions to the definition of an 

online pharmacy: One relating to 

electronic prescribing of controlled 

substances and the other to the use of 

automated dispensing systems. These 

exceptions are explained below. 

B. In-Person Medical Evaluation 

Requirement 

To directly prohibit what had been 

the practice of many rogue Web sites— 

allowing customers to buy controlled 

substances and/or prescriptions for 

controlled substances via the Internet 

without ever seeing the prescribing 

practitioner in person—the Ryan Haight 

Act includes as one of its central 

features the ‘‘valid prescription’’ 

requirement. This requirement is set 

forth in 21 U.S.C. 829(e)(1): ‘‘No 

controlled substance that is a 

prescription drug as determined under 

the Federal Food, Drug, and Cosmetic 

Act 26 may be delivered, distributed, or 

dispensed by means of the Internet 

without a valid prescription.’’ 

The Act further defines the meaning 

of ‘‘valid prescription’’ in 21 U.S.C. 

829(e)(2)(A): ‘‘The term ‘valid 

prescription’ means a prescription that 

is issued for a legitimate medical 

purpose in the usual course of 

professional practice by—(i) a 

practitioner who has conducted at least 

1 in-person medical evaluation of the 

patient; or (ii) a covering practitioner.’’ 

The Act explains the meaning of ‘‘inperson medical evaluation’’ in 21 U.S.C. 

829(e)(2)(B): 

(i) The term ‘‘in-person medical 

evaluation’’ means a medical evaluation that 

is conducted with the patient in the physical 

presence of the practitioner, without regard 

to whether portions of the evaluation are 

conducted by other health professionals. 

(ii) Nothing in clause (i) shall be construed 

to imply that 1 in-person medical evaluation 

demonstrates that a prescription has been 

issued for a legitimate medical purpose 

within the usual course of professional 

practice. 

Thus, for every controlled substance 

that is delivered, distributed, or 

dispensed by means of the Internet, 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15601 

27For a detailed explanation of the ‘‘legitimate 

medical purpose requirement,’’ see 71 FR 52716, 

52717 (2006 DEA policy statement). See also, 21 

CFR 1306.04(a); United States v. Moore, 423 U.S. 

122 (1975). 

there must be a ‘‘valid prescription,’’ 

which means not only that the 

prescription must comply with the 

longstanding requirement of being 

issued for a legitimate medical purpose 

by a practitioner acting in the usual 

course of professional practice, but also 

that the prescribing practitioner must 

either (i) have conducted at least one inperson medical evaluation of the patient 

or (ii) meet the definition of a ‘‘covering 

practitioner’’ (explained below). Any 

practitioner who writes a prescription 

for a controlled substance that fails to 

comply with this provision of the Act, 

as well as any pharmacy that knowingly 

or intentionally fills such a prescription, 

violates 21 U.S.C. 841(h)(1). 

Hence, the Act makes it unambiguous 

that, except in limited and specified 

circumstances, it is a per se violation of 

the CSA for a practitioner to issue a 

prescription for a controlled substance 

by means of the Internet without having 

conducted at least one in-person 

medical evaluation. However, the Act 

also expressly provides that a 

prescribing practitioner does not 

automatically meet the requirement of 

issuing a prescription for a legitimate 

medical purpose while acting in the 

usual course of professional practice 

merely by having conducted a single inperson medical evaluation of the 

patient. Rather, as with all situations in 

which a prescription for a controlled 

substance is issued, all the facts and 

circumstances surrounding the issuance 

of the prescription must be evaluated in 

determining whether it was issued for a 

legitimate medical purpose by a 

practitioner acting in the usual course of 

professional practice.27 A rogue Internet 

operation cannot, for example, defeat 

the purpose of the Act by establishing 

a method of operation in which a 

practitioner conducts a perfunctory inperson ‘‘evaluation’’ of each ‘‘patient’’ 

simply for the purpose of selling 

prescriptions for controlled substances 

to the patient in perpetuity with no 

follow-up visits. This topic is addressed 

further below in Section VII, which 

provides additional information for 

practitioners. 

With respect to the term ‘‘covering 

practitioner,’’ the Act states (21 U.S.C. 

829(e)(2)(C)): 

The term ‘‘covering practitioner’’ means, 

with respect to a patient, a practitioner who 

conducts a medical evaluation (other than an 

in-person medical evaluation) at the request 

of a practitioner who—(i) has conducted at 

least 1 in-person medical evaluation of the 

patient or an evaluation of the patient 

through the practice of telemedicine, within 

the previous 24 months; and (ii) is 

temporarily unavailable to conduct the 

evaluation of the patient. 

Thus, a prescribing practitioner who 

falls within the above definition of a 

‘‘covering practitioner’’ need not 

conduct an in-person medical 

evaluation as a prerequisite to 

prescribing a controlled substance to a 

given patient, provided that the 

practitioner for whom the covering 

practitioner is covering has conducted 

an in-person medical evaluation of that 

patient and provided further that this 

covering arrangement is taking place on 

only a temporary basis. Moreover, just 

as with the primary practitioner, the 

requirement that the prescription must 

be issued in the usual course of 

professional practice for a legitimate 

medical purpose applies with equal 

force to a ‘‘covering practitioner.’’ 

The Act also provides for an 

exception to the requirement of an inperson medical evaluation for 

practitioners who are engaged in the 

‘‘practice of telemedicine’’ within the 

meaning of the Act. 21 U.S.C. 

829(e)(3)(A). Of course, a practitioner 

engaged in the ‘‘practice of 

telemedicine’’ remains subject to the 

requirement that every prescription for 

a controlled substance be issued for a 

legitimate medical purpose by a 

practitioner acting in the usual course of 

professional practice. The Act provides 

a temporary definition of the ‘‘practice 

of telemedicine’’ pending issuance of 

new regulations addressing 

‘‘telemedicine.’’ The topic of 

‘‘telemedicine’’ is further addressed in 

paragraph D below. 

C. Requirements for Online Pharmacies 

Modified Registration Requirement— 

The Act imposes various requirements 

for those persons and other entities that 

fit within the Act’s definition of an 

online pharmacy. To begin with, an 

online pharmacy may only operate 

lawfully as an online pharmacy if it is 

a DEA-registered pharmacy that has 

obtained from DEA a modification of its 

registration authorizing it to engage in 

such activity. 21 U.S.C. 823(f), 841(h)(1). 

An online pharmacy that is not validly 

registered with a modification 

authorizing it to operate as an online 

pharmacy as required by 21 U.S.C. 

823(f) will violate 21 U.S.C. 841(h)(1) if 

it knowingly or intentionally delivers, 

distributes, or dispenses a controlled 

substance by means of the Internet. 

Moreover, under the Act, the only type 

of online pharmacy that is eligible to 

apply to DEA for such modification of 

registration is a DEA-registered 

pharmacy. 21 U.S.C. 823(f). Thus, any 

person, entity, or Internet site that falls 

within the definition of an online 

pharmacy—and is not a DEA-registered 

pharmacy that has obtained a 

modification of its registration 

authorizing it to operate as an online 

pharmacy—is necessarily violating the 

Act if it knowingly or intentionally 

delivers, distributes, or dispenses a 

controlled substance by means of the 

Internet. 

The regulations being issued here set 

forth the process by which a DEAregistered pharmacy may apply online 

for a modification of its registration 

authorizing it to operate as an online 

pharmacy. Under the Act, DEA must 

base its decision on whether to grant or 

deny such an application for a 

modification of registration on the same 

statutory criteria that it must consider in 

evaluating an application for 

registration submitted by a pharmacy or 

other practitioner. 21 U.S.C. 823(f). 

Reporting Requirement—A pharmacy 

that has obtained a modification of its 

registration authorizing it to dispense 

controlled substances by means of the 

Internet must report to DEA, on a 

monthly basis, the total amount of each 

controlled substance it dispenses. 21 

U.S.C. 827(d)(2). For pharmacies that 

are subject to this requirement, the 

monthly report must include all 

controlled substances dispensed by any 

means—not just controlled substances 

dispensed by means of the Internet. Id. 

However, if a pharmacy with such a 

modified registration dispenses an 

amount that falls below the threshold in 

a given month, it is not required to 

submit a report for that month. Id. The 

monthly threshold is either (A) 100 or 

more prescriptions for controlled 

substances filled by the pharmacy or (B) 

5,000 or more total dosage units of 

controlled substances dispensed. Id. 

Again, these threshold amounts include 

all controlled substances dispensed by 

the pharmacy by any means (through 

walk-in business, by mail, by means of 

the Internet, or otherwise). Id. If the 

pharmacy meets or exceeds either of the 

foregoing amounts in a given month, it 

must report to DEA the total amount of 

controlled substances it dispensed by 

any means during that month. Id. The 

regulations being issued here specify the 

time and manner in which such reports 

must be filed. 

Statements that must appear on an 

online pharmacy’s Web site—Every 

online pharmacy is required under the 

Act to ‘‘display in a visible and clear 

manner on its homepage a statement 

that it complies with the requirements 

of [21 U.S.C. 831] with respect to the 

delivery or sale or offer for sale of 


pwalker on PROD1PC71 with RULES2
15602 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

28A State may bring a civil action in federal court 

to enjoin any violation of the Ryan Haight Act—not 

merely those violations of State law—and to obtain 

other appropriate legal or equitable relief. 21 U.S.C. 

882(c). 

controlled substances and shall at all 

times display on the homepage of its 

Internet site a declaration of compliance 

in accordance with this section.’’ 21 

U.S.C. 831(a). 

In addition, the Act requires every 

online pharmacy to satisfy the following 

requirement relating to what the Act 

refers to as the ‘‘Internet Pharmacy Site 

Disclosure Information.’’ As set forth in 

21 U.S.C. 831(c), each online pharmacy 

shall post in a visible and clear manner 

on the homepage of each Internet site it 

operates, or on a page directly linked 

thereto in which the hyperlink is also 

visible and clear on the homepage, the 

following information for each 

pharmacy that delivers, distributes, or 

dispenses controlled substances 

pursuant to orders made on, through, or 

on behalf of, that Web site: 

• The name and address of the 

pharmacy as it appears on the 

pharmacy’s Drug Enforcement 

Administration Certificate of 

Registration. 

• The pharmacy’s telephone number 

and e-mail address. 

• The name, professional degree, and 

States of licensure of the pharmacist-incharge, and a telephone number at 

which the pharmacist-in-charge can be 

contacted. 

• A list of the States in which the 

pharmacy is licensed to dispense 

controlled substances. 

• A certification that the pharmacy is 

registered under this part to deliver, 

distribute, or dispense by means of the 

Internet controlled substances. 

• The name, address, telephone 

number, professional degree, and States 

of licensure of any practitioner who has 

a contractual relationship to provide 

medical evaluations or issue 

prescriptions for controlled substances, 

through referrals from the Web site or at 

the request of the owner or operator of 

the Web site, or any employee or agent 

thereof. 

• The following statement, unless 

revised by the [DEA Administrator] by 

regulation: ‘‘This online pharmacy will 

only dispense a controlled substance to 

a person who has a valid prescription 

issued for a legitimate medical purpose 

based upon a medical relationship with 

a prescribing practitioner. This includes 

at least one prior in-person medical 

evaluation or medical evaluation via 

telemedicine in accordance with 

applicable requirements of section 309.’’ 

While the foregoing requirements are 

largely self-explanatory, some aspects 

warrant special emphasis. The 

requirement that an online pharmacy 

post the foregoing information ‘‘in a 

visible and clear manner on the 

homepage of each Internet site it 

operates, or on a page directly linked 

thereto in which the hyperlink is also 

visible and clear on the homepage’’ is 

intended to ensure that members of the 

public who visit such Web sites are 

informed about the Ryan Haight Act’s 

core requirements and to ensure that the 

DEA-registered pharmacies and 

prescribing practitioners affiliated with 

the site, if any, are clearly identified. 

Any effort by an online pharmacy to 

hide or reduce the visibility on the Web 

site of this required information will 

subject those responsible to potential 

criminal and civil liability and, in the 

case of DEA registrants, potential loss of 

registration. The required information 

must be displayed ‘‘for each pharmacy 

that delivers, distributes, or dispenses 

controlled substances pursuant to orders 

made on, through, or on behalf of, that 

Web site.’’ Thus, if multiple pharmacies 

dispense controlled substances pursuant 

to orders made on, through, or on behalf 

of, that Web site, each required category 

of information must be displayed for 

each such pharmacy. 

The requirement (under paragraph 

(4)) that an online pharmacy list the 

States in which it is licensed to 

dispense controlled substances is 

designed to ensure that an online 

pharmacy only dispenses controlled 

substances to patients in States in which 

it is authorized to practice pharmacy. 

Dispensing beyond the scope of State 

licensure is one of the recurring 

transgressions of some rogue online 

pharmacies and generally violates State 

law.28

State licensure requirement—The Act 

also requires that online pharmacies 

comply with State licensure 

requirements. Specifically, the Act 

requires that: 

Each online pharmacy shall comply with 

the requirements of State law concerning the 

licensure of pharmacies in each State from 

which it, and in each State to which it, 

delivers, distributes, or dispenses or offers to 

deliver, distribute, or dispense controlled 

substances by means of the Internet, pursuant 

to applicable licensure requirements, as 

determined by each such State. 

21 U.S.C. 831(b). 

Required notification to DEA—The 

Act contains a provision that is 

designed to ensure that DEA, and the 

applicable State boards of pharmacy, are 

aware of the existence of an online 

pharmacy before it commences 

operation. The Act’s notification 

requirements are set forth in 21 U.S.C. 

831(d)(1): 

Thirty days prior to offering a controlled 

substance for sale, delivery, distribution, or 

dispensing, the online pharmacy shall notify 

the [DEA Administrator], in such form and 

manner as the [Administrator] shall 

determine, and the State boards of pharmacy 

in any States in which the online pharmacy 

offers to sell, deliver, distribute, or dispense 

controlled substances. 

Pursuant to this provision, the 

regulations being issued here provide 

that such notification to DEA shall be 

made by the pharmacy as part of the 

process by which it applies to DEA for 

a modification of its registration 

authorizing it to operate as an online 

pharmacy. The Act specifies that the 

foregoing notification must include the 

following information: 

(A) The information required to be posted 

on the online pharmacy’s Internet site under 

[21 U.S.C. 831(c)] and shall notify the [DEA 

Administrator] and the applicable State 

boards of pharmacy, under penalty of 

perjury, that the information disclosed on its 

Internet site under [21 U.S.C. 831(c)] is true 

and accurate; 

(B) The online pharmacy’s Internet site 

address and a certification that the online 

pharmacy shall notify the [Administrator] of 

any change in the address at least 30 days in 

advance; and 

(C) the Drug Enforcement Administration 

registration numbers of any pharmacies and 

practitioners referred to in [21 U.S.C. 831(c)], 

as applicable. 

21 U.S.C. 831(d)(2). 

Thus, the information that an online 

pharmacy is required to post on its Web 

site must also be provided to DEA as 

part of the application for a 

modification of its DEA registration in 

order to satisfy part of the notification 

requirement. 

Declaration of compliance— 

Beginning on the date on which the 

online pharmacy makes the notification 

to DEA required by 21 U.S.C. 831(d), 

and continuing thereafter, it must 

‘‘display on the homepage of its Internet 

site, in such form as the [DEA 

Administrator] shall by regulation 

require, a declaration that it has made 

such notification to the 

[Administrator].’’ 21 U.S.C. 831(e). The 

regulations being issued here specify 

precisely the form in which this 

declaration must be made. 

Additional considerations regarding 

statements, declarations, notifications, 

and disclosures required under the 

Act—As stated in 21 U.S.C. 831(f): ‘‘Any 

statement, declaration, notification, or 

disclosure required under [21 U.S.C. 

831] shall be considered a report 

required to be kept under [the CSA].’’ 

One important effect of this provision is 

that, in conjunction with 21 U.S.C. 

843(a)(4), it is a felony violation of the 

CSA to furnish false or fraudulent 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15603 

29 In addition, the Act lists the following as an 

example of a violation of 21 U.S.C. 841(h)(1): 

‘‘making a material false, fictitious, or fraudulent 

statement or representation in a notification or 

declaration under [21 U.S.C. 831(d) or (e)].’’ 21 

U.S.C. 841(h)(2)(E). Such conduct might also 

subject the offender to liability under 18 U.S.C. 

1001(a). 

30See, e.g., United States v. Rosen, 582 F.2d 1032, 

1036 (5th Cir. 1978). 

31These circumstances are specified in 21 U.S.C. 

829(e) and discussed above. 32Public Law 110–425, section 3(j). 

material information in, or omit any 

material information from, any 

statement, declaration, notification, or 

disclosure required under 21 U.S.C. 

831.29

D. Telemedicine 

As indicated above, ‘‘a practitioner 

engaged in the practice of telemedicine’’ 

within the meaning of the Act is exempt 

from the requirement of an in-person 

medical evaluation as a prerequisite to 

prescribing or otherwise dispensing 

controlled substances by means of the 

Internet. Before explaining the meaning 

of the ‘‘practice of telemedicine,’’ it 

bears repeated emphasis that all 

practitioners who prescribe controlled 

substances—even those engaged in the 

practice of telemedicine—remain 

subject to the requirement that the 

prescription be issued for a legitimate 

medical purpose by a practitioner acting 

in the usual course of professional 

practice. Prescribing a controlled 

substance without conducting an inperson medical evaluation has always 

been, and remains under the Act, a 

strong indication (or ‘‘red flag’’) of likely 

diversion.30 The Act simply made the 

failure to perform an in-person medical 

evaluation in certain circumstances 31

an automatic violation of the CSA, 

while leaving it as a factor indicative of 

possible diversion in all other 

circumstances. 

The definition of the ‘‘practice of 

telemedicine’’ includes seven distinct 

categories that involve circumstances in 

which the prescribing practitioner might 

be unable to satisfy the Act’s in-person 

medical evaluation requirement, yet 

nonetheless has sufficient medical 

information to prescribe a controlled 

substance for a legitimate medical 

purpose in the usual course of 

professional practice. In these 

circumstances, provided certain 

safeguards are in place to ensure that 

the practitioner who is engaged in the 

practice of telemedicine is able to 

conduct a bona fide medical evaluation 

of the patient at the remote location, and 

is otherwise acting in the usual course 

of professional practice, the Act 

contemplates that the practitioner will 

be permitted to prescribe controlled 

substances by means of the Internet 

despite not having conducted an inperson medical evaluation. The Act 

defines these categories, through the 

definition of ‘‘practice of telemedicine,’’ 

which is set forth in 21 U.S.C. 802(54). 

The Act specifies that the definition 

of the ‘‘practice of telemedicine’’ found 

in 21 U.S.C. 802(54) does not take effect 

at the same time the rest of the Act takes 

effect (April 13, 2009). Rather, the Act 

provides for a temporary definition of 

the ‘‘practice of telemedicine’’ that will 

apply beginning April 13, 2009, and 

continuing until the earlier of two dates: 

(i) three months after the date on which 

regulations are promulgated to carry out 

21 U.S.C. 831(h) [relating to the 

issuance of a special registration to 

practice telemedicine] or (ii) January 15, 

2010.32 Until the first of the foregoing 

two dates is reached, the Act states that 

the following definition applies: 

[T]he term ‘‘practice of telemedicine’’ 

means the practice of medicine in accordance 

with applicable Federal and State laws by a 

practitioner (as that term is defined in section 

102 of the Controlled Substances Act (21 

U.S.C. 802)) (other than a pharmacist) who is 

at a location remote from the patient and is 

communicating with the patient, or health 

care professional who is treating the patient, 

using a telecommunications system referred 

to in section 1834(m) of the Social Security 

Act (42 U.S.C. 1395m(m)), if the practitioner 

is using an interactive telecommunications 

system that satisfies the requirements of 

section 410.78(a)(3) of title 42, Code of 

Federal Regulations. 

The rule being issued today contains 

both definitions of the practice of 

telemedicine (temporary and 

permanent), with the respective 

effective dates indicated. 

Special registration for telemedicine— 

A practitioner who is engaged in the 

practice of telemedicine within the 

meaning of the Act is not subject to the 

mandatory in-person medical evaluation 

requirement of 21 U.S.C. 829(e) 

(although such practitioner remains 

subject to the requirement that all 

prescriptions for controlled substances 

be issued for a legitimate medical 

purpose). The Act’s permanent 

definition of the ‘‘practice of 

telemedicine’’ includes, as an example, 

‘‘a practitioner who has obtained from 

the [DEA Administrator] a special 

registration under [21 U.S.C. 831(h)].’’ 

21 U.S.C. 802(54)(E). The Act specifies 

certain criteria that DEA must consider 

when evaluating an application for such 

a registration. However, the Act 

contemplates that DEA must issue 

certain regulations to effectuate this 

special registration provision. 

Specifically, the Act states: ‘‘The [DEA 

Administrator] shall, with the 

concurrence of the Secretary [of Health 

and Human Services], promulgate 

regulations specifying the limited 

circumstances in which a special 

registration under [21 U.S.C. 831(h)] 

may be issued and the procedures for 

obtaining such a special registration.’’ 

DEA will issue a separate rule 

promulgating regulations consistent 

with this directive. As explained above, 

until such regulations are promulgated, 

or until January 15, 2010 (whichever 

comes first), the temporary definition of 

the practice of telemedicine recited 

above remains in effect. 

E. Exemptions for Electronic Prescribing 

of Controlled Substances and 

Automated Dispensing Systems 

Electronic prescribing of controlled 

substances—On June 27, 2008, DEA 

published in the Federal Register a 

Notice of Proposed Rulemaking that 

would amend the DEA regulations to 

allow practitioners to electronically 

prescribe controlled substances (73 FR 

36722). DEA is currently developing a 

final rule on electronic prescribing of 

controlled substances that takes into 

account the numerous public comments 

that were submitted in response to the 

proposed rule. Once the rule is finalized 

and published in the Federal Register, 

practitioners will be permitted to 

electronically prescribe controlled 

substances in accordance with the 

requirements in the regulations. In most 

cases, electronic prescribing of 

controlled substances will occur by 

means of the Internet. Given the Act’s 

definitions, a pharmacy that knowingly 

or intentionally fills an electronic 

prescription for a controlled substance 

would (in the likely event that such an 

electronic prescription were transmitted 

via the Internet) fall within the Act’s 

definition of an online pharmacy. 

As indicated above, the Act gives the 

DEA Administrator, acting jointly with 

the Secretary of Health and Human 

Services, authority to exempt by 

regulation certain persons from the 

definition of an ‘‘online pharmacy,’’ 

where the Administrator and the 

Secretary have found that doing so is 

‘‘consistent with effective controls 

against diversion and otherwise 

consistent with the public health and 

safety.’’ 21 U.S.C. 802(52)(B)(ix). 

Pursuant to this authority, the 

regulations being issued here today 

contain a provision that exempts from 

the definition of an online pharmacy 

any DEA-registered pharmacy ‘‘whose 

delivery, distribution, or dispensing of 

controlled substances by means of the 

Internet consists solely of * * * filling 

prescriptions that were electronically 

prescribed in a manner authorized by 


pwalker on PROD1PC71 with RULES2
15604 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

this chapter and otherwise in 

compliance with the Act.’’ 21 CFR 

1300.04(h)(9). To eliminate any possible 

confusion as to how this exception 

applies, this provision of the regulations 

further states: ‘‘A registered pharmacy 

will be deemed to meet this exception 

if, in view of all of its activities other 

than [the acceptance of electronic 

prescriptions for controlled substances 

transmitted in accordance with the 

requirements of this chapter], it would 

fall outside the definition of an online 

pharmacy.’’ A DEA-registered pharmacy 

that is so exempted from the definition 

of an online pharmacy is not required to 

obtain a modified registration and is not 

subject to the reporting requirement of 

21 U.S.C. 827(d)(2) or the additional 

requirements relating to online 

pharmacies set forth in 21 U.S.C. 831. 

It should be understood that the 

exception provided in 21 CFR 

1300.04(h)(9) cannot take effect until 

DEA issues regulations allowing for the 

electronic prescribing of controlled 

substances. Until then, electronic 

prescribing of controlled substances is 

not permitted by the DEA regulations 

and thus cannot form the basis for any 

exception to the requirement of a 

modified registration for DEA-registered 

pharmacies. 

It should also be clear from the 

language of 21 CFR 1300.04(h)(9) that 

this exception provides no loophole for 

operators of rogue Internet Web sites or 

unscrupulous pharmacies that fill 

prescriptions generated through such 

sites. The mere fact that a pharmacy 

accepts electronic prescriptions does 

not, in any way, immunize the 

pharmacy from the requirements of the 

Act. Likewise, a rogue Web site that 

operates in violation of the Act cannot 

escape liability simply by having either 

(i) unscrupulous practitioners who have 

a contract to write prescriptions on 

behalf of the site issue such 

prescriptions electronically or (ii) 

unscrupulous pharmacies that have a 

contract to fill such prescriptions do so 

through the acceptance of electronic 

prescriptions. To the contrary, the 

regulation is written so that the 

exception cannot possibly be utilized by 

a rogue Web site; only a DEA-registered 

pharmacy is eligible for the exception 

and only to the extent it is otherwise 

acting in conformity with the CSA and 

the DEA regulations. 

Exemption for automated dispensing 

systems—Under current DEA 

regulations, a DEA-registered retail 

pharmacy may install and operate an 

automated dispensing system at a long 

term care facility under certain specified 

conditions. 21 CFR 1301.27. Among 

other requirements, any retail pharmacy 

that installs and operates an automated 

dispensing system at a long term care 

facility must maintain a separate 

registration at each long term care 

facility in which its automated 

dispensing systems are located. Id. 

Prescription information may be 

transmitted by the retail pharmacy to 

the automated dispensing system via the 

Internet. Therefore, a pharmacy that 

operates an automated dispensing 

system at a long term care facility could 

potentially fall within the Act’s 

definition of an online pharmacy. 

Pursuant to 21 U.S.C. 802(52)(B)(ix), the 

DEA Administrator and the Secretary 

have jointly concluded that it would be 

consistent with effective controls 

against diversion and otherwise 

consistent with the public health and 

safety to issue the following exemption. 

As set forth in 21 CFR 1300.04(h)(10), if 

a DEA-registered retail pharmacy does 

not deliver, distribute, or dispense, or 

offer to deliver, distribute, or dispense, 

controlled substances by means of the 

Internet, other than to communicate 

prescription information to an 

automated dispensing system for which 

it holds a separate registration at a long 

term care facility, that retail pharmacy 

is exempted from the definition of an 

online pharmacy. As a result, such a 

pharmacy is not required to obtain a 

modified registration and is not subject 

to the reporting requirement of 21 

U.S.C. 827(d)(2) or the additional 

requirements relating to online 

pharmacies set forth in 21 U.S.C. 831. 

VI. Criminal Provisions of the Ryan 

Haight Act 

The Ryan Haight Act adds two new 

criminal offenses to the CSA. The first 

new offense is set forth in 21 U.S.C. 

841(h)(1), which states: 

It shall be unlawful for any person to 

knowingly or intentionally– 

(A) Deliver, distribute, or dispense a 

controlled substance by means of the 

Internet, except as authorized by [the CSA]; 

or 

(B) Aid or abet (as such terms are used in 

section 2 of title 18, United States Code) any 

activity described in subparagraph (A) that is 

not authorized by [the CSA]. 

The Act contains specific examples of 

conduct which would violate 21 U.S.C. 

841(h)(1). These examples in the Act, 

however, are not an exclusive list of the 

types of conduct that constitute 

violations of 21 U.S.C. 841(h)(1). With 

this proviso made clear, 21 U.S.C. 

841(h)(2) lists the following as examples 

of violations: 

(A) Delivering, distributing, or dispensing 

a controlled substance by means of the 

Internet by an online pharmacy that is not 

validly registered with a modification 

authorizing such activity as required by [21 

U.S.C. 823(f)] (unless exempt from such 

registration); 

(B) Writing a prescription for a controlled 

substance for the purpose of delivery, 

distribution, or dispensation by means of the 

Internet in violation of [21 U.S.C. 829(e)]; 

(C) Serving as an agent, intermediary, or 

other entity that causes the Internet to be 

used to bring together a buyer and seller to 

engage in the dispensing of a controlled 

substance in a manner not authorized by [21 

U.S.C. 823(f) or 829(e)]; 

(D) Offering to fill a prescription for a 

controlled substance based solely on a 

consumer’s completion of an online medical 

questionnaire; and 

(E) Making a material false, fictitious, or 

fraudulent statement or representation in a 

notification or declaration under [21 U.S.C. 

831(d) or (e)]. 

As these examples are largely selfilluminating, and some have already 

been addressed in this preamble, only 

limited further amplification is 

provided here. Paragraph (C), in 

particular, reflects that the Act was 

intended not only to prohibit DEA 

registrants from using the Internet to 

facilitate the unlawful dispensing of 

controlled substances, but to also 

prohibit non-DEA registrants from doing 

so. Most notably, paragraph (C) is aimed 

squarely at the criminal facilitator 

whose ‘‘business plan’’ for operating a 

rogue online pharmacy is to recruit an 

unscrupulous practitioner to write 

prescriptions based on insufficient or 

nonexistent medical evaluations and/or 

an unscrupulous pharmacist to fill such 

prescriptions. 

The Act contains certain categories of 

conduct that do not result in the 

participants falling within the Act’s 

definition of an online pharmacy. 

Specifically, 21 U.S.C. 841(h)(3) states: 

(A) This subsection [21 U.S.C. 

841(h)(1)] does not apply to: 

(i) The delivery, distribution, or 

dispensation of controlled substances by 

nonpractitioners to the extent authorized by 

their registration under [the CSA]; 

(ii) The placement on the Internet of 

material that merely advocates the use of a 

controlled substance or includes pricing 

information without attempting to propose or 

facilitate an actual transaction involving a 

controlled substance; or 

(iii) except as provided in subparagraph 

(B), any activity that is limited to— 

(I) the provision of a telecommunications 

service, or of an Internet access service or 

Internet information location tool (as those 

terms are defined in section 231 of the 

Communications Act of 1934) [47 U.S.C. 

231]; or 

(II) the transmission, storage, retrieval, 

hosting, formatting, or translation (or any 

combination thereof) of a communication, 

without selection or alteration of the content 

of the communication, except that deletion of 

a particular communication or material made 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15605 

33Under the CSIEA, the importation of controlled 

substances into the United States is prohibited 

except by persons registered with DEA to do so or 

persons exempted from such requirement. 21 U.S.C. 

952, 957, 960. In accordance with the CSIEA, DEA 

has issued a regulation authorizing a person to 

import certain controlled substances for personal 

medical use, provided the person has the drugs in 

his possession upon entering the United States, 

makes the required declaration to the U.S. Customs 

and Border Protection, and otherwise complies 

fully with the requirements of the regulation. 21 

CFR 1301.26; 69 FR 55343 (2004). Under no 

circumstances is it permissible under the CSIEA or 

the regulations for a person to have controlled 

substances shipped into the United States for 

personal medical use. 

34United States v. Katz, 445 F.3d 1023, 1031 (8th 

Cir. 2006), cert. denied, 127 S.Ct. 421 (2006). 

35United States v. Lawson, 682 F.2d 480, 482 (4th 

Cir. 1982) (citations omitted), cert. denied, 459 U.S. 

991 (1982). 

by another person in a manner consistent 

with section 230(c) of the Communications 

Act of 1934 [47 U.S.C. 230(c)] shall not 

constitute such selection or alteration of the 

content of the communication. 

(B) The exceptions under subclauses (I) 

and (II) of subparagraph (A)(iii) shall not 

apply to a person acting in concert with a 

person who violates paragraph (1). 

Thus, paragraph (A)(i) allows DEAregistered nonpractitioners (such as 

manufacturers and distributors) to 

utilize the Internet in carrying out 

activities authorized by their DEA 

registrations (and otherwise in 

conformity with the CSA) without being 

subject to liability under 21 U.S.C. 

841(h)(1). Paragraph (A)(ii) allows for 

Web sites that advocate the use of 

controlled substances or contain pricing 

information ‘‘without attempting to 

propose or facilitate an actual 

transaction involving a controlled 

substance.’’ Paragraph (A)(iii) exempts 

from application of 21 U.S.C. 841(h)(1) 

Internet service providers, Web hosting 

services, and certain other specified 

entities that do not alter content of 

Internet transmissions. However, it is 

crucial to bear in mind that the 

exception of paragraph (A)(iii) does not 

apply to ‘‘a person acting in concert 

with a person who violates [21 U.S.C. 

841(h)(1)].’’ Thus, any person whose 

conduct would be sufficient to prove 

that he conspired to violate 21 U.S.C. 

841(h)(1), or aided and abetted such 

violation, is not immune from 

prosecution under paragraph (A)(iii). 

The second new criminal offense 

added by the Act is 21 U.S.C. 

843(c)(2)(A). This provision expressly 

prohibits using the Internet to advertise 

illegal transactions in controlled 

substances. Specifically, this provision 

states: 

It shall be unlawful for any person to 

knowingly or intentionally use the Internet, 

or cause the Internet to be used, to advertise 

the sale of, or to offer to sell, distribute, or 

dispense, a controlled substance where such 

sale, distribution, or dispensing is not 

authorized by [the CSA] or by the Controlled 

Substances Import and Export Act. 

The Act further states: 

Examples of activities that violate [21 

U.S.C. 843(c)(2)(A)] include, but are not 

limited to, knowingly or intentionally 

causing the placement on the Internet of an 

advertisement that refers to or directs 

prospective buyers to Internet sellers of 

controlled substances who are not registered 

with a modification under [21 U.S.C. 823(f)]. 

Thus, for example, it is unlawful under 

the Act to knowingly or intentionally 

place an advertisement on the Internet 

that directs persons to a Web site that 

sells prescriptions for controlled 

substances where the operator of the 

Web site is not a DEA-registered 

pharmacy with a modification 

authorizing it to operate as an online 

pharmacy. As another example, it is 

unlawful under the Act to knowingly or 

intentionally place an advertisement on 

the Internet that offers to sell a 

controlled substance without a 

prescription or that directs persons to a 

Web site through which a controlled 

substance may be purchased without a 

prescription. 

Two important points should be 

noted with respect to 21 U.S.C. 

843(c)(2)(A). First, to establish a 

violation of this felony provision, it is 

not necessary that the person placing 

the advertisement actually engage in a 

transaction involving a controlled 

substance. Rather, merely placing on the 

Internet an advertisement that is 

designed to facilitate, or offers to 

facilitate, an illegal sale of a controlled 

substance is sufficient to violate 21 

U.S.C. 843(c)(2)(A). Second, the Act 

applies to advertisements relating to 

violations not only of the CSA, but also 

of the Controlled Substances Import and 

Export Act (CSIEA, which is found in 21 

U.S.C. 951 through 971). Thus, it is a 

violation of 21 U.S.C. 843(c)(2)(A) to 

place an advertisement on the Internet 

that offers, for example, to ship 

controlled substances into the United 

States for personal medical use, since 

doing so would violate the 

CSIEA.33 What It Means to ‘‘Knowingly 

or intentionally deliver, distribute, or 

dispense a controlled substance by 

means of the Internet.’’ 

The Ryan Haight Act is structured 

around the phrase ‘‘knowingly or 

intentionally deliver, distribute, or 

dispense a controlled substance by 

means of the Internet.’’ The meaning of 

this phrase is therefore essential to the 

meaning of the Act. To explain its 

meaning, it is helpful to divide the 

phrase into two parts, starting with the 

latter half (‘‘deliver, distribute, or 

dispense a controlled substance by 

means of the Internet’’). The Act itself 

contains the following definition: 

The term ‘‘deliver, distribute, or dispense 

by means of the Internet’’ refers, respectively, 

to any delivery, distribution, or dispensing of 

a controlled substance that is caused or 

facilitated by means of the Internet. 

21 U.S.C. 802(51) (emphasis added). 

Given that the phrase ‘‘deliver, 

distribute, or dispense by means of the 

Internet’’ has the foregoing definition, 

the next question is: What does it mean 

to ‘‘knowingly or intentionally’’ deliver, 

distribute, or dispense a controlled 

substance by means of the Internet? 

The phrase ‘‘knowingly or 

intentionally’’ has been a part of the 

CSA since its enactment in 1970. 

Among other provisions, 21 U.S.C. 

841(a)(1) (the most widely utilized 

criminal provision of the CSA) makes it 

an offense to ‘‘knowingly or 

intentionally * * * manufacture, 

distribute, or dispense, or possess with 

intent to manufacture, distribute, or 

dispense, a controlled substance’’ 

except as authorized by the CSA. There 

are numerous reported federal cases, 

some of which are discussed below, in 

which practitioners and pharmacists 

have been convicted of violating 21 

U.S.C. 841(a)(1). These cases establish 

clear precedent for interpreting the 

phrase ‘‘knowingly or intentionally’’ in 

the context of practitioners who 

unlawfully prescribe controlled 

substances and pharmacists who 

unlawfully fill prescriptions for 

controlled substances. Specifically, a 

practitioner may be convicted of 

knowingly or intentionally dispensing 

controlled substances in violation of the 

CSA where the practitioner either (i) 

had actual knowledge of the illegal 

activity or (ii) was presented with facts 

that put him on notice that criminal 

activity was particularly likely and yet 

intentionally failed to investigate those 

facts.34 The following statement by one 

federal court of appeals exemplifies the 

standard under which pharmacists may 

be held liable for knowingly or 

intentionally dispensing controlled 

substances in violation of the CSA: 

The question, then, in any case where a 

pharmacist is charged with illegal 

distribution of controlled substances, is 

whether he knew that the purported 

prescription was not issued for a legitimate 

medical purpose or in the usual course of 

medical practice. The key element of 

knowledge may be shown by proof that the 

defendant deliberately closed his eyes to the 

true nature of the prescription.35

Another federal court has similarly 

stated that a pharmacist may be 


pwalker on PROD1PC71 with RULES2
15606 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

36United States v. Veal, 23 F.3d 985, 988 (6th Cir. 

1994). 37Katz, 445 F.3d at 1031. 38See 21 CFR 1306.04(a). 

convicted of unlawfully dispensing 

controlled substances where the 

evidence establishes that the pharmacist 

‘‘deliberately closed his eyes to 

wrongdoing that should have been 

obvious to him.’’36 Courts have referred 

to such conduct as ‘‘willful blindness’’ 

or ‘‘deliberate ignorance.’’ As one court 

has stated: 

Ignorance is deliberate if the defendant was 

presented with facts that put her on notice 

that criminal activity was particularly likely 

and yet she intentionally failed to investigate 

those facts.* * * If, in light of certain 

obvious facts, reasonable inferences support 

a finding that a defendant’s failure to 

investigate is equivalent to ‘burying one’s 

head in the sand,’ the jury may consider 

willful blindness as a basis for knowledge.37

Thus, a pharmacist who fills a 

prescription that was issued in violation 

of any provision of the Act may be held 

criminally liable under 21 U.S.C. 

841(h)(1) if he did so knowingly or 

intentionally—that is, if he either (i) had 

actual knowledge of the violation or (ii) 

deliberately disregarded facts that 

would have led a reasonable pharmacist 

to be highly suspicious about the 

likelihood of such a violation. Likewise, 

a practitioner who writes a prescription 

in violation of the Act may be held 

criminally liable under 21 U.S.C. 

841(h)(1) if he did so knowingly or 

intentionally—which can be proven by 

showing that either (i) the practitioner 

had actual knowledge of the violation or 

(ii) the practitioner deliberately 

disregarded facts that would have led a 

reasonable practitioner to be highly 

suspicious about the likelihood of such 

a violation. 

VII. Additional Information About the 

Ryan Haight Act for Pharmacists, 

Practitioners, Other Registrants, and 

Members of the Public 

This section provides additional 

information specifically tailored to 

various categories of persons who are 

likely to be affected by, or otherwise 

have an interest in, the Ryan Haight Act. 

This information must be read in 

conjunction with the general 

information explaining the Act provided 

above. For example, the definitions of 

the terminology used in the Act will not 

be repeated in this section (due to their 

length) and should be reviewed as 

necessary by returning to the 

appropriate sections of the preamble. 

A. Additional Specific Information for 

Pharmacists 

If you are a pharmacist, and your 

DEA-registered pharmacy falls within 

the definition of an ‘‘online pharmacy,’’ 

your pharmacy must, beginning on 

April 13, 2009, obtain from DEA a 

modification of its registration 

authorizing it to operate as an online 

pharmacy. (DEA will issue to the 

pharmacy a Certificate of Registration 

indicating the modification of 

registration.) The Ryan Haight Act 

contains several exceptions to the 

definition of an online pharmacy, so 

you should review carefully these 

exceptions before submitting an 

application for such modification of 

registration. Among other things, 

particular consideration should be given 

to the exception set forth in 21 U.S.C. 

802(52)(B)(viii) that excludes from the 

definition of an online pharmacy those 

DEA-registered pharmacies ‘‘whose 

dispensing of controlled substances via 

the Internet consists solely of * * * (I) 

refilling prescriptions for controlled 

substances in schedule III, IV, or V, as 

defined in paragraph [21 U.S.C. 802(55)] 

or (II) filling new prescriptions for 

controlled substances in schedule III, 

IV, or V, as defined in paragraph [21 

U.S.C. 802(56)].’’ 

Also, the regulations being issued 

here exempt from the definition of 

online pharmacy any registered 

pharmacy ‘‘whose delivery, distribution, 

or dispensing of controlled substances 

by means of the Internet consists solely 

of * * * filling prescriptions that were 

electronically prescribed in a manner 

authorized by this chapter and 

otherwise in compliance with the Act.’’ 

Given these exceptions to the definition 

of an online pharmacy, DEA anticipates 

that the overwhelming majority of 

pharmacies in the United States, if they 

follow their current practices, will not, 

as of April 13, 2009, fall within the 

definition of an online pharmacy. 

However, as of April 13, 2009, if a 

pharmacist knowingly or intentionally 

dispenses a controlled substance by 

means of the Internet, and the pharmacy 

fits within the definition of an online 

pharmacy, but does not hold a modified 

DEA registration authorizing it to 

operate as an online pharmacy, the 

pharmacy and the pharmacist are 

violating 21 U.S.C. 841(h)(1) and subject 

to potential criminal prosecution and 

loss of the pharmacy’s DEA registration. 

Accordingly, if the anticipated activities 

of your pharmacy will render it an 

online pharmacy within the meaning of 

the Act, you should submit to DEA your 

application for a modified registration 

as early as possible, since you will not 

be permitted to engage in the activities 

of an online pharmacy until DEA has 

approved such application. To expedite 

matters, DEA has established an online 

application process for registrants to 

apply for such modification of 

registration. 

In addition, as explained earlier in 

this preamble, any pharmacy that fits 

within the Act’s definition of an online 

pharmacy must display certain 

information on its Web site and make 

certain notifications to DEA, as required 

by the Act and the regulations being 

issued here. Also, if a pharmacy has 

applied for and been granted a 

modification of its registration 

authorizing it to operate as an online 

pharmacy, it is obligated to submit 

monthly reports of all controlled 

substances dispensed by any means 

(walk-in business, dispensing by mail, 

or any other type of dispensing— 

whether by means of the Internet or 

not), provided such dispensing meets or 

exceeds the threshold amounts. 

A pharmacist has always had a 

corresponding responsibility to ensure 

that any dispensing of controlled 

substances conforms with the CSA and 

DEA regulations.38 That same 

corresponding responsibility now 

applies with respect to the new 

requirements of the Ryan Haight Act 

and the implementing regulations. That 

is, a pharmacist’s corresponding 

responsibility now includes ensuring 

that controlled substances are dispensed 

in conformity with the Ryan Haight Act. 

For example, under the Act, a 

pharmacist may not knowingly or 

intentionally fill a prescription for a 

controlled substance that was issued in 

violation of the inperson medical 

evaluation requirement of 21 U.S.C. 

829(e). 

How does a pharmacist, when 

presented with a prescription (whether 

it is a written prescription presented in 

person, an oral prescription, a faxed 

prescription, or otherwise) know 

whether the prescription was 

‘‘dispensed by means of the Internet,’’ 

and thus subject to the requirements of 

the Act? Again, under the law, a 

pharmacist has a corresponding 

responsibility to ensure that any 

prescription filled was issued in 

conformity with the law and 

regulations. The same legal standard 

that has always applied in determining 

whether a pharmacist met this 

responsibility will also apply in 

determining whether the pharmacist 

acted properly in filling a prescription 

subject to the requirements of the Ryan 

Haight Act. If the pharmacist either (i) 

had actual knowledge that the 

prescription was issued by means of the 

Internet and that the requirements of the 

Act were not met or (ii) in view of all 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15607 

39As discussed above, the electronic prescribing 

of controlled substances is not currently permitted 

under the DEA regulations, but DEA has proposed 

regulations that, once finalized, will allow such 

practice. The electronic prescribing of controlled 

substances through use of the Internet does, as 

explained above, constitute delivering, distributing, 

or dispensing controlled substances by means of the 

Internet. Nonetheless, since the overwhelming 

majority of practitioners only prescribe controlled 

substances to patients for whom they have 

conducted an in-person medical evaluation, and 

only for a legitimate medical purpose in the usual 

course of professional practice, it is anticipated that 

the overwhelming majority of practitioners will 

continue this practice once electronic prescribing of 

controlled substances becomes permissible under 

the DEA regulations. If so, such practitioners would 

satisfy the ‘‘valid prescription’’ requirement of the 

Ryan Haight Act. 

the circumstances surrounding a 

particular prescription, and, in the 

exercise of proper professional practice, 

should have known of such violation, or 

deliberately closed his eyes to 

circumstances indicative of a possible 

violation, or otherwise failed to take 

appropriate steps that a professional 

pharmacist should take to investigate 

suspicious circumstances, the pharmacy 

and pharmacist may be deemed to have 

knowingly or intentionally violated 21 

U.S.C. 841(h)(1). 

Depending on the circumstances, the 

relevant factors for this inquiry might 

include: the number of prescriptions 

received from a practitioner; the 

practitioner’s pattern of prescribing; the 

address of the patient in relation to that 

of the practitioner; and the distance 

from the practitioner to the pharmacy. 

If, taking factors such as these into 

account, the pharmacist either (a) 

actually knows that the patient to whom 

a prescription for a controlled substance 

was issued was steered to the 

practitioner through a Web site or (b) 

should reasonably suspect so and fails 

to verify, the pharmacist who fills such 

a prescription will have knowingly or 

intentionally dispensed a controlled 

substance by means of the Internet. If 

such dispensing occurs, both the 

pharmacy and the pharmacist fall 

within the definition of an online 

pharmacy, and both will automatically 

violate 21 U.S.C. 841(h)(1) if the 

pharmacy does not have a modified 

DEA registration authorizing it to 

operate as an online pharmacy. Again, 

such a violation, or any other 

transgression by a pharmacist of the 

corresponding responsibility as it 

pertains to the requirements of the Act 

may result in criminal prosecution of 

the pharmacist and/or administrative 

proceedings to revoke the pharmacy’s 

registration. 

Pharmacists should also note that the 

new requirements of the Act are in 

addition to, and not in lieu of, the 

longstanding requirement that all 

prescriptions for controlled substances 

be issued by a practitioner acting in the 

usual course of professional practice 

and otherwise in conformity with the 

CSA and DEA regulations. Thus, when 

a prescription for a controlled substance 

has been issued by means of the 

Internet, even if the pharmacy that fills 

the prescription has obtained from DEA 

a modification of its registration, and 

even if the pharmacist has confirmed 

that the prescribing practitioner has 

conducted at least one in-person 

medical evaluation of the patient, the 

pharmacist still has the corresponding 

responsibility to ensure that the 

prescription was issued for a legitimate 

medical purpose in the usual course of 

professional practice. For example, if 

the pharmacist knows that a 

prescription for a controlled substance 

was issued by a practitioner who works 

for a Web site that sends its customers 

to practitioners for a one-time sham 

medical evaluation with the intent to 

sell prescriptions to the customers 

repeatedly thereafter with no in-person 

follow-up evaluations, the fact that the 

practitioner conducted an in-person 

‘‘evaluation’’ purporting to comply with 

the Act does not excuse the pharmacist 

from fulfilling his corresponding 

responsibility to fill only those 

prescriptions for controlled substances 

that were issued for a legitimate medical 

purpose in the usual course of 

professional practice. 

To list another common practice of 

rogue Internet site operators, if you are 

an owner of a pharmacy and you are 

approached by an ‘‘entrepreneur’’ who 

offers to funnel to you large quantities 

of prescriptions for filling in exchange 

for a fee, there is a strong possibility that 

you are being asked to serve as the 

supplier to a rogue Web site. This is 

especially so if such ‘‘entrepreneur’’ is 

not affiliated with a legitimate health 

care organization. Again, the rogue Web 

sites that the Act was designed to 

eliminate often depend on the 

assistance of DEA-registered 

pharmacies. If you as a pharmacy owner 

or pharmacist are asked to participate in 

a scheme that raises suspicions about 

compliance with the Act, you are 

risking potential criminal liability and 

loss of DEA registration if you agree to 

participate without taking reasonable 

steps to rule out the possibility that the 

scheme will violate the Act. 

A pharmacist is not, however, 

obligated to know what cannot be 

known through the exercise of sound 

professional pharmacy practice. For 

example, it is conceivable that a 

customer could walk into a pharmacy 

with a prescription that was issued by 

means of the Internet (or such a 

prescription could be faxed to a 

pharmacy) with the pharmacist having 

no reasonable basis to know or suspect 

that it was issued by means of the 

Internet. As long as the pharmacist 

meets his corresponding responsibility 

to take reasonable steps under the 

circumstances to ensure that the 

prescription was issued in accordance 

with the requirements of the Ryan 

Haight Act (as well as all other 

applicable requirements of the CSA and 

DEA regulations), the pharmacist will 

not be held strictly liable for filling a 

prescription that he could not 

reasonably have known was issued by 

means of the Internet. Thus, it is 

absolutely unnecessary for a pharmacy 

to apply for a modification of its DEA 

registration authorizing it to operate as 

an online pharmacy for the sole purpose 

of ensuring that it does not—despite the 

exercise of sound professional 

judgment—inadvertently fill a 

prescription that was issued by means 

of the Internet. 

B. Additional Specific Information for 

Practitioners 

If you are a physician, dentist, 

veterinarian, mid-level practitioner, or 

other practitioner registered with DEA 

to prescribe, administer, or dispense 

controlled substances, and your 

activities involving controlled 

substances are limited to those 

authorized by your registration, you are 

exempted under the Ryan Haight Act 

from the definition of an ‘‘online 

pharmacy.’’ As a result, you are not 

subject to the requirement of obtaining 

a modified DEA registration that applies 

to pharmacies that dispense controlled 

substances by means of the Internet. 

Nonetheless, there are other 

requirements of the Act and the 

implementing regulations that, 

depending on the nature of your 

practice, might apply to you. 

DEA believes that the overwhelming 

majority of practitioners in the United 

States, based on their current practices, 

do not engage in activities that 

constitute delivering, distributing, or 

dispensing controlled substances by 

means of the Internet.39 Accordingly, 

the overwhelming majority of 

practitioners need not change their 

practices because of the enactment of 

the Ryan Haight Act. However, if you 

are a DEA-registered practitioner who 

prescribes or otherwise dispenses a 

controlled substance by means of the 

Internet, you must comply with the 

provisions of the Act that apply to you. 

First, if you are a DEA-registered 

practitioner who prescribes or otherwise 

dispenses a controlled substance by 

means of the Internet, you must comply 


pwalker on PROD1PC71 with RULES2
15608 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

40 71 FR 52716, 52719 & 52723 (2006 DEA policy 

statement). 

41As stated in 21 CFR 1304.50: ‘‘For a Web site 

to identify itself as being exempt from the definition 

of an online pharmacy by virtue of section 

102(52)(B)(ii) of the Act (21 U.S.C. 802(52)(B)(ii)), 

the Web site shall post in a visible and clear manner 

on its homepage, or on a page directly linked 

thereto in which the hyperlink is also visible and 

clear on the homepage, a list of the DEA-registered 

nonpharmacy practitioners who are affiliated with 

the Web site. Any nonpharmacy practitioner 

affiliated with such a Web site is responsible for 

compliance with this section. An institutional 

practitioner that otherwise complies with the 

requirements of the Act and this chapter will be 

deemed to meet the requirements of this section if, 

in lieu of posting the names of each affiliated 

individual practitioner, it posts its name (as it 

appears on its Certificate of Registration) in a visible 

and clear manner on its homepage and in a manner 

that identifies itself as being responsible for the 

operation of the Web site.’’ 

42 21 U.S.C. 831(c)(6). 

43Such an arrangement whereby compensation is 

based primarily or exclusively on the number of 

prescriptions for controlled substances issued is a 

‘‘red flag’’ indicating that diversion of controlled 

substances into illicit channels might be 

occurring—regardless of whether the Internet is 

involved. 

44See 21 U.S.C. 802(51), 802(52), 823(f), & 

841(h)(1). 

with the provision of the Act relating to 

the in-person medical evaluation 

requirement, which is set forth in 21 

U.S.C. 829(e). Certain exceptions apply 

to this requirement, as are discussed 

above in this preamble. Note, however, 

that the Act expressly states that 

compliance by a practitioner with the 

in-person medical evaluation 

requirement does not, by itself, satisfy 

the requirement that every prescription 

be issued for a legitimate medical 

purpose in the usual course of 

professional practice. Whether a 

prescription was issued for a legitimate 

medical purpose in the usual course of 

professional practice must, as always, be 

determined based on the totality of the 

circumstances under which a particular 

prescription was issued to a particular 

patient. As DEA has previously stated, 

‘‘DEA recognizes that the overwhelming 

majority of American physicians who 

prescribe controlled substances do so 

for legitimate medical purposes [and] 

exercise the appropriate degree of 

medical supervision—as part of their 

routine practice during office visits.’’40

However, this favorable characterization 

cannot be applied to the very small 

percentage of practitioners who write 

prescriptions on behalf of rogue Internet 

Web sites. Indeed, the main reason 

Congress enacted the Ryan Haight Act 

was to bring an end to the rogue Web 

sites that hire unscrupulous 

practitioners to write prescriptions 

without a legitimate medical purpose 

and outside the usual course of 

professional practice. 

If you are a practitioner who 

knowingly or intentionally prescribes or 

otherwise dispenses controlled 

substances on behalf of a particular Web 

site, and if that Web site is not 

compliant with the requirements of the 

Act and the implementing regulations, 

you are dispensing controlled 

substances by means of the Internet in 

a manner not authorized by the Act. 

Doing so constitutes a violation of 21 

U.S.C. 841(h)(1) and may result in 

criminal prosecution and/or 

administrative proceedings to revoke 

your DEA registration. 

If you are a practitioner who writes 

prescriptions on behalf of a particular 

Web site, your name must appear 

prominently on that Web site. (This 

requirement helps to distinguish those 

Web sites that are compliant with the 

Act and the implementing regulations 

from those that are not compliant.) If 

such Web site is operated on behalf of 

a group medical practice in which you 

participate, it is sufficient that your 

name (along with the names of your 

fellow practitioners who write 

prescriptions on behalf of the site) are 

posted in a visible and clear manner on 

the homepage of the Web site, or on a 

page directly linked thereto in which 

the hyperlink is also visible and clear on 

the homepage.41 It is anticipated that 

most every medical office in the United 

States that currently has a Web site is 

already in compliance with this 

provision as it is common practice for 

such Web sites to post in such manner 

the names of the practitioners. If, 

however, you are one of what is 

anticipated to be a very small number of 

practitioners who, beginning on or after 

April 13, 2009 (the effective date of the 

Ryan Haight Act), writes prescriptions 

on behalf of a Web site of a DEAregistered pharmacy, the Act requires 

the Web site to post additional 

information identifying you. 

Specifically, the Web site must post the 

following information in a visible and 

clear manner on the homepage of each 

Internet site it operates, or on a page 

directly linked thereto in which the 

hyperlink is also visible and clear on the 

homepage: ‘‘The name, address, 

telephone number, professional degree, 

and States of licensure of any 

practitioner who has a contractual 

relationship to provide medical 

evaluations or issue prescriptions for 

controlled substances, through referrals 

from the Web site or at the request of the 

owner or operator of the Web site, or 

any employee or agent thereof.’’ 42

How does a practitioner know 

whether he is writing prescriptions that 

are issued through, or on behalf of, a 

Web site? In some cases, this will be 

obvious to the practitioner. For 

example, if a practitioner is approached 

by a person who offers to pay the 

practitioner to write prescriptions for 

‘‘patients’’ who will be routed to the 

practitioner through the Web site, the 

practitioner has actual knowledge that 

he is being asked to dispense controlled 

substances by means of the Internet 

within the meaning of the Act. (As most 

practitioners would immediately 

recognize, such a proposal is inherently 

suspect, since the legitimate practice of 

medicine is not structured around 

writing prescriptions for controlled 

substances and being compensated 

primarily or exclusively on that 

basis.) 43 The profitability of rogue 

Internet Web sites typically depends on 

the ability of the criminal facilitator 

who operates the site to recruit 

unscrupulous practitioners to enter into 

such types of contractual arrangements. 

In response to the enactment of the 

Ryan Haight Act, some rogue Web sites 

have come up with the following 

approach in an effort to circumvent the 

new law. Drug-seeking customers who 

visit the rogue Web site are told that 

they should arrange a visit with one of 

the practitioners affiliated with the site 

to satisfy the Act’s requirement of an inperson medical evaluation. Once the 

practitioner has gone through the 

motions of conducting what purports to 

be a medical evaluation, the ‘‘patient’’ 

will be permitted to purchase controlled 

substances (or prescriptions therefor) 

through the Web site in perpetuity, 

without having to see the practitioner in 

person again. A practitioner who might 

be inclined to consider entering into a 

contract with the operator of such a 

rogue Web site should consider that, in 

all likelihood, such an operation 

violates the Act—despite its purported 

compliance with the in-person medical 

evaluation requirement. For one, under 

the Act, the only persons who may 

operate Web sites through which 

controlled substances are prescribed or 

otherwise dispensed are DEA-registered 

practitioners (pharmacies and 

nonpharmacy practitioners).44 Thus, a 

non-DEA registrant may not operate a 

Web site that constitutes an ‘‘online 

pharmacy’’ within the meaning of the 

Act (which includes, for example, a 

Web site that sells prescriptions for 

controlled substances or fills such 

prescriptions). Second, even in the 

unlikely event that the person who is 

offering the practitioner the opportunity 

to participate in such a Web site is a 

DEA registrant with the appropriate 

registration allowing it to dispense 

controlled substances by means of the 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15609 

45As explained earlier in this preamble, the Ryan 

Haight Act contains an exception from the 

definition of ‘‘online pharmacy’’ for any pharmacy 

registered under 21 U.S.C. 823(f) whose dispensing 

of controlled substances via the Internet consists 

solely of ‘‘refilling prescriptions for controlled 

substances in schedule III, IV, or V’’ or ‘‘filling new 

prescriptions for controlled substances in schedule 

III, IV, or V’’ (as those terms are defined in 21 U.S.C. 

802(55) and (56)). 21 U.S.C. 802(52)(B)(viii). Given 

these and other exceptions in the Act, it is 

anticipated that most pharmacies, if they continue 

their current practices, will not fall within the 

definition of an online pharmacy. However, a 

pharmacy that actively solicits buyers of controlled 

substances via the Internet or is associated with a 

Web site that does so cannot fall within the 

foregoing exception and, therefore, does constitute 

an online pharmacy. 

46 DEA provides a ‘‘Registration Validation’’ tool 

on its Web site, through which DEA registrants may 

query DEA’s registration database regarding another 

DEA registrant to gather specific information about 

that registrant. Information available includes: The 

registrant’s name, address, and DEA registration 

number; the date of expiration of the registration; 

business activity; and the schedules of controlled 

substances the registrant is authorized to handle. 

47As with all DEA registrants, distributors have 

a duty to maintain effective controls against 

diversion of controlled substances. 21 U.S.C. 

823(b)(1), 823(e)(1); 21 CFR 1301.71(a). As part of 

this responsibility, all distributors must design and 

operate a system to disclose to the registrant 

suspicious orders of controlled substances and must 

report to DEA any such suspicious orders of 

controlled substances in accordance with 21 CFR 

1301.74(b). Failure to comply with these or any 

other applicable regulatory requirements may, 

depending on the circumstances, result in civil 

monetary penalties and/or administrative 

revocation proceedings, among other things. 

Internet, the prescribing practitioner 

must ensure that the Web site properly 

displays his name and the other 

required information in the manner 

required by the Act and the 

implementing regulations. 

Further, even if the Web site has the 

required registration and posts the 

required information, it is difficult to 

envision how a conscientious 

practitioner could enter into a contract 

to provide medical evaluations and/or 

issue prescriptions through referrals 

from a Web site that is designed 

primarily to attract and supply persons 

seeking to obtain controlled substances 

for other than legitimate medical 

purposes (rather than to provide 

legitimate medical care to patients 

without a predetermined goal of selling 

drugs or prescriptions). Indeed, a Web 

site that operates in such a manner— 

such as by offering to arrange in-person 

‘‘medical evaluations’’ for the purpose 

of allowing customers to obtain 

controlled substances through the Web 

site indefinitely thereafter—should be 

viewed by a practitioner as a ‘‘red flag’’ 

indicating that diversion of controlled 

substances to illicit channels might be 

occurring. 

The same considerations apply if you, 

as a practitioner, are offered a contract 

or otherwise presented with a proposal 

to write prescriptions to customers of a 

Web site based on reviewing online 

questionnaires or faxed ‘‘medical 

records’’ or by answering telephone 

calls through a phone number affiliated 

with the Web site. If these customers are 

being referred to you through the Web 

site or at the request of the owner or 

operator of the Web site, any 

prescriptions for controlled substances 

you write for the customers constitute 

‘‘dispensing by means of the Internet’’ 

within the meaning of the Act. As 

explained above, a practitioner who 

dispenses a controlled substance by 

means of the Internet in violation of the 

Act may be held criminally liable under 

21 U.S.C. 841(h)(1) if he did so 

knowingly or intentionally—which can 

be proven by showing that either (i) the 

practitioner had actual knowledge of the 

violation or (ii) the practitioner 

deliberately disregarded facts that 

would have led a reasonable 

practitioner to be highly suspicious 

about the likelihood of such a violation. 

In addition, any transgression of the Act 

may result in administrative action to 

revoke the practitioner’s DEA 

registration. 

With the foregoing considerations in 

mind, DEA again emphasizes that the 

current practices of the overwhelming 

majority of practitioners in the United 

States do not involve delivering, 

distributing, or dispensing controlled 

substances by means of the Internet. 

This means that the vast majority of 

practitioners need not alter their current 

practices to conform to the requirements 

of the Ryan Haight Act. 

C. Additional Specific Information for 

DEA-Registered Distributors 

The ability of rogue Internet sites to 

supply controlled substances to persons 

who seek them for other than legitimate 

medical purposes depends largely on 

the existence of DEA-registered 

pharmacies that are willing to supply 

the customers of these Web sites. As the 

data provided at the beginning of this 

preamble illustrates, it takes only a 

relatively small number of 

unscrupulous pharmacies, working in 

conjunction with rogue Internet sites, to 

supply enormous quantities of 

hydrocodone and other controlled 

substances, causing a substantial 

detrimental effect on the public health 

and welfare. Accordingly, if you are a 

DEA-registered distributor, it is critical 

that you are vigilant in taking 

appropriate steps to avoid supplying the 

pharmacies that service the customers of 

rogue Web sites. 

In a September 27, 2006, letter to all 

DEA-registered distributors, DEA 

specified a number of pharmacy 

practices that might be indicative of 

diversion. While all the considerations 

set forth in that letter remain valid 

today, the enactment of the Ryan Haight 

Act should further assist distributors in 

avoiding distributing controlled 

substances to pharmacies that are 

supplying customers of rogue Web sites. 

For example, if you are a distributor and 

you know that a pharmacy is soliciting 

buyers of controlled substances via the 

Internet, or is associated with an 

Internet site that solicits orders for 

controlled substances,45 you are on 

notice that the pharmacy is an ‘‘online 

pharmacy’’ under the Act. If so, it is 

unlawful, per se, for the pharmacy to be 

operating without a modified DEA 

registration authorizing it to operate as 

an online pharmacy. Under such 

circumstances, if the pharmacy does not 

have such a modified registration, it 

would be unlawful for you as a 

distributor to supply the pharmacy with 

controlled substances. (The pharmacy’s 

Certificate of Registration will reflect its 

status as an online pharmacy in its 

business activity designation.) 46

Even if you do not have actual 

knowledge that the pharmacy is 

operating through a Web site, if the 

pharmacy’s buying patterns are of a 

volume or otherwise of a nature 

indicating a reasonable likelihood that 

the pharmacy is supplying customers of 

a Web site or otherwise engaging in 

practices that render it an online 

pharmacy within the meaning of the 

Ryan Haight Act, the sound course of 

action for the distributor would be to 

confirm that the pharmacy is complying 

with the Act prior to supplying the 

pharmacy with controlled substances.47

D. Additional Specific Information for 

Consumers 

The full title of the Ryan Haight Act 

is ‘‘The Ryan Haight Online Pharmacy 

Consumer Protection Act of 2008.’’ As 

this title implies, a primary purpose of 

the Act is to protect consumers by 

ensuring that only legitimate, lawabiding Web sites dispense controlled 

substances via the Internet. One of the 

ways the Act achieves this goal is by 

allowing only pharmacies who are 

properly registered with DEA to operate 

Web sites through which prescriptions 

for controlled substances are filled. In 

addition, the Act and the implementing 

regulations require such Web sites to 

fully disclose to consumers certain basic 

information, such as the name and 

telephone number of the pharmacist-incharge, a list of the states in which the 

pharmacy is authorized to dispense 

controlled substances, the names of any 


pwalker on PROD1PC71 with RULES2
15610 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

48The exact wording of this provision is found in 

21 U.S.C. 843(c)(2) and is recited above in this 

preamble. 49 21 U.S.C. 952, 957, 960(a)(1). 

practitioners who have a contractual 

relationship to issue prescriptions for 

controlled substances through referrals 

from the Web site, and a certification 

that the Web site is acting in compliance 

with the Act. Accordingly, the Act 

should make it easier for consumers to 

differentiate between legitimate and 

illegitimate Web sites that sell 

controlled substances. 

One strong indicator of an unlawful 

Web site is that it lets you as a customer 

pick the controlled substance and then 

charges you a fee to arrange for a 

practitioner to prescribe that controlled 

substance to you. An unlawful Web site 

might further offer to refund all or part 

of your fee if you are not sold the 

prescription for your drug of choice. A 

Web site that engages in such practices 

is virtually certain to be a rogue Web 

site that is not operating in compliance 

with the Ryan Haight Act. 

Consumers should also be aware that 

the Act also prohibits certain 

advertising practices relating to the 

types of criminal activities the Act is 

designed to eliminate. Specifically, the 

Act makes it a crime to place an 

advertisement on the Internet that offers 

to sell a controlled substance or a 

prescription for a controlled substance 

in a manner that would be illegal (in 

violation of the CSA or the CSIEA).48

For example, the Act makes it unlawful 

to place an advertisement on the 

Internet stating: ‘‘Hydrocodone! No 

Prescription Needed!’’ (or words to the 

same effect). This provision of the Act 

also makes it illegal to place an 

advertisement on the Internet that refers 

consumers to a Web site that is 

operating in violation of the Act (such 

as one that sells controlled substances 

but is not properly registered with 

DEA). This ban on illegal Internet 

advertising also applies to unsolicited 

commercial e-mail, which is sometimes 

referred to as ‘‘spam’’ or ‘‘junk e-mail.’’ 

Consequently, beginning on April 13, 

2009, if you as a consumer receive an 

unsolicited commercial e-mail with the 

subject line: ‘‘Hydrocodone! No 

Prescription Needed!,’’ the sender of 

that e-mail has violated the law. 

Likewise, if you receive spam directing 

you to a Web site that is operating in 

violation of the Act, the spammer has 

also violated the Act. 

Consumers should also be wary of 

rogue Web sites falsely claiming that 

they are allowed to sell controlled 

substances without complying with the 

Ryan Haight Act because they are 

located outside the United States. Any 

such claim is flatly wrong. In fact, as 

explained earlier in this preamble, it has 

always been unlawful under the 

Controlled Substances Import and 

Export Act (CSIEA) (even prior to the 

Ryan Haight Act) to ship controlled 

substances into the United States for 

personal medical use. Any person who 

ships controlled substances from abroad 

into the United States illegally, along 

with the person in the United States 

who places the order for such a 

shipment and thereby causes the 

controlled substances to be illegally 

shipped into the United States, violates 

the CSIEA and is subject to criminal 

prosecution.49

VIII. Regulatory Changes To Implement 

the Ryan Haight Act 

This section summarizes the 

regulations contained in this Interim 

Rule, which are being issued to 

implement the Ryan Haight Act. This 

section should be viewed as merely a 

summary provided for the convenience 

of the reader, and any registrant subject 

to the Ryan Haight Act should read 

carefully the entire preamble along with 

the text of the regulations being issued 

here. 

A. Notification and Registration 

As provided in 21 CFR 1304.40, all 

online pharmacies that intend to 

dispense controlled substances by 

means of the Internet must provide DEA 

with a thirty-day notice of such intent. 

To do this, they must apply for a 

modified registration via the online 

application process. The Administrator 

must approve the application for a 

modified registration and issue a 

Certificate of Registration indicating the 

modification before the online 

pharmacy may engage in any activity of 

an online pharmacy. As discussed 

previously in the preamble, the only 

entities that may apply for a modified 

registration are registrants with a valid 

Certificate of Registration (DEA Form 

223) as a pharmacy. If you are not 

registered with DEA as a pharmacy and 

you intend to dispense controlled 

substances by means of the Internet, you 

must first apply for registration as a 

pharmacy in accordance with 21 CFR 

1301.13. Upon receipt of the Certificate 

of Registration as a pharmacy from the 

Administrator, you may then apply for 

a modification to your registration to 

operate as an online pharmacy. 

The Administrator may deny an 

application for such registration or such 

modification of registration if the 

Administrator determines that the 

issuance of such registration or 

modification would be inconsistent 

with the public interest. 21 CFR 

1301.19. The same statutory criteria 

used in determining the public interest 

for purposes of evaluating an 

application for registration—those 

found in 21 U.S.C. 823(f)—will be used 

in evaluating an application for a 

modification of registration to operate as 

an online pharmacy. 

An online pharmacy must make a 

separate thirty-day advance notice to the 

State boards of pharmacy in each State 

in which it intends to offer to sell, 

deliver, distribute, or dispense 

controlled substances. 

In accordance with 21 U.S.C. 831, the 

following information must be included 

in the notification to DEA that must be 

submitted as part of the Application for 

Modification of Registration: 

• All Internet pharmacy site 

disclosure information as listed below. 

• A certification, under penalty of 

perjury, that the Internet pharmacy site 

disclosure information that is posted on 

the online pharmacy’s Web site is true 

and accurate. 

• A listing of all Internet Web site 

addresses (also known as the uniform 

resource locator or URL) owned by the 

online pharmacy to conduct its online 

business activities. 

• A certification that the online 

pharmacy will notify DEA of any 

changes to any of its Internet Web site 

addresses (URLs) at least 30 days in 

advance. 

• The name, address, telephone 

number, professional degree, DEA 

registration numbers and States of 

licensure of any practitioner who has a 

contractual relationship to provide 

medical evaluations or issue 

prescriptions for controlled substances, 

through referrals from the Web site or at 

the request of the owner or operator of 

the Web site, or any employee or agent 

thereof. 

• The DEA registration numbers of 

each pharmacy that delivers, distributes, 

or dispenses controlled substances 

pursuant to orders made on, through, or 

on behalf of the online pharmacy. 

Pharmacies that intend to dispense 

controlled substances by means of the 

Internet must apply for the modified 

registration using the online registration 

process by going to the DEA Office of 

Diversion Control Web site at http:// 

www.deadiversion.usdoj.gov. 

Registrants must positively 

acknowledge and agree to several 

statements during the application 

process. These acknowledgements will 

be printed on the registrant’s receipt of 

registration for future reference. The 

following is a list of the 

acknowledgments with which a 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15611 

registrant must agree as part of the 

online pharmacy application process: 

1. Pursuant to section 309(e) of the 

Controlled Substances Act (21 U.S.C. 829(e)), 

you, as an online pharmacy, acknowledge 

and agree that no controlled substance that 

is a prescription drug may be delivered, 

distributed, or dispensed by means of the 

Internet without a valid prescription. 

2. Pursuant to 21 CFR 1306.09, you, as an 

online pharmacy, acknowledge and agree 

that a prescription for a controlled substance 

may only be dispensed by means of the 

Internet by a pharmacist, acting in the usual 

course of his professional practice, and 

employed in a pharmacy whose registration 

has been modified to authorize it to operate 

as an online pharmacy. 

3. You, as an online pharmacy, 

acknowledge and understand that you may 

not engage in any activity of an online 

pharmacy, as defined in 21 CFR 1300.04(h), 

until your application for modified 

registration to operate as an online pharmacy 

is granted and a Certificate of Registration 

indicating the modification is issued by the 

Administrator (DEA Form 223). 

4. You, as an online pharmacy, understand 

that the Administrator may deny an 

application for a modification of registration 

if the Administrator determines that the 

issuance of such modification would be 

inconsistent with the public interest. In 

determining the public interest, the 

Administrator considers the factors listed in 

21 U.S.C. 823(f). 

5. Pursuant to section 303(f) of the 

Controlled Substances Act (21 U.S.C. 823(f)), 

you, as an online pharmacy, certify that you 

are authorized by the appropriate state 

authority(ies) to modify your existing DEA 

registration to authorize you to dispense 

schedule II–V controlled substances by 

means of the Internet. 

6. Pursuant to 21 CFR 1301.19, if you, as 

an online pharmacy, cease to dispense 

controlled substances by means of the 

Internet, you acknowledge and agree that you 

shall promptly notify the Administrator by 

modifying your registration to reflect the 

appropriate business activity. 

7. Pursuant to section 307(d) of the 

Controlled Substances Act (21 U.S.C. 827(d)), 

you, as an online pharmacy, understand you 

are required to report the dispensing of 

controlled substances by means of the 

Internet to the Administrator in the manner 

set forth in 21 CFR 1304.55. This report will 

include the total quantity of each controlled 

substance that the pharmacy dispenses each 

calendar month. The report must be 

submitted to DEA electronically via online 

reporting, electronic file upload, or other 

means as approved by DEA. The monthly 

report shall include the date range of the 

reporting period, the NDC, and total quantity 

of each controlled substance dispensed. 

Reporting shall include all controlled 

substances dispensed via Internet 

transactions, mail-order, face-to-face 

transactions, or any other means. The report 

shall be submitted to DEA by the 15th day 

of the following month. (For threshold 

amounts refer to DEA Web site: http:// 

www.deadiversion.usdoj.gov.) 

8. Pursuant to section 311(a) of the 

Controlled Substances Act (21 U.S.C. 831(a)), 

you, as an online pharmacy, agree to display 

at all times on your homepage, in a visible 

and clear manner, a statement that your 

online pharmacy complies with the 

requirements of section 311 of the Act (21 

U.S.C. 831) with respect to the delivery or 

sale or offer for sale of controlled substances. 

9. Pursuant to section 311(b) of the 

Controlled Substances Act (21 U.S.C. 831(b)), 

you, as an online pharmacy, acknowledge 

and agree to comply with the requirements 

of State law concerning the licensure of 

pharmacies in each State from which and to 

which you, deliver, distribute, or dispense, or 

offer to deliver, distribute, or dispense 

controlled substances by means of the 

Internet. 

10. Pursuant to section 311(c) of the 

Controlled Substances Act (21 U.S.C. 831(c)), 

you, as an online pharmacy, acknowledge 

and agree to post the following Internet 

Pharmacy Site Disclosure information in a 

visible and clear manner on the homepage of 

each Internet site you operate, or on a page 

directly linked thereto in which the 

hyperlink is also visible and clear on the 

homepage: 

(A) The name and address of the pharmacy 

as it appears on the pharmacy’s DEA 

Certificate of Registration. 

(B) The pharmacy’s telephone number and 

e-mail address. 

(C) Name of pharmacist-in charge, 

professional degree, States of licensure, and 

telephone number. 

(D) List of States in which the pharmacy 

is licensed to dispense controlled substances. 

(E) Certification that the pharmacy is 

registered to deliver, distribute, or dispense 

by means of the Internet, controlled 

substances. 

(F) Practitioner’s name, address, telephone 

number, professional degree, and States of 

licensure of any practitioner who has a 

contractual relationship to provide medical 

evaluations or issue prescriptions for 

controlled substances, through referrals from 

the Web site or at the request of the owner 

or operator of the Web site, or any employee 

or agent thereof. 

(G) The following statement: ‘‘This online 

pharmacy is obligated to comply fully with 

the Controlled Substances Act and DEA 

regulations. As part of this obligation, this 

online pharmacy has obtained a modified 

DEA registration authorizing it to operate as 

an online pharmacy. In addition, this online 

pharmacy will only dispense a controlled 

substance to a person who has a valid 

prescription issued for a legitimate medical 

purpose based upon a medical relationship 

with a prescribing practitioner. This includes 

at least one prior in-person medical 

evaluation in accordance with section 309 of 

the Controlled Substances Act (21 U.S.C. 

829), or a medical evaluation via 

telemedicine in accordance with section 

102(54) of the Controlled Substances Act (21 

U.S.C. 802(54)).’’ 

11. Pursuant to section 311(d)(2)(A) of the 

Controlled Substances Act (21 U.S.C. 

831(d)(2)(A)), you, as an online pharmacy, 

certify that the Internet Pharmacy Site 

Disclosure information disclosed on your 

Web site, under penalty of perjury, is true 

and accurate. 

12. Pursuant to section 311(d) of the 

Controlled Substances Act (21 U.S.C. 831(d)), 

you, as an online pharmacy, acknowledge 

and agree that, thirty days prior to offering 

a controlled substance for sale, delivery, 

distribution, or dispensing, you must notify 

the Administrator and the State boards of 

pharmacy in any States in which you offer 

to sell, deliver, distribute, or dispense 

controlled substances. By fully completing 

and submitting this application, you will 

satisfy this requirement with respect to 

notifying the Administrator. However, you 

must separately notify the State boards of 

pharmacy as required by the Act. You 

understand that subsequent online pharmacy 

registration renewals will be accomplished 

by the online process and the appropriate 

renewal fee will apply. 

13. You understand that in accordance 

with section 401(h) of the Act (21 U.S.C. 

841(h)), as of April 13, 2009, it is unlawful 

for any online pharmacy to deliver, 

distribute, or dispense a controlled substance 

by means of the Internet unless such online 

pharmacy is validly registered with a 

modification of DEA registration authorizing 

the dispensing of controlled substances by 

means of the internet. 

14. Pursuant to section 311(e) of the 

Controlled Substances Act (21 U.S.C. 831(e)), 

you, as an online pharmacy, understand and 

agree that on and after the date you apply for 

a modified registration, you will display on 

your homepage, in the manner described in 

21 CFR 1304.40(d), a declaration that you 

have made the required notifications to the 

DEA Administrator. 

There is no fee to apply for 

modification of an existing DEA 

registration. When a pharmacy makes 

application for a modified registration to 

conduct business as an online 

pharmacy, and the Administrator issues 

a Certificate of Registration for the 

modification to that pharmacy, the 

registration period continues from the 

date of the pharmacy’s prior 

registration. When, however, an online 

pharmacy makes application to renew 

the modified registration, it will incur 

the appropriate application fee and, if 

approved, a new three-year registration 

period will begin. 

An online pharmacy that seeks to 

discontinue its modification of 

registration authorizing it to dispense 

controlled substances by means of the 

Internet, but continue its business 

activity as a pharmacy, must so notify 

the Administrator through the online 

application process for modification of 

registration. The Administrator will 

issue a new Certificate of Registration to 

the pharmacy based on the changes 

made to its registration. Once the 

registration has been changed back to its 

previous status (retail pharmacy), the 

pharmacy is no longer authorized to 

dispense controlled substances by 

means of the Internet. 


pwalker on PROD1PC71 with RULES2
15612 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

50 21 U.S.C. 831(c). 51 21 U.S.C. 827(d)(2). 

B. Licensure 

An online pharmacy must comply 

with the requirements of State law 

concerning the licensure of pharmacies 

in each State from which it, and in each 

State to which it, delivers, distributes, 

or dispenses or offers to deliver, 

distribute, or dispense controlled 

substances by means of the Internet. 21 

U.S.C. 831(b). 

C. Online Pharmacy Internet Site 

Disclosure 

Online pharmacies have a continual 

obligation under the Ryan Haight Act to 

make certain disclosures on their Web 

sites required by the Act. Consequently, 

an online pharmacy must maintain an 

active Web site to post the required 

information, statements, and other 

disclosures required by the Act and 

update the information as necessary. 

D. Statement of Compliance 

The Act requires that each online 

pharmacy shall display, at all times and 

in a visible and clear manner, on its 

homepage a statement that it complies 

with the requirements of section 311(a) 

of the Act (21 U.S.C. 831(a)) with 

respect to the delivery or sale or offer for 

sale of controlled substances. This 

requirement is reiterated in the 

regulations being issued here in 21 CFR 

1304.45(a). This regulation does not 

require specific language to be used for 

this statement, but the statement must 

include the name of the pharmacy as 

displayed on its DEA Certificate of 

Registration and clearly state that the 

pharmacy is in compliance with 21 

U.S.C. 831(a). The following is an 

example of a statement a pharmacy may 

post on its Web site that would meet the 

requirements of this provision: 

XYZ Pharmacy is in full compliance with 

the requirements of section 311(a) of the 

Controlled Substances Act (21 U.S.C. 831(a)) 

with respect to the delivery or sale or offer 

for sale of controlled substances. 

E. Internet Pharmacy Site Disclosure 

Information 

The Act 50 and the regulations being 

issued here (21 CFR 1304.45(b)) require 

that each online pharmacy shall post in 

a visible and clear manner on the 

homepage of each Internet Web site it 

operates, or on a page directly linked 

thereto in which the hyperlink is also 

visible and clear on the homepage, the 

following information for each 

pharmacy that delivers, distributes, or 

dispenses controlled substances 

pursuant to orders made on, through, or 

on behalf of, that Web site: 

• The name and address of the 

pharmacy as it appears on the 

pharmacy’s DEA Certificate of 

Registration. 

• The pharmacy’s telephone number 

and active business e-mail address. 

• The name, professional degree, and 

States of licensure of the pharmacist-incharge, and a telephone number at 

which the pharmacist-in-charge can be 

contacted. 

• A list of the States in which the 

pharmacy is licensed to dispense 

controlled substances. 

• A certification that the pharmacy is 

registered under 21 CFR Part 1301 to 

deliver, distribute, or dispense 

controlled substances by means of the 

Internet. 

• The name, address, telephone 

number, professional degree, and States 

of licensure with State license number 

of any practitioner who has a 

contractual relationship to provide 

medical evaluations or issue 

prescriptions for controlled substances, 

through referrals from the Web site or at 

the request of the owner or operator of 

the Web site, or any employee or agent 

thereof. 

• The following statement: ‘‘This 

online pharmacy is obligated to comply 

fully with the Controlled Substances 

Act and DEA regulations. As part of this 

obligation, this online pharmacy has 

obtained a modified DEA registration 

authorizing it to operate as an online 

pharmacy. In addition, this online 

pharmacy will only dispense a 

controlled substance to a person who 

has a valid prescription issued for a 

legitimate medical purpose based upon 

a medical relationship with a 

prescribing practitioner. This includes 

at least one prior in-person medical 

evaluation in accordance with section 

309 of the Controlled Substances Act 

(21 U.S.C. 829) or a medical evaluation 

via telemedicine in accordance with 

section 102(54) of the Controlled 

Substances Act (21 U.S.C. 802(54)).’’ 

The following is a hypothetical 

example of a statement that would 

comply with all of the requirements of 

21 CFR 1304.45(b) (assuming the 

assertions were true): 

XYZ Pharmacy, 

1 Main Street, 

[City, State, zip code], 

[Area code and telephone number], 

pharmacist@xyzpharmacy.com. 

John H. Smith, R.Ph., Pharmacist-inCharge, licensed in State. 

The XYZ Pharmacy is in full compliance 

with the requirements of section 311(a) of the 

Controlled Substances Act (21 U.S.C. 831(a)). 

XYZ Pharmacy is licensed in [State(s)] to 

dispense controlled substances. The 

pharmacist-in-charge may be contacted at the 

above telephone number. XYZ Pharmacy 

does not have any contractual relationships 

with any practitioner to provide medical 

evaluations or issue prescriptions for 

controlled substances through referrals from 

this Web site or at the request of the owner 

or operator of this Web site, or any employee 

or agent thereof. This online pharmacy is 

obligated to comply fully with the Controlled 

Substances Act and DEA regulations. As part 

of this obligation, this online pharmacy has 

obtained a modified DEA registration 

authorizing it to operate as an online 

pharmacy. In addition, this online pharmacy 

will only dispense a controlled substance to 

a person who has a valid prescription issued 

for a legitimate medical purpose based upon 

a medical relationship with a prescribing 

practitioner. This includes at least one prior 

in-person medical evaluation in accordance 

with section 309 of the Controlled 

Substances Act (21 U.S.C. 829) or a medical 

evaluation via telemedicine in accordance 

with section 102(54) of the Controlled 

Substances Act (21 U.S.C. 802(54)). 

F. Declaration of Compliance 

On and after the date on which an 

online pharmacy makes the notification 

and applies for a modified registration, 

it must display, on the homepage of its 

Web site, a declaration that it has made 

such notification/application to the 

Administrator. 

G. Reporting 

The Act requires,51 and 21 CFR 

1304.55 reiterates, that each online 

pharmacy must submit a monthly report 

to the Administrator of the total 

quantity of each controlled substance it 

has dispensed the previous calendar 

month. This report will be due on or 

before the 15th day of the following 

month. The report must include the 

total amount of such dispensing by any 

means, including all controlled 

substances dispensed via Internet 

transactions, mail-order transactions, 

face-to-face transactions, or any other 

means. It is not required that the online 

pharmacy identify the means of the 

dispensing in its report. The report is 

required for every month in which the 

total amount of dispensing of controlled 

substances by the pharmacy is either (i) 

over 100 prescriptions filled or (ii) 5,000 

or more dosage units dispensed of all 

controlled substances combined. 

Each online pharmacy shall report a 

negative response to the Administrator 

if, during a given calendar month, its 

total quantity of dispensing of 

controlled substances falls below both 

of the thresholds listed above. 

The reporting required by online 

pharmacies under 21 CFR 1304.55 must 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15613 

be submitted to the Administrator 

electronically via online reporting, 

electronic file upload, or other means as 

approved by DEA. The report shall 

identify controlled substances by 

National Drug Code (NDC) number 

assigned to the product under the 

National Drug Code System of the Food 

and Drug Administration. 

Online pharmacies must maintain 

these records for at least two years. The 

information must be easily accessible 

and available for inspection by 

authorized DEA employees. 

A pharmacy that has changed its 

registration status from that of an online 

pharmacy back to a retail pharmacy 

remains responsible for submitting 

reports in accordance with § 1304.55 of 

this chapter with respect to any 

controlled substances that it dispensed 

while it was registered with a 

modification authorizing it to operate as 

an online pharmacy. 

IX. Section-by-Section Discussion of the 

Interim Final Rule 

In part 1300, new § 1300.04, 

containing definitions relating to the 

dispensing of controlled substances by 

means of the Internet, is added. These 

definitions are from the definitions 

contained in the Ryan Haight Act. This 

includes definitions of the terms 

‘‘covering practitioner,’’ ‘‘deliver, 

distribute or dispense by means of the 

Internet,’’ ‘‘filling new prescriptions for 

controlled substances in Schedule III, 

IV, or V,’’ ‘‘homepage,’’ ‘‘in-person 

medical evaluation,’’ ‘‘Internet,’’ ‘‘online 

pharmacy,’’ ‘‘practice of telemedicine,’’ 

‘‘refilling prescriptions for controlled 

substances in Schedule III, IV, or V,’’ 

‘‘valid prescription,’’ and the temporary 

definition of ‘‘practice of telemedicine.’’ 

However, please note that the 

regulations being issued here expand 

upon the exceptions to the definition of 

an online pharmacy contained in the 

Act. Specifically, as discussed above, 

the regulations add two exceptions to 

the definition of ‘‘online pharmacy’’: 

One relating to electronic prescriptions 

for controlled substances issued in a 

manner permitted by the DEA 

regulations and another relating to the 

utilization by retail pharmacies of 

automated dispensing systems at long 

term care facilities in a manner 

permitted by the DEA regulations. 

In part 1301 (registration of 

manufacturers, distributors, and 

dispensers of controlled substances), 

new § 1301.11(b) restates the 

requirements of the Act that any person 

falling within the definition of an online 

pharmacy must be validly registered 

with a modification authorizing it to 

operate as an online pharmacy and that 

only pharmacies registered under 21 

U.S.C. 823(f) may apply for such 

modification. 

To address the modification of 

registration as an online pharmacy, the 

table in § 1301.13(e)(1) is amended in 

‘‘(iv) Dispensing or instructing’’ to 

specify the application for an online 

pharmacy. A comment has been added 

in the ‘‘Coincident activities allowed’’ 

column to explain that an online 

pharmacy may perform the activities of 

both a retail and online pharmacy. 

New § 1301.19 (special requirements 

for online pharmacies) provides in 

paragraphs (a), (c), and (f) that a 

pharmacy must request a modification 

of its registration authorizing it to 

operate as an online pharmacy by 

completing the online application 

process. This section also provides, 

consistent with the Ryan Haight Act, 

that a pharmacy registrant may not 

operate as an online pharmacy until the 

DEA Administrator grants the modified 

registration. Paragraph (b) requires, 

consistent with the Ryan Haight Act, 

that an online pharmacy must comply 

with the pharmacy license requirements 

of not only the State where it is located, 

but also of any State to which it 

delivers, distributes, or dispenses 

controlled substances. Paragraph (d) 

requires a pharmacy that seeks to 

discontinue its authorization to operate 

as an online pharmacy to modify its 

registration to reflect this change in its 

business activity. 

Section 1301.52, which addresses 

termination of registrations, is revised to 

include modification of registration 

within the meaning of the Act. 

Four new sections are added to 21 

CFR part 1304 (records and reports of 

registrants) to implement the reporting 

requirements of the Ryan Haight Act for 

online pharmacies, and to specify the 

information the Act requires to be 

posted on an online pharmacy’s Web 

site. New § 1304.40(a) requires online 

pharmacies to notify the Administrator 

and State boards of pharmacy 30 days 

before offering to fill prescriptions for 

controlled substances. Notification to 

the DEA Administrator will be made by 

applying for a modification of DEA 

registration. Paragraph (b) of § 1304.40 

contains a list of items that must be 

included in the notification. Paragraph 

(c) requires online pharmacies in 

operation at the time the Ryan Haight 

Act becomes effective (April 13, 2009) 

to make this notification by May 13, 

2009, but this paragraph also makes 

clear that, as of April 13, 2009, it is 

unlawful for any person to operate as an 

online pharmacy unless it has obtained 

from DEA a modification of its 

registration authorizing it to do so. In 

addition, paragraph (d) requires that on 

and after an online pharmacy makes 

notification under this section, it shall 

display a declaration that it has done so. 

Under § 1304.40(e), an online pharmacy 

must notify the Administrator of any 

changes to the information submitted in 

its notification thirty days prior to the 

change. 

New section 1304.45 specifies the 

data elements required to be posted on 

the Web site of online pharmacies in a 

visible and clear manner, as provided in 

the Act. 

To identify Web sites that are 

operating solely on behalf of DEAregistered nonpharmacy practitioners 

who are acting within the scope of their 

registrations (and thereby exempt from 

the definition of an online pharmacy), 

new § 1304.50 requires such Web sites 

that dispense controlled substances by 

means of the Internet to display in a 

visible and clear manner a list of those 

DEA-registered nonpharmacy 

practitioners affiliated with the Web 

site. 

New § 1304.55 implements the 

requirement of the Act that each online 

pharmacy make a monthly report to 

DEA stating the total quantity of each 

controlled substance the pharmacy has 

dispensed the previous calendar month. 

This report must include not only the 

transactions made through the online 

pharmacy, but also any that the 

pharmacy made through mail order, 

face-to-face, or any other transaction 

when the pharmacy’s total dispensing of 

controlled substances meets or exceeds 

the monthly threshold of either 100 

prescriptions filled or 5,000 or more 

dosage units dispensed. Online 

pharmacies that do not meet this 

threshold in a given month are required 

to so notify DEA. 

In part 1306 (prescriptions), new 

§ 1306.09 includes requirements for 

prescriptions that track the 

requirements of the Act. Paragraph (a) 

specifies that no controlled substance 

may be delivered, distributed, or 

dispensed by means of the Internet 

without a valid prescription (using the 

definition of a valid prescription 

contained in the Act). Also consistent 

with the Act, paragraph (b) provides 

that a prescription may only be filled by 

a pharmacy whose registration has been 

modified as specified in the Act. 

Finally, paragraph (c) applies to online 

pharmacies the requirements of sections 

1306.15 and 1306.25 regarding transfers 

of prescriptions between pharmacies. 


pwalker on PROD1PC71 with RULES2
15614 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

52Public Law 110–425, sec. 3(k)(1). 

X. Regulatory Certifications 

A. Administrative Procedure Act 

The Administrative Procedure Act 

(APA) generally requires agencies to 

publish a notice of proposed rulemaking 

and allow for a period of public 

comment prior to implementing new 

rules. The APA also provides, however, 

that agencies can be excepted from these 

requirements ‘‘when the agency for good 

cause finds (and incorporates the 

finding and a brief statement of reasons 

therefor in the rules issued) that notice 

and public procedure thereon are 

impracticable, unnecessary, or contrary 

to the public interest.’’ 5 U.S.C. 

553(b)(B). DEA has concluded that 

‘‘good cause’’ exists to promulgate this 

rule as an Interim Final Rule rather than 

a proposed rule for the following 

reasons. 

As explained above, the Ryan Haight 

Act contains the following provision 

specifically addressing the issuance of 

interim rules to implement the Act: 

The [DEA Administrator] may promulgate 

and enforce any rules, regulations, and 

procedures which may be necessary and 

appropriate for the efficient execution of 

functions under this Act or the amendments 

made by this Act, and, with the concurrence 

of the Secretary of Health and Human 

Services where this Act or the amendments 

made by this Act so provide, promulgate any 

interim rules necessary for the 

implementation of this Act or the 

amendments made by this Act, prior to its 

effective date.52

It is evident from the foregoing 

provision that Congress envisioned that 

DEA might need to issue regulations on 

an interim basis to implement the Ryan 

Haight Act prior to the Act’s effective 

date (April 13, 2009). This provision 

indicates that, given the 180 days 

between enactment of the Act and its 

effective date, Congress recognized it 

could be impracticable for DEA to 

complete notice-and-comment 

rulemaking within a time frame that 

would have allowed for regulations to 

become effective prior to the effective 

date of the Act. Similarly, this provision 

indicates that Congress believed it 

would be contrary to the public interest 

to delay the promulgation of regulations 

in a manner that would prevent 

implementation of the Act upon its 

effective date. Delaying the effective 

date of the regulations past the effective 

date of the Act would also be confusing 

to the public and would frustrate the 

intent of Congress to have the new 

provisions of the Act take effect on 

April 13, 2009. Accordingly, the rules 

published here are effective 

immediately while at the same time the 

agency is seeking public comment on 

them. 

Under the APA, 5 U.S.C. 553(d), 

agencies must generally provide a 30- 

day delayed effective date for final 

rules. An agency may dispense with the 

30-day delayed effective date 

requirement ‘‘for good cause found and 

published with the rule.’’ 5 U.S.C. 

553(d)(3). For the reasons just 

discussed, DEA concludes that such 

good cause exists to justify an 

immediate effective date. In addition to 

the reasons provided above, DEA had to 

make this rule effective immediately to 

have in place regulatory procedures that 

will allow legitimate pharmacies that 

wish to conduct activity as an ‘‘online 

pharmacy’’ to do so upon the effective 

date of the Act. With the immediate 

effective date of these regulations, 

pharmacies may, sufficiently in advance 

of the effective date of the Act, submit 

applications to modify their 

registrations as required by the Act. 

B. Executive Order 12866 

The Deputy Administrator certifies 

that this rulemaking has been drafted in 

accordance with the principles in 

Executive Order 12866 Section 1(b). It 

has been determined that this is ‘‘a 

significant regulatory action.’’ 

Therefore, this action has been reviewed 

by the Office of Management and 

Budget. As discussed above, this action 

is largely codifying statutory provisions 

and involves limited agency discretion. 

Costs. It should be noted that the costs 

identified here are costs associated with 

activities that online pharmacies are 

obligated to carry out to comply with 

the statutory requirements of the Ryan 

Haight Act. The regulatory provisions 

listed here are those which carry 

forward the statutory requirements 

mandated by the Act. 

Pharmacies with existing online 

operations and those that wish to begin 

dispensing controlled substances by 

means of the Internet must apply to 

DEA to modify their registrations. 

Section 1304.40 requires notification to 

DEA. The application for modification 

of registration includes the notifications 

required by the Act; application to DEA 

is made with an online form. The 

information required is straightforward: 

Names, addresses, telephone numbers, 

the name, professional degree, and 

telephone number of the pharmacist-incharge, and required certifications. 

Assembly of this information and 

putting it in the online form in the 

proper manner can be accomplished by 

a pharmacist (Standard Occupational 

Code (SOC) 29–1051). The information 

required for the online pharmacy Web 

site is largely the same as that required 

for the notification, so the pharmacist’s 

work will also provide the information 

needed for the Web site. 

Since an online pharmacy must have 

a Web site to operate, the initial cost of 

setting up the Web site is not a cost of 

the rule. (In fact, it is now commonplace 

for even small retail establishments to 

have Web sites.) The only cost is that of 

entering the required information and 

certifications on the site. Given that the 

site is already, or must be, in place, DEA 

estimates that such revisions will be 

relatively minor in nature. Modification 

of the Web site to include the required 

information will, however, require 

additional work—work that requires 

some technical expertise with computer 

systems and programs, including Web 

sites. DEA expects that a computer 

support specialist (SOC 15–1041) will 

be required for this work. 

Completion of the online application 

for modification of registration will 

require fifteen minutes of the 

pharmacist’s time and half an hour of 

the computer support specialist’s time 

to update the Web site with the required 

information. The Web site will require 

ongoing maintenance as information 

changes. This will require one hour per 

year of the computer-support 

specialist’s time. 

Section 1304.55 requires online 

pharmacies to report to DEA the total 

quantity of each controlled substance 

that the pharmacy has dispensed each 

calendar month. The report must 

include the total quantity of such 

dispensing by any means, regardless of 

whether the controlled substances are 

dispensed by means of the Internet. 

Such reporting is required for every 

calendar month in which the total 

quantity of controlled substances 

dispensed by the pharmacy meets or 

exceeds one of the following thresholds: 

100 or more prescriptions for controlled 

substances filled; or 5,000 or more 

dosage units dispensed of all controlled 

substances combined. 

Such reporting is not required now 

from pharmacies of any kind. Based 

upon common industry practice, DEA 

believes that virtually all pharmacies 

will have internal electronic 

recordkeeping systems which will 

include the necessary data. A computer 

programmer (SOC 15–1021) will be 

required to set up a system that will 

extract the required data from existing 

records and put it in a form that meets 

the rule and is suitable for transmission 

to DEA. DEA estimates that the initial 

set-up will take two hours of the 

programmer’s time. DEA expects that 

maintenance of the reporting system 

will not entail any increment in cost 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15615 

53Economic Census, Statistics of U.S. Businesses, 

2006, available at http://www.census.gov/epcd/ 

susb/latest/us/US44.HTM#N446. 

beyond the initial work of setting up the 

system. DEA further assumes that a 

pharmacist will require ten minutes per 

month to transmit the monthly report to 

DEA. 

Table 1 presents initial unit costs. 

TABLE 1—INITIAL UNIT COSTS

Requirement Unit time 

(in hours) 

Hourly wage, 

fully loaded Unit cost 

Application for Modification of Registration (pharmacist) .......................................................... 0 .25 $104.40 $26.10 

Revision of pharmacy Web site (computer support specialist) ................................................. 0 .5 47.79 23.89 

Establishing reporting system (programmer) ............................................................................ 2 .0 75.96 151.93 

Total .................................................................................................................................... .......................... ........................ 201.92 

Annual ongoing costs for online 

pharmacies comprise the cost of filing 

monthly reports with DEA and revising 

the pharmacy Web site as needed to 

comply with the requirements of the 

Act. As noted previously, DEA assumes 

that Web site modifications can be 

handled by a computer support 

specialist. DEA assumes one hour per 

year of a computer support specialist’s 

time for those modifications and two 

hours a year for the pharmacist to file 

the reports. Table 2 presents annual 

ongoing costs for online pharmacies. 

TABLE 2—ANNUAL ONGOING COSTS

Requirement Unit time 

(in hours) 

Hourly wage, 

fully loaded Unit cost 

Pharmacy Web site modification (computer support specialist) ................................................. 1.0 $47.79 $47.79 

Sending monthly report to DEA (pharmacist) ............................................................................. 2.0 104.40 208.80 

Total ...................................................................................................................................... ........................ ........................ 256.59 

Total costs. To estimate total costs, it 

is necessary to estimate the number of 

firms that will seek to modify their 

registration to that of online pharmacies. 

DEA estimates that 250 pharmacies will 

initially apply for such modification of 

registration. It is also necessary to 

estimate the number of pharmacies that 

will apply for such modification of 

registration in the future. DEA estimates 

that there would be a moderate number 

of registrants applying to modify their 

registrations in the two years after the 

first year as some other pharmacies find 

advantage in an online presence. After 

that, DEA estimates the number of 

pharmacies applying to modify their 

registrations will decline steadily, as 

few pharmacies will find benefit. Each 

year it is expected that a number of 

registrants applying to modify their 

registrations may drop out for various 

reasons. The total number of pharmacies 

in the United States has been declining. 

Data from the Economic Census indicate 

that the number of retail pharmacies fell 

at an annual rate of 1.7 percent from 

1998 through 2006.53 DEA estimates 

that the number of online pharmacy 

registrants will decline at a slightly 

faster rate, because some pharmacies 

will drop their online pharmacy 

registrations but stay in business as 

retail pharmacies. DEA estimates an 

annual attrition rate of 2.0 percent for 

online pharmacies. The table below 

shows the estimated number of online 

pharmacy registrations and registrants 

in operation, year by year. 

TABLE 3—ONLINE PHARMACY

REGISTRANTS

Registrations Registrants in 

operation 

Year 1 ... 250 250 

Year 2 ... 30 275 

Year 3 ... 25 295 

Year 4 ... 20 309 

Year 5 ... 20 322 

Year 6 ... 10 326 

Year 7 ... 10 329 

Year 8 ... 10 333 

Year 9 ... 9 335 

Year 10 8 337 

Year 11 7 337 

Year 12 6 336 

Year 13 5 334 

Year 14 5 333 

Year 15 5 331 

To obtain undiscounted costs, year by 

year, the unit cost estimates—$201.92 

for initial start-up, $256.59 for ongoing 

costs—are applied, respectively, to the 

number of online pharmacy 

registrations and the number of 

operating registrants in each year. The 

results are shown in the following table. 

TABLE 4—UNDISCOUNTED TOTAL

COSTS

Initial Ongoing Total 

Year 1 ..... $50,480 $64,147 $114,628 

Year 2 ..... 6,058 70,562 76,620 

Year 3 ..... 5,048 75,566 80,614 

Year 4 ..... 4,038 79,186 83,225 

Year 5 ..... 4,038 82,734 86,773 

Year 6 ..... 2,019 83,646 85,665 

Year 7 ..... 2,019 84,538 86,558 

Year 8 ..... 2,019 85,414 87,433 

Year 9 ..... 1,817 86,015 87,832 

Year 10 ... 1,615 86,347 87,962 

Year 11 ... 1,413 86,416 87,830 

Year 12 ... 1,212 86,227 87,439 

Year 13 ... 1,010 85,786 86,795 

Year 14 ... 1,010 85,353 86,363 

Year 15 ... 1,010 84,929 85,939 

Table 5 shows the present value and 

annualized cost at 7.0 percent and 3.0 

percent discount rates, over fifteen 

years. 

TABLE 5—PRESENT VALUE AND

ANNUALIZED COSTS

7.0 

Percent 

3.0 

Percent 

Year 1 ....................... $114,628 $114,628 

Year 2 ....................... 71,607 74,388 

Year 3 ....................... 70,411 75,986 

Year 4 ....................... 67,936 76,162 

Year 5 ....................... 66,198 77,096 

Year 6 ....................... 61,078 73,895 

Year 7 ....................... 57,677 72,491 

Year 8 ....................... 54,449 71,091 


pwalker on PROD1PC71 with RULES2
15616 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

54Office of National Drug Control Policy, Press 

Release, March 1, 2008, available at http:// 

www.ondcp.gov/pda/030108.html. 

55S. Rep. No. 110–521, at 68 (2008). 

56Small Business Administration, Table of Small 

Business Size Standards, August 22, 2008. 

TABLE 5—PRESENT VALUE AND

ANNUALIZED COSTS—Continued 

7.0 

Percent 

3.0 

Percent 

Year 9 ....................... 51,119 69,335 

Year 10 ..................... 47,846 67,416 

Year 11 ..................... 44,648 65,354 

Year 12 ..................... 41,542 63,168 

Year 13 ..................... 38,538 60,877 

Year 14 ..................... 35,837 58,809 

Year 15 ..................... 33,328 56,816 

Total ................... 856,843 1,077,511 

Annualized ......... 94,077 90,259 

The costs are relatively modest; the 

annualized sum of the present values is 

less than $100,000 at both discount 

rates. Further, Table 4 shows that the 

undiscounted annual cost never exceeds 

$100,000 after the first year with its 

relatively large number of registrations. 

Benefits. The Ryan Haight Online 

Pharmacy Consumer Protection Act is 

designed to save lives by reducing 

deaths from drug overdoses and 

otherwise lessen the detrimental 

consequences of pharmaceutical 

controlled substance abuse by 

restricting the ability of rogue Internet 

pharmacies to illegally divert dangerous 

controlled substance prescription drugs 

to millions of people, including teens, 

without valid prescriptions issued 

under a legitimate physician’s care.54

The regulations promulgated based on 

this legislation will address the ‘‘wideopen channel of distribution’’ that 

currently exists for prescription 

controlled substances sold over the 

Internet, which represents an ‘‘easy 

availability [that] has enormous 

implications for public health, 

particularly the health of our children.55

A key provision of this law, the 

requirement for practitioners to conduct 

at least one in-person medical 

evaluation of the patient before they 

prescribe a prescription for a controlled 

substance, is a major step toward 

combating the use of the Internet to 

facilitate illegal sales of pharmaceutical 

controlled substances. Also, requiring 

online pharmacies to post the required 

site disclosure information, 

certifications, and other information on 

their homepage provides consumers 

with enhanced tools to determine the 

legitimacy of the online pharmacy. 

C. Regulatory Flexibility Act 

The Deputy Administrator hereby 

certifies that this rulemaking has been 

drafted in accordance with the 

Regulatory Flexibility Act (RFA) (5 

U.S.C. 601–612). The RFA applies to a 

rule that is published by the agency as 

a notice of proposed rulemaking. As 

explained above, the Ryan Haight Act 

expressly contemplates that DEA will 

issue interim rules under the ‘‘good 

cause’’ provision of the APA as the 

agency deems necessary to implement 

the Act prior to its effective date (April 

13, 2009). Thus, Congress has expressly 

granted DEA authority to issue 

regulations to implement the Act that 

become effective immediately without 

the requirement of first seeking public 

comment through a notice of proposed 

rulemaking. Consequently, the 

requirements of the RFA do not apply 

to this rule. 

It also should be noted that only a 

limited portion of the regulatory text 

being issued here is subject to 

modification following the comment 

period as the bulk of the regulatory text 

is taken verbatim from, and mandated 

by, the Ryan Haight Act. DEA is seeking 

public comment with respect to those 

parts of the regulatory text about which 

the agency has discretion. 

Although the RFA does not apply to 

this Interim Final Rule, DEA has 

reviewed the potential impacts. The rule 

is likely to affect a substantial number 

of small entities, but DEA does not 

believe that it will have a significant 

economic impact on small entities. 

DEA is uncertain which pharmacies 

will apply to modify their registrations 

to that of online pharmacies. While it is 

possible that such applicants will be a 

mixture of independent pharmacies and 

chains, DEA believes it unlikely that 

many chain pharmacies will fall within 

the definition of an online pharmacy 

and thereby need to apply for the 

modified registration. As discussed 

previously, the Ryan Haight Act 

contains several exceptions to the 

definition of ‘‘online pharmacy’’ 

including the exception set forth in 21 

U.S.C. 802(52)(B)(viii) that excludes 

from the definition of an online 

pharmacy those DEA-registered 

pharmacies ‘‘whose dispensing of 

controlled substances via the Internet 

consists solely of * * * (I) refilling 

prescriptions for controlled substances 

in schedule III, IV, or V, as defined in 

paragraph [21 U.S.C. 802(55)] or (II) 

filling new prescriptions for controlled 

substances in schedule III, IV, or V, as 

defined in paragraph [21 U.S.C. 

802(56)].’’ Also, the regulations being 

issued here exempt from the definition 

of online pharmacy any registered 

pharmacy ‘‘whose delivery, distribution, 

or dispensing of controlled substances 

by means of the Internet consists solely 

of * * * filling prescriptions that were 

electronically prescribed in a manner 

authorized by this chapter and 

otherwise in compliance with the Act.’’ 

Given these exceptions to the definition 

of an online pharmacy, DEA anticipates 

that the overwhelming majority of 

pharmacies in the United States, if they 

follow their current practices, will not, 

as of April 13, 2009, fall within the 

definition of an online pharmacy. 

Further, as DEA stated previously, as 

long as the pharmacist meets his 

corresponding responsibility to take 

reasonable steps under the 

circumstances of the dispensing of any 

particular prescription to ensure that the 

prescription was issued in accordance 

with the requirements of the Ryan 

Haight Act (as well as all other 

applicable requirements of the CSA and 

DEA regulations), the pharmacist will 

not be held strictly liable for filling a 

prescription that he could not 

reasonably have known was issued by 

means of the Internet. Thus, it is 

absolutely unnecessary for a pharmacy 

to apply for a modification of its DEA 

registration authorizing it to operate as 

an online pharmacy for the sole purpose 

of ensuring that it does not—despite the 

exercise of sound professional 

judgment—inadvertently fill a 

prescription that was issued by means 

of the Internet. 

The small-business size standard for 

retail pharmacies is annual revenue of 

$7.0 million.56 From the 2002 Economic 

Census, there are data on revenue of 

pharmacies by revenue class. The class 

with the lowest average revenue is 

pharmacies with sales of less than 

$250,000 per year. Average revenue for 

this group is $132,000. Table 6 shows 

Small Business Administration 

standards for these and larger firms that 

dispense controlled substances. 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15617 

57Economic Census, Establishment and Firm 

Size, 2002, Table 4. 

TABLE 6—SBA DEFINITIONS OF SMALL ENTITIES

Industry description NAICS code 

Small 

business 

definition 

(sales in $) 

Pharmacies and Drug Stores .................................................................................................................................. 446110 7,000,000 

Supermarkets and Other Grocery Stores ................................................................................................................ 445110 27,000,000 

Discount Department Stores ................................................................................................................................... 452112 27,000,000 

Warehouse Clubs and Supercenters ...................................................................................................................... 452910 25,000,000 

Mail Order Houses ................................................................................................................................................... 454113 25,000,000 

DEA estimates the annual cost of 

compliance with the Interim Final Rule 

for an individual pharmacy is the 

annualized sum of the present value of 

a 15-year stream of ongoing costs and 

the initial start-up cost. Table 7 shows 

these values for 7.0 percent and 3.0 

percent discount rates. The result is 

annualized cost of about $275. Even for 

the smallest pharmacies, that is not a 

significant economic impact.57

TABLE 7—ANNUALIZED COST FOR AN ONLINE PHARMACY

7.0 Percent 3.0 Percent 

Annual Ongoing Cost .............................................................................................................................................. $256.59 $256.59 

PV of Ongoing Cost ................................................................................................................................................. 2,337.00 3,063.15 

Initial Cost ................................................................................................................................................................ 201.92 201.92 

Sum of PV and Initial Cost ...................................................................................................................................... 2,538.92 3,265.07 

Annualized Cost ....................................................................................................................................................... 278.76 273.50 

D. Paperwork Reduction Act 

The Ryan Haight Act requires 

pharmacies that dispense controlled 

substances by means of the Internet to 

obtain a modification of their existing 

DEA registration to that of an online 

pharmacy (21 U.S.C. 823(f), 21 CFR 

1301.11). To address this, DEA is 

revising its existing information 

collection, ‘‘Application for Registration 

(DEA Form 224), Application for 

Registration Renewal (DEA Form 224a), 

Affidavit for Chain Renewal (DEA Form 

224b)’’ [information collection 1117– 

0014] to add an Application for 

Modification of Registration for Online 

Pharmacies (DEA Form 224c). This form 

will be completed online by pharmacies 

requesting to modify their registrations 

to that of an online pharmacy. 

Application for modification of 

registration—The application for 

modification of registration will require 

an online pharmacy applicant to 

provide to DEA certain information, as 

discussed above. For purposes of this 

reporting, DEA believes that the Internet 

Pharmacy Site Disclosure information 

that applicants must supply will be 

immediately obtainable with minimal 

effort. Information such as the 

pharmacy’s name, registration number, 

and contact information will be 

populated by DEA on the online form 

completed by the pharmacy applicant. 

Contact information for the pharmacistin-charge should be readily available. 

State licensure information should be 

readily available as well. 

DEA believes that very few legitimate 

pharmacies (i.e., those that comply with 

the law) will be affiliated with more 

than one Web site. Nor does it seem 

likely that such pharmacies will have 

contractual relationships with 

practitioners to issue prescriptions for 

controlled substances through referrals 

from the Web site or at the request of the 

owner or operator of the Web site, or 

any employee or agent thereof. Thus, 

DEA believes that the reporting of this 

type of information should be minimal, 

if at all, and will not be burdensome for 

the vast majority of the limited number 

of pharmacies likely to apply to modify 

their registrations. 

DEA believes that the certifications 

required of the online pharmacies are 

straightforward and can easily be 

included on pharmacies’ Web sites and 

reported to DEA. DEA has provided 

examples of those certifications for 

potential use by pharmacies applying to 

modify their registrations. 

While the new reporting and 

application requirements will request 

information not previously requested by 

DEA (as the Ryan Haight Act mandates), 

DEA believes that much of the 

information required to be provided as 

part of the applications is readily 

available and retrievable, thus limiting 

the impact of the burden for completion 

of this application. 

DEA estimates that 250 pharmacies 

will apply to modify their registrations 

to that of online pharmacies. DEA 

estimates that it will take a pharmacy 15 

minutes (0.25 hours) to complete an 

Application for Modification of 

Registration for Online Pharmacies 

(DEA Form 224c), and that it will take 

an online pharmacy 15 minutes (0.25 

hours) to renew its online pharmacy 

registration. DEA notes that the 

Application for Modification of 

Registration for Online Pharmacies 

(DEA Form 224c) is completed and 

submitted online through the DEA 

Office of Diversion Control Web site. 

Because those applying for a 

modification of registration must 

already be registered with DEA, the 

overall number of respondents will not 

change. To account for the new 

requirement, the number of respondents 

using DEA–224a has been reduced by 

the 250 respondents DEA estimates will 

apply for a modification using DEA– 

224c. As a result, the total burden for 

DEA–224a has been reduced by 16.7 

hours. DEA estimates that DEA–224c 

will have a total of 62.5 burden hours 

for an overall increase of 46.2 burden 

hours. 

Reports of dispensing of controlled 

substances by online pharmacies—The 

Ryan Haight Act requires those 

pharmacies with modified registrations 

to report certain information regarding 

their dispensing of controlled 


pwalker on PROD1PC71 with RULES2
15618 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

substances to DEA. Specifically, online 

pharmacies are required to report to 

DEA the total quantity of controlled 

substances that the pharmacy has 

dispensed during each calendar month 

by any means, regardless of whether the 

controlled substances are dispensed by 

means of the Internet. Reports are 

required to be filed by every pharmacy 

that, at any time during a calendar 

month, holds a modified registration 

authorizing it to operate as an online 

pharmacy, regardless of whether the 

online pharmacy dispenses any 

controlled substances by means of the 

Internet during the month. Reports are 

required when the total quantity of 

controlled substances dispensed meets 

or exceeds either 100 or more 

prescriptions for controlled substances 

filled, or 5,000 or more dosage units 

dispensed of all controlled substances 

combined, in the calendar month for 

which reporting is required. If a 

pharmacy fills fewer than 100 

prescriptions for controlled substances, 

and dispenses fewer than 5,000 dosage 

units of all controlled substances 

combined, in the calendar month for 

which reporting is required, a negative 

response indicating that reporting is not 

required must be received by DEA. 

Thus, each online pharmacy will report 

every month to DEA, either by 

providing actual dispensing information 

or by providing a negative response. 

DEA believes that, of the limited 

number of pharmacies expected to be 

subject to the reporting requirement of 

the Act, few are likely to submit 

negative responses. It is reasonable to 

assume that online pharmacies subject 

to the reporting requirement will either 

fill 100 or more prescriptions for 

controlled substances, or 5,000 or more 

dosage units of all controlled substances 

combined, in any calendar month. 

Therefore, DEA has assumed for 

purposes of these estimates that all 

online pharmacies will report 

dispensing information to DEA. 

DEA estimates that 250 online 

pharmacies will file monthly reports 

with DEA regarding their dispensing of 

controlled substances. DEA estimates 

that it will take each pharmacy 10 

minutes to file this report. 

The Department of Justice, Drug 

Enforcement Administration, has 

submitted the following information 

collection requests to the Office of 

Management and Budget (OMB) for 

review and clearance in accordance 

with the review procedures of the 

Paperwork Reduction Act of 1995. The 

information collections are published to 

obtain comments from the public and 

affected agencies. 

All comments and suggestions, or 

questions regarding additional 

information, to include obtaining a copy 

of the proposed information collection 

instrument with instructions, should be 

directed to Mark W. Caverly, Chief, 

Liaison and Policy Section, Office of 

Diversion Control, Drug Enforcement 

Administration, 8701 Morrissette Drive, 

Springfield, VA 22152, Telephone (202) 

307–7297. 

Written comments and suggestions 

from the public and affected agencies 

concerning the required collections of 

information are encouraged. Your 

comments on the information 

collection-related aspects of this rule 

should address one or more of the 

following four points: 

• Evaluate whether the collection of 

information is necessary for the proper 

performance of the functions of the 

agency, including whether the 

information will have practical utility. 

• Evaluate the accuracy of the 

agency’s estimate of the burden of the 

proposed collection of information, 

including the validity of the 

methodology and assumptions used. 

• Recommendations to enhance the 

quality, utility, and clarity of the 

information to be collected. 

• Recommendations to minimize the 

burden of the collection of information 

on those who are to respond, including 

through the use of appropriate 

automated, electronic, mechanical, or 

other technological collection 

techniques or other forms of information 

technology, e.g., permitting electronic 

submission of responses. 

Overview of information collection 

1117–0014: 

(1) Type of Information Collection: 

Revision of a currently approved 

collection. 

(2) Title of the Form/Collection: 

Application for Registration (DEA 

Form 224); 

Application for Registration Renewal 

(DEA Form 224a); 

Affidavit for Chain Renewal (DEA 

Form 224b); 

Application for Modification of 

Registration for Online Pharmacies 

(DEA Form 224c) 

(3) Agency form number, if any, and 

the applicable component of the 

Department of Justice sponsoring the 

collection: 

Form Number: DEA Form 224, 224a, 

224b, 224c; 

Component: Office of Diversion 

Control, Drug Enforcement 

Administration, U.S. Department of 

Justice. 

(4) Affected public who will be asked 

or required to respond, as well as a brief 

abstract: 

Primary: Business or other for-profit. 

Other: Not-for-Profit Institutions; 

State, Local or Tribal Government. 

Abstract: All firms and individuals 

who distribute or dispense controlled 

substances must register with the DEA 

under the Controlled Substances Act. 

Pharmacies wishing to be online 

pharmacies must apply to modify their 

registrations. Such registration is 

mandatory under the law and needed 

for control measures over legal handlers 

of controlled substances and to monitor 

their activities. 

(5) An estimate of the total number of 

respondents and the amount of time 

estimated for an average respondent to 

respond is provided in the table below. 

Please note that the number of 

respondents using DEA–224a has been 

reduced by the 250 respondents that 

DEA estimates will apply for a 

modification using DEA–224c. Because 

those applying for a modification of 

registration must be currently registered 

with DEA, the overall number of 

respondents will not increase. The total 

response time has increased by 46.2 

hours as a result of the 11 additional 

minutes it is estimated it will take each 

respondent to complete DEA–224c as 

compared to DEA–224a. 

Form Completed Number of 

respondents Time per response Total (in hours) 

Application for Registration (DEA–224) ..................... Paper ............................... 12,094 0.2 hours (12 minutes) .... 2,418 .8 

Application for Registration (DEA–224) ..................... Electronic ......................... 59,283 0.13 hours (8 minutes) .... 7,904 .4 

Application for Registration Renewal (DEA–224a) .... Paper ............................... 159,678 0.2 hours (12 minutes) .... 31,935.6 

Application for Registration Renewal (DEA–224a) .... Electronic ......................... 209,285 0.06 hours (4 minutes) .... 13,952 .3 

Affidavit for Chain Renewals (DEA–224b) ................. Electronic ......................... 16 5 hours ............................ 80 

Application for Modification of Registration for Online 

Pharmacies (DEA–224c).

Electronic ......................... 250 0.25 hours (15 minutes) .. 62 .5 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15619 

Form Completed Number of 

respondents Time per response Total (in hours) 

Total .................................................................... .......................................... 440,606 .......................................... 56,354 

(6) An estimate of the total public 

burden (in hours) associated with the 

collection: It is estimated that this 

collection will create a burden of 56,354 

annual burden hours. 

Overview of new information 

collection: 

(1) Type of Information Collection: 

New collection. 

(2) Title of the Form/Collection: 

Reports of dispensing of controlled 

substances by online pharmacies. 

(3) Agency form number, if any, and 

the applicable component of the 

Department of Justice sponsoring the 

collection: 

Form Number: DEA Form 332. 

Component: Office of Diversion 

Control, Drug Enforcement 

Administration, U.S. Department of 

Justice. 

(4) Affected public who will be asked 

or required to respond, as well as a brief 

abstract: 

Primary: Business or other for-profit. 

Other: Not-for-Profit Institutions; 

State, Local or Tribal Government. 

Abstract: The Controlled Substances 

Act (21 U.S.C. 827(d)(2)) requires online 

pharmacies to report to DEA the total 

quantity of controlled substances that 

the pharmacy has dispensed during 

each calendar month by any means, 

regardless of whether the controlled 

substances are dispensed by means of 

the Internet. Reports are required to be 

filed by every pharmacy that, at any 

time during a calendar month, holds a 

modified registration authorizing it to 

operate as an online pharmacy, 

regardless of whether the online 

pharmacy dispenses any controlled 

substances by means of the Internet 

during the month. Such reporting is 

mandated by the Ryan Haight Act and 

permits DEA to monitor the dispensing 

of controlled substances by online 

pharmacies. 

(5) An estimate of the total number of 

respondents and the amount of time 

estimated for an average respondent to 

respond: It is estimated that 250 persons 

respond to this collection at 0.25 hours 

per person per month, for a total of 750 

hours per year. 

(6) An estimate of the total public 

burden (in hours) associated with the 

collection: 750 annual burden hours. 

If additional information is required 

contact: Lynn Bryant, Department 

Clearance Officer, Information 

Management and Security Staff, Justice 

Management Division, Department of 

Justice, Patrick Henry Building, Suite 

1600, 601 D Street, NW., Washington, 

DC 20530. 

E. Executive Order 12988 

This regulation meets the applicable 

standards set forth in sections 3(a) and 

3(b)(2) of Executive Order 12988, Civil 

Justice Reform. 

F. Executive Order 13132 

This rulemaking does not impose 

enforcement responsibilities on any 

State; nor does it diminish the power of 

any State to enforce its own laws. 

Accordingly, this rulemaking does not 

have federalism implications warranting 

the application of Executive Order 

13132. 

G. Unfunded Mandates Reform Act of 

1995 

This rule will not result in the 

expenditure by State, local, and tribal 

governments, in the aggregate, or by the 

private sector, of $120,000,000 or more 

(adjusted for inflation) in any one year, 

and will not significantly or uniquely 

affect small governments. Therefore, no 

actions were deemed necessary under 

the provisions of the Unfunded 

Mandates Reform Act of 1995. 

H. Congressional Review Act 

This rule is not a major rule as 

defined by section 804 of the Small 

Business Regulatory Enforcement 

Fairness Act of 1996 (Congressional 

Review Act). This rule will not result in 

an annual effect on the economy of 

$100,000,000 or more; a major increase 

in costs or prices; or significant adverse 

effects on competition, employment, 

investment, productivity, innovation, or 

on the ability of United States-based 

companies to compete with foreignbased companies in domestic and 

export markets. Further, as noted above 

in the Administrative Procedure Act 

certification, DEA has concluded that 

‘‘good cause’’ exists to promulgate this 

rule as an Interim Final Rule effective as 

set forth in the DATES section of the 

preamble pursuant to 5 U.S.C. 553(b)(B) 

and 5 U.S.C. 553(d)(3). 

List of Subjects 

21 CFR Part 1300 

Chemicals, Drug traffic control. 

21 CFR Part 1301 

Administrative practice and 

procedure, Drug traffic control, Security 

measures. 

21 CFR Part 1304 

Drug traffic control, Reporting and 

recordkeeping requirements. 

21 CFR Part 1306 

Drug traffic control, Prescription 

drugs. 

■ For the reasons set out above, 21 CFR 

parts 1300, 1301, 1304, and 1306 are 

amended as follows: 

PART 1300—DEFINITIONS 

■ 1. The authority citation for part 1300 

is revised to read as follows: 

Authority: 21 U.S.C. 802, 821, 829, 871(b), 

951, 958(f). 

■ 2. Section 1300.04 is added to read as 

follows: 

§ 1300.04 Definitions relating to the 

dispensing of controlled substances by 

means of the Internet. 

(a) Any term not defined in this part 

or elsewhere in this chapter shall have 

the definition set forth in sections 102 

and 309 of the Act (21 U.S.C. 802, 829). 

(b) The term covering practitioner 

means, with respect to a patient, a 

practitioner who conducts a medical 

evaluation (other than an in-person 

medical evaluation) at the request of a 

practitioner who: 

(1) Has conducted at least one inperson medical evaluation of the patient 

or an evaluation of the patient through 

the practice of telemedicine, within the 

previous 24 months; and 

(2) Is temporarily unavailable to 

conduct the evaluation of the patient. 

(c) The term deliver, distribute, or 

dispense by means of the Internet refers, 

respectively, to any delivery, 

distribution, or dispensing of a 

controlled substance that is caused or 

facilitated by means of the Internet. 

(d) The term filling new prescriptions 

for controlled substances in Schedule 

III, IV, or V means filling a prescription 

for an individual for a controlled 

substance in Schedule III, IV, or V, if: 

(1) The pharmacy dispensing that 

prescription has previously dispensed 

to the patient a controlled substance 

other than by means of the Internet and 

pursuant to the valid prescription of a 

practitioner that meets the applicable 


pwalker on PROD1PC71 with RULES2
15620 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

requirements of subsections (b) and (c) 

of section 309 of the Act (21 U.S.C. 829) 

and §§ 1306.21 and 1306.22 of this 

chapter (for purposes of this definition, 

such a prescription shall be referred to 

as the ‘‘original prescription’’); 

(2) The pharmacy contacts the 

practitioner who issued the original 

prescription at the request of that 

individual to determine whether the 

practitioner will authorize the issuance 

of a new prescription for that individual 

for the controlled substance described 

in paragraph (d)(1) of this section (i.e., 

the same controlled substance as 

described in paragraph (d)(1)); and 

(3) The practitioner, acting in the 

usual course of professional practice, 

determines there is a legitimate medical 

purpose for the issuance of the new 

prescription. 

(e) The term homepage means the 

opening or main page or screen of the 

Web site of an online pharmacy that is 

viewable on the Internet. 

(f) The term in-person medical 

evaluation means a medical evaluation 

that is conducted with the patient in the 

physical presence of the practitioner, 

without regard to whether portions of 

the evaluation are conducted by other 

health professionals. Nothing in this 

paragraph shall be construed to imply 

that one in-person medical evaluation 

demonstrates that a prescription has 

been issued for a legitimate medical 

purpose within the usual course of 

professional practice. 

(g) The term Internet means 

collectively the myriad of computer and 

telecommunications facilities, including 

equipment and operating software, 

which comprise the interconnected 

worldwide network of networks that 

employ the Transmission Control 

Protocol/Internet Protocol, or any 

predecessor or successor protocol to 

such protocol, to communicate 

information of all kinds by wire or 

radio. 

(h) The term online pharmacy means 

a person, entity, or Internet site, 

whether in the United States or abroad, 

that knowingly or intentionally delivers, 

distributes, or dispenses, or offers or 

attempts to deliver, distribute, or 

dispense, a controlled substance by 

means of the Internet. The term 

includes, but is not limited to, a 

pharmacy that has obtained a 

modification of its registration pursuant 

to §§ 1301.13 and 1301.19 of this 

chapter that currently authorizes it to 

dispense controlled substances by 

means of the Internet, regardless of 

whether the pharmacy is currently 

dispensing controlled substances by 

means of the Internet. The term does not 

include: 

(1) Manufacturers or distributors 

registered under subsection (a), (b), (d), 

or (e) of section 303 of the Act (21 

U.S.C. 823(a), (b), (d), or (e)) (§ 1301.13 

of this chapter) who do not dispense 

controlled substances to an unregistered 

individual or entity; 

(2) Nonpharmacy practitioners who 

are registered under section 303(f) of the 

Act (21 U.S.C. 823(f)) (§ 1301.13 of this 

chapter) and whose activities are 

authorized by that registration; 

(3) Any hospital or other medical 

facility that is operated by an agency of 

the United States (including the Armed 

Forces), provided such hospital or other 

facility is registered under section 303(f) 

of the Act (21 U.S.C. 823(f)) (§ 1301.13 

of this chapter); 

(4) A health care facility owned or 

operated by an Indian tribe or tribal 

organization, only to the extent such 

facility is carrying out a contract or 

compact under the Indian SelfDetermination and Education 

Assistance Act; 

(5) Any agent or employee of any 

hospital or facility referred to in 

paragraph (h)(3) or (h)(4) of this section, 

provided such agent or employee is 

lawfully acting in the usual course of 

business or employment, and within the 

scope of the official duties of such agent 

or employee, with such hospital or 

facility, and, with respect to agents or 

employees of health care facilities 

specified in paragraph (h)(4) of this 

section, only to the extent such 

individuals are furnishing services 

pursuant to the contracts or compacts 

described in such paragraph; 

(6) Mere advertisements that do not 

attempt to facilitate an actual 

transaction involving a controlled 

substance; 

(7) A person, entity, or Internet site 

that is not in the United States and does 

not facilitate the delivery, distribution, 

or dispensing of a controlled substance 

by means of the Internet to any person 

in the United States; 

(8) A pharmacy registered under 

section 303(f) of the Act (21 U.S.C. 

823(f)) (§ 1301.13 of this chapter) whose 

dispensing of controlled substances via 

the Internet consists solely of: 

(i) Refilling prescriptions for 

controlled substances in Schedule III, 

IV, or V, as defined in paragraph (k) of 

this section; or 

(ii) Filling new prescriptions for 

controlled substances in Schedule III, 

IV, or V, as defined in paragraph (d) of 

this section; 

(9)(i) Any registered pharmacy whose 

delivery, distribution, or dispensing of 

controlled substances by means of the 

Internet consists solely of filling 

prescriptions that were electronically 

prescribed in a manner authorized by 

this chapter and otherwise in 

compliance with the Act. 

(ii) A registered pharmacy will be 

deemed to meet this exception if, in 

view of all of its activities other than 

those referred to in paragraph (h)(9)(i) of 

this section, it would fall outside the 

definition of an online pharmacy; or 

(10)(i) Any registered pharmacy 

whose delivery, distribution, or 

dispensing of controlled substances by 

means of the Internet consists solely of 

the transmission of prescription 

information between a pharmacy and an 

automated dispensing system located in 

a long term care facility when the 

registration of the automated dispensing 

system is held by that pharmacy as 

described in §§ 1301.17 and 1301.27 

and the pharmacy is otherwise 

complying with this chapter. 

(ii) A registered pharmacy will be 

deemed to meet this exception if, in 

view of all of its activities other than 

those referred to in paragraph (h)(10)(i) 

of this section, it would fall outside the 

definition of an online pharmacy. 

(i) Effective January 15, 2010, the term 

practice of telemedicine means the 

practice of medicine in accordance with 

applicable Federal and State laws by a 

practitioner (other than a pharmacist) 

who is at a location remote from the 

patient and is communicating with the 

patient, or health care professional who 

is treating the patient, using a 

telecommunications system referred to 

in section 1834(m) of the Social Security 

Act (42 U.S.C. 1395m(m)), which 

practice falls within a category listed in 

the following paragraphs (i)(1) through 

(7): 

(1) Treatment in a hospital or clinic. 

The practice of telemedicine is being 

conducted while the patient is being 

treated by, and physically located in, a 

hospital or clinic registered under 

section 303(f) of the Act (21 U.S.C. 

823(f)) by a practitioner acting in the 

usual course of professional practice, 

who is acting in accordance with 

applicable State law, and who is 

registered under section 303(f) of the 

Act (21 U.S.C. 823(f)) in the State in 

which the patient is located, unless the 

practitioner: 

(i) Is exempted from such registration 

in all States under section 302(d) of the 

Act (21 U.S.C. 822(d); or 

(ii) Is an employee or contractor of the 

Department of Veterans Affairs who is 

acting in the scope of such employment 

or contract, and registered under section 

303(f) of the Act (21 U.S.C. 823(f)) in 

any State or is utilizing the registration 

of a hospital or clinic operated by the 

Department of Veterans Affairs 

registered under section 303(f); 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15621 

(2) Treatment in the physical presence 

of a practitioner. The practice of 

telemedicine is being conducted while 

the patient is being treated by, and in 

the physical presence of, a practitioner 

acting in the usual course of 

professional practice, who is acting in 

accordance with applicable State law, 

and who is registered under section 

303(f) of the Act (21 U.S.C. 823(f)) in the 

State in which the patient is located, 

unless the practitioner: 

(i) Is exempted from such registration 

in all States under section 302(d) of the 

Act (21 U.S.C. 822(d)); or 

(ii) Is an employee or contractor of the 

Department of Veterans Affairs who is 

acting in the scope of such employment 

or contract, and registered under section 

303(f) of the Act (21 U.S.C. 823(f)) in 

any State or is using the registration of 

a hospital or clinic operated by the 

Department of Veterans Affairs 

registered under section 303(f); 

(3) Indian Health Service or tribal 

organization. The practice of 

telemedicine is being conducted by a 

practitioner who is an employee or 

contractor of the Indian Health Service, 

or is working for an Indian tribe or tribal 

organization under its contract or 

compact with the Indian Health Service 

under the Indian Self-Determination 

and Education Assistance Act; who is 

acting within the scope of the 

employment, contract, or compact; and 

who is designated as an Internet Eligible 

Controlled Substances Provider by the 

Secretary of Health and Human Services 

under section 311(g)(2) of the Act (21 

U.S.C. 831(g)(2)); 

(4) Public health emergency declared 

by the Secretary of Health and Human 

Services. The practice of telemedicine is 

being conducted during a public health 

emergency declared by the Secretary of 

Health and Human Services under 

section 319 of the Public Health Service 

Act (42 U.S.C. 247d), and involves 

patients located in such areas, and such 

controlled substances, as the Secretary 

of Health and Human Services, with the 

concurrence of the Administrator, 

designates, provided that such 

designation shall not be subject to the 

procedures prescribed by the 

Administrative Procedure Act (5 U.S.C. 

551–559 and 701–706); 

(5) Special registration. The practice 

of telemedicine is being conducted by a 

practitioner who has obtained from the 

Administrator a special registration 

under section 311(h) of the Act (21 

U.S.C. 831(h)); 

(6) Department of Veterans Affairs 

medical emergency. The practice of 

telemedicine is being conducted: 

(i) In a medical emergency situation: 

(A) That prevents the patient from 

being in the physical presence of a 

practitioner registered under section 

303(f) of the Act (21 U.S.C. 823(f)) who 

is an employee or contractor of the 

Veterans Health Administration acting 

in the usual course of business and 

employment and within the scope of the 

official duties or contract of that 

employee or contractor; 

(B) That prevents the patient from 

being physically present at a hospital or 

clinic operated by the Department of 

Veterans Affairs registered under 

section 303(f) of the Act (21 U.S.C. 

823(f)); 

(C) During which the primary care 

practitioner of the patient or a 

practitioner otherwise practicing 

telemedicine within the meaning of this 

paragraph is unable to provide care or 

consultation; and 

(D) That requires immediate 

intervention by a health care 

practitioner using controlled substances 

to prevent what the practitioner 

reasonably believes in good faith will be 

imminent and serious clinical 

consequences, such as further injury or 

death; and 

(ii) By a practitioner that: 

(A) Is an employee or contractor of the 

Veterans Health Administration acting 

within the scope of that employment or 

contract; 

(B) Is registered under section 303(f) 

of the Act (21 U.S.C. 823(f)) in any State 

or is utilizing the registration of a 

hospital or clinic operated by the 

Department of Veterans Affairs 

registered under section 303(f); and 

(C) Issues a controlled substance 

prescription in this emergency context 

that is limited to a maximum of a fiveday supply which may not be extended 

or refilled; or 

(7) Other circumstances specified by 

regulation. The practice of telemedicine 

is being conducted under any other 

circumstances that the Administrator 

and the Secretary of Health and Human 

Services have jointly, by regulation, 

determined to be consistent with 

effective controls against diversion and 

otherwise consistent with the public 

health and safety. 

(j) Temporary definition of practice of 

telemedicine. Prior to January 15, 2010, 

or as otherwise specified by regulation 

prior to that date, instead of the 

definition in paragraph (i), the term 

practice of telemedicine means the 

practice of medicine in accordance with 

applicable Federal and State laws by a 

practitioner (as that term is defined in 

section 102 of the Act (21 U.S.C. 802)) 

(other than a pharmacist) who is at a 

location remote from the patient and is 

communicating with the patient, or 

health care professional who is treating 

the patient, using a telecommunications 

system referred to in section 1834(m) of 

the Social Security Act (42 U.S.C. 

1395m(m)), if the practitioner is using 

an interactive telecommunications 

system that satisfies the requirements of 

section 410.78(a)(3) of title 42, Code of 

Federal Regulations. 

(k) The term refilling prescriptions for 

controlled substances in Schedule III, 

IV, or V: 

(1) Means the dispensing of a 

controlled substance in Schedule III, IV, 

or V in accordance with refill 

instructions issued by a practitioner as 

part of a valid prescription that meets 

the requirements of subsections (b) and 

(c) of section 309 of the Act (21 U.S.C. 

829) and §§ 1306.21 and 1306.22 of this 

chapter, as appropriate; and 

(2) Does not include the issuance of 

a new prescription to an individual for 

a controlled substance that individual 

was previously prescribed. 

(l)(1) The term valid prescription 

means a prescription that is issued for 

a legitimate medical purpose in the 

usual course of professional practice by: 

(i) A practitioner who has conducted 

at least one in-person medical 

evaluation of the patient; or 

(ii) A covering practitioner. 

(2) Nothing in this paragraph (l) shall 

be construed to imply that one inperson medical evaluation demonstrates 

that a prescription has been issued for 

a legitimate medical purpose within the 

usual course of professional practice. 

PART 1301—REGISTRATION OF 

MANUFACTURERS, DISTRIBUTORS, 

AND DISPENSERS OF CONTROLLED 

SUBSTANCES 

■ 3. The authority citation for part 1301 

is revised to read as follows: 

Authority: 21 U.S.C. 821, 822, 823, 824, 

831, 871(b), 875, 877, 886a, 951, 952, 953, 

956, 957, 958. 

■ 4. Section 1301.11 is revised to read 

as follows: 

§ 1301.11 Persons required to register; 

requirement of modification of registration 

authorizing activity as an online pharmacy. 

(a) Every person who manufactures, 

distributes, dispenses, imports, or 

exports any controlled substance or who 

proposes to engage in the manufacture, 

distribution, dispensing, importation or 

exportation of any controlled substance 

shall obtain a registration unless 

exempted by law or pursuant to 

§§ 1301.22 through 1301.26. Except as 

provided in paragraph (b) of this 

section, only persons actually engaged 

in such activities are required to obtain 

a registration; related or affiliated 


pwalker on PROD1PC71 with RULES2
15622 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

persons who are not engaged in such 

activities are not required to be 

registered. (For example, a stockholder 

or parent corporation of a corporation 

manufacturing controlled substances is 

not required to obtain a registration.) 

(b) As provided in sections 303(f) and 

401(h) of the Act (21 U.S.C. 823(f) and 

841(h)), it is unlawful for any person 

who falls within the definition of 

‘‘online pharmacy’’ (as set forth in 

section 102(52) of the Act (21 U.S.C. 

802(52)) and § 1300.04(h) of this 

chapter) to deliver, distribute, or 

dispense a controlled substance by 

means of the Internet if such person is 

not validly registered with a 

modification of such registration 

authorizing such activity (unless such 

person is exempt from such modified 

registration requirement under the Act 

or this chapter). The Act further 

provides that the Administrator may 

only issue such modification of 

registration to a person who is registered 

as a pharmacy under section 303(f) of 

the Act (21 U.S.C. 823(f)). Accordingly, 

any pharmacy registered pursuant to 

§ 1301.13 of this part that falls within 

the definition of an online pharmacy 

and proposes to dispense controlled 

substances by means of the Internet 

must obtain a modification of its 

registration authorizing such activity 

following the submission of an 

application in accordance with 

§ 1301.19 of this part. This requirement 

does not apply to a registered pharmacy 

that does not fall within the definition 

of an online pharmacy set forth in 

§ 1300.04(h). Under the Act, persons 

other than registered pharmacies are not 

eligible to obtain such a modification of 

registration but remain liable under 

section 401(h) of the Act (21 U.S.C. 

841(h)) if they deliver, distribute, or 

dispense a controlled substance while 

acting as an online pharmacy without 

being validly registered with a 

modification authorizing such activity. 

■ 5. Section 1301.13 is amended by 

revising paragraph (e)(1)(iv) and (e)(3) to 

read as follows: 

§ 1301.13 Application for registration; time 

for application; expiration date; registration 

for independent activities; application 

forms, fees, contents and signature; 

coincident activities. 

* * * * * 

(e) * * * 

(1) * * * 

Business activity Controlled 

substances 

DEA application 

forms 

Application 

fee 

(dollars) 

Registration 

period 

(years) 

Coincident activities allowed 

* * * * * * * 

(iv) Dispensing or instructing (includes Practitioner, Hospital/ 

Clinic, Retail Pharmacy, Online 

Pharmacy, Central fill pharmacy, Teaching Institution).

Schedules II–V New—224 .........

Renewal—224a 

Online Pharmacy—224c.

551 

551 

3 May conduct research and instructional activities with those 

substances for which registration was granted, except that a 

mid-level practitioner may conduct such research only to the 

extent expressly authorized 

under State statute. A pharmacist may manufacture an 

aqueous or oleaginous solution 

or solid dosage form containing a narcotic controlled 

substance in Schedule II–V in 

a proportion not exceeding 

20% of the complete solution, 

compound or mixture. A retail 

pharmacy may perform central 

fill pharmacy activities. An online pharmacy may perform activities of retail pharmacy as 

well as online pharmacy activities. 

* * * * * * * 

* * * * * 

(3) Registrants will receive renewal 

notifications approximately 60 days 

prior to the registration expiration date. 

DEA Forms 224a, 225a, and 363a may 

be mailed, as applicable, to registrants; 

if any registered person does not receive 

such notification within 45 days before 

the registration expiration date, the 

registrant must promptly give notice of 

such fact and may request such forms by 

writing to the Registration Section, Drug 

Enforcement Administration. 

* * * * * 

■ 6. Section 1301.19 is added to read as 

follows: 

§ 1301.19 Special requirements for online 

pharmacies. 

(a) A pharmacy that has been issued 

a registration under § 1301.13 may 

request that the Administrator modify 

its registration to authorize the 

pharmacy to dispense controlled 

substances by means of the Internet as 

an online pharmacy. The Administrator 

may deny an application for a 

modification of registration if the 

Administrator determines that the 

issuance of a modification would be 

inconsistent with the public interest. In 

determining the public interest, the 

Administrator will consider the factors 

listed in section 303(f) of the Act (21 

U.S.C. 823(f)). 

(b) Each online pharmacy shall 

comply with the requirements of State 

law concerning licensure of pharmacies 

in each State from which it, and in each 

State to which it, delivers, distributes, 

or dispenses, or offers to deliver, 

distribute, or dispense controlled 

substances by means of the Internet. 

(c) Application for a modified 

registration authorizing the dispensing 

of controlled substances by means of the 

Internet will be made by an online 

application process as specified in 

§ 1301.13 of this part. Subsequent 

online pharmacy registration renewals 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15623 

will be accomplished by an online 

process. 

(d) A pharmacy that seeks to 

discontinue its modification of 

registration authorizing it to dispense 

controlled substances by means of the 

Internet as an online pharmacy (but 

continue its business activity as a nononline pharmacy) shall so notify the 

Administrator by requesting to modify 

its registration to reflect the appropriate 

business activity. Once the registration 

has been so changed, the pharmacy may 

no longer dispense controlled 

substances by means of the Internet. A 

pharmacy that has so changed its 

registration status back to that of a nononline pharmacy remains responsible 

for submitting reports in accordance 

with § 1304.55 of this chapter with 

respect to any controlled substances that 

it dispensed while it was registered with 

a modification authorizing it to operate 

as an online pharmacy. 

(e) Registrants applying for modified 

registrations under this section must 

comply with notification and reporting 

requirements set forth in §§ 1304.40, 

1304.45, 1304.50, and 1304.55 of this 

chapter. 

(f) No person (including a registrant) 

required to obtain a modification of a 

registration under §§ 1301.11(b) and 

1301.13 of this part authorizing it to 

operate as an online pharmacy may 

engage in any activity for which such 

modification of registration is required 

until the application for such modified 

registration is granted and an active 

Certificate of Registration indicating the 

modification of the registration has been 

issued by the Administrator to such 

person. 

■ 7. Section 1301.52 is amended by 

revising paragraph (a) to read as follows: 

§ 1301.52 Termination of registration; 

transfer of registration; distribution upon 

discontinuance of business. 

(a) Except as provided in paragraph 

(b) of this section, the registration of any 

person, and any modifications of that 

registration, shall terminate if and when 

such person dies, ceases legal existence, 

or discontinues business or professional 

practice. Any registrant who ceases legal 

existence or discontinues business or 

professional practice shall notify the 

Administrator promptly of such fact. 

* * * * * 

PART 1304—RECORDS AND 

REPORTS OF REGISTRANTS 

■ 8. The authority citation for part 1304 

is revised to read as follows: 

Authority: 21 U.S.C. 821, 827, 831, 871(b), 

958(e), 965, unless otherwise noted. 

■ 9. Section 1304.01 is revised to read 

as follows: 

§ 1304.01 Scope of part 1304. 

Inventory and other records and 

reports required under section 307, 

section 311, or section 1008(e) of the 

Act (21 U.S.C. 827, 831, and 958(e)) 

shall be in accordance with, and contain 

the information required by, those 

sections and by the sections of this part. 

■ 10. An undesignated heading and 

§§ 1304.40, 1304.45, 1304.50 and 

1304.55 are added to read as follows: 

Online Pharmacies 

1304.40 Notification by online pharmacies. 

1304.45 Internet Web site disclosure 

requirements. 

1304.50 Disclosure requirements for Web 

sites of nonpharmacy practitioners that 

dispense controlled substances by means 

of the Internet. 

1304.55 Reports by online pharmacies. 

Online Pharmacies 

§ 1304.40 Notification by online 

pharmacies. 

(a) Thirty days prior to offering a 

controlled substance for sale, delivery, 

distribution, or dispensing by means of 

the Internet, an online pharmacy shall: 

(1) Notify the Administrator of its 

intent to do so by submitting an 

application for a modified registration 

in accordance with §§ 1301.13 and 

1301.19 of this chapter, with such 

application containing the information 

required by this section; and 

(2) Notify the State boards of 

pharmacy in any States in which the 

online pharmacy offers to sell, deliver, 

distribute, or dispense controlled 

substances. 

(b) The following information must be 

included in the notification submitted 

under paragraph (a) of this section: 

(1) The pharmacy’s Internet Pharmacy 

Site Disclosure information required to 

be posted on the homepage of the online 

pharmacy’s Internet site under section 

311(c) of the Act (21 U.S.C. 831(c)) and 

§ 1304.45 of this part. 

(2) Certification that the information 

disclosed on its Internet site under the 

Internet Pharmacy Site Disclosure is 

true and accurate. The statement shall 

be in a form similar to the following: 

‘‘The above-named pharmacy, a DEA 

registrant, certifies, under penalty of 

perjury, that the information contained 

in this statement is true and accurate.’’ 

(3) Each Internet site address utilized 

by the online pharmacy and a 

certification that the online pharmacy 

shall notify the Administrator of any 

change in any such Internet address at 

least 30 days in advance. In the event 

that a pharmacy delivers, distributes, or 

dispenses controlled substances 

pursuant to orders made on, through, or 

on behalf of, more than one Web site, 

the pharmacy shall provide, for 

purposes of complying with this 

paragraph, the Internet site address of 

each such site. 

(4) The DEA registration numbers of: 

(i) Every pharmacy that delivers, 

distributes, or dispenses controlled 

substances pursuant to orders made on, 

through, or on behalf of, each Web site 

referred to in paragraph (b)(3) of this 

section; and 

(ii) Every practitioner who has a 

contractual relationship to provide 

medical evaluations or issue 

prescriptions for controlled substances, 

through referrals from the Web site or at 

the request of the owner or operator of 

the Web site, or any employee or agent 

thereof. 

(c) An online pharmacy that is in 

operation at the time Public Law 110– 

425 becomes effective (April 13, 2009) 

must make the notifications required in 

this section on or before May 13, 2009. 

However, in accordance with section 

401(h) of the Act (21 U.S.C. 841(h)), as 

of April 13, 2009, it is unlawful for any 

online pharmacy to deliver, distribute, 

or dispense a controlled substance by 

means of the Internet unless such online 

pharmacy is validly registered with a 

modification of such registration 

authorizing such activity. 

(d) On and after the date an online 

pharmacy makes the notifications 

required under this section, each online 

pharmacy shall display on the 

homepage of its Internet site, a 

declaration that it has made such 

notifications to the Administrator in the 

following form: ‘‘In accordance with the 

Controlled Substances Act and the DEA 

regulations, this online pharmacy has 

made the notifications to the DEA 

Administrator required by 21 U.S.C. 831 

and 21 CFR 1304.40.’’ 

(e)(1) Except as provided in 

paragraphs (e)(2) and (e)(3) of this 

section, if any of the information 

required to be submitted under this 

section changes after the online 

pharmacy submits the notification to the 

Administrator, the online pharmacy 

shall notify the Administrator of the 

updated information no later than 30 

days before the change becomes 

effective via the online process. 

(2) If a pharmacy referred to in 

paragraph (b)(4)(i) of this section ceases 

to deliver, distribute, or dispense 

controlled substances pursuant to orders 

made on, through, or on behalf of, each 

Web site referred to in paragraph (b)(3) 

of this section, the online pharmacy 

shall notify the Administrator no later 

than 30 days after the change becomes 

effective via the online process. 


pwalker on PROD1PC71 with RULES2
15624 Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 

(3) If a practitioner referred to in 

paragraph (b)(4)(ii) of this section ceases 

to have a contractual relationship with 

the online pharmacy, the online 

pharmacy shall notify the Administrator 

no later than 30 days after the change 

becomes effective via the online 

process. 

§ 1304.45 Internet Web site disclosure 

requirements. 

(a) Each online pharmacy shall 

display, at all times and in a visible and 

clear manner, on its homepage a 

statement that it complies with the 

requirements of section 311 of the Act 

(21 U.S.C. 831) with respect to the 

delivery or sale or offer for sale of 

controlled substances. This statement 

must include the name of the pharmacy 

as it appears on the DEA Certificate of 

Registration. 

(b) Each online pharmacy shall clearly 

display the following information on the 

homepage of each Internet site it 

operates, or on a page directly linked to 

the homepage. If the information is 

displayed on a page directly linked to 

the homepage, that link on the 

homepage must be visible and clear. 

The information must be displayed for 

each pharmacy that delivers, distributes, 

or dispenses controlled substances 

pursuant to orders made on, through, or 

on behalf of that Web site. 

(1) The name and address of the 

pharmacy as it appears on the 

pharmacy’s DEA Certificate of 

Registration. 

(2) The pharmacy’s telephone number 

and e-mail address. 

(3) The name, professional degree, 

and States of licensure of the 

pharmacist-in-charge, and a telephone 

number at which the pharmacist-incharge can be contacted. 

(4) A list of the States in which the 

pharmacy is licensed to dispense 

controlled substances. 

(5) A certification that the pharmacy 

is registered under part 1301 of this 

chapter with a modification of its 

registration authorizing it to deliver, 

distribute, or dispense controlled 

substances by means of the Internet. 

(6) The name, address, telephone 

number, professional degree, and States 

of licensure with State license number 

of any practitioner who has a 

contractual relationship to provide 

medical evaluations or issue 

prescriptions for controlled substances, 

through referrals from the Web site or at 

the request of the owner or operator of 

the Web site, or any employee or agent 

thereof. 

(7) The following statement: ‘‘This 

online pharmacy is obligated to comply 

fully with the Controlled Substances 

Act and DEA regulations. As part of this 

obligation, this online pharmacy has 

obtained a modified DEA registration 

authorizing it to operate as an online 

pharmacy. In addition, this online 

pharmacy will only dispense a 

controlled substance to a person who 

has a valid prescription issued for a 

legitimate medical purpose based upon 

a medical relationship with a 

prescribing practitioner. This includes 

at least one prior in-person medical 

evaluation in accordance with section 

309 of the Controlled Substances Act 

(21 U.S.C. 829) or a medical evaluation 

via telemedicine in accordance with 

section 102(54) of the Controlled 

Substances Act (21 U.S.C. 802(54)).’’ 

§ 1304.50 Disclosure requirements for 

Web sites of nonpharmacy practitioners 

that dispense controlled substances by 

means of the Internet. 

For a Web site to identify itself as 

being exempt from the definition of an 

online pharmacy by virtue of section 

102(52)(B)(ii) of the Act (21 U.S.C. 

802(52)(B)(ii)) and § 1300.04(h)(2) of 

this chapter, the Web site shall post in 

a visible and clear manner on its 

homepage, or on a page directly linked 

thereto in which the hyperlink is also 

visible and clear on the homepage, a list 

of the DEA-registered nonpharmacy 

practitioners who are affiliated with the 

Web site. Any nonpharmacy 

practitioner affiliated with such a Web 

site is responsible for compliance with 

this section. An institutional 

practitioner that otherwise complies 

with the requirements of the Act and 

this chapter will be deemed to meet the 

requirements of this section if, in lieu of 

posting the names of each affiliated 

individual practitioner, it posts its name 

(as it appears on its Certificate of 

Registration) in a visible and clear 

manner on its homepage and in a 

manner that identifies itself as being 

responsible for the operation of the Web 

site. 

§ 1304.55 Reports by online pharmacies. 

(a) Each online pharmacy shall report 

to the Administrator the total quantity 

of each controlled substance that the 

pharmacy has dispensed each calendar 

month. The report must include the 

total quantity of such dispensing by any 

means, regardless of whether the 

controlled substances are dispensed by 

means of the Internet. Thus, such 

reporting shall include all controlled 

substances dispensed via Internet 

transactions, mail-order transactions, 

face-to-face transactions, or any other 

means. However, the pharmacy is not 

required to describe in its report to the 

Administrator such means of 

dispensing. Such reporting is required 

for every calendar month in which the 

total quantity of controlled substances 

dispensed by the pharmacy meets or 

exceeds one of the following thresholds: 

(1) 100 or more prescriptions for 

controlled substances filled; or 

(2) 5,000 or more dosage units 

dispensed of all controlled substances 

combined. 

(b) Each online pharmacy shall report 

a negative response if, during a given 

calendar month, its total dispensing of 

controlled substances falls below both 

of the thresholds in paragraph (a) of this 

section. 

(c) The reporting requirements of this 

section apply to every pharmacy that, at 

any time during a calendar month, 

holds a modified registration 

authorizing it to operate as an online 

pharmacy, regardless of whether the 

online pharmacy dispenses any 

controlled substances by means of the 

Internet during the month. 

(d) Reports will be submitted to DEA 

electronically via online reporting, 

electronic file upload, or other means as 

approved by DEA. 

(e) Reports shall be filed every month 

not later than the fifteenth day of the 

month succeeding the month for which 

they are submitted. 

(f) An online pharmacy filing a report 

under paragraph (a) of this section shall 

utilize the National Drug Code number 

assigned to the product under the 

National Drug Code System of the Food 

and Drug Administration, and indicate 

the total number of dosage units 

dispensed for each such National Drug 

Code number. 

(g) Records required to be kept under 

this section must be kept by the 

registrant for at least two years from the 

date of such records. The information 

shall be readily retrievable from the 

ordinary business records of the 

registrant and available for inspection 

and copying by authorized employees of 

the Administration. 

PART 1306—PRESCRIPTIONS 

■ 11. The authority citation for part 

1306 is revised to read as follows: 

Authority: 21 U.S.C. 821, 829, 831, 871(b), 

unless otherwise noted. 

■ 12. Section 1306.09 is added to read 

as follows: 

§ 1306.09 Prescription requirements for 

online pharmacies. 

(a) No controlled substance that is a 

prescription drug may be delivered, 

distributed, or dispensed by means of 

the Internet without a valid 

prescription. 


pwalker on PROD1PC71 with RULES2
Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules and Regulations 15625 

(b) In accordance with the Act, it is 

unlawful for any person to knowingly or 

intentionally fill a prescription for a 

controlled substance that was issued in 

a manner that constitutes dispensing by 

means of the Internet unless such 

person is a pharmacist who is acting in 

the usual course of his professional 

practice and is acting on behalf of a 

pharmacy whose registration has been 

modified under sections 1301.13 and 

1301.19 of this chapter to authorize it to 

operate as an online pharmacy. 

(c) Any online pharmacy that 

participates in the transfer between 

pharmacies of prescription information 

must do so in accordance with the 

requirements of §§ 1306.15 and 1306.25 

of this part. 

Dated: April 1, 2009. 

Michele M. Leonhart, 

Deputy Administrator. 

[FR Doc. E9–7698 Filed 4–3–09; 8:45 am] 

BILLING CODE 4410–09–P 


pwalker on PROD1PC71 with RULES2