Source: https://www.federalregister.gov/documents/2003/06/27/03-16082/electronic-orders-for-controlled-substances
Timestamp: 2017-09-22 03:30:09
Document Index: 369119993

Matched Legal Cases: ['ART 1311', '§\u20091305', '§\u20091305', 'art 1311', 'art 1311', 'art 1305', '§\u20091300', 'art 1305', '§\u20091301', '§\u20091305', '§\u20091305', '§\u20091305', '§\u20091305', '§\u20091301', '§\u20091305', '§\u20091305', '§\u20091311', '§\u20091311', '§\u20091311', '§\u20091311', 'art 1305', '§\u20091305', '§\u20091305', '§\u20091311']

A Proposed Rule by the Drug Enforcement Administration on 06/27/2003
Written comments must be postmarked on or before September 25, 2003.
68 FR 38557
38557-38581 (25 pages)
Docket No. DEA-217P
03-16082
PART 1311—DIGITAL CERTIFICATES
Subpart B—Obtaining and Using Digital Certificates
https://www.federalregister.gov/d/03-16082 https://www.federalregister.gov/d/03-16082
Start Preamble Start Printed Page 38558
DEA is proposing to revise its regulations to provide an electronic equivalent to the DEA official order form, which is legally required for all distributions involving Schedule I and II controlled substances. These proposed regulations will allow registrants to order Schedule I and II substances electronically and maintain the records of these orders electronically. The proposed regulations would reduce paperwork and transaction times for DEA registrants who handle, sell, or buy these controlled substances. This proposed rule has no effect on patients' ability to receive prescriptions for controlled substances from practitioners, nor on their ability to have those prescriptions filled at pharmacies. In fact, this rule will help to ensure the appropriate supply of controlled substances throughout the distribution system.
The purpose of DEA's regulations is to establish a framework for the legal distribution of controlled substances and to prevent their diversion to the illegal markets. Controlled substances are those substances listed in the Start Printed Page 38559schedules of the CSA and 21 CFR 1308.11-1308.15, and generally include narcotics, stimulants, depressants, hallucinogens, and anabolic steroids that have a high potential for abuse and dependency. DEA's regulations require that people involved in the manufacture, distribution, research, dispensing, import, and export of controlled substances register with DEA, keep track of all stocks of controlled substances, and maintain records to account for all stocks received, distributed, or otherwise disposed of. For Schedule I and II controlled substances, which have the highest potential for abuse and dependency, the CSA mandates that distribution can only occur in response to an order signed by the purchaser on a form issued to the purchaser by DEA. For other schedules, the law requires recordkeeping by both DEA-registered parties.
The Electronic Signatures in Global and National Commerce Act of 2000, commonly known as E-Sign, was signed into law on June 30, 2000. It establishes the basic rules for using electronic signatures and records in commerce. E-Sign was enacted to encourage electronic commerce by giving legal effect to electronic signatures and records and to protect consumers. E-Sign prohibits government agencies from denying the legal effect of electronic signatures and records of electronic commerce based solely on their electronic nature, but allows Federal, state, and local agencies to set performance standards where necessary to ensure record integrity and accessibility of records.
Section 104(a) of E-Sign provides that, subject to the requirements of the Government Paperwork Elimination Act of 1998 (GPEA), “* * * nothing in this title limits or supersedes any requirement by a Federal regulatory agency, self-regulatory organization, or State regulatory agency that records be filed with such agency or organization in accordance with specified standards or formats.” The CSA and regulations require that distributions involving Schedule I or II controlled substances may be accomplished only when the orders are made on forms that DEA issued in triplicate to the purchaser and upon which DEA has imprinted the name of the purchaser (21 U.S.C. 828(d)(1) and 21 CFR 1305.05(a)). The law further provides that “* * * it shall be unlawful for any other person (A) to use such form for the purpose of obtaining controlled substances or (B) to furnish such form to any person with intent thereby to procure the distribution of such substances.” (21 U.S.C. 828(d)(1)). Of the three copies of the form issued, the purchaser and the supplier must each maintain a copy, and the supplier must provide a copy to DEA following completion of the transaction (21 CFR 1305.13). The CSA and implementing regulations clearly establish a specified standard and format that must be adhered to in filing records of distributions of Schedule I and II controlled substances with DEA, which are not superseded by E-Sign. It should be noted that the filing requirement is subject to the requirements of GPEA, which requires, in part, that for certain governmental filings, an electronic means to satisfy the requirement must be established, to the extent practicable, by October, 2003. DEA does anticipate that the electronic means to satisfy the order form requirement that is being proposed in this rule will be in place by the GPEA deadline.
DEA is proposing to include in the rule three performance standards that are necessary to ensure that the electronic system is substantially equivalent to the DEA Form 222: message/record integrity, authentication, and nonrepudiation. DEA has determined that of the existing electronic signature technologies, only digital signatures using certificates issued through a public key infrastructure (PKI) system, operated by DEA, provide for record integrity and can serve as the functional equivalent of the form that the CSA mandates DEA to provide. If other technologies are Start Printed Page 38560identified that meet all of the performance standards, DEA will consider them and determine whether they could satisfy the CSA mandates with respect to order forms.
At present, only a digital signature based on a public key infrastructure (PKI) would provide the authentication, nonrepudiation, and message integrity that are necessary to protect these communications and prevent alteration of the documents. In a June 2000 report, “The Evolving Federal Public Key Infrastructure,” the Federal Public Key Infrastructure Steering Committee described the benefits PKI provides as follows:
PKI systems are based on asymmetric cryptography: the holder of the digital certificate has a private key, which only the certificate holder can access, and a public key, which is available to anyone. What one key encrypts, only the other key can decrypt. It is computationally infeasible for the two keys to be derived from each other. Only one public key will validate signatures made using its corresponding private key. Because the private key is held by only one person, it is that person's responsibility to ensure that it is not divulged or compromised. The method in which PKI systems ensure the integrity of the message is explained in detail in the section entitled “In simple terms, how does a digital signature work?”
A PKI system is more than cryptographic keys. The infrastructure component (the “I” in PKI) is critical to meeting the criteria for authentication, integrity and nonrepudiation. PKI systems are operated by a Certification Authority (CA), which is responsible for verifying the identity of any applicant for a digital certificate, maintaining security, establishing the responsibilities of certificate holders, and maintaining a public directory of public keys and an up-to-date certificate revocation list. The Certification Authority is a trusted third party. Suppliers and purchasers need only trust the CA, in this case DEA, to be able to trust each other.
After reviewing options, DEA determined that a digital certificate issued by DEA is the only “electronic Start Printed Page 38561signature” technology that meets the dual requirements:
When the certificate holder digitally signs an order, the PKI-enabled software runs the text of the order through a complex algorithm that creates a fixed length digest of the document (called a hash). The hash is a compact representative image of the document that is often referred to as a document “fingerprint.” The software then uses the private key to encrypt the hash; the encrypted hash is the digital signature.
Once the CA verifies the identification, the CA would send the applicant a one-time use access code and password via separate channels. The applicant would use the PKI software to generate a key pair (public and private keys) and access the Certification Authority electronically using the access code and password to request a certificate. These keys would be stored in the applicant's computer or on a FIPS 140-2 approved secure hardware device. Once generated, the Certification Authority must prove that the user has possession of the key. For signature public keys, the corresponding private key must sign the certificate request. Verification of the signature using the public key in the request Start Printed Page 38562would serve as proof of possession of the private key. The user would not need to learn the keys. The user would employ an authentication mechanism to access the private key. The authentication mechanism could be a user name and password. Although DEA is not requiring use of biometrics, DEA recognizes the advantages of biometric passwords to ensure that a private key cannot be shared and suggests that registrants consider their use.
When the users want to digitally sign an order, they would authenticate themselves to access the private key to sign the document. Specific procedures may vary depending on the exact nature of the system employed, but basically, once the certificate holder has accessed the private key, a single key stroke would “sign” the document. At the keystroke, the software would perform the hashing functions and encryption, attach the encrypted hash and digital certificate to the plain text order, and transmit.
Because a digital certificate is the functional equivalent of a Form 222 that DEA is required to issue, only DEA can serve as the Certification Authority for issuing digital certificates for signing electronic orders for Schedule I and II controlled substances. Registrants and their designated power of attorney holders (POA) who are eligible to sign Forms 222 would apply to the DEA Certification Authority and obtain a digital certificate from it. DEA proposes to act in this capacity either directly or through a contractor.
CSOS Coordinators are one or more responsible persons designated by a DEA registrant to serve as that registrant's recognized agent regarding issues pertaining to issuance of, revocation of, and changes to digital certificates issued under that registrant's DEA registration. These individuals serve as knowledgeable liaisons between one or more DEA registered locations and the CSOS Certification Authority. While the CSOS Coordinator is the main point of contact between the DEA Certification Authority and the DEA registrant, all digital certificate activities are the responsibility of the registrant with whom the digital certificate is associated. To that end, the CSOS Certification Authority will communicate with the CSOS Coordinator regarding digital certificate applications, renewals, revocations, and other matters. Even when an individual registrant, i.e., an individual practitioner, is applying for a digital certificate to order controlled substances a CSOS Coordinator must be designated. It is acceptable to have the person applying for the registrant digital Start Printed Page 38563certificate also be designated as the CSOS Coordinator. Once designated, the registrant's CSOS Coordinator must identify him or herself to the Certification Authority through an application process. If a change occurs regarding persons designated as CSOS Coordinators, or if a change occurs regarding the registered locations for which a CSOS Coordinator is responsible, the Certification Authority must be notified. For applicants applying for a CSOS digital certificate, and for applicants applying for CSOS power of attorney for a DEA registrant, the CSOS Coordinator must verify the applicant's identity, review and approve the application package, and submit the completed package to the Certification Authority.
If the Certification Authority approves an application, the applicant would receive an access code and password. The access code and password would be sent in two segments, each sent by a different method. For example, the access code may be mailed while the password is e-mailed. The access code and password would be used to submit an electronic request for a digital certificate. Prior to submitting the request, the applicant would have to obtain software that PKI-enables its system and that can generate the public and private key; most Internet browsers have this capability. The software would generate a public and private key pair. The public key is transmitted to the Certification Authority. The Certification Authority would then issue a signed digital certificate associated with the applicant's public key and a copy of the Certification Authority's public key certificate.
DEA is proposing that the application for registrant CSOS Coordinators be notarized to ensure that the person presenting the photo ID is in fact the person signing the application and to legally tie the person signing the application to it. CSOS Coordinators serve as their registrant's recognized agent regarding issues pertaining to issuance of, revocation of, and changes to digital certificates issued under that registrant's DEA registration. While all digital certificate activities are the responsibility of the registrant with whom the digital certificate is associated, within the Controlled Substances Order System DEA is placing a high level of trust in the CSOS Coordinators associated with each DEA registrant. DEA and its Certification Authority must trust the information CSOS Coordinators provide to DEA and must trust the actions requested by CSOS Coordinators of DEA and its Certification Authority. DEA recognizes that notaries may not be able to determine whether the photo ID is real. Some state driver's licenses can be obtained in other names with relative ease. The package, however, includes not just the photo ID, but also copies of each of the registrant's Certificates of Registration (DEA form 223) for which the CSOS Coordinator will be responsible. These requirements will make it harder for someone to present fraudulent information to pose as a CSOS Coordinator with its attendant rights and responsibilities.
DEA recognizes that in cases of central ordering systems, a single POA may have to obtain more than a thousand separate certificates. DEA is proposing two steps that will reduce the burden on these POAs. First, POAs applying for multiple certificates would be able to submit a single application with a list of the DEA registration numbers for which they are applying for certificates. This process would be similar to batch renewals of registrations.
A second step would reduce the burden of obtaining the certificates. Normally, each certificate has to be generated separately. The POA would have to obtain separate access codes from the CA, generate the keys, and access the CA for each certificate. This process takes about five minutes per certificate. To reduce the burden for POAs applying for large numbers of certificates, DEA is proposing to provide software that would include the access codes and functions for key generation. The registrant could then install the software and allow it to contact the CA and generate all of the certificates Start Printed Page 38564automatically without the applicant having to enter codes individually. DEA believes that these steps will facilitate the application and certificate generation process while retaining the basic integrity of the Form 222 system that links every order to a specific registered location.
Any system enabled to handle digital signatures may be used provided it meets the following requirements:
11. The system must create an order that includes the data fields listed in proposed § 1305.21(b)—these fields are the same fields that exist on the Form 222 that purchasers complete except for the line numbers, total number of lines and purchaser information, i.e., name, address, DEA registration number, authorized schedules, and business activity, all of which are included in the digital certificate which must accompany the order.
Item five is needed to ensure that the digital signing capability cannot be accessed by someone other than the certificate holder. DEA is concerned that a certificate holder authenticate himself or herself to the system, open the signing software, and begin signing Start Printed Page 38565orders. If the certificate holder left the computer while the signing system was open, another person could sign orders because the signing software generally does not require reauthentication of the user for each order once the private key has been accessed. The automatic closure of the system if unused for 10 minutes will lessen this threat.
9. If the supplier intends to file a summary report of orders rather than copies of the actual orders, the system must create a report that includes, for each Schedule I and II order, all data fields listed in proposed § 1305.28(a) in a format that DEA specifies. This provision would allow for compliance with the current paper requirement that suppliers forward copy 2 of the DEA Form 222 to the nearest DEA office on a monthly basis.
FIPS means Federal Information Processing Standard. FIPS 140-2 is a standard entitled “Security Requirements for Cryptographic Modules.” The standard is produced by the National Institute of Standards and Technology (NIST) to lay out general requirements for cryptographic modules for computer and telecommunications systems. FIPS 186-2 specifies algorithms for applications used to generate digital signatures. FIPS 180-1 is the Secure Hash Standard. The standards have been adopted by the U.S. government and are required for all cryptographic-based security systems and digital signature systems that are used by or approved by Federal agencies to protect unclassified information. DEA, therefore, must require that the software modules used for digital signatures comply with these standards. A list of vendors whose cryptographic modules have been validated as FIPS 140-2 compliant may be obtained from the NIST web site at http://csrc.nist.gov/​cryptval/​140-2/​1402vend.htm. Information on FIPS 186-2 and FIPS 180-1 can be obtained from http://csrc.nist.gov.
DEA regulations require that each registrant provide effective controls and procedures to guard against theft and diversion of controlled substances. This requirement applies to both physical and procedural safeguards; a registrant Start Printed Page 38566must take steps to secure the controlled substances and the authorization to obtain and distribute or dispense the controlled substances. In this regard, it is important that the private key be properly secured, since it is the functional equivalent of both the paper DEA Form 222 and the registrant's valid signature on that form.
All certificate holders must provide secure storage for the private key. The private key may be stored on any electronic medium, with access controlled by at least a user ID and password. As noted before, DEA encourages certificate holders and registrants to use biometric passwords instead of user IDs and passwords. Although not a requirement, biometric passwords provide a higher level of assurance that a private key cannot be used by anyone except the certificate holder.
Electronic records for Schedule I and II controlled substances must, by regulation, be maintained separately from other records. However, DEA considers electronic records of Schedule I and II controlled substances to be maintained separately so long as these records are readily retrievable by schedule and controlled substance.
Each of these differences is discussed in greater detail in subsequent sections.
(1) A unique number generated by the purchaser to track the order. The number must be in the following 9-character format: the last two digits of the year, the character “x”, and six numbers of the purchaser's choice.
Because the original order has been digitally signed, it cannot be altered. Start Printed Page 38567The supplier and purchaser, both of whom are required to “annotate” the file with information on the substances shipped and received, would have to create a separate record with the needed information and electronically link the record of the required information to the original order. The supplier's linked file would have to contain packages shipped and date shipped and any other item on the order that the supplier completes. The purchaser's linked file would have to contain the number of packages received and the date received. The software must archive both the original and the linked record. The original and linked records constitute the complete order form, the equivalent of a Form 222 that has been annotated. The same process would apply to partially filled orders, endorsed orders, or canceled orders; the records of these actions must be linked to the original order and maintained as a record of the transaction. Both the purchaser and the supplier must keep the original digitally signed order and the linked files for a period of two years.
DEA allows suppliers to endorse a DEA Form 222 to another supplier if the first supplier cannot fill the order. This requires the initial supplier to record on the back of each copy of the DEA Form 222 the name and address of the second supplier, and the signature of a person authorized by that initial supplier to obtain and execute order forms. Paper orders must be endorsed in their entirety; a supplier cannot fill part of the order and endorse the rest to a second supplier because the paper 222 must accompany the order.
The electronic system does not involve the use of serially numbered, DEA-issued forms. Consequently, DEA's ability to track and account for orders must rely on timely reports by the suppliers. DEA determined that the 30-day reporting period is too long for electronic orders. Because all order reporting would be handled electronically, the daily transmission of reports should represent a minimal burden on suppliers. Start Printed Page 38568
Part 1311—DEA is proposing to add a new part that would provide the requirements for the following:
Performance standards for electronic signatures and electronic transmission.
1305.04—Persons entitled to obtain forms order form 1305.04—Persons entitled to obtain and execute order forms.
1305.07—Power of attorney 1305.04(c)—Power of attorney.
1305.08—Persons entitled to fill order forms 1305.05—Persons entitled to fill DEA Forms 222.
1305.16—Special procedure for filling certain order forms 1305.06—Special procedure for filling certain DEA Forms 222.
1305.21—Requirements for electronic orders.
1305.22—Procedure for filling electronic orders.
1305.23—Endorsing electronic orders.
1305.24—Central processing of orders.
1305.25—Unaccepted and defective electronic orders.
1305.26—Lost electronic orders.
1305.27—Preservation of electronic orders.
1305.28—Cancelling and voiding electronic orders.
1305.29—Reporting to DEA
Part 1311 is proposed to be added to provide requirements for obtaining, handling, and using digital certificates. Note that DEA is proposing, in a separate notice, rules for obtaining, handling, and using digital certificates to sign controlled substance prescriptions. Because the requirements are the same in some instances, some of the proposed sections cover both orders and prescriptions.
Section 1311.01 discusses the scope of the new part.
Section 1311.08 proposes to incorporate by reference FIPS 140-2, FIPS 180-1, and FIPS 186-2. Start Printed Page 38569
These standards are available from the National Institute of Standards and Technology, Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology, 100 Bureau Drive, Gaithersburg, MD 20899-8930 and are available at http://csrc.nist.gov/​.
Under Executive Order 12866 (58 FR 51735, October 4, 1993), DEA must determine whether a regulatory action is “significant” and, therefore, subject to OMB review and the requirements of the Executive Order. The Order defines “significant regulatory action” as one that is likely to result in a rule that may:
Table 1.—Unit Time and Fixed Cost Assumptions for Form 222
Table 2.—Total Annual Hours and Costs for the Form 222 System
The proposed system of digital certificates would impose initial implementation costs and on-going costs. People seeking a digital certificate would have to complete the application, generate keys, learn how to use the Start Printed Page 38570digital certificate, and implement the software systems to handle electronic orders. Based on a pilot project (67 FR 1507, January 11, 2002), DEA assumes that completing the application, which is primarily collecting paperwork, and generating keys and learning to use the system would take about 1.5 hours per applicant. DEA further assumes that a limited number of registrants (estimated at 256) would develop or purchase their software systems. These registrants are likely to be manufacturers, chain drug stores, and distributors. DEA assumes that they would provide the software to other registrants. The ongoing costs include the time required to digitally sign and validate the order and the time to annotate the order. Tables 3 and 4 provide the unit time estimates for initial and annual compliance of the electronic system. Tables 5 and 6 present total costs for initial and annual compliance.
Table 3.—Unit Time and Fixed Cost Assumptions for Electronic Orders—Initial Compliance
Complete application Supplier Purchaser 0.72/1.24 *
Generate keys Supplier Purchaser 0.10
Learn to use system Purchaser Supplier 0.417
Implementing software Supplier 40/firm
Purchaser 8.00/firm
Practitioner 0.50
* Higher value is for the CSOS coordinator.
Table 4.—Unit Costs for Electronic Orders—Annual Compliance
Signing orders Purchaser 0.006/order.
Validating orders Supplier 0.004/order.
Purchaser 0.025/order.
Annotating orders Supplier 0.042/order.
Sending orders to DEA Supplier 0.05/every 2nd day.
Renewing certificate Purchaser Supplier 0.083/person.
Renewing certificate (every third renewal) Purchaser Supplier 0.36 hour/person.
Table 5.—Total Initial Compliance Hours and Costs for the Electronic Order System
Table 6.—Total Annual Compliance Hours and Costs for the Electronic Order System
Table 7.—Total Cost Over Ten Years (Present Value)
With the Form 222, if a supplier cannot fill all of an order, the supplier may endorse the entire order over to another supplier. The order cannot be divided and filled in part by one supplier and in part by a second, even if both suppliers belong to the same company. Because each location holds a separate registration, a distributor with multiple locations must maintain stocks of all Schedule I and II controlled substances at each location to be able to fill orders for these substances from that location. With electronic orders, DEA will allow a distributor with a central distribution system to divide an order and ship parts of the order from different distribution points. New orders will not need to be generated because the central computer system can track each item in the order and ensure that it is shipped to the appropriate registrant only once. DEA and the Start Printed Page 38572supplier will have the records necessary to maintain the closed system of control while allowing the supplier to take advantage of its own system of distribution.
A copy of the economic analysis for this proposed rule can be obtained by contacting the Liaison and Policy Section, Office of Diversion Control, Drug Enforcement Administration, Washington, DC 20537, Telephone (202) 307-7297 or on the Diversion Control Program web site, http://www.deadiversion.usdoj.gov. DEA solicits comments on the economic analysis and the reasonableness of the assumptions.
Under the Regulatory Flexibility Act of 1980, Federal agencies must evaluate the impact of rules on small entities and consider less burdensome alternatives. As discussed in the previous section DEA has conducted a preliminary cost benefit analysis on this proposal. As part of that analysis, DEA evaluated the impact on small entities. DEA has determined that this rule would affect a substantial number of small entities. DEA estimates that about one third of the manufacturers and hospitals, 40 percent of clinics and pharmacies would meet the Small Business Administration definition of “small business.” Practitioners and narcotic treatment programs are all assumed to be small.
DEA, as part of its economic analysis, considered the costs of the existing system and the proposed approach for small entities. The annualized costs of the Form 222 system for the smallest entities (clinics with less than $100,000 in revenues), are less than 1.45 percent of annual revenues; for these clinics, the annual costs of the proposed rule are about 0.15 percent of annual revenues. For most small entities affected by the rule, the cost of the electronic system will be less than 0.1 percent of revenues or sales. Consequently, the Acting Administrator hereby certifies that this rulemaking has been drafted in accordance with the Regulatory Flexibility Act (5 U.S.C. 605(b)), has reviewed this regulation, and by approving it certifies that this regulation will not have a significant economic impact on a substantial number of small entities.
Form No.: DEA Form 222, U.S. Official Order Forms for Schedule I and II Controlled Substances (Accountable Forms). Start Printed Page 38573
For the reasons set out above
1 Part 1305 is revised to read as follows:
Lost and stolen DEA Forms 222. Start Printed Page 38574
(d) Delivery from a central fill pharmacy, as defined in § 1300.01(b)(43), to a retail pharmacy.
___(Name of registrant)
___(Address of registrant)
___(DEA registration number)
I,___(name of person granting power), the undersigned, who am authorized to sign the current application for registration of the above-named registrant under the Controlled Substances Act or Controlled Substances Import and Export Act, have made, constituted, and appointed, and by these presents, do make, constitute, and appoint___(name of attorney-in-fact), my true and lawful attorney for me in my name, place, and stead, to execute applications for Forms 222 and to sign orders for Schedule I and II controlled substances, in accordance with section 308 of the Controlled Substances Act (21 U.S.C. 828) and part 1305 of Title 21 of the Code of Federal Regulations. I hereby ratify and confirm all that said attorney must lawfully do or cause to be done by virtue hereof.
I,____(name of attorney-in-fact), hereby affirm that I am the person named herein as attorney-in-fact and that the signature affixed hereto is my signature.
Signed and dated on the ___day of ____ (year), at ____.
The foregoing power of attorney is hereby revoked by the undersigned, who is authorized to sign the current application for registration of the above-named registrant under the Controlled Substances Act or the Controlled Substances Import and Export Act. Written notice of this revocation has been given to the attorney-in-fact____this same day.
2.__________ .
(a) A person registered with DEA to dispense such substances, or to export such substances, if he/she is discontinuing business or if his/her registration is expiring without reregistration, may dispose of any controlled substances listed in Schedule I or II in his/her possession with a DEA Form 222 or an electronic order in accordance with § 1301.52 of this chapter.
(d) A person registered or authorized to conduct chemical analysis or research Start Printed Page 38575with controlled substances may distribute a controlled substance listed in Schedule I or II to another person registered or authorized to conduct chemical analysis, instructional activities, or research with such substances with either a DEA Form 222 or an electronic order, if the distribution is for the purpose of furthering the chemical analysis, instructional activities, or research.
(c) Each requisition must show the name, address, and registration number of the registrant and the number of books of DEA Forms 222 desired. Each requisition must be signed and dated by the same person who signed the most recent application for registration or for reregistration, or by any person authorized to obtain and execute DEA Forms 222 by a power of attorney under § 1305.04(c).
(f) DEA Forms 222 submitted by registered procurement officers of the Defense Supply Center of the Defense Logistics Agency for delivery to armed services establishments within the United States may be shipped to locations other than the location printed on the DEA Form 222, and in partial shipments at different times not to exceed six months from the date of the Start Printed Page 38576order, as designated by the procurement officer when submitting the order.
(a) A DEA Form 222, made out to any supplier who cannot fill all or a part of the order within the time limitation set forth in § 1305.13, may be endorsed to another supplier for filling. The endorsement must be made only by the supplier to whom the DEA Form 222 was first made, must state (in the spaces provided on the reverse sides of Copies 1 and 2 of the DEA Form 222) the name and address of the second supplier, and must be signed by a person authorized to obtain and execute DEA Forms 222 on behalf of the first supplier. The first supplier may not fill any part of an order on an endorsed form. The second supplier may fill the order, if possible and if the supplier desires to do so, in accordance with § 1305.13 (b), (c), and (d), including shipping all substances directly to the purchaser.
(c) DEA Forms 222 must be maintained separately from all other records of the registrant. DEA Forms 222 are required to be kept available for inspection for a period of two years. If a purchaser has several registered locations, the purchaser must retain Copy 3 of the executed DEA Form 222 and any attached statements or other related documents (not including unexecuted DEA Forms 222, which may be kept elsewhere under § 1305.12(d)), at the registered location printed on the DEA Form 222.
If the registration of any purchaser terminates (because the purchaser ceases legal existence, discontinues business or professional practice, or changes the name or address as shown on the purchaser's registration) or is suspended or revoked under § 1301.36 of this chapter for all controlled substances listed in Schedules I and II for which the purchaser is registered, the purchaser must return all unused DEA Forms 222 for such substances to the nearest office of the Administration.
(a) A purchaser may cancel part or all of an order on a DEA Form 222 by notifying the supplier in writing of such cancellation. The supplier must indicate the cancellation on Copies 1 and 2 of the DEA Form 222 by drawing a line through the canceled items and printing “canceled” in the space provided for number of items shipped.
(1) A unique number the purchaser assigns to track the order. The number must be in the following 9-character format: X, the last two digits of the year, and six characters as selected by the purchaser. Start Printed Page 38577
(b) A supplier may fill the order for a Schedule I or II controlled substance, if possible and if the supplier desires to do so and is authorized to do so under § 1305.04.
(c) When a purchaser receives a rejected electronic order from the supplier, the purchaser must electronically link the statement of reasons for rejection to the original. The original and the statement must be retained in accordance with § 1305.26 of this part.
Start Printed Page 38578
(c) If the supplier to whom the order was directed subsequently receives the first order, the supplier must make an electronic record, indicate that it is “Not Accepted,” and return it to the purchaser. The purchaser must link the returned order to the record of that order and the statement.
A supplier may void all or part of an electronic order by notifying the purchaser of the voiding. If the entire order is voided, the supplier must make an electronic copy of the order, indicate on the copy “Void,” and return it to the purchaser. The purchaser must retain an electronic copy of the voided order. To partially void an order, the supplier must indicate on the annotated copy that nothing was shipped for each item voided.
Eligibility to obtain a digital certificate.
Limitations on digital certificates.
Coordinators for controlled substances order system digital certificate holders.
Requirements for obtaining a digital certificate for signing orders.
Number of certificates needed.
Requirements for registrants that allow powers of attorney to obtain digital certificates under their DEA registration.
Key pair means two mathematically related keys having the properties that (1) one key can be used to encrypt a message that can only be decrypted Start Printed Page 38579using the other key and (2) even knowing one key, it is computationally infeasible to discover the other key.
(3) FIPS 186-2, Digital Signature Standard. These standards are available from the National Institute of Standards and Technology, Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology, 100 Bureau Drive, Gaithersburg, MD 20899-8930 and are available at http://csrc.nist.gov/​.
§ 1311.16
Requirements for obtaining a certificate for a digital signature for orders.
(1) Two copies of identification, one of which must be a government-issued photographic identification.Start Printed Page 38580
(e) The certificate holder must report the loss, theft, or compromise of the private key or the password, via a revocation request, to the Certification Authority within 24 hours of discovery of the loss, theft, or compromise. Upon receipt and verification of a signed revocation request, the Certification Authority will revoke the certificate. The certificate holder must apply for a new certificate under the requirements of § 1311.20.
Number of digital certificates needed.
Renewal of digital certificates.
(c) If a certificate holder applies for a renewal before the certificate expires, the certificate holder may renew electronically twice. For every third renewal, the certificate holder must submit a new application and documentation, as provided in § 1311.20.
(d) If a certificate expires before the holder applies for a renewal, the certificate holder must submit a new application and documentation, as provided in § 1311.20.
Requirements for registrants that allow powers of attorney individual to obtain digital certificates under their DEA registration.
(b) A registrant must maintain a record that lists each person granted power of attorney to sign controlled substance orders.
(9) For orders, the system must archive the digitally signed orders and any other records required in Part 1305 Start Printed Page 38581of this chapter, including any linked data.
(10) For orders, the system must create an order that includes all data fields listed under § 1305.21(b) of this chapter.
(11) If a registrant sends daily reports on orders to DEA, the system must create a report that includes, for each order, all the data fields listed under § 1305.28(a) of this chapter.
§ 1311.65