Source: https://www.deadiversion.usdoj.gov/fed_regs/rules/2011/fr1019.htm
Timestamp: 2019-04-21 04:53:50
Document Index: 231377371

Matched Legal Cases: ['arts 1300', 'art 1311', 'art 1311', 'art 1311', 'art 1311', 'art 1311', 'arts 1300']

2011 - Clarification and Notification: Electronic Prescriptions for Controlled Substances Clarification
RESOURCES > Federal Register Notices > Rules - 2011 > Clarification and Notification: Electronic Prescriptions for Controlled Substances Clarification
[Pages 64813-64816]
[FR Doc No: 2011-26738]
21 CFR Parts 1300, 1304, 1306 and 1311
[Docket No. DEA-360]
ACTION: Clarification and notification.
SUMMARY: DEA wishes to emphasize that third-party audits of software applications for Electronic Prescriptions for Controlled Substances (EPCS) must encompass all applicable requirements in our regulations, including security, and must address "processing integrity" as set forth in our regulations. Likewise, where questions or gaps may arise in reviewing a particular application, DEA recommends consulting federal guidelines set forth in NIST Special Publication 800-53A. DEA is also announcing the first DEA approved certification process for EPCS. Certifying organizations with a certification process approved by DEA pursuant to the regulations are posted on DEA's Web site once approved.
FOR FURTHER INFORMATION, CONTACT: Imelda L. Paredes, Office of Diversion Control, Drug Enforcement Administration, 8701 Morrissette Drive, Springfield, Virginia 22152; Telephone (202) 307-7165.
The information technology industry is currently in the process of developing and testing applications to implement the requirements set forth in the Interim Final Rule. As this process continues, DEA believes it prudent to issue the following clarifications, recommendation, and update to help ensure that the requirements of the Interim Final Rule are properly implemented. Specifically, DEA is clarifying that third-party audits must be conducted by qualified persons and must determine that an application meets all of the applicable requirements in 21 CFR part 1311 as well as other requirements referenced in Part 1311. "Processing integrity" must be addressed in audits of EPCS applications. DEA recommends that federal guidelines as set forth by the National Institute of Standards and Technology (NIST), including NIST Special Publication 800-53A, be consulted where questions arise. DEA has also announced an approved certification process for EPCS applications and has posted this information on its Web site. DEA notes its concern that proposed EPCS applications receive careful review prior to being used to create, sign, transmit or process controlled substance prescriptions so as to ensure the closed system for controlled substances established by the CSA. Secure and safe dispensing of controlled substances is necessary to protect the public interest and prevent diversion of controlled substances to illicit purposes. As with any violations of the CSA or DEA's implementing regulations, if diversion occurs in the EPCS environment, or if controlled substances are otherwise dispensed in violation of the EPCS regulations, those responsible may be subject to administrative and/or judicial action, to include civil injunction.
Implementation of electronic prescriptions for controlled substances is occurring at the same time the President has declared current prescription drug misuse and abuse as an epidemic constituting a major public health and public safety crisis.\2\ The non-medical use of prescription drugs is on the rise in the United States. Drug induced deaths now exceed motor vehicle accident deaths in the United States.\3\ According to the "Drug Abuse Warning Network (DAWN), 2009: National Estimates of Drug-Related Emergency Department Visits," the
[[Page 64815]]
Substance Abuse and Mental Health Services Administration (SAMHSA),\4\ emergency department visits involving non-medical use of pharmaceuticals (misuse or abuse) almost doubled between 2004 and 2009 from 627,291 in 2004 to 1,244,679 visits in 2009 (a 98.4 percent increase).\5\ About half of the 2009 emergency department visits related to abuse or misuse of pharmaceuticals involved painkillers and more than one-third involved drugs to treat insomnia and anxiety.\6\
\2\ "Epidemic: Responding to America's Prescription Drug Abuse Crisis," Office of National Drug Control Policy, Executive Office of the President of the United States, 2011. http://www.whitehousedrugpolicy.gov/publications/pdf/rx_abuse_plan.pdf.
\3\ National Vital Statistics Reports, Vol. 59, No. 4, March 16, 2011, http://www.cdc.gov/nchs/data/nvsr59/nvsr59_04.pdf.
\4\ Behavioral Health Statistics and Quality, "Highlights of the 2009 Drug Abuse Warning Network (DAWN) Findings on Drug-Related Emergency Department Visits," The DAWN Report, December 28, 2010.
\5\ Id. at 4.
\6\ Id. at 3.
The 2009 National Survey on Drug Use and Health (NSDUH) \7\ estimated that 7.0 million persons used prescription-type psychotherapeutic drugs--pain relievers, anti-anxiety medications, stimulants, and sedatives--non-medically. This represents 2.8 percent of the population aged twelve or older. These estimates were 13 percent higher than those from the 2008 Survey. In 2009, 2.2 million persons aged twelve or older used pain relievers non-medically for the first time; that averages to over 6,000 new users per day. Teenagers (grades 9-12) believe that prescription drugs are easier to obtain than illegal drugs. There is a concern that young people may perceive prescription and/or over-the-counter drugs as "safer" than illegal drugs because of their intended, legitimate medical use.\8\
\7\ Substance Abuse and Mental Health Services Administration, "Results from the 2009 National Survey on Drug Use and Health: Volume I, Summary of National Findings," Office of Applied Studies, 2010 (NSDUH Series H-38A, HHS Publication No. SMA 10-4856), http://www.oas.samhsa.gov/nsduh/2k9NSDUH/2k9Results.pdf.
\8\ Partnership for a Drug-Free America and MetLife Foundation, "2009 Parents and Teens Attitude Tracking Study Report" March 2, 2010.
Cyber attacks are growing in frequency, size and complexity and are of concern as EPCS goes online. Responses by 583 U.S. businesses of all sizes to a recent independent survey conducted by the Ponemon Institute released June 22, 2011 found that 90 percent had at least one cyber security breach in the past 12 months. This survey found that the top two endpoints from which these security breaches occurred are employees' laptop computers and employee's mobile devices.\9\ Numerous recent news articles describe incidents of major security breaches or hacking incidents into major U.S. private and government computer systems, including incidents involving electronic health records.\10\ These incidents occur for many reasons, but access to controlled substances has not been cited as an objective because such substances have not been communicated via an electronic system. With the impending implementation of electronic prescriptions for controlled substances, DEA wishes to reiterate that adequate security of EPCS has been and continues to be a primary consideration in any electronic system used to communicate a legitimate controlled substance prescription for the purpose of dispensing to an ultimate user.
\9\ http://www.marketwire.com/printer_friendly?id=1529987; http://business.financialpost.com/2011/06/23/survey-finds-90-of-u-s-companies-hacked-in-past-year/.
\10\ For example, among others, see Wall Street Journal articles May 19 (U.N. International Atomic Energy Agency), May 27 (Lockheed Martin), June 2 (Google), June 10 (Citigroup), June 11 (Sony), 2011; Workers' Compensation California Medical Record Privacy Breach, August 23, 2011, http://workers-compensation.blogspot.com/2011/08/major-california-medical-record-privacy.html; New York Times article September 8, 2011 (electronic medical record breaches).
Some individuals may be misinterpreting 21 CFR 1311.300(c) and (d), which state that audits "for installed applications must address processing integrity and determine that the application meets the requirements of this part," and audits "for application service providers must address processing integrity and physical security and determine that the application meets the requirements of this part." (emphasis added). To further clarify, the Code of Federal Regulations is organized by title, chapter, part, subpart, section and paragraph. Any audit must include all of the applicable requirements for electronic prescriptions of controlled substances found in 21 CFR part 1311 and not just section 1311.300 of part 1311. Part 1311 also cross- references Parts 1300, 1304 and 1306 which establish specific requirements that must be the subject of any audit. Thorough review and testing of all requirements is both required by the regulations and necessary to ensure secure and effective electronic prescribing and dispensing of controlled substances in the interests of public health and safety.
"Processing Integrity" must be addressed in audits of EPCS prescriber and pharmacy applications.
EPCS applications must address security to prevent insider threats and outsider attacks on any system. Careful review by an independent, qualified third-party of the "processing integrity" of any application is required to determine whether an application or application service provider has adequate protection against the range of potential security threats.
DEA notes that 21 CFR 1311.300(b)(1) and (2) require that a third- party audit be conducted by a person qualified to conduct a SysTrust, WebTrust or SAS 70 audit or by a Certified Information System Auditor. The regulations do not require one of these types of audits, but rather that the person conducting the audit must have specified qualifications. As provided in 21 CFR 1311.300(c) and (d), any audit must address processing
[[Page 64816]]
integrity and determine that the application meets the requirements of DEA's regulations. DEA is reviewing the fact that the American Institute of Certified Public Accountants has replaced SAS 70 audits referenced in 21 CFR 1311.300(b)(1) and will necessarily address this issue in the final rule on EPCS.
Some of the questions surrounding interpretation of DEA's EPCS regulations as applied to specific applications are addressed by federal guidelines articulated by the National Institute of Standards and Technology in NIST Special Publication (SP) 800-53A, as revised. Federal computer systems must comply with federal guidelines as outlined in NIST SP 800-53A.\11\ As NIST SP 800-53A states, the publication may be used by nongovernmental organizations on a voluntary basis. Although the Interim Final Rule does not require compliance with NIST SP 800-53A, DEA believes this publication provides useful guidance and that it is advisable for private sector entities to consult the publication when reviewing security requirements for EPCS applications. In addition, EPCS will be used on federal systems in the military, the Department of Veterans Affairs and elsewhere where such systems must comply with federal guidelines.
\11\ http://csrc.nist.gov/publications/nistpubs/800-53A-rev1/sp800-53A-rev1-final.pdf. Note that the latest version of SP800-53A should be consulted as it is regularly updated to meet technology developments.
DEA notes that the Notice of Proposed Rulemaking (NPRM) in June 27, 2008 discussed NIST SP 800-53A and whether or not it should be the basis for security requirements. 73 FR 36746-47 (June 27, 2008). DEA did not require application of NIST SP 800-53A in the Interim Final Rule due to the perceived need for flexibility and because security would be ensured by review of "processing integrity." In light of developments since that time, DEA will be revisiting this issue as it is clear that a mechanism must be established in the EPCS regulations to keep EPCS applications current with technology, particularly security requirements.