Source: http://www.wsparx.org/associations/7310/files/fr0401.htm
Timestamp: 2017-12-17 04:10:38
Document Index: 426380068

Matched Legal Cases: ['arts 1305', 'art 1311', 'art 1305', 'art 1305', 'art 1305', 'art 1305', 'art 1305', 'art 1305', 'art 1311', 'ART 1305', 'art 1305', 'art 1305', 'art 1305', 'art 1311', 'ART 1311', 'art 51']

Rules 2005 - Electronic Orders for Controlled Substances
Federal Register Notices > Rules - 2005 > Electronic Orders for Controlled Substances
FR Doc 05-6504 [Federal Register: April 1, 2005 (Volume 70, Number 62)] [Rules and Regulations] [Page 16901-16919] From the Federal Register Online via GPO Access [wais.access.gpo.gov] [DOCID:fr01ap05-18]
[[Page 16902]]
21 CFR Parts 1305 and 1311
[Docket No. DEA-217F] RIN 1117-AA60
SUMMARY: DEA is revising its regulations to provide an electronic equivalent to the DEA official order form, which is legally required for all distributions involving Schedule I and II controlled substances. These regulations will allow, but not require, registrants to order Schedule I and II substances electronically and maintain the records of these orders electronically. The regulations will reduce paperwork and transaction times for DEA registrants who handle, sell, or buy these controlled substances. This rule has no effect on patients' ability to receive prescriptions for controlled substances from practitioners, nor on their ability to have those prescriptions filled at pharmacies.
DATES: Effective Date: This rule is effective on May 31, 2005. The incorporation by reference of certain publications listed in the rule is approved by the Director of the Federal Register as of May 31, 2005.
Industry asked DEA to provide an electronic means to satisfy the legal requirements for order forms. DEA began discussions with the regulated industry regarding CSOS standards in 1999. On January 11, 2002, DEA published a notice in the Federal Register expressing its intent to conduct a pilot project to conduct performance verification testing of public key infrastructure enabled controlled substances orders. This pilot project was conducted in partnership with two industry associations--the Health Care Distribution Management Association and the National Association of Chain Drug Stores. A total of 22 DEA registrants were listed as initial pilot participants. Initial pilot objectives were to ascertain the level of compatibility and usability of CSOS standards for electronic controlled substances ordering applications and to test industry's ability to deploy these systems. All technical test objectives were successfully realized in early phases of the pilot with registrants demonstrating the ability to retrieve and manage their CSOS digital certificates. Where participants expressed difficulty or reported undue burden with processes (e.g., with initial notarization requirements for enrollment) proposed technical standards were reviewed and modified, where possible, without compromising necessary nonrepudiation and security services objectives.
On June 27, 2003, DEA issued a Notice of Proposed Rulemaking (NPRM) in which DEA proposed revisions to its regulations to allow electronic orders if those orders were signed using an electronic signature that met three criteria--authentication, non-repudiation, and record integrity (68 FR 38558). Because only digital signatures based on certificates issued by a Certification Authority as part of a public key infrastructure (PKI) meet all three criteria, DEA proposed requirements that apply to obtaining and using digital certificates.
[[Page 16903]]
Procedures for enrolling to obtain a digital certificate are available on the DEA Diversion Control Program Web site, http://www.deadiversion.usdoj.gov , and on the DEA E-Commerce Web site at http://www.deaecom.gov. Applicants can download the Diversion PKI CSOS Enrollment document and the CSOS Subscriber's Manual for guidance on enrollment procedures. DEA will begin accepting applications to obtain digital certificates May 31, 2005. Upon receiving a completed application DEA estimates that it will take the Certification Authority 10 business days to process the application. DEA's Certification Authority will maintain a support line to assist applicants and subscribers with issues pertaining to certificate enrollment, issuance, revocation, and renewal.
DEA has revised the rule language to clarify that only the registrant's authorized schedules will be included in the extension data. If a registrant limits an individual's signing authority, it is incumbent on the registrant to ensure that the individual does not sign orders for schedules he/she is not authorized to order. The supplier is not required to verify information on schedules beyond confirming that the
[[Page 16904]]
registrant is authorized to order the schedules.
The intent of this rulemaking is to establish an electronic means of satisfying the order form requirements--not to change the existing order form requirements. DEA did not propose to change the POA requirement or process, which was established to ensure that all activities by a registrant with respect to order forms be under the ultimate control of one responsible individual within the registrant. Any concerns regarding existing requirements with respect to POA will have to be considered in a separate action; they are beyond the scope of this CSOS rulemaking.
One commenter noted that the language in Sec. 1305.12(d) that states that orders must be signed by a person authorized to sign an application for registration was wrong and should state that orders must be signed either by a person who is authorized to sign a registration application or a person granted POA to sign orders. DEA agrees and has changed the rule.
Linked records. Commenters objected to the use of the phrase ``electronically linked'' records because they think that links could be electronic or manual. In technical discussions with DEA, industry clarified that their concern was that DEA might interpret ``electronically linked'' to require active rather than passive links, where all order data are linked automatically. Passive links would allow the data to be stored in separate databases linked by one or more data elements common to all records.
DEA emphasizes that it is not requiring any specific type of link; DEA's only concern is that if it requests copies of orders (e.g., for a particular customer or substance), the registrant must be able to produce the requested records (i.e., both the electronic orders and the linked distribution records) upon request in a format that an agent can read and understand. DEA has revised the rule to clarify that ``readable format'' means that a person, not a computer, can easily read the documents.
Corrections. Several commenters identified changes needed to correct regulatory language. In Sec. 1305.22(c)(1), DEA proposed that suppliers should verify the signature and order by ``having'' software that complies with Part 1311. The commenter recommended ``using'' instead of ``having.'' DEA agrees and has made the change.
Commenters stated that the proposed language in Sec. 1305.25(b) and (c) that requires the supplier to provide a reason for not filling the order was inconsistent with the existing rule. DEA agrees and has changed the language to clarify that a supplier must notify a purchaser that an order will not be filled, however, the supplier does not need to provide a reason for refusing to fill an order.
Commenters asked DEA to make the definition of digital certificate specific to CSOS. DEA disagrees. The definition is intended to be general and will cover more than CSOS certificates. In the regulatory text, however, DEA has added ``CSOS'' before digital certificate wherever the certificate is limited to the CSOS certificate. One commenter asked whether ``a registrant's recognized agent'' was different from a CSOS coordinator. The two are the same; DEA has revised the
[[Page 16905]]
rule to replace registrant's recognized agent with CSOS coordinator.
Central Ordering. A commenter asked whether the Sec. 1305.22(f) requirement to ship to the registered location of the purchaser allowed for shipment to a different registered location if the order was issued by a central ordering facility. A number of firms issue orders for all their registered locations from a central location which may not, itself, be registered. Each order, however, can be for only one specific registered location and the supplier must ship to that location. If the registered location identified within the order deviates from that identified within the digital certificate, the supplier cannot fill the order; a new order must be requested from the purchaser.
Commenters also recommended that for central processing of orders that DEA allow either the central location or the location filling part of the order to create the record. DEA agrees that either location may create the record and has revised the rule. DEA's concern is not with the creation of the record, but with its maintenance. The registrant that distributes a controlled substance must maintain a full record of the order and make it available for DEA on request. One commenter raised the issue of linking a single certificate to multiple locations. As DEA explained in the NPRM, DEA understands the concern and has taken steps to reduce the burden for individuals who hold keys for many locations, but to serve as an equivalent of a Form 222, each digital certificate must be specific to a single registered location.
Commenters also stated that the meaning of Sec. 1305.26 on lost orders was confusing and requested that only the purchaser maintain records of lost orders. DEA agrees and has revised the rule to specify that a supplier need maintain only those orders that the supplier fills.
Registrants may notify the CA in advance of revocations. DEA agrees that the 24-hour period should be within 24 hours of substantiation of key compromise, etc., and has changed the rule. On the 6-hour notification, DEA disagrees with the commenters. DEA believes it is important that the CA be notified as soon as someone's signing privileges are revoked. The digital certificate is the equivalent of a Form 222--a former employee still in possession of their digital certificate and keys would have all they needed to generate orders that would be otherwise indistinguishable from legitimate orders. In the paper world, this concern does not exist since a former employee would no longer have access to the order forms and, thus, could not engage in any mischief. DEA notes that the CA will be staffed 24/7 so there is no need to wait until the next business day. An e-mail to the CA that is digitally signed by the coordinator or registrant will be sufficient notification.
Reports to DEA. Commenters objected to the requirement that suppliers file reports on orders with DEA every other business day. They stated that this frequency of filing would not provide them with an opportunity to review and correct minor discrepancies. With paper orders, DEA knows which registrants have executed Form 222, which provides a control on the system. DEA needs frequent reports on electronic orders because it has no other means of determining who is ordering and in what volume. DEA recognizes that some
[[Page 16906]]
of the data may be imprecise due to changes in orders, but DEA needs frequent submissions of reports to account for all orders generated by a given purchasing registrant and as a means to identify and account for all outstanding orders for a given registrant.
Audits. Comments expressed concern about the scope of the third- party audits and DEA audits. They specifically stated that the reports to DEA should not be included in the third-party audits.
Commenters questioned the use of ``system.'' DEA agrees with commenters that systems for creating and processing digitally signed orders may be one or more software systems. As noted above, DEA's concern is the integrity and availability of the records of orders, not the technologies and software used to create and store the information.
Commenters objected to the statement in the NPRM that the practical implementation of PKI systems is simple. DEA understands and explained in the NPRM that the technologies involved in PKI systems are complex, but from the user's standpoint, digital signatures are simple because so much of the work is actually done by machine. After authenticating themselves to the system and activating the key, the signer generally digitally ``signs'' the document with a single key stroke. One commenter raised issues related to digital certificates for pharmacists for use in the electronic prescription system. This issue is beyond the scope of this notice; DEA will address the issue when it proposes its rule for electronic prescriptions.
Except for the changes discussed above, DEA is adopting the rule as proposed. Part 1305 has been reorganized to place requirements that apply to all Schedule I and II orders in subpart A; these include old Sec. Sec. 1305.01, 1305.02, 1305.03, 1305.04, which retain their numbers, old Sec. 1305.07 (power of attorney), which is redesignated as Sec. 1305.05, old Sec. 1305.08 (persons entitled to fill orders), which is redesignated as Sec. 1305.06, and old Sec. 1305.16 (special procedures for filling certain orders), which is redesignated as Sec. 1305.07. The remainder of old Part 1305 is subpart B, which covers the requirements for obtaining, executing, and filling orders on Form 222. Subpart B includes old Sec. Sec. 1305.05 and 1305.06 (procedures for obtaining and executing
[[Page 16907]]
Forms 222), which are redesignated as Sec. Sec. 1305.11 and 1305.12, and old Sec. Sec. 1305.09-1305.15, which are redesignated as Sec. Sec. 1305.13-1305.19. These sections include specific references to orders on Form 222.
Subpart C covers the requirements for electronic orders. Section 1305.21 specifies that an electronic order must be signed with a CSOS digital certificate and that the order may include substances other than Schedule I and II controlled substances. The section specifies the data fields that must be included in electronic orders.
Section 1311.10 specifies who is eligible to obtain a CSOS certificate; Sec. 1311.15 covers the limitation of certificates to the schedules authorized for the DEA registration under which the certificate is issued. The revised section states that the registrant is responsible for ensuring that any person whose signing authority the registrant limits abides by those limits.
Part 1305.--Distribution Table
1305.01--Scope of part 1305
1305.01--Scope of part 1305.
1305.02—Definitions
1305.02--Definitions.
1305.03--Distributions requiring order forms
1305.04--Persons entitled to obtain and execute order forms
1305.04--Persons entitled to obtain and execute order forms.
1305.05--Procedure for obtaining order forms
1305.11--Procedure for obtaining DEA Forms 222.
1305.06--Procedure for executing order forms
1305.12--Procedure for executing DEA Forms 222.
1305.07--Power of attorney.............
1305.05--Power of attorney.
1305.08--Persons entitled to fill order forms
1305.06--Persons entitled to fill DEA Forms 222.
1305.09--Procedure for filling order forms
1305.13--Procedure for filling DEA Forms 222.
1305.10--Procedure for endorsing order forms
1305.14--Procedure for endorsing DEA Forms 222
1305.11--Unaccepted and defective order forms
1305.15--Unaccepted and defective DEA Forms 222.
1305.12--Lost and stolen order forms
1305.16--Lost and stolen DEA Forms 222.
1305.13--Preservation of order forms
1305.17--Preservation of DEA Forms 222.
1305.14--Return of unused order forms
1305.18--Return of unused DEA Forms 222.
1305.15--Cancellation and voiding of order forms
1305.19--Cancellation and voiding of DEA Forms 222.
1305.16--Special procedure for filling certain order forms.
1305.07--Special procedure for filling certain DEA Forms 222.
These standards are available from the National Institute of Standards and Technology, Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology, 100 Bureau Drive, Gaithersburg, MD 20899-8930 and are available at http://csrc.nist.gov/.
This regulation has been drafted and reviewed in accordance with Executive Order 12866, ``Regulatory Planning and Review'', Section 1(b), Principles of Regulation. It has been determined that this is a ``significant regulatory action'' under Executive Order 12866, Section 3(f), Regulatory Planning and Review, and accordingly this rule has been reviewed by the Office of Management and Budget.
DEA has conducted a cost-benefit analysis of the rule, which the Office of Management and Budget has reviewed. The Economic Impact Analysis for the proposed rule was posted on the Diversion Control Program Web site. That analysis has been updated to account for the number of orders expected in 2004 (6,561,000), the first year of implementation, and to adjust registrant estimates based on data from DEA's ARCOS reporting system. DEA estimates that about 98,000 registrants order Schedule I and II controlled substances and will apply for about 145,000 digital certificates. Over ten years, DEA estimates that electronic orders will reduce the annualized cost of Schedule I and II orders by $284 million; the annualized costs of digital
[[Page 16908]]
certificates are estimated to be $20 million. The annualized net benefit of the rule, therefore, is $264 million.
Table 1.--Total Annual Hours and Costs for the Form 222 System [2004 orders]
Complete and send order 1,640,250 $139,323,000 .............. $7,355,000 $146,677,000
Requisition order 3,124 265,000 ............. 23,000 288,000
Annotate order 328,050 27,865,000 .............. 27,865,000
Enter order 1,640,250 58,770,000 .............. .............. 58,770,000
Annotate order 328,050 21,212,000 .............. .............. 21,212,000
Compile and send to DEA 90,936 3,258,000 .............. 174,000 3,433,000
Table 2.--Total Hours and Costs for Digital Certificates
Complete application 58,950 $5,007,000 .............. $5,007,000
Complete application--coordinator 78,755 6,689,000 $638,000 7,328,000
Generate keys 12,116 1,029,000 .............. 1,029,000
Learn to use signature 20,778 1,765,000 .............. 1,765,000
Renewal--one year 1,234 105,000 .............. 105,000
Renewal--3 year-annual 3,627 308,000 308,000
Complete application 3,311 214,000 .............. 214,000
Complete application--coordinator 345 22,000 2,790 25,000
Generate keys 406 26,000 .............. 26,000
Learn to use signature 2,032 131,000 .............. 131,000
Renewal 406 26,000 .............. 26,000
Table 3.--Total Hours and Costs for Electronic Orders
Total 506,661 .............. 36,826,000
[[Page 16909]]
Table 4.--Total Hours and Costs for the Electronic Order Software
Install--chains 8,680 $666,000 .............. $666,000
Install software--other 314,408 13,010,000 .............. 13,010,000
Install--practitioner 43,940 1,818,000 .............. 1,818,000
Install software 280 11,600 .............. 11,600
Development 103,600 9,700,000 .............. 9,700,000
Maintenance 89,000 3,683,000 .............. 3,683,000
Upgrades 17,800 1,367,000 .............. 1,367,000
580,022 30,352,000 593,000 30,945,000
Table 5.--Total Cost of Orders Over Ten Years
Table 6.--Total Costs of Digital Certificates and Software Over 10 Years
With the Form 222, if a supplier cannot fill all of an order, the supplier may endorse the entire order over to another supplier. The order cannot be divided and filled in part by one supplier and in part by a second, even if both suppliers belong to the same company. Because each location holds a separate registration, a distributor with multiple locations must maintain stocks of all Schedule I and II controlled substances at each location to be able to fill orders for these substances from that location. Some distributors have created centralized systems where all orders are
[[Page 16910]]
processed through the central distribution office, which then transmits parts of the orders to the warehouses that hold specific items. The Form 222 system cannot take advantage of this arrangement because the paper must accompany the order. With electronic orders, DEA will allow a distributor with a central distribution system to divide an order and ship parts of the order from different distribution points. New orders will not need to be generated because the central computer system can track each item in the order and ensure that it is shipped to the appropriate registrant only once. DEA and the supplier will have the records necessary to maintain the closed system of control while allowing the supplier to take advantage of its own system of distribution.
(3) The agency form number, if any, and the applicable component of the Department sponsoring the collection: Form No.: DEA Form 222, U.S. Official Order Forms for Schedule I and II Controlled Substances (Accountable Forms) DEA Form 222a: Order Form Requisition Applicable component of the Department sponsoring the collection: Office of Diversion Control, Drug Enforcement Administration, U.S. Department of Justice
(4) Affected public who will be asked or required to respond, as well as a brief abstract: Primary: Business or other for-profit. Other: Non-profit, state and local governments. Abstract: DEA-222 is used to transfer or purchase Schedule I and II controlled substances and data are needed to provide an audit of transfer and purchase. DEA-222a Requisition Form is used to obtain the DEA-222 Order Form. Persons may also digitally sign and transmit orders for controlled substances electronically, using a digital certificate. Orders for Schedule I and II controlled substances are archived and transmitted to DEA; both the supplier and purchaser must retain records for two years.
(3) The agency form number, if any, and the applicable component of the Department sponsoring the collection: Form No.:
(4) Affected public who will be asked or required to respond, as well as a brief abstract: Primary: Business or other for-profit. Other: Non-profit, state and local governments. Abstract: Persons use these forms to apply for DEA-issued digital certificates to order Schedule I and II controlled substances. Certificates must be renewed upon renewal of the DEA registration to which the certificate is linked. Certificates may be revoked and/or replaced when information on which the certificate is based changes.
Drug traffic control, Reporting requirements.
Administrative practice and procedure, Certification authorities, Controlled substances, Digital certificates, Drug traffic control, Electronic signatures, Incorporation by reference, Prescription drugs, Reporting and recordkeeping requirements.
For the reasons set out above, 21 CFR Part 1305 is revised, and Part 1311 is added as follows:
PART 1305--ORDERS FOR SCHEDULE I AND II CONTROLLED SUBSTANCES
1305.01 Scope of part 1305.
1305.02 Definitions.
1305.03 Distributions requiring a Form 222 or digitally signed electronic order.
1305.04 Persons entitled to order Schedule I and II controlled substances.
1305.05 Power of attorney.
1305.06 Persons entitled to fill orders for Schedule I and II controlled substances.
1305.07 Special procedure for filling certain orders.
Subpart B--DEA Form 222
1305.11 Procedure for obtaining DEA Forms 222.
1305.12 Procedure for executing DEA Forms 222.
1305.13 Procedure for filling DEA Forms 222.
1305.14 Procedure for endorsing DEA Forms 222.
1305.15 Unaccepted and defective DEA Forms 222.
1305.16 Lost and stolen DEA Forms 222.
1305.17 Preservation of DEA Forms 222.
1305.18 Return of unused DEA Forms 222.
1305.19 Cancellation and voiding of DEA Forms 222.
Subpart C--Electronic Orders
1305.21 Requirements for electronic orders.
1305.22 Procedure for filling electronic orders.
1305.23 Endorsing electronic orders.
1305.24 Central processing of orders.
1305.25 Unaccepted and defective electronic orders.
1305.26 Lost electronic orders.
1305.27 Preservation of electronic orders.
1305.28 Canceling and voiding electronic orders.
1305.29 Reporting to DEA.
Sec. 1305.01 Scope of part 1305.
Sec. 1305.02 Definitions.
(d) Delivery from a central fill pharmacy, as defined in Sec. 1300.01(b)(44) of this chapter, to a retail pharmacy.
Sec. 1305.04 Persons entitled to order Schedule I and II controlled substances.
(a) Only persons who are registered with DEA under section 303 of the Act (21 U.S.C. 823) to handle Schedule I or II controlled substances, and persons who are registered with DEA under section 1008 of the Act (21 U.S.C. 958) to export these substances may obtain and use DEA Form 222 (order forms) or
issue electronic orders for these substances. Persons not registered to handle Schedule I or II controlled substances and persons registered only to import controlled substances are not entitled to obtain Form 222 or issue electronic orders for these substances.
Sec. 1305.05 Power of attorney.
I, -------- (name of person granting power), the undersigned, who am authorized to sign the current application for registration of the above-named registrant under the Controlled Substances Act or Controlled Substances Import and Export Act, have made, constituted, and appointed, and by these presents, do make, constitute, and appoint -------- (name of attorney-in-fact), my true and lawful attorney for me in my name, place, and stead, to execute applications for Forms 222 and to sign orders for Schedule I and II controlled substances, whether these orders be on Form 222 or electronic, in accordance with 21 U.S.C. 828 and Part 1305 of Title 21 of the Code of Federal Regulations. I hereby ratify and confirm all that said attorney must lawfully do or cause to be done by virtue hereof.
I, -------- (name of attorney-in-fact), hereby affirm that I am the person named herein as attorney-in-fact and that the signature affixed hereto is my signature.
Signed and dated on the -------- day of --------, (year), at -------- .
The foregoing power of attorney is hereby revoked by the undersigned, who is authorized to sign the current application for registration of the above-named registrant under the Controlled Substances Act or the Controlled Substances Import and Export Act. Written notice of this revocation has been given to the attorney-in- fact -------- this same day.
Signed and dated on the -------- day of -------- , (year), at ------ -- .
Sec. 1305.06 Persons entitled to fill orders for Schedule I and II controlled substances.
(a) A person registered with DEA to dispense the substances, or to export the substances, if he/she is discontinuing business or if his/ her registration is expiring without reregistration, may dispose of any Schedule I or II controlled substances in his/her possession with a DEA Form 222 or an electronic order in accordance with Sec. 1301.52 of this chapter.
(c) A person registered to dispense Schedule II substances may distribute the substances to another dispenser with either a DEA Form 222 or an electronic order only in the circumstances described in Sec. 1307.11 of this chapter.
Sec. 1305.07 Special procedure for filling certain orders.
A supplier of carfentanil, etorphine hydrochloride, or diprenorphine, if he or she determines that the purchaser is a veterinarian engaged in zoo and exotic animal practice, wildlife management programs, or research, and is authorized by the Administrator to handle these substances, may fill the order in accordance with the procedures set forth in Sec. 1305.17 except that:
Sec. 1305.11 Procedure for obtaining DEA Forms 222.
(a) DEA Forms 222 are issued in mailing envelopes containing either seven or fourteen forms, each form containing an original, duplicate, and triplicate copy (respectively, Copy 1, Copy 2, and Copy 3). A limit, which is
based on the business activity of the registrant, will be imposed on the number of DEA Forms 222, which will be furnished on any requisition unless additional forms are specifically requested and a reasonable need for such additional forms is shown.
(c) Each requisition must show the name, address, and registration number of the registrant and the number of books of DEA Forms 222 desired. Each requisition must be signed and dated by the same person who signed the most recent application for registration or for reregistration, or by any person authorized to obtain and execute DEA Forms 222 by a power of attorney under Sec. 1305.05.
Sec. 1305.12 Procedure for executing DEA Forms 222.
(d) Each DEA Form 222 must be signed and dated by a person authorized to sign an application for registration or a person granted power of attorney to sign a Form 222 under Sec. 1305.05. The name of the purchaser, if different from the individual signing the DEA Form 222, must also be inserted in the signature space.
Sec. 1305.13 Procedure for filling DEA Forms 222.
Sec. 1305.14 Procedure for endorsing DEA Forms 222.
(a) A DEA Form 222, made out to any supplier who cannot fill all or a part of the order within the time limitation set forth in Sec. 1305.13, may be endorsed to another supplier for filling. The endorsement must be made only by the supplier to whom the DEA Form 222 was first made, must state (in the spaces provided on the reverse sides of Copies 1 and 2 of the DEA Form 222) the name and address of the second supplier, and must be signed by a person authorized to obtain and execute DEA Forms 222 on behalf of the first supplier. The first supplier may not fill any part of an order on an endorsed form. The second supplier may fill the order, if possible and if the supplier desires to do so, in accordance with Sec. 1305.13(b), (c), and (d), including shipping all substances directly to the purchaser.
Sec. 1305.15 Unaccepted and defective DEA Forms 222.
(1) The order is not complete, legible, or properly prepared, executed, or endorsed. (2) The order shows any alteration, erasure, or change of any description. (b) If a DEA Form 222 cannot be filled for any reason under this section, the supplier must return Copies 1 and 2 to the purchaser with a statement as to the reason (e.g., illegible or altered).
(c) A supplier may for any reason refuse to accept any order and if a supplier refuses to accept the order, a statement that the order is not accepted
[[Page 16914]]
is sufficient for purposes of this paragraph.
(d) When a purchaser receives an unaccepted order, Copies 1 and 2 of the DEA Form 222 and the statement must be attached to Copy 3 and retained in the files of the purchaser in accordance with Sec. 1305.17. A defective DEA Form 222 may not be corrected; it must be replaced by a new DEA Form 222 for the order to be filled.
Sec. 1305.16 Lost and stolen DEA Forms 222.
(a) If a purchaser ascertains that an unfilled DEA Form 222 has been lost, he or she must execute another in triplicate and attach a statement containing the serial number and date of the lost form, and stating that the goods covered by the first DEA Form 222 were not received through loss of that DEA Form 222. Copy 3 of the second form and a copy of the statement must be retained with Copy 3 of the DEA Form 222 first executed. A copy of the statement must be attached to Copies 1 and 2 of the second DEA Form 222 sent to the supplier. If the first DEA Form 222 is subsequently received by the supplier to whom it was directed, the supplier must mark upon the face ``Not accepted'' and return Copies 1 and 2 to the purchaser, who must attach it to Copy 3 and the statement.
Sec. 1305.17 Preservation of DEA Forms 222.
(c) DEA Forms 222 must be maintained separately from all other records of the registrant. DEA Forms 222 are required to be kept available for inspection for a period of two years. If a purchaser has several registered locations, the purchaser must retain Copy 3 of the executed DEA Form 222 and any attached statements or other related documents (not including unexecuted DEA Forms 222, which may be kept elsewhere under Sec. 1305.12(e)), at the registered location printed on the DEA Form 222.
Sec. 1305.18 Return of unused DEA Forms 222.
If the registration of any purchaser terminates (because the purchaser dies, ceases legal existence, discontinues business or professional practice, or changes the name or address as shown on the purchaser's registration) or is suspended or revoked under Sec. 1301.36 of this chapter for all Schedule I and II controlled substances for which the purchaser is registered, the purchaser must return all unused DEA Forms 222 to the nearest office of the Administration.
Sec. 1305.19 Cancellation and voiding of DEA Forms 222.
(a) A purchaser may cancel part or all of an order on a DEA Form 222 by notifying the supplier in writing of the cancellation. The supplier must indicate the cancellation on Copies 1 and 2 of the DEA Form 222 by drawing a line through the canceled items and printing ``canceled'' in the space provided for number of items shipped.
Sec. 1305.21 Requirements for electronic orders.
Sec. 1305.22 Procedure for filling electronic orders.
(b) A supplier may fill the order for a Schedule I or II controlled substance, if possible and if the supplier desires to do so and is authorized to do so under Sec. 1305.06.
(1) Verify the integrity of the signature and the order by using software that
[[Page 16915]]
complies with Part 1311 of this chapter to validate the order.
Sec. 1305.23 Endorsing electronic orders.
Sec. 1305.24 Central processing of orders.
Sec. 1305.25 Unaccepted and defective electronic orders.
(c) When a purchaser receives an unaccepted electronic order from the supplier, the purchaser must electronically link the statement of nonacceptance to the original order. The original order and the statement must be retained in accordance with Sec. 1305.27. (d) Neither a purchaser nor a supplier may correct a defective order; the purchaser must issue a new order for the order to be filled.
Sec. 1305.26 Lost electronic orders.
(c) If the supplier to whom the order was directed subsequently receives the first order, the supplier must indicate that it is ``Not Accepted'' and return it to the purchaser. The purchaser must link the returned order to the record of that order and the statement.
Sec. 1305.27 Preservation of electronic orders.
Sec. 1305.28 Canceling and voiding electronic orders.
(a) A supplier may void all or part of an electronic order by notifying the purchaser of the voiding. If the entire order is voided, the supplier must make an electronic copy of the order, indicate on the copy ``Void,'' and return it to the purchaser. The supplier is not required to retain a record of orders that are not filled. (b) The purchaser must retain an electronic copy of the voided order. (c) To partially void an order, the supplier must indicate in the linked record that nothing was shipped for each item voided.
Sec. 1305.29 Reporting to DEA.
PART 1311 `` DIGITAL CERTIFICATES
Subpart A--General Sec.
1311.01 Scope.
1311.02 Definitions.
1311.05 Standards for technologies for electronic transmission of orders.
1311.08 Incorporation by reference.
Subpart B--Obtaining and Using Digital Certificates for Electronic Orders
1311.10 Eligibility to obtain a CSOS digital certificate.
1311.15 Limitations on CSOS digital certificates.
1311.20 Coordinators for CSOS digital certificate holders.
[[Page 16916]]
1311.25 Requirements for obtaining a CSOS digital certificate.
1311.30 Requirements for storing and using a private key for digitally signing orders.
1311.35 Number of CSOS digital certificates needed.
1311.40 Renewal of CSOS digital certificates.
1311.45 Requirements for registrants that allow powers of attorney to obtain CSOS digital certificates under their DEA registration.
1311.50 Requirements for recipients of digitally signed orders.
1311.55 Requirements for systems used to process digitally signed orders.
1311.60 Recordkeeping.
Sec. 1311.01 Scope.
Sec. 1311.02 Definitions.
For the purposes of this chapter: Biometric authentication means authentication based on measurement of the individual's physical features or repeatable actions where those features or actions are both unique to the individual and measurable.
FIPS means Federal Information Processing Standards. These Federal standards, as incorporated by reference in Sec. 1311.08, prescribe specific performance requirements, practices, formats, communications protocols, etc., for hardware, software, data, etc.
FIPS 140-2, as incorporated by reference in Sec. 1311.08, means a Federal standard for security requirements for cryptographic modules.
FIPS 180-2, as incorporated by reference in Sec. 1311.08, means a Federal secure hash standard.
FIPS 186-2, as incorporated by reference in Sec. 1311.08, means a Federal standard for applications used to generate and rely upon digital signatures.
NIST means the National Institute of Standards and Technology. Private key means the key of a key pair that is used to create a digital signature.
Sec. 1311.05 Standards for technologies for electronic transmission of orders.
Sec. 1311.08 Incorporation by reference.
(iii) Annex C: Approved Random Number Generators for FIPS PUB 140- 2, Security Requirements for Cryptographic Modules, January 31, 2005.
(b) These standards are available from the National Institute of Standards and Technology, Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology, 100
Bureau Drive, Gaithersburg, MD 20899-8930 and are available at http://csrc.nist.gov/ .
(c) These incorporations by reference were approved by the Director of the Federal Register in accordance with 5 U.S.C. 552(a) and 1 CFR part 51. Copies may be inspected at the Drug Enforcement Administration, 600 Army Navy Drive, Arlington, VA 22202 or at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, call (202) 741-6030, or go to: http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html .
Sec. 1311.10 Eligibility to obtain a CSOS digital certificate.
Sec. 1311.15 Limitations on CSOS digital certificates.
Sec. 1311.20 Coordinators for CSOS digital certificate holders.
Sec. 1311.25 Requirements for obtaining a CSOS digital certificate.
Sec. 1311.30 Requirements for storing and using a private key for digitally signing orders.
[[Page 16918]]
Sec. 1311.35 Number of CSOS digital certificates needed.
Sec. 1311.40 Renewal of CSOS digital certificates.
Sec. 1311.45 Requirements for registrants that allow powers of attorney to obtain CSOS digital certificates under their DEA registration.
Sec. 1311.50 Requirements for recipients of digitally signed orders.
Sec. 1311.55 Requirements for systems used to process digitally signed orders.
(d) For systems used to process CSOS orders, the system developer or vendor must have an initial independent third-party audit of the system and an
[[Page 16919]]
additional independent third-party audit whenever the signing or verifying functionality is changed to determine whether it correctly performs the functions listed under paragraphs (b) and (c) of this section. The system developer must retain the most recent audit results and retain the results of any other audits of the software completed within the previous two years.
Sec. 1311.60 Recordkeeping.
Toll Free Number: 1-800-882-9539
ARCOS | Career Opportunities | Chemical Program | Controlled Substance Schedules | Drugs and Chemicals of Concern
Electronic Commerce Initiatives | | Federal Register Notices | Import Export | Links | Meetings and Events | NFLIS
Offices & Directories | On-Line Forms & Applications | Program Description | Publications | Questions & Answers | Quotas
Reports Required by 21 CFR | Title 21 Regulations & Codified CSA
Contact Us | Home | Hot Items | Site Map | Search | What's New