Internet Pharmacies: Federal Agencies and States Face Challenges Combating Rogue Sites, Particularly Those Abroad
Published: 2013-07-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Internet offers consumers a convenient method for purchasing drugs that is sometimes cheaper than buying from traditional brick-and-mortar pharmacies. According to a recent FDA survey, nearly 1 in 4 adult U.S. Internet consumers have purchased prescription drugs online. However, many Internet pharmacies are fraudulent enterprises that offer prescription drugs without a prescription and are not appropriately licensed. These rogue Internet pharmacies may sell drugs that are expired, improperly labeled, or are counterfeits of other drugs. A number of federal and state agencies share responsibility for administering and enforcing laws related to Internet pharmacies, including state boards of pharmacy, FDA, DOJ, CBP, and ICE.
The Food and Drug Administration Safety and Innovation Act directed GAO to report on problems with Internet pharmacies. This report identifies (1) how rogue sites violate federal and state laws, (2) challenges federal agencies face in investigating and prosecuting operators, (3) efforts to combat rogue Internet pharmacies, and (4) efforts to educate consumers about the risks of purchasing prescription drugs online. To conduct this work, GAO interviewed officials from FDA, DOJ, CBP, ICE, and other federal agencies, reviewed federal laws and regulations, and examined agency data and documents. GAO also interviewed officials from five state boards of pharmacy with varied approaches to regulating Internet pharmacies, and stakeholders including NABP, drug manufacturers, and companies that provide services to Internet businesses, such as payment processors.
section_title: What GAO Found
paragraphs: Rogue Internet pharmacies violate a variety of federal and state laws. Most operate from abroad, and many illegally ship prescription drugs into the United States that have not been approved by the Food and Drug Administration (FDA), an agency within the Department of Health and Human Services (HHS), that is responsible for ensuring the safety and effectiveness of prescription drugs. Many also illegally sell prescription drugs without a prescription that meets federal and state requirements. Rogue sites also often violate other laws, including those related to fraud, money laundering, and intellectual property rights.
Rogue Internet pharmacies are often complex, global operations, and federal agencies face substantial challenges investigating and prosecuting those involved. According to federal agency officials, piecing together rogue Internet pharmacy operations can be difficult because they may be composed of thousands of related websites, and operators take steps to disguise their identities. Officials also face challenges investigating and prosecuting operators because they are often located abroad. The Department of Justice (DOJ) may not prosecute such cases due to competing priorities, the complexity of these operations, and challenges related to bringing charges under some federal laws.
Despite these challenges, federal and state agencies as well as stakeholders have taken actions to combat rogue Internet pharmacies. Federal agencies have conducted investigations that have led to convictions, fines, and asset seizures from rogue Internet pharmacies as well as from companies that provide services to them. FDA and other federal agencies have also collaborated with law enforcement agencies around the world to disrupt rogue Internet pharmacy operations. The Department of Homeland Security's (DHS) U.S. Customs and Border Protection (CBP) and U.S. Immigration and Customs Enforcement (ICE), which are responsible for enforcing laws related to the importation of goods such as prescription drugs, have also worked with other agencies, including FDA, to interdict rogue Internet pharmacy shipments at the border. Given that most rogue Internet pharmacies operate from abroad, states have faced challenges combating them, and generally focus their oversight on licensed in-state entities that fulfill orders for rogue Internet pharmacies. Companies that provide services to Internet-based businesses, such as search engines and payment processors, have also taken action--primarily by blocking services to them.
FDA and others have taken steps to educate consumers about the dangers of buying prescription drugs from rogue Internet pharmacies. FDA recently launched a national campaign to raise public awareness about the risks of purchasing drugs online, and the National Association of Boards of Pharmacy (NABP) posts information on its website about how to safely purchase drugs online. However, rogue Internet pharmacies use sophisticated marketing methods to appear legitimate, making it hard for consumers to differentiate between legitimate and rogue sites.
HHS, DOJ, and DHS provided technical comments on a draft of this report, which GAO incorporated as appropriate.

section_title: Letter
paragraphs: The Internet offers consumers a convenient method for purchasing  prescription drugs that is sometimes cheaper than traditional brick-and- mortar retail pharmacies. Some Internet pharmacies are legitimate  businesses that offer a safe and cost-effective way for consumers to  obtain medications. However, there is mounting concern that many online  pharmacies are, in fact, fraudulent enterprises. Commonly known as  “rogue” websites, these fraudulent Internet pharmacies may send  unsolicited e-mails offering cheap drugs without a prescription, advertise  deep discounts that may seem too good to be true, and are often not  licensed in the United States. Buying drugs on the Internet is not  uncommon. According to a recent survey conducted by the Food and  Drug Administration (FDA), an agency within the Department of Health  and Human Services, nearly one in four adult U.S. Internet consumers  surveyed reported purchasing prescription drugs online. At the same  time, nearly 30 percent said that they lacked confidence about how to  safely purchase medicine online. This is a matter of grave concern as  rogue Internet pharmacies may sell products that, among other things,  have expired; been labeled, stored, or shipped improperly; and may even  be counterfeits—unauthorized versions—of other drugs.
Like brick-and-mortar pharmacies, Internet pharmacies are subject to  federal and state statutes and regulations that are designed to ensure the  safety, efficacy, and proper administration of medications. A number of  federal and state agencies share responsibility for regulating prescription  drugs that are marketed and sold to U.S. consumers, including by Internet  pharmacies. For example, FDA is responsible for ensuring the safety and  effectiveness of prescription drugs, and FDA approval is required prior to  marketing prescription drugs in the United States. The Department of  Homeland Security’s (DHS) U.S. Customs and Border Protection (CBP) is  responsible for enforcing laws prohibiting the illegal importation of goods  into the United States, including prescription drugs that have not been  approved for marketing in the United States by FDA, and its U.S.  Immigration and Customs Enforcement (ICE) conducts investigations  related to violations of these laws, including illegally importing prescription  drugs and trafficking in counterfeit goods. The U.S. Postal Inspection  Service (USPIS) conducts investigations related to the misuse of mail.  The Department of Justice (DOJ) may investigate and prosecute an  operator of an Internet pharmacy that is suspected of violating federal  laws. State agencies regulate the practice of pharmacy through state  boards of pharmacy and, similarly, the practice of medicine though state  medical boards.
The proliferation and widespread patronage of rogue Internet pharmacies  has prompted public officials to identify them as a continuing public health  threat. The Food and Drug Administration Safety and Innovation Act  enacted in 2012 required that we report on problems posed by rogue  Internet pharmacies. This report identifies (1) how rogue Internet  pharmacies are selling prescription drugs in violation of federal or state  law or established industry standards, (2) challenges associated with  federal investigations and prosecutions of rogue Internet pharmacies,   (3) efforts to combat rogue Internet pharmacies, and (4) efforts to educate  consumers about the risks of rogue Internet pharmacies and how to  recognize legitimate online pharmacies.
To identify how rogue Internet pharmacies are selling prescription drugs  in violation of federal or state laws or established industry standards, we  interviewed officials from federal agencies such as FDA, CBP, ICE,  USPIS, and DOJ, reviewed federal laws and regulations, and examined  agency documents, including those that presented information about  federal indictments and prosecutions related to Internet pharmacy crimes.  To obtain additional information, we interviewed a variety of  knowledgeable stakeholders, including the National Association of Boards  of Pharmacy (NABP) and LegitScript, an online pharmacy verification  service, both of which routinely review Internet pharmacy websites to  determine compliance with federal and state laws, and reviewed  stakeholders’ publications on rogue Internet pharmacies. (See app. I for a  complete list of agencies and stakeholders interviewed.) In addition, we  interviewed officials from state boards of pharmacy and state attorneys  general offices and reviewed relevant pharmacy and medical practice  laws and regulations of five judgmentally selected states—California,  Florida, Maine, Nevada, and Utah. We selected these states on the basis of variations in the states’ approaches in regulating Internet pharmacies.
To identify challenges involved in investigating and prosecuting rogue  Internet pharmacies, as well as efforts to combat rogue Internet  pharmacies, we interviewed officials from federal agencies such as FDA,  CBP, ICE, and DOJ. We obtained data from several federal agencies that  summarize their efforts to combat Internet pharmacies. We discussed  these data with agency officials, reviewed them for reasonableness and  consistency, and determined that they were sufficiently reliable for our  purposes. We also interviewed officials from the five state medical  boards, four of those states’ Attorneys General offices, as well as  stakeholders with knowledge of state oversight activities, such as NABP,  Federation of State Medical Boards (FSMB), the National Association of  Attorneys General, and its Intellectual Property Committee. In addition,  we interviewed officials from stakeholders involved in combating rogue  Internet pharmacies, including the Alliance for Safe Online Pharmacies,  Center for Safe Internet Pharmacies (CSIP), Pharmaceutical Security  Institute, International AntiCounterfeiting Coalition (IACC), and the  National Cyber-Forensics and Training Alliance. Stakeholders we also  spoke with included officials from five drug manufacturers—Eli Lilly and  Company; Merck & Co., Inc.; Pfizer; Purdue Pharma L.P.; and Takeda  Pharmaceuticals U.S.A., Inc.—as well as several private companies that  provide services to Internet-based companies, including the Internet  registrar Go Daddy; search engines Microsoft and Google Inc. (Google);  payment processors MasterCard International, Incorporated  (MasterCard), Visa, Inc. (Visa), and PayPal; and the shipping companies  FedEx and UPS. Finally, we reviewed published reports on rogue Internet  pharmacy operations.
To identify efforts to educate consumers about the risks of rogue Internet  pharmacies and how to recognize legitimate online pharmacies, we  interviewed officials from federal agencies, as well as officials from  stakeholders including NABP, FSMB, LegitScript, and the five  manufacturers listed above to discuss their consumer education efforts.  We also reviewed available educational campaign materials.
We conducted this performance audit from October 2012 to June 2013 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The federal government plays a role in overseeing Internet pharmacy  activity to the extent that these entities engage in interstate commerce or  violate federal laws. However, states have traditionally regulated the  practice of pharmacy and the practice of medicine. State boards of  pharmacy license pharmacists and pharmacies, and state medical boards  license physicians and set standards to ensure appropriate care,  including standards for writing prescriptions. By violating federal and state  laws, rogue Internet pharmacies threaten the public health.
subsections: section_title: Federal Role in Overseeing Internet Pharmacy Activity
paragraphs: No one federal agency is designated as the lead in combating rogue  Internet pharmacy activity. Instead, several federal agencies, including  FDA, CBP, and ICE, have separate and distinct roles and often work  together.
Under the Federal Food, Drug, and Cosmetic Act (FDCA), FDA is  responsible for ensuring the safety, effectiveness, and quality of domestic  and imported prescription drugs that are marketed to U.S. consumers.  The FDCA requires that certain drugs be dispensed pursuant to a  prescription that is issued by a licensed practitioner. The act also  requires drug manufacturers to obtain FDA’s approval before marketing  their drugs in the United States. To obtain FDA’s approval,  manufacturers must demonstrate to the agency that their drug is safe and  effective for its intended use, and meet other statutory and regulatory  standards relating to drug purity, labeling, manufacturing, and packaging.  Drugs that are manufactured in foreign countries for the U.S. market,  including those sold over the Internet, are subject to the same  requirements as those manufactured domestically. That is, all prescription  drugs offered for import must meet the requirements of the FDCA,  including requirements for obtaining FDA approval. Drugs that are  unapproved, or do not meet other provisions of the FDCA, such as those  listed below, may be subject to enforcement action.
Misbranded drugs include those that are sold without a prescription  that meets applicable requirements, as well as those whose labeling  or container is misleading or does not include required information,  such as the name of the drug, adequate directions for use, and  cautionary statements.
Adulterated drugs include those that differ in strength, quality, or purity  from approved products, as well as those that are not manufactured in  conformity with good manufacturing practices.
Counterfeit drugs include those sold under a product name without  proper authorization—where the drug is mislabeled in a way that  suggests that it is the authentic and approved product—as well as  unauthorized generic versions of FDA-approved drugs that mimic  trademarked elements of such drugs.
Drugs that do not appear to be in compliance with these provisions may  be denied entry into the United States. In addition, those—including  Internet pharmacy operators—that cause drugs to be misbranded,  adulterated, or counterfeited, as well as those that sell such drugs, violate  the FDCA and are subject to enforcement action. Counterfeiting and  trafficking or selling counterfeit drugs also violate laws that protect  intellectual property rights.
DOJ’s Drug Enforcement Administration (DEA) is responsible for  enforcing the Controlled Substances Act (CSA), which regulates the  possession, manufacture, distribution, and dispensing of controlled  substances, such as narcotic pain relievers. DEA is also responsible for enforcing provisions and investigating violations of the Ryan Haight  Online Pharmacy Consumer Protection Act of 2008, which amended the  CSA to regulate the distribution and dispensing of controlled substances  on the Internet. The act requires all entities that sell, or facilitate the  sale, of controlled substances online to register and be authorized by the  DEA to do so. Entities based in foreign countries are not eligible for  registration; it is illegal for consumers to import controlled substances.  The act also defines what constitutes a valid prescription for controlled  substances, and requires that such a prescription be issued for controlled  substances dispensed over the Internet.
CBP is responsible for enforcing laws prohibiting the illegal importation of  goods into the United States, including prescription drugs that have not  been approved by the FDA for the U.S. market, as well as those that are  counterfeit or misbranded.  Additionally, the importation of prescription  drugs by individuals for personal use is illegal, but FDA may exercise its  regulatory discretion in determining whether to take enforcement action  against such importation.inspections of products presented for import at the border. CBP interdicts  and turns suspicious prescription drug shipments over to FDA for   CBP coordinates with FDA to conduct  examination, and may seize and destroy certain shipments that are  deemed to be in violation of applicable laws.
ICE is responsible for, among other things, investigating violations of  customs and trade laws, including those related to trafficking in  counterfeit goods. ICE also operates the National Intellectual Property  Rights Coordination Center, the mission of which is to share information  across 17 federal government agencies and four foreign regulatory  agencies, coordinate enforcement actions, and conduct investigations  related to intellectual property theft—including those that occur through  rogue Internet pharmacies.
USPIS helps prevent the illegal importation of prescription drugs by  providing CBP with information about suspicious mail packages entering  the United States. USPIS also investigates issues related to the misuse of  mail.
Other federal agencies are also sometimes involved in investigating  rogue Internet pharmacy activity, to the extent that their jurisdiction  relates to illicit activities conducted by these entities.
The Internal Revenue Service investigates instances of money  laundering, which is the act of disguising or concealing illicit funds to  make them appear legitimate.
The Federal Trade Commission (FTC) may investigate rogue Internet  pharmacies to the extent that their websites make false or misleading  statements about how they collect and use medical information about  consumers, which constitute violations of the Federal Trade  Commission Act. In addition, FTC may investigate potential  violations of the CAN-SPAM Act of 2003, which imposes limitations  and penalties on the transmission of certain unsolicited commercial   e-mail, such as those with misleading information in the line  identifying the person who sent the message.
DOJ’s Federal Bureau of Investigation may investigate rogue Internet  pharmacies if their activities defraud health care benefit programs or  present a clear public health or safety threat.
DOJ prosecutes rogue Internet pharmacies through U.S. Attorneys’  Offices located in 94 federal judicial districts throughout the nation, and  through DOJ’s Civil and Criminal Divisions, located in Washington, DC.  U.S. Attorneys are the chief federal law enforcement officers for each  federal district, and they serve as the nation’s principal litigators under the  direction of the Attorney General, working with officials from appropriate  federal, state, local, and foreign agencies to prosecute rogue Internet  pharmacy cases in their districts. DOJ’s Civil and Criminal Divisions also  prosecute such cases, coordinating closely with U.S. Attorneys,  particularly in cases spanning multiple districts or international borders.  DOJ’s Civil Division has expertise in prosecuting cases involving FDCA  violations, and DOJ’s Criminal Division has expertise in prosecuting  cases related to trafficking in counterfeit goods and offenses such as  money laundering and fraud that are often integral to these criminal  operations, as well as expertise in working with foreign law enforcement  to obtain evidence or secure the extradition of defendants from other  countries.
section_title: State Oversight of Pharmacies
paragraphs: In the United States, prescription drugs must be prescribed and  dispensed by licensed health care professionals, who can help ensure  proper dosing and administration and provide patients with important  information on the drug’s use. To legally dispense a prescription drug, a  pharmacist licensed by the state and working in a pharmacy licensed by  the state must be presented a valid prescription from a licensed health  care professional. In addition, most states require pharmacies located  outside their state to obtain a nonresident pharmacy permit prior to  dispensing prescription drugs to customers located in that state. Some  states regulate Internet pharmacies according to the same standards that  apply to nonresident pharmacies. Others require pharmacies to obtain a  special license in order to dispense prescription drugs ordered online.
The regulation of the practice of pharmacy is rooted in state pharmacy  practice acts and regulations enforced by state boards of pharmacy. The  state boards of pharmacy also are responsible for routinely inspecting  pharmacies, ensuring that pharmacists and pharmacies comply with  applicable state and federal laws, and investigating and disciplining those  that fail to comply.
States also are responsible for regulating the practice of medicine. All  states require that physicians practicing in the state be licensed to do so.  State medical practice laws generally outline standards for the practice of  medicine and delegate the responsibility of regulating physicians to state  medical boards. Each state’s medical board also defines the elements of  a valid patient—provider relationship, and grants prescribing privileges to  physicians and other health care professionals. In addition, state medical  boards investigate complaints and impose sanctions for violations of state  medical practice laws.
Because regulation of the practices of pharmacy and medicine occurs at  the state level, definitions and other requirements related to these  practices differ from state to state. As a result, there is no uniform,  national definition of the term “prescription” that applies to noncontrolled  substances. Thus, certain activities, such as prescribing drugs without  performing an in-person examination, may be explicitly illegal in one state  while another state may not specifically address its legality.
Organizations such as NABP and FSMB have established and promoted  uniform national standards related to Internet pharmacies for the  consideration of state pharmacy and medical boards, as well as for  consumers.
NABP established the Verified Internet Pharmacy Practice Sites  (VIPPS) program to provide a means for the public to identify  legitimate Internet pharmacies. This accreditation program identifies  those online pharmacies that are appropriately licensed, are  legitimately operating via the Internet, and have successfully  completed a review and inspection by NABP.
FSMB has developed model guidelines regarding the appropriate use  of the Internet in medical practice. According to these guidelines,  electronic technology should supplement and enhance, but not  replace, the crucial interpersonal interactions that are the basis of the  physician—patient relationship. These professional standards,  however, are not legally enforceable in the absence of state laws  establishing such requirements.
The Center for Telehealth and e-Health Law (CTeL), an organization  that works to overcome legal and regulatory barriers to telemedicine,  issued guidance in February 2013 regarding how telemedicine, using  two-way audio-video communications, can be used to establish a  bona fide physician—patient relationship when prescribing  noncontrolled substances. Specifically, the guidance notes that an  appropriate examination of the patient by the practitioner must occur  prior to the issuance of a prescription, and that audio-only telephone  conversations and e-mails cannot be used as a basis for establishing  a bona fide practitioner—patient relationship.
section_title: Public Health Risks Associated with Purchasing Prescription Drugs from Rogue Internet Pharmacies
paragraphs: Rogue Internet pharmacies often sell unapproved prescription drugs— including those that are substandard, counterfeit, and have no therapeutic  value or are harmful to consumers. These drugs may be manufactured  under conditions that do not meet FDA standards, including unsanitary  and unsterile conditions. The drugs sold by rogue Internet pharmacies  have been found to contain too much, too little, or no active  pharmaceutical ingredient, or the wrong active ingredient. They have also  been found to contain dangerous contaminants, such as toxic yellow  highway paint, heavy metals, and rat poison.
Consumers who have taken prescription drugs purchased from rogue  Internet pharmacies have experienced health problems, required  emergency treatments, and have died.pharmacies sell prescription drugs without legitimate medical oversight,  consumers may be harmed by ingesting drugs that are contraindicated for  them, or have interactions with other medications that they are taking.  However, adverse events caused by prescription drugs purchased from  rogue Internet pharmacies are difficult to detect and quantify. Consumers  may purchase drugs from rogue Internet pharmacies because of privacy  concerns or to circumvent normal processes for obtaining prescription  drugs. As a result, they may be reluctant to report health problems that  they experience. Further, it can be difficult to determine whether adverse  events are caused by substandard drugs. The role played by drugs from  rogue Internet pharmacies may even go unnoticed. For example, when  consumers take drugs that have no therapeutic value to treat their  diseases, they may not experience adverse events to the drugs  themselves, but they derive no benefit. Persistent symptoms may be  attributed to their diseases, as opposed to ineffective treatments.
section_title: Rogue Internet Pharmacies Violate a Variety of Federal and State Laws
paragraphs: Rogue Internet pharmacies violate a variety of federal and state laws.  Many ship unapproved drugs into the United States and sell drugs to  consumers without a prescription that meets federal and state  requirements. Rogue Internet pharmacies also violate other federal and  state laws, such as those related to fraud and money laundering, in  addition to not complying with industry standards.
subsections: section_title: Most Rogue Internet Pharmacies Operate from Abroad, and Many Illegally Ship Unapproved Drugs into the United States and Sell Drugs without Requiring Valid Prescriptions
paragraphs: Although the exact number of rogue Internet pharmacies is unknown,  most operate from abroad. According to LegitScript, an online pharmacy  verification service that applies NABP standards to assess the legitimacy  of Internet pharmacies, there were over 34,000 active rogue Internet  pharmacies as of April 2013. Federal officials and other stakeholders we  interviewed consistently told us that most rogue Internet pharmacies  operate from abroad, and many have shipped drugs into the United  States that are not approved by FDA. In doing so, they violate FDCA  provisions that require FDA approval prior to marketing prescription drugs  to U.S. consumers, as well as customs laws that prohibit the unlawful  importation of goods, including unapproved drugs. The prescription  drugs that rogue Internet pharmacies sell have included counterfeit,  misbranded, and adulterated drugs. Certain rogue Internet pharmacies  have also sold dietary supplements that contain prescription drug  ingredients, in violation of the FDCA. In addition, some, particularly those  abroad, have sold controlled substances to customers located in the  United States. As no Internet pharmacies have been approved by DEA  to dispense controlled substances to customers in the United States as of  May 3, 2013, doing so violates the CSA.
Example of a Foreign Rogue Internet  Pharmacy Indicted for Illegally Selling  Drugs to U.S. Customers  In 2012, two operators of a rogue Internet  pharmacy based abroad were indicted for  allegedly shipping unapproved prescription  drugs into the United States, in violation of the  FDCA. The shipments allegedly included  controlled substances, and the pharmacy  owners were also charged with importing  controlled substances without authorization, in  violation of the CSA. According to DOJ’s  indictment, some of the imported drugs were  misbranded because the packages did not  include adequate directions for the drugs,  some of the drugs offered for sale were listed  under a different name, and the company  fulfilled orders without ensuring that  customers had a prescription. The indictment  also noted that the operators packaged drug  shipments to evade scrutiny by customs  officials. For example, drugs were allegedly  wrapped with carbon paper and black plastic  bags, and packages included false return  addresses.
To sell drugs to their U.S. customers, foreign rogue Internet pharmacies  use sophisticated methods to evade scrutiny by customs officials and  smuggle their drugs into the country. For example, they have used  intermediary shippers to help disguise the actual source of their  shipments, which, according to CBP officials, may increase the likelihood  that the shipments get through customs unnoticed. FDA and ICE officials  told us that rogue Internet pharmacies have also misdeclared the  contents of packages sent via express courier services or cargo  shipments, in violation of customs laws. Federal agencies use  importation declarations to identify potentially illicit shipments for further  examination; as such, misdeclaring the contents of such packages can  result in illicit shipments evading additional scrutiny at the border. Further,  rogue Internet pharmacies have disguised or hidden their drugs in various  types of packaging; for example, CBP has found drugs in bottles of lotion  and in tubes of toothpaste.
Example of a Licensed Brick-and-Mortar  Pharmacy Selling Misbranded Drugs In 2011 and 2012, the owners of a U.S.-based  brick-and-mortar pharmacy were convicted of  several charges related to selling misbranded  prescription drugs for rogue Internet  pharmacies. The pharmacy was paid by  multiple foreign rogue Internet pharmacies to  fill prescriptions that did not meet state  medical board requirements for a valid  prescription and were sold and distributed in  violation of the CSA. The rogue Internet  pharmacies paid doctors, or in some cases,  lay persons, to review brief online medical  questionnaires and authorize the orders. The  pharmacy filled orders for drugs, including  controlled substances, and shipped them to  customers who were usually located in a  different state than the pharmacy. Because  the drugs were sold without a valid  prescription, they were considered  misbranded, in violation of the FDCA.
Rogue Internet pharmacies also often sell drugs to consumers without a  prescription, in violation of FDCA and state requirements, or with a  prescription that does not satisfy FDCA and state requirements.  According to federal officials, they have done this by advertising that no  prescription is necessary or by allowing consumers to purchase drugs  after completing a brief online questionnaire that does not meet their  state’s requirements for a valid prescription. In some cases, rogue  Internet pharmacies have ignored information from these questionnaires  and have allowed consumers to make a purchase, regardless of the  information disclosed. These actions violate the FDCA requirement that  certain drugs be dispensed only with a prescription that is written by a  licensed practitioner. In addition, some rogue Internet pharmacies  operating from abroad have recruited doctors and pharmacies based and  licensed in the United States to fulfill online prescription drug orders in  exchange for payment, according to officials from federal agencies and  stakeholders. Often, they have targeted doctors and pharmacies that are  struggling financially, and have compensated them according to the  number of prescriptions they authorize and fill, respectively. In these  circumstances, the doctors violate state laws or medical board regulations  as well as industry standards, such as those issued by FSMB and CTeL,  which require valid patient—provider relationships prior to the issuance of  a prescription. Likewise, the pharmacists violate state laws or pharmacy  board regulations by selling drugs without ensuring that there is a  prescription that meets state requirements. Drugs sold in this manner are  considered misbranded, and are subject to enforcement under the FDCA.
section_title: Rogue Internet Pharmacies Violate a Variety of Other Federal and State Laws and Industry Standards
paragraphs: Rogue Internet pharmacies violate a variety of federal laws, including  those related to fraud, money laundering, and intellectual property rights,  according to officials from several federal agencies and stakeholders we  interviewed. For example, rogue Internet pharmacies have engaged in  mail fraud by using the mail to facilitate their illegal transactions. In  addition, some rogue Internet pharmacies have engaged in money  laundering.Internet pharmacies, operators have created a shell—or fake—company   Specifically, to use the proceeds generated from rogue  to disguise the nature of their business, or have misstated the nature of  their business to banks that process their credit card transactions,  according to stakeholders we interviewed. To appear more legitimate to  their consumers, rogue Internet pharmacies have also violated intellectual  property laws by fraudulently displaying trademarks on their websites. For  example, rogue Internet pharmacies have fraudulently displayed the  VIPPS accreditation logo as well as the logos for payment processors  such as Visa, MasterCard, or PayPal, without having obtained  permission. Rogue Internet pharmacies have violated a range of other  federal laws, such as those related to making false or misleading  statements, as well as by engaging in other deceptive and unfair acts or  practices. For example, rogue Internet pharmacies have violated the  CAN-SPAM Act by sending e-mails that list false information in the  subject line or otherwise hide the message’s origin.
Rogue Internet pharmacies also violate state laws, including those related  to operating without an appropriate license. Rogue Internet pharmacies  have violated state laws by not obtaining pharmacy licenses from the  states where their customers reside. In addition, licensed brick-and- mortar pharmacies recruited to fulfill prescription drug orders for rogue  Internet pharmacies have violated state laws when they perform activities  not authorized under their license or when they ship drugs to out-of-state  customers. According to officials from state boards of pharmacy we  interviewed, brick-and-mortar pharmacies have fulfilled online prescription  drug orders, including to residents of another state without obtaining a  nonresident pharmacy license in the state where those customers reside  or without ensuring the prescriptions are valid. When fulfilling such orders for out-of-state customers, brick-and-mortar pharmacies have also  violated valid prescription requirements of the state where their customers  live. For example, the California Board of Pharmacy identified an Internet  pharmacy based in Utah that was violating California pharmacy laws,  which require that prescription drugs be dispensed through the Internet  only with a prescription issued after a good-faith medical examination  from a physician licensed in the state. According to the California Board  of Pharmacy, the Utah pharmacy was selling prescription drugs to  Californians based on prescriptions that it knew or should have known  were not based on good-faith medical exams and were written by  physicians who were not licensed in California, in violation of California  law. However, according to Utah Board of Pharmacy officials, the  pharmacy was complying with Utah’s laws, which allow certain licensed  Internet pharmacies to dispense specified types of prescription drugs— such as certain erectile dysfunction drugs and hormone-based  contraception—solely on the basis of an online questionnaire.
Rogue Internet pharmacies do not comply with industry standards for  legitimate Internet pharmacies. For example, officials from federal  agencies and stakeholders told us that rogue Internet pharmacies have  not provided accurate or complete information to domain name registrars  when registering a website and have not adequately protected customer  privacy. In addition, rogue Internet pharmacies have not displayed  identifying information on their website, such as a business address and  telephone number.
section_title: The Complex and Global Nature of Rogue Internet Pharmacies Poses Substantial Challenges for Federal Investigators and Prosecutors
paragraphs: Rogue Internet pharmacies are often complex, global operations, and as  a result, federal agencies face substantial challenges investigating and  prosecuting their operators. Officials from federal agencies and  stakeholders we interviewed told us that piecing together these  operations can be difficult because rogue Internet pharmacies can be  composed of thousands of related websites. Although a small number of  individuals own the majority of rogue Internet pharmacies operating  across the world, they may contract with hundreds or thousands of  individuals to set up, run, and advertise their websites—primarily by  sending out unsolicited spam e-mails. The ease with which operators  can set up and take down websites also makes it difficult for agencies to  identify, track, and monitor rogue websites and their activities, as  websites can be created, modified, and deleted in a matter of minutes.
Additionally, rogue Internet pharmacies frequently locate different  components of their operations in different countries, further complicating  efforts to unravel the entirety of a rogue Internet pharmacy operation. For  example, one rogue Internet pharmacy registered its domain name in  Russia, used website servers located in China and Brazil, processed  payments through a bank in Azerbaijan, and shipped its prescription  drugs from India. (See fig. 1.)
section_title: Federal Agencies, States, and Stakeholders Have Taken a Variety of Steps to Combat Rogue Internet Pharmacies
paragraphs: Federal agencies, states, and stakeholders have investigated and  prosecuted operators, prevented illicit shipments of pharmaceuticals from  entering the United States, and blocked rogue Internet pharmacies’ ability  to market and sell their products.
subsections: section_title: Federal Agencies Have Investigated and Prosecuted Rogue Internet Pharmacy Operators and Prevented Some Illegal Shipments
paragraphs: Despite facing substantial challenges, several federal agencies— including FDA, ICE, and USPIS—have investigated and prosecuted  rogue Internet pharmacy operators that have violated federal laws. (See  fig. 2 for a screenshot of a rogue Internet pharmacy that FDA recently  investigated, which led to a conviction in 2011.) Agencies have  investigated rogue Internet pharmacies independently and conducted  collaborative investigations with other federal agencies through ICE’s  National Intellectual Property Rights Coordination Center. In certain  instances, agencies have collaborated with international law enforcement  agencies. Agency investigations have resulted in the conviction of  operators, fines, and asset seizures. Specifically, according to agency  officials, from fiscal years 2010 through 2012,
FDA opened 227 rogue Internet pharmacy investigations and its  investigations led to the conviction of 219 individuals and more than  $76 million in fines and restitution;  ICE initiated 138 investigations and its investigations led to 56  convictions and the seizure of nearly $7 million;
USPIS worked on 392 investigations and arrested 560 individuals;  IRS conducted 22 investigations and its investigations led to the  conviction of 5 individuals; and
DEA conducted 49 investigations into rogue Internet pharmacies and  seized more than $1 million.
In addition to investigating rogue Internet pharmacy operators, federal  agencies have investigated companies for providing services to rogue  Internet pharmacies. In 2011, a DOJ and FDA investigation led to a  settlement under which Google agreed to forfeit $500 million for allowing  certain rogue Internet pharmacies to place sponsored advertisements in  its search engine results from calendar years 2003 through 2009. In  March 2013, a DOJ investigation led to a settlement under which UPS  agreed to forfeit $40 million for transporting and distributing prescription  drugs, including controlled substances, from certain rogue Internet  pharmacies to U.S. consumers from calendar years 2003 through 2010.
As part of their settlements with DOJ, both companies noted that they will  stop serving rogue Internet pharmacies and create compliance programs  to identify rogue actors, in exchange for not being prosecuted by the U.S.  government for crimes related to this activity. In addition, according to  FedEx documents, DOJ is investigating the company for potentially  violating federal law by shipping prescription drugs from Internet  pharmacies.
Federal agencies have also taken steps to shut down rogue Internet  pharmacy websites. For example, FDA and other federal agencies have  participated in Operation Pangea, an annual worldwide, week-long  initiative in which regulatory and law enforcement agencies from around  the world work together to combat rogue Internet pharmacies. In 2013,  FDA took action against 1,677 rogue Internet pharmacy websites during  Operation Pangea. In 2012, as part of the Operation, FDA informed  domain name registrars that over 4,100 rogue Internet pharmacy  websites were illegally selling prescription drugs online, in violation of the  registrars’ terms of service with their customers. The agency informed the registrars of these violations in order to encourage them to shut down  these violative websites. FDA officials told us that the effect of such  shutdowns is primarily disruptive since rogue Internet pharmacies often  reopen after their websites get shut down; officials from federal agencies  and stakeholders we spoke with likened shutting down websites to taking  a “whack-a-mole” approach. One stakeholder noted that rogue Internet  pharmacies own and keep domain names in reserve so that they can  redirect traffic to new websites and maintain operations if any of their  websites get shut down. Rogue Internet pharmacies may also find new  registrars to host their websites—figure 3 provides an example of a rogue  Internet pharmacy website that was shut down during Pangea but that  continued operations by switching to another domain name registrar. FDA  has also issued warning letters to rogue Internet pharmacies to notify  them that they are engaged in potentially illegal activity and direct them to  cease their illegal activity. From calendar years 2009 through 2012,  FDA reported issuing about 30 warning letters to rogue Internet  pharmacies. According to FDA officials, rogue Internet pharmacies often  ignore the letters and continue with their illicit activity. However, in some  cases, FDA’s warning letters have led to the removal of potentially  dangerous products from certain websites. FDA officials told us that  they remain committed to combating rogue Internet pharmacies and in  April 2013 they formed a new Cyber Crimes Investigation Unit that is  devoted to this cause.
Federal agencies responsible for preventing illegal prescription drug  imports have also interdicted rogue Internet pharmacy shipments. CBP  coordinates with FDA to inspect and seize illicit mail, express courier, and  cargo shipments of prescription drugs presented for import at the border  on a daily basis. CBP also leads Operation Safeguard, a multiagency  initiative to target illicit imports of prescription drugs. Once a month, CBP,  along with FDA and ICE, targets a specific international mail or express  courier facility and, according to agency officials, conducts extensive  examinations and seizures of illicit prescription drug shipments for 3 days.  In total, from fiscal years 2010 through 2012, FDA reported examining  nearly 45,000 shipments and CBP reported seizing more than 14,000  illicit shipments of prescription drugs, with mail shipments constituting the  majority of the shipments that were seized. In addition to seizures of  shipments presented for import, according to USPIS, the agency seized  more than 800 illicit shipments of controlled substances in the domestic  mail system during fiscal year 2012. Despite these efforts, FDA officials  told us that the sheer volume of inbound international mail shipments— which total nearly 1.2 million pieces every day, according to USPIS— makes it difficult to interdict all illicit prescription drug imports.
Other federal agencies have also taken steps to combat rogue Internet  pharmacies by sponsoring research and engaging stakeholders. The  National Science Foundation has provided grants to researchers who  have examined rogue Internet pharmacy operations and developed  strategies for combating them. For example, researchers found that rogue  Internet pharmacies may be vulnerable to efforts to limit their ability to  process online payments.companies to encourage them to limit services to rogue Internet  pharmacies.
According to DEA officials, illicit pain clinics—brick-and-mortar operations where  customers can obtain prescriptions for controlled substances without a legitimate medical  need—have since emerged as the primary source of controlled substance diversion. agency’s conclusion that domestic and foreign rogue Internet pharmacies  are generally not selling controlled substances. Furthermore, agency  officials told us that they do not track data that could demonstrate a  reduction in the sale of controlled substances online because they told us  there is no reason to do so. DEA officials explained their rationale by  saying that the agency does not collect data on threats that do not exist.  However, DEA’s 2011 assessment of Internet pharmacies that advertised  the sale of controlled substances revealed that 40 percent were selling  such substances. DEA has not gathered additional data to demonstrate  the extent to which controlled substances are being diverted over the  Internet.
section_title: States Face Challenges Combating Rogue Internet Pharmacies, and Have Focused on Regulating the Activities of Licensed Pharmacies
paragraphs: States face challenges investigating rogue Internet pharmacies and have  played a limited role in combating them. Given that most rogue Internet  pharmacies operate from abroad, stakeholders including NABP, National  Alliance for Model State Drug Laws, and National Association of  Attorneys General, as well as officials from several state attorneys  general offices told us that states do not have the authority, ability, or  resources to investigate and prosecute them. These stakeholders told us  that, as a result, states generally have not investigated rogue Internet  pharmacies for violating their laws. In addition, officials from the five state  boards of pharmacy we interviewed also told us that they do not  proactively investigate unlicensed pharmacy activity, and most of the  boards view the enforcement of unlicensed pharmacy activity as the  responsibility of state law enforcement agencies, rather than themselves.  Accordingly, they have not actively sought to identify or investigate rogue  Internet pharmacies—either in-state or out-of-state—that sell prescription  drugs to customers within their state, though they may look into rogue  Internet pharmacies if they received complaints. Further, board officials  told us that they face challenges enforcing laws outside of their own  states. When rogue Internet pharmacies located in other states violate  their state laws, board officials contact officials of state boards where the  pharmacies are located, and it is then the responsibility of the contacted  boards to take any appropriate investigative or enforcement actions. The  boards may also send cease-and-desist letters or attempt to fine out-of- state pharmacies that violate their states’ laws. However, the boards have  no ability to ensure compliance with enforcement actions against  pharmacies outside of their state that are not licensed in their state.
State boards of pharmacy focus on regulating licensed brick-and-mortar  pharmacies located within their state. In regulating licensed pharmacies,  officials from each of the five states told us that they have taken  enforcement actions against licensed pharmacies in their states for  fulfilling orders on behalf of rogue Internet pharmacies or illicitly selling  prescription drugs over the Internet. For example, in 2010, the Nevada  Board of Pharmacy revoked the license of a pharmacist for illegally  shipping controlled substances to an out-of-state customer who placed an  order through a rogue Internet pharmacy. In addition to actions taken by  state pharmacy boards, state medical boards have also taken  enforcement actions against physicians involved in illicitly writing  prescriptions for rogue Internet pharmacies, according to FSMB  officials.
section_title: Stakeholders Have Blocked Services to Known Rogue Internet Pharmacies and Routinely Share Information with Federal Agencies
paragraphs: Stakeholders that provide services to Internet-based businesses have  blocked rogue Internet pharmacies’ ability to market and sell their  products. These stakeholders have taken such actions on the basis of  information that they learn about and share through various associations.
CSIP has helped member companies that provide services to Internet  businesses—such as Internet registrars, search engines, and  payment processors—share information about rogue Internet  pharmacies, and encourages its members to block services to them.CSIP contracts with a third-party company that proactively searches  the Internet to identify rogue Internet pharmacies and disseminates  this information to its members. In addition, CSIP gathers information  about rogue Internet pharmacies from member companies, as well as  from other outside sources such as federal agencies. According to  CSIP, from November 1, 2011, through December 1, 2012, its  members took more than 3 million actions against rogue Internet  pharmacies. For example, Internet registrars shut down rogue Internet  pharmacy websites, search engines prevented them from placing  advertisements, and credit card companies prevented payments from  being processed.
IACC has also taken action to combat rogue Internet pharmacies by,  among other things, working with credit card companies to discourage  banks from processing payments for rogue Internet pharmacies.
IACC officials told us that they collect information on websites that  market counterfeit and otherwise illegal products from trademark and  copyright holders, including four brand-name prescription drug  manufacturers. IACC then provides this information to credit card  companies so that they can take action against banks that process  payments for these rogue Internet pharmacies. (See fig. 4.) Under  their terms of service, credit card companies can fine or take other  enforcement actions against banks that process payments for  merchants involved in illegal activities.
In addition to private efforts to block services to rogue Internet  pharmacies, drug manufacturers maintain surveillance programs to  identify and investigate the marketing of counterfeit versions of their  brand-name prescription drugs and share their findings with federal  agencies. In doing so, they monitor web activity to identify rogue Internet  pharmacies, and employ investigators to gather evidence against rogue  operators. On the basis of their investigations, these manufacturers  provide federal agencies, such as ICE and FDA, with investigative leads  and information that may support existing investigations. In addition,  manufacturers have also provided CBP with information to better target  illicit drug imports and with brochures to help CBP officials differentiate  between legitimate and counterfeit prescription drugs.
Several stakeholders also help facilitate information sharing between drug  manufacturers and federal agencies on rogue Internet pharmacies. The  Pharmaceutical Security Institute, an association of 26 drug  manufacturers focused on sharing information related to counterfeit  prescription drugs, collects and analyzes surveillance information from its  members and, according to an official from the institute, helps them share  information with federal agencies about the illicit marketing of counterfeit  prescription drugs by rogue Internet pharmacies. The National Cyber- Forensics & Training Alliance—an organization that facilitates public- private information sharing on cybercrime—also works with drug  manufacturers to share information with federal agencies. Officials said  that the alliance collects information from the manufacturers and performs  additional intelligence gathering to provide agencies with actionable  investigative leads, such as the identities and locations of operators.
section_title: FDA and Stakeholders Have Taken Steps to Educate Consumers about the Risks of Purchasing Prescription Drugs from Internet Pharmacies, but Challenges Remain
paragraphs: FDA and stakeholders have taken steps to educate consumers about the  dangers of buying prescription drugs from rogue Internet pharmacies and  how to identify legitimate ones; however, these efforts face challenges. In  September 2012, FDA launched a national campaign called “BeSafeRx:  Know Your Online Pharmacy” to raise public awareness and educate  consumers about the risks associated with purchasing prescription drugs  on the Internet. The campaign provides information about the dangers of  purchasing drugs from rogue Internet pharmacies, how to identify the  signs of rogue Internet pharmacies, as well as how to find safe Internet  pharmacies. FDA officials told us that the agency plans to direct the same  messages to health care professionals and assess the campaign’s  effectiveness in the future.
Some federal agencies and stakeholders have also taken steps to  educate consumers about the risks of purchasing prescription drugs  online and provide tools to help consumers identify legitimate and rogue  Internet pharmacies. For example, CBP, DEA, and FTC post information  on their websites regarding the dangers of purchasing drugs online.
NABP publicly releases the results of its review of Internet pharmacies  quarterly, which most recently showed that 97 percent of the over 10,000  Internet pharmacies that it reviewed were out of compliance with federal  or state laws or industry standards. NABP also warns consumers not to  buy from websites that are on its publicly available list of rogue Internet  pharmacies, and posts information on its website to educate consumers  about how to safely buy medicine online. The association directs  consumers to purchase medicines from legitimate Internet pharmacies  that it has accredited through its VIPPS program; as of May 1, 2013,  NABP’s website listed 32 VIPPS-accredited Internet pharmacies. To  assist consumers in more readily identifying legitimate online pharmacies,  NABP also plans to launch a new top-level domain name called  .pharmacy by the end of 2013. The association intends to grant this  domain name to appropriately licensed, legitimate Internet pharmacies  operating in compliance with regulatory standards—including pharmacy  licensure, drug authenticity, and prescription requirements—in every  jurisdiction that the pharmacy does business.
LegitScript also helps consumers to differentiate between legitimate and  rogue Internet pharmacies. It regularly scans the Internet and, using  NABP’s standards, classifies Internet pharmacies into one of four  categories: (1) legitimate, (2) not recommended, (3) rogue, or (4) pending  review. When visiting their publicly available website, consumers can  enter the website address of any Internet pharmacy and immediately find   As of May 1, 2013, LegitScript had classified  LegitScript’s classification.259 Internet pharmacies as legitimate and therefore safe for U.S.  consumers, on the basis of NABP standards.
Despite the actions of agencies and stakeholders, consumer education  efforts face many challenges. Many rogue Internet pharmacies use  sophisticated marketing methods to appear professional and legitimate,  making it challenging for even well-informed consumers and health care  professionals to differentiate between legal and illegal Internet  pharmacies. For example, some rogue Internet pharmacies advertise that  customers need a prescription in order to purchase drugs, but allow  customers to meet this requirement by completing an online  questionnaire at the time of sale. Other Internet pharmacies may  fraudulently display a VIPPS-accreditation logo on their website, despite  not having earned the accreditation, or may fraudulently display Visa,  MasterCard, PayPal, or other logos on their website despite not holding  active accounts with these companies or being able to process such  payments. Figure 5 displays a screenshot of a rogue Internet pharmacy  website that may appear to be legitimate to consumers, but whose  operators pled guilty to multiple federal offenses, including smuggling  counterfeit and misbranded drugs into the United States.
Some rogue Internet pharmacies seek to assure consumers of the safety  of their drugs by purporting to be “Canadian.” Canadian pharmacies have  come to be perceived as a safe and economical alternative to pharmacies  in the United States. Over the last 10 years, several local governments  and consumer organizations have organized bus trips to Canada so that  U.S. residents can purchase prescription drugs at Canadian brick-and- mortar pharmacies at prices lower than those in the United States. More  recently, some state and local governments implemented programs that  provided residents or employees and retirees with access to prescription  drugs from Canadian Internet pharmacies. Despite FDA warnings to  consumers that the agency could not ensure the safety of drugs not  approved for sale in the United States that are purchased from other  countries, the prevalence of such programs may have contributed to a  perception among U.S. consumers that they can readily save money and  obtain safe prescription drugs by purchasing them from Canada. Many  rogue Internet pharmacies seek to take advantage of this perception by  purporting to be located in Canada, or sell drugs manufactured or  approved for sale in Canada, when they are actually located elsewhere or  selling drugs sourced from other countries.
Educational efforts also need to overcome issues related to consumer  demand for these drugs. Many consumers mistakenly believe that if a  drug may be prescribed for medical use, it is safe to consume regardless   In addition,  of whether they have a prescription for that particular drug.other pressures, including consumers’ desire to self-medicate, their wish  for privacy related to obtaining lifestyle medications (such as drugs for  sexual dysfunction), and relatively high out-of-pocket costs for brand- name drugs may fuel a demand among consumers to purchase  prescription drugs from rogue Internet pharmacies. While educational  efforts attempt to overcome these challenges, their success thus far is  unknown—in part, because the volume of drugs purchased from rogue  Internet pharmacies is unknown, making it difficult to assess whether  educational efforts have been effective at reducing such purchases.
section_title: Agency Comments
paragraphs: We provided a draft of this report for comment to HHS, DOJ, and DHS,  and we provided excerpts of this report for comment to USPIS and NSF.  We received technical comments from HHS, DOJ, and DHS, which we  incorporated as appropriate.
We are sending copies of this report to the Department of Commerce, the  Department of Health and Human Services, the Department of Homeland  Security, the Department of Justice, the Department of State, the Federal  Trade Commission, the Internal Revenue Service, the National Science  Foundation, the Office of Management and Budget, and the United States  Postal Inspection Service, as well as other interested parties. In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or crossem@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Other key contributors to this report are listed  in appendix III.
section_title: Appendix I: List of Organizations Interviewed
subsections: section_title: Federal Agencies
section_title: Selected State Boards of Pharmacy and Offices of Attorneys General
section_title: Stakeholder Groups
paragraphs: 2.  Alliance for Safe Online Pharmacies  3.  American Medical Association  5.  Center for Safe Internet Pharmacies  6.  Center for Telehealth and e-Health Law  7.  Eli Lilly and Company  8.  Federation of State Medical Boards  10. Generic Pharmaceutical Association  12. Google Inc.  14. Internet Crime Complaint Center  16. MasterCard International, Incorporated  17. Merck & Co., Inc.  19. National Alliance for Model State Drug Laws  20. National Association of Attorneys General  21. National Association of Boards of Pharmacy  22. National Association of Chain Drug Stores  23. National Community Pharmacists Association  24. National Cyber-Forensics & Training Alliance  25. National Science Foundation grant recipient Damon McCoy, Assistant    Professor, George Mason University Computer Science Department  26. Partnership for Safe Medicines  29. Pharmaceutical Security Institute  30. Pharmaceutical Research and Manufacturers of America  31. Purdue Pharma L.P.  32. Takeda Pharmaceuticals U.S.A., Inc.  34. Visa, Inc.  35. WellPoint, Inc.
section_title: Appendix II: Summary of Recent Proposals to Combat Rogue Internet Pharmacies
paragraphs: Members of Congress have sponsored bills and other stakeholders have  endorsed proposals to enhance regulators’ ability to both combat rogue  Internet pharmacies and enhance the public’s ability to distinguish rogue  Internet pharmacies from legitimate ones. This appendix provides a brief  synopsis of federal legislation introduced in the 112th Congress, which  ran from January 2011 to January 2013, and the 113th Congress, from  January 2013 through June 2013, as well as proposals from stakeholders  we interviewed. While some stakeholders broadly supported these  proposals, others noted that because most rogue Internet pharmacies are  operated from overseas, additional federal laws and authorities, such as  those noted below, would have a limited effect on their ability to combat  rogue Internet pharmacies.
Creating a Federal Definition of a Valid Prescription. Some Members of  Congress and other stakeholders have proposed creating a federal  definition of a valid prescription that applies to all prescription drugs.  Currently, the only federal definition of a valid prescription applies solely  to prescriptions for controlled substances. Although the Federal Food,  Drug, and Cosmetic Act (FDCA) requires certain drugs to be dispensed  upon a prescription of a licensed practitioner, it does not define how this  requirement is to be met. Instead, each state’s pharmacy and medical  practice acts define what constitutes a valid prescription. As such, when  federal prosecutors pursue charges against operators of rogue Internet  pharmacies that sell drugs without prescriptions that meet the FDCA’s  prescription requirement, they must research the laws of each relevant  state to determine which ones apply to their case.
Proponents of a federal definition contend that such a definition would  make it easier and less resource-intensive for federal and state  investigators and prosecutors to gather evidence and build a case against  rogue Internet pharmacy operators who sell drugs without valid  prescriptions. Some contend, however, that such a definition would be of  limited value. They note that, because rogue Internet pharmacy  operations have increasingly moved components of their business  abroad, they are beyond the boundaries of where such a law could be  readily enforced. Additionally, those interested in promoting telemedicine  have raised concerns that these proposals have too narrowly defined the  circumstances for which prescriptions could be issued on the basis of  legitimate medical examinations conducted via telemedicine.
Developing a Comprehensive List of Legitimate Internet Pharmacies.  Members of Congress have introduced legislation that would have  required the establishment of a comprehensive list of legitimate Internet  pharmacies. Other stakeholders, such as the Alliance for Safe Online  Pharmacies, have also supported this proposal. Members of Congress  and stakeholders have proposed that the Food and Drug Administration  (FDA) would be responsible for establishing and maintaining the list.
Proponents of a comprehensive list contend that it would help consumers,  stakeholders, and federal and state agencies distinguish between  legitimate and rogue Internet pharmacies. Although the National  Association of Boards of Pharmacy (NABP) and LegitScript have tools on  their websites that enable consumers to identify legitimate Internet  pharmacies, some maintain that FDA management of the list is critical,  and could help to inspire public confidence in the list. Others stated that a  list created by a third party would be helpful, as long as it is endorsed by  the FDA. However, FDA officials and other stakeholders have raised  concerns about the agency’s ability to maintain such a list, given the large  volume of new Internet pharmacies launched and modified every day.  Additionally, FDA does not regulate the practice of pharmacy, which has  long been regulated by the states. Finally, according to officials we  interviewed from two stakeholders that provide services to Internet  businesses, such a list is not necessary as their companies’ policies and  procedures allow them to immediately suspend customer accounts once  they become aware that such customers are violating their policies and  procedures.
Establishing a Safe Harbor for Companies That Provide Services to  Internet-Based Businesses. Members of Congress have introduced  legislation to provide legal immunity to companies—such as Internet  registrars, search engines, and credit card processors—that ceased or  refused to provide services to rogue Internet pharmacies when acting in  good faith. Proponents state that protection from liability would  encourage companies to block services to rogue Internet pharmacies. In  addition, some told us that such immunity would allow them to more  readily take action against suspected rogue Internet pharmacies.  However, others doubted the necessity of such legislation. Officials from  two companies we interviewed explained that their companies already  have the right to refuse service to rogue Internet pharmacies and do not  open themselves up to liability by doing so.
Granting FDA New Subpoena and Seizure Authorities. Members of  Congress have introduced legislation to grant new subpoena and seizure  authorities to FDA. Agency officials stated the authorities would enable  them to more rapidly investigate and take action against rogue Internet  pharmacies.have enabled FDA to compel the attendance and testimony of witnesses  and the production of records and other items for the purposes of any  hearing, investigation, or other proceeding related to a suspected FDCA  violation. Further, seizure authority proposed under this legislation would  have provided FDA with the authority to take noncompliant drugs out of  the supply chain. At present, FDA must obtain approval from the  Department of Justice (DOJ) in order to issue a subpoena or to seize  goods. According to FDA officials, the DOJ approval process can delay  investigations and enforcement actions. Such delays may lead to the   Subpoena authority proposed under this legislation would  distribution of noncompliant drugs further into the supply chain and may  make such products more difficult to locate and seize.
Adopting a Track-and-Trace System for Prescription Drug Supply Chain.  Members of Congress have introduced, and stakeholders such as the  Intellectual Property Enforcement Coordinator have supported, legislation  that would require FDA to implement a system to track, trace, and verify  prescription drugs throughout the drug supply chain. In 2007, Congress  required FDA to develop standards that would apply to such a system, as  well as to develop a standardized numerical identifier that could be  applied to prescription drugs during manufacturing and repackaging. In  response, FDA issued guidance for industry, and hosted a public  workshop on the topic. However, a nationwide track-and-trace system  has not yet been implemented. Supporters of a nationwide track-and- trace system contend that it would enable federal agencies to more  readily identify counterfeit or adulterated prescription drugs, as well as  reduce the potential for counterfeit drugs to enter the supply chain,  including through Internet pharmacies. FDA officials told us that while a  track-and-trace system would benefit multiple stakeholders, it would likely  not directly affect the operations of rogue Internet pharmacies because  such enterprises sell counterfeit and adulterated drugs directly to  consumers, which is not a distribution method that would be covered by a  track-and-trace system.
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Marcia Crosse, (202) 512-7114, crossem@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Geri Redican-Bigott, Assistant  Director; Michael Erhardt; Cathleen Hamann; Jason Kelly; Lisa Motley;  Patricia Roy; and Lillian Shields made key contributions to this report.
section_title: Related GAO Products
paragraphs: Prescription Drug Control: DEA Has Enhanced Efforts to Combat  Diversion, but Could Better Assess and Report Program Results.   GAO-11-744. Washington, D.C.: August 26, 2011.
Intellectual Property: Observations on Efforts to Quantify the Economic  Effects of Counterfeit and Pirated Goods. GAO-10-423. Washington,  D.C.: April 12, 2010.
Cybercrime: Public and Private Entities Face Challenges in Addressing  Cyber Threats. GAO-07-705. Washington, D.C.: June 22, 2007.
Intellectual Property: Better Data Analysis and Integration Could Help  U.S. Customs and Border Protection Improve Border Enforcement  Efforts. GAO-07-735. Washington, D.C.: April 26, 2007.
Internet Management: Prevalence of False Contact Information for  Registered Domain Names. GAO-06-165. Washington, D.C.:   November 4, 2005.
Anabolic Steroids Are Easily Purchased Without a Prescription and  Present Significant Challenges to Law Enforcement Officials.   GAO-06-243R. Washington, D.C.: November 3, 2005.
Prescription Drugs: Strategic Framework Would Promote Accountability  and Enhance Efforts to Enforce the Prohibitions on Personal Importation.  GAO-05-372. Washington, D.C.: September 8, 2005.
Internet Pharmacies: Some Pose Safety Risks for Consumers.   GAO-04-820. Washington, D.C.: June 17, 2004.
Internet Pharmacies: Adding Disclosure Requirements Would Aid State  and Federal Oversight. GAO-01-69. Washington, D.C.: October 19, 2000.