Electronic Prescriptions for Controlled Substances
2010-06-02 2020-06-04 2020-06-10 2020-06-22 2020-06-22 2020-06-22 2020-04-29 2020-04-27 2020-05-04
DEA-2010-0010-0057 DEA-2010-0010-0117 DEA-2010-0010-0122 DEA-2010-0010-0146 DEA-2010-0010-0147 DEA-2010-0010-0134 DEA-2010-0010-0106 DEA-2010-0010-0105 DEA-2010-0010-0107
04:00:00 04:00:00 04:00:00 04:00:00 04:00:00 04:00:00 04:00:00 04:00:00 04:00:00
https://api.regulations.gov/v4/comments/DEA-2010-0010-0057 https://api.regulations.gov/v4/comments/DEA-2010-0010-0117 https://api.regulations.gov/v4/comments/DEA-2010-0010-0122 https://api.regulations.gov/v4/comments/DEA-2010-0010-0146 https://api.regulations.gov/v4/comments/DEA-2010-0010-0147 https://api.regulations.gov/v4/comments/DEA-2010-0010-0134 https://api.regulations.gov/v4/comments/DEA-2010-0010-0106 https://api.regulations.gov/v4/comments/DEA-2010-0010-0105 https://api.regulations.gov/v4/comments/DEA-2010-0010-0107
Anonymous Naomi Troy Anonymous Anonymous Ken Anonymous Chris Carissa
Anonymous Turner Sims Anonymous Anonymous Whittemore Anonymous Turnbull-solis Russo
For comments or questions, please contact Beki Marshall. RIN 1117-AA61/Docket No. DEA-218I 1. The knowledge-based form of the two-factor test is an archaic method of security. For instance, in 2018 the Hawaii emergency agency responsible for a missile scare had their password leaked because it was written on a post-it note on the monitor, and a photo of the monitor circulated the internet. Passwords are a faulty method that invites human error too frequently. An alternative to this form is a call system, where a physician can log-in to the system by dialing a number and a receiver authorizes the first factor of the log-in. 2. Remotely identity proofing to ensure service to rural areas sacrifices security. A major argument for Electronic Prescriptions is efficiency. In rural areas, where the doctor to patient ratio is more manageable than urban areas, the need for efficiency is minuscule. 3. Viewing a drivers license via video for remote identity proofing is not a secure method. Video and photos can be manipulated far too easily with current technology. 4. The record of the changes in the internal audit trail should be compressed to save storage space. 5. A practitioners access must be revoked also if it is discovered the practitioner accesses the system irregularly, using an algorithm that flags irregular activity. 6. N/A7. External USB devices should not be used for the two-factor authentication because they can too easily be compromised, and access will be revoked too frequently.8. Iris scans are a very secure method of identity and the current technology allows for broad use of this technique. This technique should be adopted for authentication.9. N/A Just a couple comments from an interested party on the reopened DEA EPCS IFR Comment Period; RIN 1117-AA61/Docket No. DEA-218I . An open ended question 7 was asked What types of issues have registrants encountered during the adoption and implementation of EPCS into their workflow, particularly where a prescriber uses an electronic health record (electronic medical record)?  and I would like to make 2 comments for this question.  1)I fully concur with the National Council for Prescription Drug Programs ( NCPDP) comments  and add additional verbiage on  the  1311.300 Application provider requirements - Third-party audits or certifications. Third Party Audit requirement are costly and burdensome to both the e-prescribing system vendors and the pharmacy management system vendors.   Vendors rarely, if ever,  make substantive changes in the EPSC system software unless the underlying  message standard changes.  Until CMS mandated the SCRIPT V2017071 standard effective 01-01-2020, there hadnt been a standards change, i.e. a substantive change to the EPCS processing since 2013, nearly 7 years.  However during that time period, vendors may have had to conduct as many as 4 additional audits depending on the timing of their audits.   Its costly and burdensome, with limited if any value.    I respectively request that the DEA reconsider this requirement  and remove the every two years requirement.   I would recommend that the new language would state that  audits are only required when substantive changes are made to the electronic prescribing of controlled substances functionality. 2)EPCS Renewal Request Issue:    Years ago, pharmacies were put at risk when a penalty was accessed to a pharmacy  for faxing forms to prescribers which facilitated the ease of prescribers approving refill requests. Basically the pharmacy sent a form, that the prescriber had to sign and return. It was deemed that this form in its current state could be considered the pharmacy prepopulating the prescription information  and was prescribing. There has been concern in the industry that this same risk exists with electronic prescribing of controlled substances RxRenewalRequest and RxRenewalResponse transactions, and that this could again put pharmacies at risk.   This process when done electronically is a completely different workflow than a faxed refill request.   The pharmacy is sending an RxRenewalRequest with fields mandated by the NCPDP SCRIPT standard to the prescriber which contains  consistent, relevant information related to the patient and the prescription to enable better decision making on the part of the prescriber.   The prescriber cannot sign this and send it back to the pharmacy.    The response must be an  RxRenewalResponse and it is a completely different transaction/message that is constructed and digitally signed by the prescriber and transmitted by its EHR system to the pharmacy.   Therefore, I would also concur with NCPDPs request that the DEA confirm the RxRenewalRequest message does not constitute pre-population and the use of this message type supports the DEAs mission to limit prescribing of controlled substances to circumstances of true need while obviating the need to resort to less secure, more vulnerable prescription-writing processes. RE:  reopened DEA EPCS IFR Comment Period; RIN 1117-AA61/Docket No. DEA-218I . An open ended question 7 was asked What types of issues have registrants encountered during the adoption and implementation of EPCS into their workflow, particularly where a prescriber uses an electronic health record (electronic medical record)?  and I would like to make a comment for this question.   I would like to make a comment on the transfer of unfilled on file controlled substance prescriptions. The  North Carolina Board of Pharmacy Newsletter made comments stating their concerns to this  in their July 2018 (link: https://nabp.pharmacy/wp-content/uploads/2016/06/North-Carolina-Newsletter-July-2018.pdf ).  This article was then reprinted by other state BOP newsletters stating their concerns.  They stated the issue much more eloquently than I, so Ill quote them below.In April 2017, word began swirling that Drug Enforcement Administration (DEA) viewed transfers of on file CS as not allowed. On July 7, 2017, Loren Miller, associate section chief, Liaison and Policy Section, Diversion Control Division, DEA, sent an email to Carmen Catizone, executive director of the National Association of Boards of Pharmacy, setting forth DEAs view on the matter.In that email (which can be found at www.ncbop.org/ PDF/LMillerDEAGuidanceTransferofOnFileCS Prescriptions.pdf), Mr Miller states the view that Title 21 Code of Federal Regulations (CFR) 1306.25 allows a pharmacy, once it has filled an original prescription for a controlled substance in Schedule III-V, to transfer the original prescription information to another DEA registered pharmacy for the purposes of allowing that second pharmacy to then dispense any remaining valid refills . . . Mr Miller further stated that an allowance currently does not exist for the forwarding of an unfilled prescription from one DEA registered retail pharmacy so that it may be filled at another DEA registered pharmacy.As the pharmacy  industry is hesitant to engage in this practice of forwarding unfilled or filled controlled substances prescriptions without additional guidance and clarification,  I  would respectfully request that the DEA clarify the position their position on this and state rules by which this can occur. Thank you for your thoughtful consideration of my comments.  Dear Sir or Madam:Please find our uploaded comments and supporting addenda with respect to the Electronic Prescriptions forControlled Substances Interim Final Rule; Reopening of Comment Period; RIN 1117-AA61/Docket No. DEA-218I.Respectfully,Ken Whittemore, JrSurescripts, LLC First, I would like to thank you for looking of ways to better the Electronic Prescriptions for Controlled Substances (EPCS) system. As a Nurse Practitioner Student, I have been able to see how the EPCS system is used at multiple different clinical sites and speak to multiple providers on their opinions of the system. The EPCS has first off brought increased convivence to the providers. I have worked with providers that have used the traditional paper system and the EPCS systems. The convivence and efficiency that EPCS brings to the provider is something that they applaud over the traditional paper system. They report that is takes less time to use the EPCS system than writing a paper prescription with all the required information. The use of EPCS also eliminated the possibility of the patient potentially losing the paper prescription. Which could potentially leave the provider in a dilemma to write another controlled prescription if the original prescription was reported lost. This implementation of EPCS is also very convenient for the patient. EPCS simplifies the process for the patient and allows the patient to not have to present to the clinic to pick up a paper prescription. The patient just has to present to their local pharmacy to pick up their controlled substance just like any other electronic prescriptions. This efficiency is also beneficial in events like the current COVID-19 pandemic because it limits the interaction needed by the patient and limits potential exposure in immunocompromised patients. The Two-Factor Authentication system is something that I believe should remain in effect at this time. Speaking with multiple health care providers they report that is doesnt add increased workflow that is burdensome to the healthcare provider.  They reported the most difficult portion was setting up the system but once up and running it did not add an unreasonable amount of time to autheticate. Two-Factor authentication also adds another layer of security to the system that could prevent people from potentially compromising the system. The diversity of different authentication types is beneficial because it gives options to the organizations on how they want to authenticate. I have seen a Windows operating system being used with All Meds Electronic Health Record and DrFirst Medication ordering as an EPCS interface. They used a Symantec Token OTP hard token and a login and password as authentication factors. This has worked effectively with no errors in submission. They also have never run into any stock issues with local pharmacies in southern California.In summary, The EPCS system has been beneficial for both providers and patients. The ease of the program and the efficacy is something that should be continued and the continued usage of a two-factor authentication allows an added layer of security to the system with little burden on the healthcare provider once set up. I hope this information helps you make any future decisions in regards to the EPCS system.   The security concerns regarding electronic prescriptions are valid and the 2010 rule requiring two-factor authentication process made sense back then, but there are better alternatives today.  The main concern addressed by the two-factor authentication is to ensure that the right patient is actually getting the prescription rather than someone who just hacked the patients account. However, the two-factor authentication, either biometrics, passwords, or computer key, can be challenging for the elderly population who rely on prescriptions.  These challenges are likely to make it impossible for them to use electronic prescriptions and will continue showing up to the doctors.  Especially in todays world we do not want elderly people leaving their houses and going to the doctors office to get their prescription because of the risk that they will be exposed to others who are ill.  So, in order to keep the agencys goal of ensuring that the patient is the actual person receiving the prescription without adding a burden onto the patient, the doctor could electronically send the prescription to the patients pharmacy rather than having the patient receive the prescription themself.  An alternative to the current process of electronic prescriptions for controlled substances (EPCS) is to have doctors who are registered to prescribed controlled substances send the prescription directly to the patients pharmacy rather than to the patient directly.  Sending the prescription directly to the pharmacy reduces the risk of pharmacists prescribing forged prescriptions to someone who was able to hack the software and have a prescription sent to their device.  When a patient shows up to the pharmacy they could simply scan their drivers license/ID, and the pharmacists computer system will be able to determine which prescription the person needs.  The two-factor identification process should still be required for the doctors. In light of the technology available in todays society the two-factor identification process should not be as difficult on doctors.  A doctors office could very easily obtain the technology for a biometric scan as one of the two factors, or they can simply use a hard token such as a USB. This could make EPCS even easier for patients to refill their prescriptions as well as improving security to avoid misuse or abuse.  This will also reduce the burden on the patients.  Patients will no longer need any fancy technology to receive their prescriptions.  Their doctors can simply send the prescription directly to the pharmacy when the patient needs it.  The patient can then simply go to the pharmacy, show their drivers license or other identification card, and pick up their prescription. This will reduce the security risk of someone other than the patient obtaining the prescription as well as reducing the burden on the patient to have the necessary technology. In conclusion, the two-factor authentication for the patient should be removed and be added to the pharmacy.  The doctor should have to use two-factor authentication to send a prescription directly to the pharmacy and the patient will be required to show personal identification.   The re-evaluation of electronic prescriptions for controlled substances (EPCS) is a critical component to tackling the opioid crisis. Acceptance of prescription opioids continues to grow in our nation and use persists despite all the evidence we have around addiction and lack of long-term effectiveness.1 Tackling this opioid epidemic needs to start with how it is being prescribed. EPCS is one intervention to prevent abuse and addiction and decrease overdose in our nation.Currently, physicians are required to provide patients with handwritten prescriptions for controlled substances. But in a practical workflow, these prescriptions are not always handwritten, sometimes printed from an electronic health system (EHR) and just hand signed. These paper methods of prescribing controlled substances have been victim of fraud for quite some time. Prescription pads get stolen, handwriting has been forged, signatures copied. The wrong paper prescription falling into the hands of the wrong patient is one way addiction begins. In 2016, more than 11.5 million Americans reported misusing prescription opioids in the past year.1 Better regulation is needed to provide more security in controlling such addictive drugs.Moving to a model of EPCS presents as another disadvantage for independent community providers. This regulation furthers the monopoly of large system run practices in our communities. But at some point, we need independent providers to sacrifice this for the greater good of our public health. Physicians should want this type of regulation. It not only makes writing for controlled substances safer, but also easier.Currently the workflow for physicians to have to leave their electronic system to write a paper prescription is cumbersome to their productivity and patient wait times. Additionally, printing a prescription to hand sign is worse. The process for a prescription to be printed requires multiple steps. Within the EHR system, the physician can prepare the prescription on the EHR system to be printed, and instead of clicking send and the process being done, they have to fetch the printed paper prescription off the printer (wherever that printer is located within the office), hand sign it (with a pen that they never have readily available), and reenter the exam room to deliver to the patient (hoping the patient hasnt already started walking towards check-out). This valuable time could be spent answering messages, reviewing laboratory results, or other tasks that could help eliminate pajama time. Allowing for electronic prescriptions to be sent to the pharmacy for controlled substances would allow for better time management.But what exactly would that workflow look like? What options are there for two-factor authentication? What about failed transmissions? Why are we trying to figure this out? EHR vendors should have this solution. And if they do not have this solution, they should be creating the solution. We have entrusted these companies to make systems that do not burden our medical providers. These systems were meant to protect our clinicians. The EHR systems should seamlessly integrate this technology without any extra cost or licensure. This technology should just exist.Simply enough, we all know patients who have lost a written prescription. These get misplaced, lost, and often stolen from friends and family members. Currently, we do not have a good process for replacing these prescriptions and we do not have a good confirmation with the pharmacy system to know if this was inappropriately filled. Until we have a process that monitors the prescription and distribution of controlled substances, we will continue to see rates of abuse and misuse increase.2Most importantly, EPCS can help provide more data around safe prescribing. According to the Centers for Disease Control and Prevention, there were 191 million opioid prescriptions filled in the United States in 2017.1 This data shows we are currently able to access data on what controlled substances are being prescribed and filled, but we are not able to access data on the prescriptions that are being prescribed but not filled. We could get a better idea of physicians who are over prescribing this way. We can implement educational opportunities to providers we deem as high risk. This electronic tracking of controlled substances will provide us with more information in tackling the opioid epidemic.Overall, EPCS will help improve the safety of prescribing controlled substances while increasing the satisfaction of our physicians, pharmacists, and patients. Please take these comments into consideration when making further decisions on this regulation. Thank you.References:1.https://www.cdc.gov/drugoverdose/opioids/prescribed.html2.https://www.ncbi.nlm.nih.gov/books/NBK537318/