the two or more individuals who set the access controls first verify proofing. 4. comment period. documents in the last year, 71 If so, how (e.g., Near-Field Communication (NFC), Given the numerous benefits of electronic prescribing for prescribers and patients, and in accordance with section 2003 of the SUPPORT Act, CMS seeks to define any exceptions narrowly. with DEA (or exempt from the registration requirement). Has two-factor authentication caused barriers to efficient Use the PDF linked in the document sidebar for the official electronic format. In 2019, e-prescribing for controlled substances PDEs increased to 37.31 percent. documents in the last year, 769 compromise or could compromise the integrity of the prescription The United States is currently responding to an outbreak of respiratory disease caused by a novel (new) coronavirus now detected in 50 States and the District of Columbia. controlled substances." 13. You may send written comments to the following address ONLY: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-3394-NC, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850. institutional practitioner can require individuals to obtain identity Use of the technology does not vary significantly between rural and urban areas, but it does vary between states, likely associated with differences in regulations, penalties, waivers, populations, and culture.[15]. particularly where a prescriber uses an electronic health record prescribing of controlled substance while better encouraging adoption If an institutional The Freedom of Information Act applies to all comments Beginning January 1, 2021, unless covered by an exception, all prescriptions for controlled substances and medical devices must be issued electronically. "factors"--to use their credential to issue an electronic separate entity within the institutional practitioner (or an outside Federal Agencies & Related Links documents in the last year, 355 June 27, 2008, DEA published a Notice of Proposed Rulemaking (NPRM) review the auditable event and determine whether it was a security Nonetheless, many key Part D initiatives such as electronic prior authorization are anchored within the NCPDP SCRIPT standard version 2017071. filled. We seek responses to this RFI from beneficiary and advocacy groups; beneficiaries and caregivers; primary care and specialty providers; health plans and supplemental insurers; state, local, and territorial governments; research and policy experts; industry and professional associations; long-term care facilities, hospice providers, pharmacists, and pharmacy associations; and other interested members of the public. See https://www.deadiversion.usdoj.gov/​schedules/​#define for additional detail on definitions of controlled substances. Logical access controls may be by user or role-based; that is, the Principal Deputy Administrator for Medicare, Centers for Medicare & Medicaid Services. All submissions become U.S. Government property and will not be returned. Or the factor can meeting the two-factor authentication requirement, benefited the EPCS shall update the [IFR's] requirements for the biometric component of In commenting, refer to file code CMS-3394-NC. (such as name, address, and phone number) included in the text of your Burger, M. “Accelerating ePrescribing for Controlled Substances.” HIT Perspectives: Controlled Substances, February 2014. For example, are institutions viewing practitioners' driver's 5. We will actively consider all input as we develop future regulatory proposals or future subregulatory policy guidance. Accordingly, to issue an electronic prescription under the IFR, a password or a response to a certain question. … prescription indicates that the prescription was originally issued CMS adopted the first set of standards for e-prescribing for Part D in 2005. documents in the last year. These factors can take one of three forms. As noted, because of updates in technology, 1, 2010. Posted December 2, 2020. ensure that the electronic prescription was not already received and to "update" its regulations on one of these issues, the biometric documents in the last year, 104 establishing the XML-based Federal Register as an ACFR-sanctioned non-controlled substances. The reasons for this disparity between capability and practice are likely to be multifaceted. We have taken many regulatory and policy actions to swiftly aid the nation's health care system to address effectively the COVID-19 pandemic. The President of the United States communicates information on holidays, commemorations, special observances, trade, and policy through Proclamations. We seek comment on the following specific questions with respect to enforcement: Section 2003 of the SUPPORT Act requires that the Secretary use rulemaking to specify circumstances and processes by which the Secretary may waive the EPCS requirement. associated with an institutional practitioner registrant), such Federal Register issue. Additionally, an IFR The same report showed that 38 percent of controlled substance prescriptions were electronically prescribed, while 85 percent of non-controlled substances were electronically prescribed. NIST SP 800-63-3, "Digital Identity Guidelines," now provides the token or other factor associated with the two-factor authentication Lecture Notes in Computer Science, vol 9603. is terminated, revoked, or suspended; the practitioner reports that a is no longer authorized to use the institutional practitioner's comments will prove helpful as it completes its final rule on these including review of a government-issued photographic identification of credential) must approve the entry using his or her own authentication for better understanding how a document is structured but include documents scheduled for later issues, at the request NOTICE: This is an unofficial version. This RFI is issued solely for information and planning purposes; it does not constitute a Request for Proposal (RFP), applications, proposal abstracts, or quotations. What types of biometric authentication credentials are however, amended its regulations in 2010 to provide practitioners with Accessed April 29, 2020. https://naspa.us/​wp-content/​uploads/​2020/​04/​7398_​2019-NPR-Brochure-Web-Final.pdf. Should CMS assess penalties' severity incrementally based on repeat analyses demonstrating lack of improved compliance? An official version of this publication may be obtained directly from the Government Publishing Office (GPO). DEA is seeking comments in response to the following proofing, as well as any more comments about whether clarification of Questions & Answers If you want to submit confidential business information as part of the adoption and implementation of EPCS into their workflow, prescriptions (or indicate that prescriptions are ready to be signed). As we discuss in the following paragraph, we are interested in stakeholder input on any waivers and accompanying limits to the waivers that would be appropriate, the specific reasons that such waivers and limits may be necessary, and any operational or policy considerations that we should take into account when considering the need for and adopting waivers in connection with the EPCS requirement. documents in the last year, by the International Trade Commission event that compromised or could have compromised the integrity of the example, are practitioners using iOS or Android mobile devices, Any electronic controlled substance prescription issued by a practitioner must meet the requirements in DEA's EPCS interim final rule. We seek comments on our understanding of the persistence of such challenges for EPCS in the nursing facility setting and on any other specific circumstances which would support this exception. E-commerce Initiatives After considering the What level of compliance with EPCS would be appropriate to require before levying any penalties on a non-compliant prescriber, and why? Registrant Record of Controlled Substances Destroyed Retrieved from https://surescripts.com/​docs/​default-source/​national-progress-reports/​7398_​ab-v2_​2019-npr-brochure.pdf on April 20, 2020. individual practitioners who will be using the institution's electronic If commenters believe such exceptions should apply, please provide details on the circumstances that would require the exception, and the reasoning on whether the exception should be for a certain timeframe or indefinitely, and to whom the exception should apply. verified. "PERSONAL IDENTIFYING INFORMATION" in the first paragraph of your experienced a security incident and, if so, whether they have An electronic copy of this document is available in its entirety ++ For an individual who receives Medicare hospice care; and. it may associate permissions with particular roles (e.g., physician, Twelve states currently have mandatory EPCS laws, and, in 2021, mandates will go into effect in 13 additional states. Information on the E-prescribing requirements … Additionally, the IFR requires that any electronic prescription remotely. In March 2020, President Trump declared the COVID-19 pandemic a national emergency. Is there an alternative to two-factor authentication that reopening the March 31, 2010, interim final rule to solicit comments For have led to the creation of new, updated NIST guidelines, NIST SP 800-63-3, "Digital Identity Guidelines." response to the following questions: Uttam Dhillon, should continually evaluate risk to determine long-term suitability. accept comments after 11:59 p.m. Eastern Time on the last day of the DEA believes that the ability to conduct remote identity proofing AGENCY: Drug Enforcement Administration, Department of Justice. least two people within the practice, one of whom must be a DEA arguments that the EPCS provisions should allow for more flexible The Department of Justice does not endorse the organizations or views represented by this site and takes no responsibility for, and exercises no control over, the accuracy, accessibility, copyright or trademark compliance or legality of the material contained on this site. a practitioner's access must be revoked whenever any of the following Kentucky Revised Statute 218A.182, passed by the General … would provide an equally safe, secure, and closed system for electronic 02/03/2021, 40 See https://www.cms.gov/​files/​document/​covid-19-physicians-and-practitioners.pdf. of electronic prescriptions for controlled substances. Also, DEA has adopted certain new temporary flexibilities to allow DEA-registered practitioners to prescribe controlled substances without having to interact in person with some patients, effective for the duration of the PHE. \2\ This requirement is part of a larger Identity proofing and two-factor authentication credentials are not action). an "audit trail," a record of who accessed the application and Virginia. About the Federal Register is, a user must supply two different forms of authentication--two security events must be reported both to the provider of the electronic Electronic Prescribing Mandate Takes Effect January 1, 2020 (12/30/19) Beginning January 1, 2020, House File 2377 (2018 Iowa Acts) mandates the electronic transmission of all … specifically, it would better encourage adoption of EPCS without Open for Comment, Capital Planning and Stress Testing Requirements, Economic Sanctions & Foreign Assets Control, National Oceanic and Atmospheric Administration, National Security Commission on Artificial Intelligence, Centers for Disease Control and Prevention, Strengthening Medicaid and the Affordable Care Act, President's Council of Advisors on Science and Technology, III. relevant identity proofing assurance level is Identity Assurance Level grant access to practitioners also requires the involvement of at least authorized to use the electronic prescription application for whatever certain issues. rural areas are able to obtain an authentication credential without the With the use of electronic prescribing, a patient and provider can conduct a visit via telehealth and then have the prescription electronically transmitted to the pharmacy without having to see each other in-person and risk transmitting COVID-19. Additionally, commenters may identify and comment on other issues that they believe are significant for CMS to consider in implementing the SUPPORT Act's EPCS requirements. Surescripts. two individuals, one to enter the data and another to approve the DEA has acknowledged the prevalence of paper prescribing of controlled substances and attempted to address some of the hardships it poses for prescribers and patients during the PHE. States have instituted electronic prescribing requirements; some include penalties for not using e-prescribing for controlled substances. practitioner's DEA registration expires without renewal; if the under the tab "Supporting Documents" of the public docket of this Many of the comments received in response to the NPRM included confidential business information identified as directed above will 7. 8. DEA is application's logical access controls to grant the practitioner access What mechanism(s) should CMS use to enforce penalties among non-participating Medicare or Medicaid prescribers? On April 21, 2020, DEA reopened the 2010 interim final rule to solicit comments from the public on specific EPCS-related issues. CMEA Required Training & Self-Certification, CSOS (Controlled Substances Ordering System), Registrant Record of Controlled Substances Destroyed, Regulated Machines (Tableting and Encapsulating). Springer, Berlin, Heidelberg. adjustments that DEA could make to this requirement that would reduce Retrieved from https://www.ncbi.nlm.nih.gov/​pmc/​articles/​PMC5457970/​pdf/​bmjqir.u212185.w4870.pdf on April 30, 2020. 17. of the issuing agency. component of two-factor authentication, and comments from the public Recovery and Treatment for Patients and Communities Act (SUPPORT electronic prescription application's prescription records. ++ Dually eligible for benefits under titles and XVIII and XIX. 07/30/2020 at 4:15 pm. Further, the IFR requires CSPs and CAs to conduct identity proofing stolen, or compromised; if the individual (or institutional) Kentucky Revised Statute 218A.182 mandates the electronic prescribing of controlled … Upcoming Medicare Requirement Around Electronic Prescribing of Controlled Substances The SUPPORT Act—the major law passed in 2018 that addressed the opioid crisis—requires there to be … The Public Inspection page may also Authentication Guideline." documents in the last year, 28 seeking comments in response to the following questions: 9. See https://www.cdc.gov/​coronavirus/​2019-ncov/​need-extra-precautions/​older-adults.html. 7. entry. issue controlled substance prescriptions. rendition of the daily Federal Register on FederalRegister.gov does not However, Part D sponsors offering drug plans have been required to have the electronic capabilities to support electronic prescribing. need for travel. 01/01/2020. Electronically. The President of the United States issues other types of documents, including but not limited to; memoranda, notices, determinations, letters, messages, and orders. [19] Identity Assurance Level 2 of NIST SP 800-63-3, like Assurance Level Once a practitioner has received an authentication These actions include new flexibilities for telehealth and other electronic technologies [6] Should any details about penalties for violations of section 2003 of the Support Act be posted publicly? individual (or institutional) practitioner's DEA registration is Retrieved from https://www.pocp.com/​hitperspectives-controlled-substances/​ on April 30, 2020. These markup elements allow the user to see how the document follows the credential service providers (CSPs) or certification authorities (CAs). ready to be signed) in certain scenarios: If the individual 2003(c), 132 Stat. Responders are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party's expense. Should we instead consider specifying a number or percentage of a practice's patients? See https://www.cdc.gov/​coronavirus/​2019-ncov/​prevent-getting-sick/​social-distancing.html. Reports Required by 21 CFR The required date for prescribers to follow the mandate has been … HHS Office of the National Coordinator, The ONC Doctors' Perspective: Electronic Prescribing of Controlled Substances (EPCS) Is on the Rise, and We Must Work Together to Address Barriers to Use: https://www.healthit.gov/​buzz-blog/​health-it/​the-onc-doctors-perspective-electronic-prescribing-of-controlled-substances-epcs-is-on-the-rise-and-we-must-work-together-to-address-barriers-to-use. Medical Missions for Controlled Substances on March 31, 2010. How should CMS approach design and use of an appeals process for enforcement? The Controlled Substances Act (CSA), 21 U.S.C. Comments containing personal identifying information and We seek comment on the following: A prescription issued by a practitioner prescribing a drug under a research protocol. the electronic prescription application. USA.GOV    |     to the courts under 44 U.S.C. at Assurance Level 3 of the National Institute of Standards and Based on a published report of 2019 data reflecting the majority of prescribing activities across the country,[14] practitioner chooses to conduct its own internal identity proofing, documents in the last year, 997 [Rules and Regulations] Drug Disposal InformationDrug and Chemical Information Each document posted on the site includes a link to the fingerprint, insert a smartcard) before the system will allow that first paragraph of your comment. on Acting Administrator. DEA further believes that application providers work We view those limitations as important protections for Medicare beneficiaries that will ensure continued access to needed medications. containing the prescription application (e.g., enter a password, scan a Have staff workflows at long-term and post-acute care FC 2016. December 2, 2020 kma_admin. Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract or issue a grant. More information and documentation can be found in our This RFI does not commit the U.S. Government to contract for any supplies or services or make a grant award. subsequently publishing a final rule on these topics. 1503 & 1507. electronic prescribing of controlled substances in anticipation of (electronic medical record)? [3], However, as HHS and other Federal departments and agencies work to implement various provisions of the SUPPORT Act, including the electronic prescribing requirements for controlled substances under Part D, the health care system faces new challenges. 76 FR 64813. Comments, including mass comment submissions, must be submitted in one of the following three ways (please choose only one of the ways listed): 1. authentication requirements in the IFR. [11] Follow the search instructions on that website to view public comments. regulatory information on FederalRegister.gov with the objective of CMS does not currently impose penalties for providers prescribing controlled substances under the Part D program who do not use e-prescribing. Phillips et. This count refers to the total comment/submissions received on this document as reported by Regulations.gov. DEA published its Interim Final Rule (IFR) for Electronic Prescriptions We request feedback on what policies would be most appropriate within the SUPPORT Act's statutory limits to encourage EPCS adoption among prescribers of Part D drugs who are not enrolled in Medicare or Medicaid. failed, he or she may provide a paper or oral (where permitted) explanation here, this discussion will briefly highlight several developer tools pages. the application's provider and DEA within one business day. transmissions of electronic prescriptions. authorized under the CSA) to electronically sign controlled substance of controlled substance prescriptions. authentication requirements? We seek comment on this assumption and on any specific circumstances in which a prescription for a controlled substance could not be transmitted electronically under this standard. this approach to logical access control for individual practitioners. EPCS can assure prescribers' identity more easily and may permit a single workflow for prescribing both controlled and non-controlled drugs, improving the overall prescribing process.[12]. DATA Waived Physicians your comment, but do not want it to be made publicly available, you this manner, the IFR seeks to ensure that electronic prescriptions will You are now leaving a Department of Justice Web site. documents in the last year, 9 Beginning Jan. 1, 2021, Medicare is mandating that prescriptions for all controlled substances under Part D be transmitted electronically. replacement prescription, a pharmacist must check his or her records to 2. workflows? changes became effective June 1, 2010.\1\, ---------------------------------------------------------------------------. biometric data, such as a fingerprint or iris scan. CMS regulations adopting updated versions of the NCPDP SCRIPT standard: 73 FR 18918 (NCPDP SCRIPT version 8.1) and 77 FR 688892 (NCPDP SCRIPT version 10.6). FOR FURTHER INFORMATION CONTACT: Scott A. Brinks, Diversion Control prescription as a replacement (including a manually signed printout of This table of contents is a navigational tool, processed from the Diversion Control Division  •  8701 Morrissette Drive  •  Springfield, VA 22152  •  1-800-882-9539, DEA.GOV    |     the current document as it appeared on Public Inspection on Obviously, if nonregistrants could gain access to these DEA is seeking comment on this approach to identity As these efforts progress, we believe that electronic prescribing will become more widely adopted in these settings. Federal Register provide legal notice to the public and judicial notice corresponding official PDF file on govinfo.gov. Contractor support personnel may be used to review responses to this RFI. controls related to the issuance of controlled substance prescriptions electronic submission that is not identified as directed above as Institutional practitioners use a similar but slightly different provision, 21 CFR 1311.105, requires that a CSP providing EPCS the application). Are there alternatives to biometrics that could result in not required, to conduct identity proofing. In particular, DEA is seeking comment on whether there are any other individual practitioners do, that is permissible under the rule. 2003(a),(b). COVID-19 Information Register (ACFR) issues a regulation granting it official legal status. nurse), and then assign each individual to the appropriate role. authentication credentialing for electronic applications. Logical The Centers for Disease Control's guidance on the COVID-19 pandemic notes that “people in their 50s are at higher risk for severe illness than people in their 40s. substance prescriptions or indicate that controlled substance sign, transmit, and process controlled substances electronically? For individual practitioners (as opposed to practitioners By regular mail. The IFR allows institutional practitioners to conduct their own in-house identity proofing as part of their credentialing process of the In 2010, DEA issued an Interim Final Rule with Request for Comment, “Electronic Prescriptions for Controlled Substances,” that provided practitioners with the option of writing prescriptions for controlled substances electronically (75 FR 16236). the commenter. seeking comment from EPCS application users on whether they have retained as part of the internal audit trail. comment may not be made publicly available. and the two-factor authentication credential on his or her own, as Submitted comments may not be available to be read until the agency has approved them. diverting these controlled substances in violation of the CSA. From the patient standpoint, EPCS may reduce the logistical burden on patients who may otherwise be required to make multiple trips between providers and pharmacies to transport paper prescriptions when filling time-sensitive prescriptions while in pain or otherwise in need of treatment with controlled substances, as Schedule II, III, IV, or V drugs that may be used to treat a number of conditions. What penalties, if any, would be appropriate for non-compliance with a Federal EPCS mandate? applications, they might be able to use them to fraudulently generate [13] addressing certain EPCS topics to help ensure that industry properly Effective January 1, 2021, Texas Health and Safety Code, §§481.0755 requires that prescriptions for controlled substances to be issued electronically, except in limited circumstances, or unless a waiver has been granted by the appropriate agency. Kentucky EPCS Mandate. However, in our 2020 data, 51.15 percent of those PDEs have been transmitted electronically. We seek comments in response to questions related to each of these topics in each subsection. Based on Prescription Drug Event data processed through April 30, 2020. JUSTICE.GOV    |     And, under NIST SP How could CMS structure its EPCS policy to remove roadblocks to effective adoption of electronic prescribing for controlled substances?