Commerce, Occupational and Professional Licensing

Rule R156-37f

Controlled Substance Database Act Rule

Notice of Proposed Rule

(New Rule)

DAR File No.: 37039
Filed: 11/13/2012 12:04:53 PM

RULE ANALYSIS

Purpose of the rule or reason for the change:

The purposes of this filing are to: 1) recodify the provisions of Sections R156-37-609, R156-37-609a, R156-37-609b, and R156-37-610 in the Utah Controlled Substance Act Rule that are being removed in a companion filing; and 2) add additional provisions into a new rule, R156-37f, Controlled Substance Database Act Rule. The recodification is consistent with the relocation in statute of the Controlled Substance Database provisions from the Controlled Substances Act in Title 58, Chapter 37, to the Controlled Substance Database Act in Title 58, Chapter 37f, by the Legislature in 2010 in HB28. The recodification relocates certain content from existing policy and procedure and places it in rule where it belongs. The recodification also adds additional provisions deemed necessary to the operation of the Database. The recodification also implements provisions from H.B. 257 passed during the 2012 Legislative General Session. (DAR NOTE: The proposed amendment to Rule R156-37 is under DAR No. 37040 in this issue, December 1, 2012, of the Bulletin.)

Summary of the rule or change:

Section R156-37f-101: This section titles the rule as the "Controlled Substance Database Act Rule". Section R156-37f-102: This section provides new definitions for "ASAP," "DEA," "NABP," "NCPDP," "NDC," and "RX". Section R156-37f-103: This section cites the authority for and explains the purpose of Rule R156-37f. Section R156-37f-104: This section explains the organization of Rule R156-37f and its relationship to Rule R156-1, the Division of Occupational and Professional Licensing (DOPL) Act Rule or "umbrella act rule" as it is often referred to. Subsection R156-37f-203(1) defines the procedure for and format of data submitted to the Database. It incorporates by reference the ASAP Telecommunications Format for Controlled Substances published by the American Society for Automation in Pharmacy, revised May 1995 (ASAP Format) as the format standard for the submission to the Database. This standard is then further classified to describe mandatory, preferred, and optional data fields. Subsection R156-37f-203(2) allows other alternate consistent formats if approved by DOPL. Subsection R156-37f-203(3) specifies the electronic methods of submission of properly formatted data to the Database. Subsection R156-37f-203(4) allows for paper submission of properly formatted data to the Database under specified conditions. Subsection R156-37f-203(5) specifies the current seven-day reporting cycle of data to the Database by reporting pharmacies. It further specifies the sorting requirement of data submissions for both individual pharmacies and pharmacy groups. It requires Class A, B, or D pharmacies that do not dispense any controlled substances during a reporting cycle to submit a null report. This is a new requirement not in the prior rule. It further allows a Class A, B, or D pharmacy that does not anticipate dispensing any controlled substances in the immediate future to submit a certification of such in a form approved by DOPL in lieu of weekly null reporting and provides that such a certification terminates immediately upon the dispensing of any controlled substance, or otherwise at the end of each calendar year. Subsection R156-37f-203(6) imposes a data transmission form requirement and specifies its content. Subsection R156-37f-301(1) requires the DOPL Director to designate in writing the individuals within DOPL that have access to the Database. Subsection R156-37f-301(2) allows a requester registered to use the Database to request information by electronic submission, orally, or in writing. Subsection R156-37f-301(3) specifies the Database information that may be disseminated to a verified requestor authorized to access the Database. Subsection R156-37f-301(4) requires federal, state, and local law enforcement authorities and prosecutors requesting information from the Database to provide a valid case number of their case or prosecution. Subsection R156-37f-301(5) specifies that individuals who may request their own information from the Database may not request an accounting of persons or entities that have requested or received information from the Database. Subsection R156-37f-301(6) specifies the conditions for a requester to request and obtain their own information submitted to the Database. Subsection R156-37f-301(7) specifies the conditions for a requester holding a power of attorney from an individual who could request his or her own data to request and obtain information from the Database. Subsection R156-37f-301(8) specifies the conditions under which a requester who is the legal guardian of a minor or incapacitated individual may request and obtain information about the minor or incapacitated person from the Database. Subsection R156-37f-301(9) specifies the conditions under which a requestor who has a release-of-records from an individual who could obtain his or her own records, may obtain information about the individual from the Database. Subsection R156-37f-301(10) specifies the conditions under which a designated employee of a prescribing practitioner may have access to information from the Database on behalf of the prescribing practitioner. Subsection R156-37f-301(11) implements H.B. 257 (2012) and specifies the conditions under which an employee of the same business that employs a prescribing practitioner may obtain information from the Database on behalf of the prescribing practitioner. Subsection R156-37f-301(12) implements H.B. 257 (2012) and specifies the conditions under which an employee of an emergency room that employs a prescribing practitioner may obtain information from the Database on behalf of the prescribing practitioner. Subsection R156-37f-301(13) specifies the conditions under which scientific investigators employed by the Utah Department of Health may access information from the Database. Subsection R156-37f-301(14) specifies the methods by which the Database staff may disseminate information from the Database. It adds email as a method of dissemination under the current rule. This is one of the most efficient methods and is at least as secure as facsimile which is already permitted. It will better streamline DOPL operations. Subsection R156-37f-801a(1) designates the pilot area for the Pilot Program for Real-Time Reporting (Pilot Program). Subsection R156-37f-801a(2) defines reporting requirements to the Database for pharmacies participating in the Pilot Program to be in conjunction with controlled substance point of sale, submitted from the participating pharmacy's database to the Database through real-time interface and reporting software developed by DOPL's contract provider. Section R156-37f-801b: This section specifies that access to information in the Database submitted via the Pilot Program shall be the same as set forth in Section 58-37f-301 as implemented by Section R156-37f-301.

State statutory or constitutional authorization for this rule:

• Subsection 58-37f-301(1)
• Subsection 58-1-106(1)

This rule or change incorporates by reference the following material:

• Adds ASAP Telecommunications Format for Controlled Substances, published by American Society for Automation in Pharmacy (ASAP), May 1995

Anticipated cost or savings to:

the state budget:

These changes will have minimal impact on the state budget. The majority of the provisions are simply recodified from Rule R156-37 and will have no impact on the state budget. Rule R156-37f will have to be printed at an approximate cost of $60. The proposed rule adds a new null reporting requirement for pharmacies that do not dispense within a reporting period, but it provides an annual "opt-out" option that eliminates the requirement if a pharmacy doesn't dispense controlled substances. The new report will cause some minimal additional cost to the DOPL, but the costs are anticipated to be nominal and reasonably absorbed within DOPL's existing budget. This change will enhance DOPL's ability to ensure complete reporting to the Database, increase the integrity of the information in the Database, and thus enhance the protection of public health, safety, and welfare. The proposed rule adds e-mail to the ways in which Database information may be disseminated. This is one of the most efficient methods of dissemination and may result in some cost savings to DOPL and health care providers, but the savings cannot be estimated.

local governments:

The proposed changes should have little or no impact on local government. Local government does not report to the Database, but law enforcement and prosecutors working for local government obtain information from the Database. The latter provisions are recodified, but unchanged in content.

small businesses:

The proposed changes will have minimal impact on the small business. The majority of the provisions are simply recodified from Rule R156-37 and will have no impact on small business. Some small business pharmacies will be required to report weekly if they have dispensed no controlled substances, but the rule also provides an "opt-out" if a pharmacy doesn't dispense at all during the year. It is anticipated to be a nominal change without significant cost associated with it. Any minimal costs cannot be estimated by the Division. The proposed change adding e-mail to the ways in which Database information may be disseminated could result in a cost savings to some small businesses, but these savings cannot be estimated.

persons other than small businesses, businesses, or local governmental entities:

The proposed changes will have minimal impact on other persons. The majority of the provisions are simply recodified from Rule R156-37 and will have no impact on other persons. Some small business pharmacies will be required to report weekly if they have dispensed no controlled substances, but the rule also provides an "opt-out" if a pharmacy doesn't dispense at all during the year. It is anticipated to be a nominal change without significant cost associated with it. The costs cannot be estimated. Prescribing practitioners who work as an employee of a clinic or as an employee of an emergency room will be able to enhance their efficiency through granting access to employees of the same clinic or emergency room to access the Database on their behalf. Potential cost savings in this regard cannot be estimated. Better clarification through this recodification should improve the level of understanding of the Database requirements and thereby compliance with the requirements and use of the Database.

Compliance costs for affected persons:

These changes will have minimal impact on individuals. The majority of the provisions are simply recodified from Rule R156-37 and will have no impact on individuals. Some small business pharmacies will be required to report weekly if they have dispensed no controlled substances, but the rule also provides an "opt-out" if a pharmacy doesn't dispense at all during the year. It is anticipated to be a nominal change without significant cost associated with it. The costs cannot be estimated. Prescribing practitioners who work as an employee of a clinic or as an employee of an emergency room will be able to enhance their efficiency through granting access to employees of the same clinic or emergency room to access the Database on their behalf. Potential cost savings in this regard cannot be estimated. Better clarification through this recodification should improve the level of understanding of the Database requirements and thereby compliance with the requirements and use of the Database.

Comments by the department head on the fiscal impact the rule may have on businesses:

As stated in the rule analysis, the proposed rule is primarily a recodification of provisions currently found in Sections R156-37-609, R156-37-609a, and R156-37-609b. These provisions are currently in effect; no fiscal impact to businesses will result from the recodification. The proposed rule also includes a new provision to require a pharmacy business that does not dispense controlled substances to submit either a weekly report or a yearly certification. Some pharmacies might need to implement technology and internal procedures in order to comply with this requirement. It is anticipated that the costs will be minimal, particularly as to a yearly certification, which may be accomplished through a paper submission.

Francine A. Giani, Executive Director

The full text of this rule may be inspected, during regular business hours, at the Division of Administrative Rules, or at:

Commerce
Occupational and Professional Licensing
HEBER M WELLS BLDG
160 E 300 S
SALT LAKE CITY, UT 84111-2316

Direct questions regarding this rule to:

• Debra Hobbins at the above address, by phone at 801-530-6789, by FAX at 801-530-6511, or by Internet E-mail at dhobbins@utah.gov

Interested persons may present their views on this rule by submitting written comments to the address above no later than 5:00 p.m. on:

12/31/2012

Interested persons may attend a public hearing regarding this rule:

• 12/17/2012 09:00 AM, Heber Wells Bldg, 160 E 300 S, Conference Room 475, Salt Lake City, UT

This rule may become effective on:

01/07/2013

Authorized by:

Mark Steinagel, Director

R156. Commerce, Occupational and Professional Licensing.

R156-37f. Controlled Substance Database Act Rule.

R156-37f-101. Title.

This rule shall be known as the "Controlled Substance Database Act Rule".

 

R156-37f-102. Definitions.

In addition to the definitions in Sections 58-17b-102, 58-37-2 and 58-37f-102, as used in this chapter:

(1) "ASAP" means the American Society for Automation in Pharmacy system.

(2) "DEA" means Drug Enforcement Administration.

(3) "NABP" means the National Association of Boards of Pharmacy.

(4) "NCPDP" means National Council for Prescription Drug Programs.

(5) "NDC" means National Drug Code.

(6) "Rx" means a prescription.

 

R156-37f-103. Authority - Purpose.

This rule is adopted by the Division under the authority of Subsection 58-1-106(1)(a) to enable the Division to administer Title 58, Chapter 37f.

 

R156-37f-104. Organization - Relationship to Rule R156-1.

The organization of this rule and its relationship to Rule R156-1 is as described in Section R156-1-107.

 

R156-37f-203. Submission, Collection, and Maintenance of Data.

(1) The format for submission to the Database shall be in accordance with the ASAP Telecommunications Format for Controlled Substances published by the American Society for Automation in Pharmacy, revised May 1995 (ASAP Format), which is hereby incorporated by reference. The Division may approve alternative formats substantially similar to this standard. This standard is further classified by the Database as follows:

(a) Mandatory Data. The following Database data fields are mandatory:

(i) pharmacy NABP or NCPDP number;

(ii) patient birth date;

(iii) patient gender code;

(iv) date filled;

(v) Rx number;

(vi) new-refill code;

(vii) metric quantity;

(viii) days supply;

(ix) NDC number;

(x) prescriber identification number;

(xi) date Rx written;

(xii) number refills authorized;

(xiii) patient last name;

(xiv) patient first name; and

(xv) patient street address, including zip code (extended).

(b) Preferred Data. The following Database data fields are strongly suggested:

(i) customer identification number;

(ii) compound code;

(iii) DEA suffix;

(iv) Rx origin code;

(v) customer location;

(vi) alternate prescriber number; and

(vii) state in which the prescription is filled.

(c) Optional Data. All other data fields in the ASAP Format not included in Subsections (a) and (b) are optional.

(2) Upon request, the Division will consider approving alternative formats, or adjustments to the ASAP Format, as might be necessary due to the capability or functionality of Database collection instruments. A proposed alternative format shall contain all mandatory data elements.

(3) In accordance with Subsection 58-37f-203(1)(c), the data required in Subsection (1) shall be submitted to the Database through one of the following methods:

(a) electronic data sent via telephone modem;

(b) electronic data submitted on floppy disk or compact disc (CD);

(c) if approved by the Database staff prior to submission, electronic data sent via encrypted electronic mail (e-mail);

(d) electronic data sent via a secured internet transfer method, including but not limited to sFTP site transfer and HyperSend; or

(e) any other electronic method approved by the Database manager prior to submission.

(4) The required information may be submitted on paper if:

(a) the pharmacy or pharmacy group submits a written request to the Division and receives prior approval for a paper submission; and

(b)(i) the pharmacy or pharmacy group has no computerized record keeping system upon which the data can be electronically recorded; or

(ii) The pharmacy or pharmacy group is unable to conform its submission(s) to an electronic format without incurring undue financial hardship.

(5)(a) Each pharmacy or pharmacy group shall submit all data collected at least once every seven days on a weekly reporting cycle established by the pharmacy.

(i) If the data is submitted by a single pharmacy entity, the data shall be submitted in chronological order according to the date each prescription was filled.

(ii) If the data is submitted by a pharmacy group, the data is required to be sorted by individual pharmacy within the group, and the data of each individual pharmacy within the group is required to be submitted in chronological order according to the date each prescription was filled.

(b)(i) A Class A, B, or D pharmacy or pharmacy group that has a controlled substance license but has not dispensed a controlled substance during the preceding seven days shall:

(A) submit a null report stating that no controlled substance was dispensed during the preceding seven days; or

(B) comply with this Subsection (5)(c).

(ii) A null report may be submitted on paper without prior approval of the Division. The Division shall facilitate electronic null reporting as resources permit.

(c)(i) A Class A, B, or D pharmacy or pharmacy group that has a controlled substance license but is not dispensing controlled substances and does not anticipate doing so in the immediate future may submit a certification of such, in a form preapproved by the Division, in lieu of weekly null reporting.

(ii) The certification must be resubmitted at the end of each calendar year.

(iii) If a pharmacy or pharmacy group that has submitted a certification under this Subsection (5)(c) dispenses a controlled substance:

(A) the certification shall immediately and automatically terminate;

(B) the pharmacy or pharmacy group shall provide written notice of the certification termination to the Division within seven days of dispensing the controlled substance; and

(C) the Database reporting requirements shall be applicable to the pharmacy or pharmacy group immediately upon the dispensing of the controlled substance.

(6) The pharmacist-in-charge, or his or her designee, for each reporting pharmacy shall submit its report, regardless of the reporting method, on a data transmission form (DTF) substantially equivalent to the DTF approved by the Division. The DTF may be mailed, faxed, emailed, or electronically uploaded to the Database. A copy of the DTF is required to be kept at the pharmacy unless an alternate location has been designated by the reporting pharmacy and approved by the Division. The DTF shall include the following information:

(a) pharmacy name;

(b) pharmacy facsimile (fax) and voice phone numbers;

(c) pharmacy e-mail address;

(d) pharmacy NABP/NCPDP number;

(e) period of time covered by each submission of data;

(f) number of prescriptions in the submission;

(g) submitting pharmacist's signature attesting to the accuracy of the report; and

(h) date of the report submission.

 

R156-37f-301. Access to Database Information.

In accordance with Subsections 58-37f-301(1)(a) and (b):

(1) The Division Director shall designate in writing those individuals employed by the Division who shall have access to the information in the Database (Database staff).

(2)(a) A request for information from the Database may be made:

(i) directly to the Database by electronic submission, if the requester is registered to use the Database; or

(ii) by oral or written submission to the Database staff, if the requester is not registered to use the Database.

(b) An oral request may be submitted by telephone or in person.

(c) A written request may be submitted by facsimile, email, regular mail, or in person except as otherwise provided herein.

(d) The Division may in its discretion require a requestor to verify the requestor's identity.

(3) The following Database information may be disseminated to a verified requestor who is permitted to obtain the information:

(a) dispensing/reporting pharmacy ID number/name;

(b) subject's birth date;

(c) date prescription was filled;

(d) prescription (Rx) number;

(e) metric quantity;

(f) days supply;

(g) NDC code/drug name;

(h) prescriber ID/name;

(i) date prescription was written;

(j) subject's last name;

(k) subject's first name; and

(l) subject's street address;

(4) Federal, state and local law enforcement authorities and state and local prosecutors requesting information from the Database under Subsection 58-37f-301(2)(d) must provide a valid case number of the investigation or prosecution.

(5) An individual whose records are contained within the Database may not receive an accounting of persons or entities that have requested or received Database information about the individual.

(6) An individual whose records are contained within the Database may obtain his or her own information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity; or

(b) submitting a signed and notarized request that includes the requester's:

(i) full name;

(ii) complete home address;

(iii) date of birth; and

(iv) driver license or state identification card number.

(7) A requester holding power of attorney for an individual whose records are contained within the Database may obtain the individual's information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity; and

(b) providing:

(i) an original, properly executed power of attorney designation; and

(ii) a signed and notarized request, executed by the individual whose information is contained within the Database, and including the individual's:

(A) full name;

(B) complete home address;

(C) date of birth; and

(D) driver license or state identification card number verifying the individual's identity.

(8) A requestor who is the legal guardian of a minor or incapacitated individual whose records are contained within the Database may obtain the individual information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity;

(b) submitting the minor or incapacitated individual's:

(i) full name;

(ii) complete home address;

(iii) date of birth; and

(iv) if applicable, state identification card number verifying the individual's identity; and

(c) submitting legal proof that the requestor is the guardian of the individual who is the subject of the request for information from the Database.

(9) A requestor who has a release-of-records from an individual whose records are contained within the Database may obtain the individual's information and records by:

(a) submitting a request in writing;

(b) submitting an original, signed and notarized release-of-records in a format acceptable to the Database staff, identifying the purpose of the release; and

(c) submitting the individual's:

(i) full name;

(ii) complete home address;

(iii) telephone number;

(iv) date of birth; and

(v) driver license or state identification card number verifying the identity of the person who is the subject of the request.

(10) An employee of a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(d)if, prior to making the request:

(a) the licensed practitioner has provided to the Division a written designation that includes the designating practitioner's DEA number and the designated employee's:

(i) full name;

(ii) complete home address;

(iii) e-mail address;

(iv) date of birth; and

(v) driver license number or state identification card number;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account. (11) An employee of a business that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(d) if, prior to making the request:

(a) the licensed practitioner and employing business have provided to the Division a written designation that includes:

(i) the designating practitioner's DEA number;

(ii) the name of the employing business; and

(iii) the designated employee's:

(A) full name;

(B) complete home address;

(C) e-mail address;

(D) date of birth; and

(E) driver license number or state identification card number;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

(12) An individual who is employed in the emergency room of a hospital that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(d) if, prior to making the request:

(a) the practitioner and the hospital operating the emergency room have provided to the Division a written designation that includes:

(i) the designating practitioner's DEA number;

(ii) the name of the hospital;

(iii) the names of all emergency room practitioners employed at the hospital; and

(iv) the designated employee's:

(A) full name;

(B) complete home address;

(C) e-mail address;

(C) date of birth; and

(D) driver license number or state identification card number;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

(13) The Utah Department of Health may access Database information for purposes of scientific study regarding public health. To access information, the scientific investigator shall:

(a) demonstrate to the satisfaction of the Division that the research is part of an approved project of the Utah Department of Health;

(b) provide a description of the research to be conducted, including:

(i) a research protocol for the project; and

(ii) a description of the data needed from the Database to conduct that research;

(c) provide assurances and a plan that demonstrates all Database information will be maintained securely, with access being strictly restricted to the requesting scientific investigator;

(d) provide for electronic data to be stored on a secure database computer system with access being strictly restricted to the requesting scientific investigator; and

(e) pay all relevant expenses for data transfer and manipulation.

(14) Database information that may be disseminated under Section 58-37f-301 may be disseminated by the Database staff either:

(a) verbally;

(b) by facsimile;

(c) by email;

(d) by U.S. mail; or

(e) where adequate technology is in place to ensure that a record will not be compromised, intercepted, or misdirected, by electronic access.

 

R156-37f-801a. Reporting of Information by Pharmacies Participating in the Pilot Program for Real-time Reporting.

(1) In accordance with Subsection 58-37f-801(1)(a), the pilot area is designated as the entire state of Utah. Any pharmacy or pharmacy group that submits information to the Database is eligible and may participate in the Real-time Pilot Program.

(2) In accordance with Subsection 58-37f-801(8), each licensed pharmacy participating in the pilot program for real-time reporting shall, in conjunction with controlled substance point of sale, submit from the pharmacy's database to the Controlled Substance Database, the information required by Section 58-37f-203 as implemented by Section R156-37f-203, through real-time interface and reporting software developed by the Division's contract provider.

 

R156-37f-801b. Access to Information in the Database Submitted by Pharmacies Participating in the Pilot Program for Real-time Reporting.

In accordance with Subsection 58-37f-801(8), access to information in the Database submitted by pharmacies participating in the pilot program for real-time reporting shall be the same as set forth in Section 58-37f-301 as implemented by Section R156-37f-301.

 

KEY: controlled substance database, licensing

Date of Enactment or Last Substantive Amendment: 2013

Authorizing, and Implemented or Interpreted Law: 58-1-106(1)(a); 58-37f-301(1)