DAR File No. 39923

Commerce, Occupational and Professional Licensing

Rule R156-37f

Controlled Substance Database Act Rule

Notice of Proposed Rule

(Amendment)

DAR File No.: 39923
Filed: 11/09/2015 10:16:58 AM

RULE ANALYSIS

Purpose of the rule or reason for the change:

The purpose of this filing is to: 1) address changes made by H.B. 395 and S.B. 119 passed during the 2015 General Session; 2) incorporate changes recommended by the Controlled Substance Database (CSD) Administrator and the Pharmacy Licensing Board; and 3) to make technical changes.

Summary of the rule or change:

In Subsection R156-37f-203(1), this change allows for any version of the American Society for Automation in Pharmacy (ASAP) Telecommunications Format for Controlled Substances published by the American Society for Automation in Pharmacy to be used for submission, collection, and maintenance of CSD data. The current rule only allows for and incorporates by reference the ASAP format, revised May 1995. The change also adds customer identification number and five-digit zip code as CSD mandatory data fields. In Subsection R156-37f-203(3), this change modifies and prescribes the method of submission of data to the CSD to be: 1) electronic data sent via a secured internet transfer method, including sFTP site transfer; 2) a web-base service; or 3) any other method approved by the database manager prior to submission. In Subsection R156-37f-203(5)(a), this change changes the time standard for submission to the CSD to either real time or daily batch file reporting, as required by statute, and specifies that submitted data shall be from the point of sale date. In Subsection R156-37f-203(5)(b), this change deletes language that is unnecessary as it is adequately addressed by the modified language that follows in this subsection by allowing for a waiver. In Subsection R156-37f-203(5)(c), the current Subsection (c) is renumbered as Subsection (5)(b). The change allows a Class A, B, or D pharmacy that has a controlled substance license but does not dispense and does not anticipate dispensing controlled substances, to request a waiver or submit a certification of such for null reporting. The subsection currently only allows only a certification. The change replaces the method by which null reporting will be carried out. Subsection R156-37f-203(6) has become largely obsolete and is deleted from the section. In Subsection 156-37f-301(4), this change implements the new statutory search warrant requirement for law enforcement access to the CSD. The rule change deletes the former case number of the investigation or prosecution standard for law enforcement accessed to the CSD. It also details how a search warrant may be submitted. In Subsection R156-37f-301(5), this change implements the new statutory requirement to provide an accounting of persons or entities that have requested or received CSD information about an individual. Previously, the rule prohibited such an accounting. The change specifies how an individual may submit such a request and the required content of a request. It also addresses how the accounting may be disseminated. Section R156-37f-801a is now obsolete and is deleted from the rule. Section R156-37f-801b is now obsolete and is deleted from the rule.

State statutory or constitutional authorization for this rule:

• Subsection 58-37f-301(1)
• Subsection 58-1-106(1)(a)

This rule or change incorporates by reference the following material:

• Removes ASAP Telecommunications Format for Controlled Substances, published by American Society for Automation in Pharmacy (ASAP), May 1995

Anticipated cost or savings to:

the state budget:

The change to real-time reporting or daily-batch reporting was required by statute and the cost was addressed by fiscal note during the 2015 General Session. Such reporting will allow users of the CSD to have more current data, which will assist users of the CSD to better prevent, control, and address controlled substance abuse. These costs and cost savings to all who are impacted cannot be estimated. Implementation of various rule changes will result in a cost savings to the Division of Occupational and Professional Licensing with regard to the cost of paper and toner. These savings will be minimal and cannot be estimated. The rules will have to be reprinted and distributed at an approximate cost of $50. Any printing and distribution costs incurred will be absorbed in the Division's current budget.

local governments:

The Division anticipates the proposed amendments would not apply to local governments and therefore the Division now anticipates there are no costs or savings to local governments beyond what may have been included in fiscal notes during the 2015 General Session with respect to H.B. 395 and S.B. 119.

small businesses:

The change to real-time reporting or daily-batch reporting was required by statute and the cost was addressed by fiscal note. Such reporting will allow users of the CSD to have more current data, which will assist users of the CSD to better prevent, control, and address controlled substance abuse. These costs and cost savings to all who are impacted cannot be estimated. Implementation of various rule changes will save resources at the pharmacies that qualify as small businesses with regard to the cost of paper and toner. The savings will be minimal and cannot be estimated.

persons other than small businesses, businesses, or local governmental entities:

The change to real-time reporting or daily-batch reporting was required by statute and the cost was addressed by fiscal note. Such reporting will allow users of the CSD to have more current data, which will assist users of the CSD to better prevent, control, and address controlled substance abuse. These costs and cost savings to all who are impacted cannot be estimated.

Compliance costs for affected persons:

The change to real-time reporting or daily-batch reporting was required by statute and the cost was addressed by fiscal note. Such reporting will allow users of the CSD to have more current data, which will assist users of the CSD to better prevent, control, and address controlled substance abuse. These costs and cost savings to all who are impacted cannot be estimated. Implementation of various rule changes will save resources at the pharmacy and state levels in the cost of paper and toner. The savings will be minimal and cannot be estimated.

Comments by the department head on the fiscal impact the rule may have on businesses:

As stated in the rule analysis, this filing updates this rule section to address changes made by H.B. 395 and S.B. 119, passed in the 2015 General Session; makes changes recommended by the Controlled Substance Database Administrator and the Pharmacy Licensing Board, and makes technical changes. This rule change will impact some pharmacies or pharmacy groups because of the requirement for real-time reporting or daily batch reporting, replacing the previous weekly-reporting requirement.

Francine A. Giani, Executive Director

The full text of this rule may be inspected, during regular business hours, at the Division of Administrative Rules, or at:

Commerce
Occupational and Professional Licensing
HEBER M WELLS BLDG
160 E 300 S
SALT LAKE CITY, UT 84111-2316

Direct questions regarding this rule to:

• Marvin Sims at the above address, by phone at 801-530-6232, by FAX at 801-530-6511, or by Internet E-mail at msims@utah.gov

Interested persons may present their views on this rule by submitting written comments to the address above no later than 5:00 p.m. on:

12/31/2015

Interested persons may attend a public hearing regarding this rule:

• 12/15/2015 10:30 AM, Heber Wells Bldg, 160 E 300 S, Conference Room 474, Salt Lake City, UT

This rule may become effective on:

01/07/2016

Authorized by:

Mark Steinagel, Director

R156. Commerce, Occupational and Professional Licensing.

R156-37f. Controlled Substance Database Act Rule.

R156-37f-203. Submission, Collection, and Maintenance of Data.

(1) The format used as a guide for submission to the Database shall be in accordance with any version of the ASAP Telecommunications Format for Controlled Substances published by the American Society for Automation in Pharmacy[, revised May 1995 (ASAP Format), which is hereby incorporated by reference]. The Division may approve alternative formats substantially similar to this standard. This standard is further classified by the Database as follows:

(a) Mandatory Data. The following Database data fields are mandatory:

(i) pharmacy NABP or NCPDP number;

(ii) customer identification number;

([ii]iii) patient birth date;

([iii]iv) patient gender code;

([i]v) date filled;

(v i) Rx number;

(vi i) new-refill code;

(vii i) metric quantity;

([viii]ix) days supply;

([i]x) NDC number;

(x i) prescriber identification number;

(xi i) date Rx written;

(xii i) number refills authorized;

([xiii]xiv) patient last name;

(x[i]v) patient first name; and

(xv i) patient street address[, including zip code (extended).];

(xvii) five digit zip code.

(b) Preferred Data. The following Database data fields are strongly suggested:

(i) [customer identification number;

(ii) ]compound code;

(ii[i]) DEA suffix;

([iv]iii) Rx origin code;

( iv) customer location;

(v[i]) alternate prescriber number; and

(vi[i]) state in which the prescription is filled.

(c) Optional Data. All other data fields in the ASAP Format not included in Subsections (a) and (b) are optional.

(2) Upon request, the Division will consider approving alternative formats, or adjustments to the ASAP Format, as might be necessary due to the capability or functionality of Database collection instruments. A proposed alternative format shall contain all mandatory data elements.

(3) In accordance with Subsection 58-37f-203(1)([c]a), the data required in Subsection (1) shall be submitted to the Database through one of the following methods:

(a) electronic data sent via a secured internet transfer method, including sFTP site transfer;[telephone modem];

(b) secure web base service; or[electronic data submitted on floppy disk or compact disc (CD);]

(c) any other electronic method approved by the Database manager prior to submission.[if approved by the Database staff prior to submission, electronic data sent via encrypted electronic mail (e-mail);

(d) electronic data sent via a secured internet transfer method, including but not limited to sFTP site transfer and HyperSend; or

(e) any other electronic method approved by the Database manager prior to submission.

(4) The required information may be submitted on paper if:

(a) the pharmacy or pharmacy group submits a written request to the Division and receives prior approval for a paper submission; and

(b)(i) the pharmacy or pharmacy group has no computerized record keeping system upon which the data can be electronically recorded; or

(ii) The pharmacy or pharmacy group is unable to conform its submission(s) to an electronic format without incurring undue financial hardship.]

(4) In accordance with Subsection 58-37f-203(1)(a):

[(5)](a) Effective January 1, 2016, each[Each] pharmacy or pharmacy group shall submit [all ]data collected on a daily basis either in real time or daily batch file reporting[at least once every seven days on a weekly reporting cycle established by the pharmacy]. The submitted data shall be from the point of sale (POS) date.

(i) If the data is submitted by a single pharmacy entity, the data shall be submitted in chronological order according to the date each prescription was filled.

(ii) If the data is submitted by a pharmacy group, the data is required to be sorted by individual pharmacy within the group, and the data of each individual pharmacy within the group is required to be submitted in chronological order according to the date each prescription was filled.

[(b)(i) A Class A, B, or D pharmacy or pharmacy group that has a controlled substance license but has not dispensed a controlled substance during the preceding seven days shall:

(A) submit a null report stating that no controlled substance was dispensed during the preceding seven days; or

(B) comply with this Subsection (5)(c).

(ii) A null report may be submitted on paper without prior approval of the Division. The Division shall facilitate electronic null reporting as resources permit.]

([c]b)(i) A Class A, B, or D pharmacy or pharmacy group that has a controlled substance license but is not dispensing controlled substances and does not anticipate doing so in the immediate future may request a waiver or submit a certification of such, in a form preapproved by the Division, in lieu of [weekly]daily null reporting.

(ii) The waiver or certification must be resubmitted at the end of each calendar year.

(iii) If a pharmacy or pharmacy group that has submitted a waiver or certification under this Subsection (5)([c]b) dispenses a controlled substance:

(A) the waiver or certification shall immediately and automatically terminate;

(B) the pharmacy or pharmacy group shall provide written notice of the waiver or certification termination to the Division within seven days of dispensing the controlled substance; and

(C) the Database reporting requirements shall be applicable to the pharmacy or pharmacy group immediately upon the dispensing of the controlled substance.[

(6) The pharmacist-in-charge, or his or her designee, for each reporting pharmacy shall submit its report, regardless of the reporting method, on a data transmission form (DTF) substantially equivalent to the DTF approved by the Division. The DTF may be mailed, faxed, emailed, or electronically uploaded to the Database. A copy of the DTF is required to be kept at the pharmacy unless an alternate location has been designated by the reporting pharmacy and approved by the Division. The DTF shall include the following information:

(a) pharmacy name;

(b) pharmacy facsimile (fax) and voice phone numbers;

(c) pharmacy e-mail address;

(d) pharmacy NABP/NCPDP number;

(e) period of time covered by each submission of data;

(f) number of prescriptions in the submission;

(g) submitting pharmacist's signature attesting to the accuracy of the report; and

(h) date of the report submission.]

 

R156-37f-301. Access to Database Information.

In accordance with Subsections 58-37f-301(1)(a) and (b):

(1) The Division Director [shall]may designate [in writing ]those individuals employed by the Division who [shall]may have access to the information in the Database (Database staff).

(2) (a) A request for information from the Database may be made:

(i) directly to the Database by electronic submission, if the requester is registered to use the Database; or

(ii) by oral or written submission to the Database staff, if the requester is not registered to use the Database.

(b) An oral request may be submitted by telephone or in person.

(c) A written request may be submitted by facsimile, email, regular mail, or in person except as otherwise provided herein.

(d) The Division may in its discretion require a requestor to verify the requestor's identity.

(3) The following Database information may be disseminated to a verified requestor who is permitted to obtain the information:

(a) dispensing/reporting pharmacy ID number/name;

(b) subject's birth date;

(c) date prescription was filled;

(d) prescription (Rx) number;

(e) metric quantity;

(f) days supply;

(g) NDC code/drug name;

(h) prescriber ID/name;

(i) date prescription was written;

(j) subject's last name;

(k) subject's first name; and

(l) subject's street address;

(4) (a) Federal, state and local law enforcement authorities and state and local prosecutors requesting information from the Database under Subsection 58-37f-301(2)([d]k) must provide a valid [case number of the investigation or prosecution.]search warrant authorized by the courts and may be provided using one of the following methods:

(i) in person;

(ii) be email to csdb@utah.gov;

(iii) facsimile; or

(iv) U.S. Mail.

(b) Information in the search warrant should be limited to subject's name and birth date.

(c) Information provided as a result of the search warrant shall be in accordance with Subsection (3).

(5) (a) An individual [whose records are contained within the Database ]may [not ]receive an accounting of persons or entities that have requested or received Database information about the individual.

(b) An individual may request the information in person or in writing by the following means:

(i) email;

(ii) facsimile; or

(iii) U.S. Mail.

(c) The request for information shall include the following:

(i) individuals' full name, including all aliases;

(ii) birth date;

(iii) home address;

(iv) government issued identification; and

(v) date-range.

(d) The results may be disseminated in accordance with Subsection (14).

(6) An individual whose records are contained within the Database may obtain his or her own information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity; or

(b) submitting a signed and notarized request that includes the requester's:

(i) full name;

(ii) complete home address;

(iii) date of birth; and

(iv) driver license or state identification card number.

(7) A requester holding power of attorney for an individual whose records are contained within the Database may obtain the individual's information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity; and

(b) providing:

(i) an original, properly executed power of attorney designation; and

(ii) a signed and notarized request, executed by the individual whose information is contained within the Database, and including the individual's:

(A) full name;

(B) complete home address;

(C) date of birth; and

(D) driver license or state identification card number verifying the individual's identity.

(8) A requestor who is the legal guardian of a minor or incapacitated individual whose records are contained within the Database may obtain the individual information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity;

(b) submitting the minor or incapacitated individual's:

(i) full name;

(ii) complete home address;

(iii) date of birth; and

(iv) if applicable, state identification card number verifying the individual's identity; and

(c) submitting legal proof that the requestor is the guardian of the individual who is the subject of the request for information from the Database.

(9) A requestor who has a release-of-records from an individual whose records are contained within the Database may obtain the individual's information and records by:

(a) submitting a request in writing;

(b) submitting an original, signed and notarized release-of-records in a format acceptable to the Database staff, identifying the purpose of the release; and

(c) submitting the individual's:

(i) full name;

(ii) complete home address;

(iii) telephone number;

(iv) date of birth; and

(v) driver license or state identification card number verifying the identity of the person who is the subject of the request.

(10) An employee of a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(d)if, prior to making the request:

(a) the licensed practitioner has provided to the Division a written designation that includes the designating practitioner's DEA number and the designated employee's:

(i) full name;

(ii) complete home address;

(iii) e-mail address;

(iv) date of birth; and

(v) driver license number or state identification card number;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification[and password];

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

(11) An employee of a business that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(d) if, prior to making the request:

(a) the licensed practitioner and employing business have provided to the Division a written designation that includes:

(i) the designating practitioner's DEA number;

(ii) the name of the employing business; and

(iii) the designated employee's:

(A) full name;

(B) complete home address;

(C) e-mail address;

(D) date of birth; and

(E) driver license number or state identification card number;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

(12) An individual who is employed in the emergency room of a hospital that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(d) if, prior to making the request:

(a) the practitioner and the hospital operating the emergency room have provided to the Division a written designation that includes:

(i) the designating practitioner's DEA number;

(ii) the name of the hospital;

(iii) the names of all emergency room practitioners employed at the hospital; and

(iv) the designated employee's:

(A) full name;

(B) complete home address;

(C) e-mail address;

(C) date of birth; and

(D) driver license number or state identification card number;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

(13) The Utah Department of Health may access Database information for purposes of scientific study regarding public health. To access information, the scientific investigator shall:

(a) demonstrate to the satisfaction of the Division that the research is part of an approved project of the Utah Department of Health;

(b) provide a description of the research to be conducted, including:

(i) a research protocol for the project; and

(ii) a description of the data needed from the Database to conduct that research;

(c) provide assurances and a plan that demonstrates all Database information will be maintained securely, with access being strictly restricted to the requesting scientific investigator;

(d) provide for electronic data to be stored on a secure database computer system with access being strictly restricted to the requesting scientific investigator; and

(e) pay all relevant expenses for data transfer and manipulation.

(14) Database information that may be disseminated under Section 58-37f-301 may be disseminated by the Database staff either:

(a) verbally;

(b) by facsimile;

(c) by email;

(d) by U.S. mail; or

(e) where adequate technology is in place to ensure that a record will not be compromised, intercepted, or misdirected, by electronic access.

 

[ R156-37f-801a. Reporting of Information by Pharmacies Participating in the Pilot Program for Real-time Reporting.

(1) In accordance with Subsection 58-37f-801(1)(a), the pilot area is designated as the entire state of Utah. Any pharmacy or pharmacy group that submits information to the Database is eligible and may participate in the Real-time Pilot Program.

(2) In accordance with Subsection 58-37f-801(8), each licensed pharmacy participating in the pilot program for real-time reporting shall, in conjunction with controlled substance point of sale, submit from the pharmacy's database to the Controlled Substance Database, the information required by Section 58-37f-203 as implemented by Section R156-37f-203, through real-time interface and reporting software developed by the Division's contract provider.

 

R156-37f-801b. Access to Information in the Database Submitted by Pharmacies Participating in the Pilot Program for Real-time Reporting.

In accordance with Subsection 58-37f-801(8), access to information in the Database submitted by pharmacies participating in the pilot program for real-time reporting shall be the same as set forth in Section 58-37f-301 as implemented by Section R156-37f-301.]

 

KEY: controlled substance database, licensing

Date of Enactment or Last Substantive Amendment: [February 24, 2015]2016

Authorizing, and Implemented or Interpreted Law: 58-1-106(1)(a); 58-37f-301(1)