DAR File No. 42220

Commerce, Occupational and Professional Licensing

Rule R156-37f

Controlled Substance Database Act Rule

Notice of Proposed Rule

(Amendment)

DAR File No.: 42220
Filed: 10/16/2017 11:56:24 AM

RULE ANALYSIS

Purpose of the rule or reason for the change:

These proposed amendments are recommended by the Division of Occupational and Professional Licensing (Division) in collaboration with the Utah State Board of Pharmacy, to update and clarify the standards, timing, and data required to be reported to the Controlled Substance Database, in accordance with the requirements of the American Society for Automation in Pharmacy (ASAP) Format, the capability or functionality of Database collection instruments, and the intent of the Controlled Substance Database Act. The primary changes include: 1) specifying certain data fields that must be completed, and deleting references to obsolete or unclear data requirements; 2) establishing standards and required data fields for daily zero reporting (in addition to the available reporting waiver); 3) clarifying that the submitted data is to be based on the date that the prescription drug leaves the pharmacy; and 4) conforming the requirements for Database access to the intent of the statute, by requiring each registered user to apply for an online account and user name, and prohibiting sharing of passwords and personal identification numbers (PINs).

Summary of the rule or change:

Formatting changes are made throughout these sections for clarification. In Section R156-37f-102, the proposed amendments add the following definitions: 1) new Subsections (6) and (12) define the terms "null report" and "zero report", respectively, meaning a report containing the data fields required by Subsection R156-37f-203(5), indicating that no controlled substance required to be reported has been dispensed since the previous submission of data; 2) new Subsection (8) defines the terms "point of sale date", "POS date", and "Date Sold" as the date that the prescription drug leaves the pharmacy (and not the date that the prescription was filled, if the dates differ). This definition also clarifies that ASAP Version 4.2 uses the "DSP17" field to identify the point of sale date. In Subsections R156-37f-203(1) and (2), the proposed amendments make formatting changes for clarity, by renumbering previous subsections (3) and (4) to subsections (1) and (2), respectively, in order to conform the provisions of this rule more closely with the provisions of the Controlled Substance Database Act. These proposed amendments also change the working title of the CSD "Manager" to CSD "Administrator", and, together with the definitions established in Section R156-37f-102, clarify that the data submitted to the Database shall be from the date the drug leaves the pharmacy. In Subsection R156-37f-203(3) and (4), the proposed amendments update and clarify what data must be submitted to the Database, by deleting references to obsolete or unclear data requirements, and specifying the ASAP Version 4.2 data fields that must be completed to capture data in accordance with the intent of the Controlled Substance Database Act and the capability or functionality of Database collection instruments. In Subsection R156-37f-203(5), the proposed amendments require "zero reporting" to the Database if no controlled substance required to be reported has been dispensed since the previous submission of data, and specify the data fields that must be completed to submit a zero report in accordance with ASAP Version 4.2. In Subsection R156-37f-203(6), minor formatting changes are made to this subsection for clarification. In Subsection R156-37f-301(2), the proposed amendments further conform the requirements for Database access to the Controlled Substance Database Act, by 1) requiring each registered user to apply for an online account and user name only under the specific Controlled Substance Database Act provision under which he or she qualifies; and 2) prohibiting a registered user from permitting another person to have knowledge of or use his or her assigned password or PIN.

Statutory or constitutional authorization for this rule:

• Subsection 58-1-106(1)(a)
• Subsection 58-37f-301(1)

Anticipated cost or savings to:

the state budget:

No fiscal impact is anticipated to the state budget from any of the formatting changes. The proposed amendments are being made to further clarify and to codify best practices with respect to Section 58-37f-203 regarding the submission, collection, and maintenance of the data contained in the Database, and to further clarify and to codify best practices with respect to Section 58-37f-301 regarding access to the Database.

local governments:

No fiscal impact is anticipated to any local government from any of the formatting changes, because the proposed amendments do not apply to local governments, and they only further clarify and codify best practices with respect to Section 58-37f-203 regarding the submission, collection, and maintenance of the date contained in the Database, and further clarify and codify best practices with respect to Section 58-37f-301 regarding access to the Database.

small businesses:

No additional fiscal impact is anticipated to any small businesses from any of the formatting changes. The proposed amendments are being made only to further clarify and to codify best practices with respect to Section 58-37f-203 regarding the submission, collection, and maintenance of the date contained in the Database, and further clarify and codify best practices with respect to Section 58-37f-301 regarding access to the Database.

persons other than small businesses, businesses, or local governmental entities:

No additional fiscal impact is anticipated to other persons from any of the formatting changes. The proposed amendments are being made only to further clarify and to codify best practices with respect to Section 58-37f-203 regarding the submission, collection, and maintenance of the date contained in the Database, and further clarify and codify best practices with respect to Section 58-37f-301 regarding access to the Database.

Compliance costs for affected persons:

The Division estimates that the proposed amendments will not impose any compliance costs on persons affected by this rule, because the proposed amendments are only being made to further clarify and to codify best practices with respect to Section 58-37f-203 regarding the submission, collection, and maintenance of the data contained in the Database, and to further clarify and to codify best practices with respect to Section 58-37f-301 regarding access to the Database.

Comments by the department head on the fiscal impact the rule may have on businesses:

The proposed rule changes recommended by the Division and the Utah State Board of Pharmacy update and clarify the standards, timing, and data required to be reported to the Controlled Substance Database in accordance with the requirements of the American Society for Automation in Pharmacy (ASAP) Format. The proposed amendments are being made only to further clarify and to codify best practices with respect to Section 58-37f-203 regarding the submission, collection, and maintenance of the data contained in the Database, and to further clarify and to codify best practices with respect to Section 58-37a-301 regarding access to the Database. No fiscal impact is anticipated by reason of these rule changes.

Francine A. Giani, Executive Director

The full text of this rule may be inspected, during regular business hours, at the Office of Administrative Rules, or at:

Commerce
Occupational and Professional Licensing
HEBER M WELLS BLDG
160 E 300 S
SALT LAKE CITY, UT 84111-2316

Direct questions regarding this rule to:

• David Furlong at the above address, by phone at 801-530-6608, by FAX at 801-530-6511, or by Internet E-mail at dfurlong@utah.gov

Interested persons may present their views on this rule by submitting written comments to the address above no later than 5:00 p.m. on:

12/01/2017

Interested persons may attend a public hearing regarding this rule:

• 11/16/2017 11:30 AM, Heber Wells Bldg, 160 E 300 S, Conference Room 464, Salt Lake City, UT

This rule may become effective on:

12/08/2017

Authorized by:

Mark Steinagel, Director

R156. Commerce, Occupational and Professional Licensing.

R156-37f. Controlled Substance Database Act Rule.

R156-37f-102. Definitions.

In addition to the definitions in Sections 58-17b-102, 58-37-2 and 58-37f-102, as used in this chapter:

(1) "ASAP" means the American Society for Automation in Pharmacy system.

(2) "DEA" means Drug Enforcement Administration.

(3) "NABP" means the National Association of Boards of Pharmacy.

(4) "NCPDP" means National Council for Prescription Drug Programs.

(5) "NDC" means National Drug Code.

(6) "Null report" means the same as zero report.

([6]7) "ORI" means Originating Agency Identifier Number.

(8) "Point of sale date", "POS date", or "Date Sold" means the date the prescription drug left the pharmacy (not the date the prescription drug was filled, if the dates differ). ASAP Version 4.2 uses the "DSP17" field to identify the point of sale date.

([7]9) "Positive identification" means:

(a) one of the following photo identifications issued by a foreign or domestic government:

(i) driver's license;

(ii) non-driver identification card;

(iii) passport;

(iv) military identification; or

(v) concealed weapons permit; or

(b) if the individual does not have government-issued identification, alternative evidence of the individual's identity as deemed appropriate by the pharmacist, as long as the pharmacist documents in a prescription record a description of how the individual was positively identified.

([8]10) "Research facility" means a facility in which research takes place that has policies and procedures describing such research.

([9]11) "Rx" means a prescription.

(12) "Zero report" means a report containing the data fields required by Subsection R156-37f-203(5), indicating that no controlled substance required to be reported has been dispensed since the previous submission of data.

 

R156-37f-203. Submission, Collection, and Maintenance of Data.

(1) In accordance with Subsection 58-37f-203(1), each pharmacy or pharmacy group shall submit the data required in this section on a daily basis, either in real time or daily batch file reporting. The submitted data shall be from the point of sale date.

(a) If the data is submitted by a single pharmacy entity, the data shall be submitted in chronological order according to the date each prescription was filled.

(b) If the data is submitted by a pharmacy group, the data shall be sorted by individual pharmacy within the group, and the data of each individual pharmacy within the group shall be submitted in chronological order according to the date each prescription was filled.

(2) In accordance with Subsections 58-37f-203(2), (3), and (6), the data required by this section shall be submitted to the Database through one of the following methods:

(a) electronic data sent via a secured internet transfer method, including sFTP site transfer;

(b) secure web base service; or

(c) any other electronic method approved by the Database administrator prior to submission.

([1]3) [The]In accordance with Subsections 58-37f-203(2), (3), and (6), the format used [as a guide ]for submission to the Database shall be [in accordance with v]Version 4.2 of the American Society for Automation in Pharmacy (ASAP) [Telecommunications ]Format for Controlled Substances[published by the American Society for Automation in Pharmacy]. The Division may approve alternative formats substantially similar to this standard.[This standard is further classified by the Database as follows:

(a) Mandatory Data. The following Database data fields are mandatory:

(i) pharmacy NABP or NCPDP number;

(ii) identification number of person picking up filled prescription;

(iii) patient birth date;

(iv) patient gender code;

(v) date filled;

(vi) Rx number;

(vii) new-refill code;

(viii) metric quantity;

(ix) days supply;

(x) NDC number;

(xi) prescriber identification number;

(xii) date Rx written;

(xiii) number refills authorized;

(xiv) patient last name;

(xv) patient first name;

(xvi) patient address;

(xvii) five-digit zip code; and

(xviii) date sold (point of sale).

(b) Preferred Data. The following Database data fields are strongly suggested:

(i) compound code;

(ii) DEA suffix;

(iii) Rx origin code;

(iv) customer location;

(v) alternate prescriber number;

(vi) state in which the prescription is filled;

(vii) method of payment; and

(viii) dispensing pharmacist state license number.

(c) Optional Data. All other data fields in the ASAP 4.2 Format not included in Subsections (a) and (b) are optional.

(2) Upon request, the Division will consider approving alternative formats, or adjustments to the ASAP Format, as might be necessary due to the capability or functionality of Database collection instruments. A proposed alternative format shall contain all mandatory data elements.]

(4) In accordance with Subsection 58-37f-203(6), the pharmacist identified in Subsections 58-37f-203(2) and (3) shall provide the following data fields to the Division:

(a) version of ASAP used to send transaction (ASAP 4.2 code = TH01);

(b) transaction control number (TH02);

(c) date transaction created (TH05);

(d) time transaction created (TH06);

(e) file type (production or test) (TH07);

(f) segment terminator character (TH09);

(g) information source identification number (IS01);

(h) information source entity name (IS02);

(i) identifier assigned to reporting pharmacy assigned by NCPDP/NABP (PHA02);

(j) DEA registration number of dispensing pharmacy (PHA03);

(k) patient last name (PAT07);

(l) patient first name (PAT08);

(m) patient address (PAT12);

(n) patient city of residence (PAT14);

(o) patient zip code (PAT 16);

(p) patient date of birth (PAT18);

(q) dispensing status - new, revised, or void (DSP01);

(r) prescription number (DSP02);

(s) date prescription written by prescriber (DSP03);

(t) number of refills authorized by prescriber (DSP04);

(u) date prescription dispensed at dispensing pharmacy (DSP05);

(v) if current dispensed prescription is a refill, number of the refill (DSP06);

(w) product identification qualifier (DSP07);

(x) NDC 11-digit drug identification number (DSP08);

(y) quantity of drug dispensed in metric units (DSP09);

(z) days supply dispensed (DSP10)

(aa) date drug left the pharmacy (DSP17);

(bb) DEA registration number of prescribing practitioner (PRE02);

(cc) state that issued identification of individual picking up dispensed drug (AIR03);

(dd) type of identification used by individual picking up dispensed drug (AIR04);

(ee) identification number of individual picking up dispensed drug (AIR05);

(ff) last name of individual picking up dispensed drug (AIR07);

(gg) first name of individual picking up dispensed drug (AIR08);

(hh) dispensing pharmacist last name (AIR09);

(ii) dispensing pharmacist first name (AIR10);

(jj) number of detail segments included for the pharmacy (TP01);

(kk) transaction control number (TT01); and

(ll) total number of segments included in the transaction (TT02).

(5) In accordance with Subsection 58-37f-203(6), if no controlled substance required to be reported has been dispensed since the previous submission of data, then the reporting pharmacist in charge shall submit a zero report to the Division, which shall include the following data fields:

(a) version of ASAP used to send transaction (TH01);

(b) transaction control number (TH02);

(c) transaction type (value 1: send/request transaction) (TH03);

(d) date transaction created (TH05);

(e) time transaction created (TH06);

(f) file type (production or test) (TH07);

(g) information source identification number (IS01);

(h) information source entity name (IS02);

(i) free form message (IS03);

(j) National Provider Identifier (PHA01);

(k) patient last name = "Report" (PAT07);

(l) patient first name = "Zero" (PAT08);

(m) date prescription dispensed at dispensing pharmacy (DSP05);

(n) number of detail segments included for the pharmacy (TP01);

(o) transaction control number (TT01); and

(p) total number of segments included in the transaction (TT02).

[(3) In accordance with Subsection 58-37f-203(1)(a), the data required in Subsection (1) shall be submitted to the Database through one of the following methods:

(a) electronic data sent via a secured internet transfer method, including sFTP site transfer;

(b) secure web base service; or

(c) any other electronic method approved by the Database manager prior to submission.

(4) In accordance with Subsection 58-37f-203(1)(a):

(a) Effective January 1, 2016, each pharmacy or pharmacy group shall submit data collected on a daily basis either in real time or daily batch file reporting. The submitted data shall be from the point of sale (POS) date.

(i) If the data is submitted by a single pharmacy entity, the data shall be submitted in chronological order according to the date each prescription was filled.

(ii) If the data is submitted by a pharmacy group, the data is required to be sorted by individual pharmacy within the group, and the data of each individual pharmacy within the group is required to be submitted in chronological order according to the date each prescription was filled.]

([b]6)[(i) A] In accordance with Subsection 58-37f-203(2), a Class A, B, or D pharmacy or pharmacy group that has a controlled substance license but is not dispensing controlled substances and does not anticipate doing so in the immediate future may request a waiver or submit a certification of such, in a form preapproved by the Division, in lieu of daily null reporting[.]:

([ii]a) The waiver or certification must be resubmitted at the end of each calendar year.

([iii]b) If a pharmacy or pharmacy group that has submitted a waiver or certification under this Subsection [(4)(b) ]dispenses a controlled substance:

([A]i) the waiver or certification shall immediately and automatically terminate;

([B]ii) the pharmacy or pharmacy group shall provide written notice of the waiver or certification termination to the Division within seven days of dispensing the controlled substance; and

([C]iii) the Database reporting requirements shall [be applicable]apply to the pharmacy or pharmacy group immediately upon the dispensing of the controlled substance.

 

R156-37f-301. Access to Database Information.

In accordance with Subsections 58-37f-301(1)(a) and (b):

(1) The Division Director may designate those individuals employed by the Division who may have access to the information in the Database (Database staff).

(2)(a) An applicant to become a registered user of the Database shall apply for an online account and user name only under the specific subparagraph in Subsection 58-37f-301(2) under which he or she qualifies.

(b) A registered user shall not permit another person to have knowledge of or use the registered user's assigned password or PIN.

([2]3)(a) A request for information from the Database may be made:

(i) directly to the Database by electronic submission, if the requester is registered to use the Database; or

(ii) by oral or written submission to the Database staff, if the requester is not registered to use the Database.

(b) An oral request may be submitted by telephone or in person.

(c) A written request may be submitted by facsimile, email, regular mail, or in person except as otherwise provided herein.

(d) The Division may in its discretion require a requestor to verify the requestor's identity.

([3]4) The following Database information may be disseminated to a verified requestor who is permitted to obtain the information:

(a) dispensing/reporting pharmacy ID number/name;

(b) subject's birth date;

(c) date prescription was filled;

(d) prescription (Rx) number;

(e) metric quantity;

(f) days supply;

(g) NDC code/drug name;

(h) prescriber ID/name;

(i) date prescription was written;

(j) subject's last name;

(k) subject's first name; and

(l) subject's street address;

([4]5)(a) Federal, state and local law enforcement authorities and state and local prosecutors requesting information from the Database under Subsection 58-37f-301(2)(k) must provide a valid search warrant authorized by the courts, which may be provided using one of the following methods:

(i) in person;

(ii) by email to csd@utah.gov;

(iii) facsimile; or

(iv) U.S. Mail.

(b) Information in the search warrant should be limited to subject's name and birth date.

(c) Information provided as a result of the search warrant shall be in accordance with Subsection (3).

([5]6) In accordance with Subsection 58-37f-301(2)(n), a probation or parole officer employed by the Department of Corrections or a political subdivision may have access to the database without a search warrant, for supervision of a specific probationer or parolee under the officer's direct supervision, if the following conditions have been met:

(a) a security agreement signed by the officer is submitted to the division for access, which contains:

(i) the agency's name;

(ii) the agency's complete address, including city and zip code;

(iii) the agency's ORI number;

(iv) a copy of the officer's driver's license;

(v) the officer's full name;

(vi) the officer's contact phone number;

(vii) the officer's email address; and

(b) the online database account includes the officer's:

(i) full name;

(ii) email address;

(iii) complete home address, including city and zip code;

(iv) work title;

(v) contact phone number;

(vi) complete work address including city and zip code;

(vii) work phone number; and

(viii) driver's license number.

([6]7)(a) In accordance with Subsection 58-37f-302(q), an individual may receive an accounting of persons or entities that have requested or received Database information about the individual.

(b) An individual may request the information in person or in writing by the following means:

(i) email;

(ii) facsimile; or

(iii) U.S. Mail.

(c) The request for information shall include the following:

(i) individuals' full name, including all aliases;

(ii) birth date;

(iii) home address;

(iv) government issued identification; and

(v) date-range.

(d) The results may be disseminated in accordance with Subsection ([17]18).

(e) The information provided in the report may include the following:

(i) the role of the person that accessed the information;

(ii) the date and a description of the information that was accessed;

(iii) the name of the person or entity that requested the information; and

(iv) the name of the practitioner on behalf of whom the request for information was made, if applicable.

([7]8) An individual whose records are contained within the Database may obtain his or her own information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity; or

(b) submitting a signed and notarized request that includes the requester's:

(i) full name;

(ii) complete home address;

(iii) date of birth; and

(iv) driver license or state identification card number.

([8]9) A requester holding power of attorney for an individual whose records are contained within the Database may obtain the individual's information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity; and

(b) providing:

(i) an original, properly executed power of attorney designation; and

(ii) a signed and notarized request, executed by the individual whose information is contained within the Database, and including the individual's:

(A) full name;

(B) complete home address;

(C) date of birth; and

(D) driver license or state identification card number verifying the individual's identity.

([9]10) A requestor who is the legal guardian of a minor or incapacitated individual whose records are contained within the Database may obtain the individual information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity;

(b) submitting the minor or incapacitated individual's:

(i) full name;

(ii) complete home address;

(iii) date of birth; and

(iv) if applicable, state identification card number verifying the individual's identity; and

(c) submitting legal proof that the requestor is the guardian of the individual who is the subject of the request for information from the Database.

([10]11) A requestor who has a release-of-records from an individual whose records are contained within the Database may obtain the individual's information and records by:

(a) submitting a request in writing;

(b) submitting an original, signed and notarized release-of-records in a format acceptable to the Database staff, identifying the purpose of the release; and

(c) submitting the individual's:

(i) full name;

(ii) complete home address;

(iii) telephone number;

(iv) date of birth; and

(v) driver license or state identification card number verifying the identity of the person who is the subject of the request.

([11]12) An employee of a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(i)if, prior to making the request:

(a) the licensed practitioner has provided to the Division a written designation that includes the designating practitioner's DEA number and the designated employee's:

(i) full name;

(ii) complete home address;

(iii) e-mail address;

(iv) date of birth;

(v) driver license number or state identification card number; and

(vi) the written designation is manually signed by the licensed practitioner and designated employee.

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

([12]13) An employee of a business that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(i) if, prior to making the request:

(a) the licensed practitioner and employing business have provided to the Division a written designation that includes:

(i) the designating practitioner's DEA number;

(ii) the name of the employing business; and

(iii) the designated employee's:

(A) full name;

(B) complete home address;

(C) e-mail address;

(D) date of birth; and

(E) driver license number or state identification card number;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

([13]14) An individual who is employed in the emergency room of a hospital that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(d) if, prior to making the request:

(a) the practitioner and the hospital operating the emergency room have provided to the Division a written designation that includes:

(i) the designating practitioner's DEA number;

(ii) the name of the hospital;

(iii) the names of all emergency room practitioners employed at the hospital; and

(iv) the designated employee's:

(A) full name;

(B) complete home address;

(C) e-mail address;

(C) date of birth; and

(D) driver license number or state identification card number;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

([14]15) In accordance with Subsection 58-37f-301(5), an individual's requests to the division regarding third-party notice when a controlled substance prescription is dispensed to that individual, shall be made as follows:

(a) A request to provide notice to a third party shall be made in writing dated and signed by the requesting individual, and shall include the following information:

(i) the requesting individual's:

(A) birth date;

(B) complete home address including city and zip code;

(C) email address; and

(D) contact phone number; and

(ii) the designated third party's:

(A) complete home address, including city and zip code;

(B) email address; and

(C) contact phone number.

(b) A request to discontinue providing notice to a designated third party shall be made by a writing dated and signed by the requesting individual, after which the division shall:

(i) provide notice to the requesting individual that the discontinuation notice was received; and

(ii) provide notice to the designated third party that the notification has been rescinded.

(c) A requesting individual may only have one active designated third party.

([15]16) A licensed pharmacy technician or pharmacy intern employed by a pharmacy may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(l) if, prior to making the request:

(a) the pharmacist-in-charge (PIC) has provided to the Division a written designation authorizing access to the pharmacy technician or pharmacy intern on behalf of a licensed pharmacist employed by the pharmacy;

(b) the written designation includes the pharmacy technician's or pharmacy intern's:

(i) full name;

(ii) professional license number assigned by the Division;

(iii) email address;

(iv) contact phone number;

(v) pharmacy name and location;

(vi) pharmacy DEA number;

(vii) pharmacy phone number;

(c) the written designation includes the pharmacist-in-charge's (PIC's):

(i) full name;

(ii) professional license number assigned by the Division;

(iii) email address;

(iv) contact phone number;

(d) the written designation includes the assigned pharmacist's:

(i) full name;

(ii) professional license number assigned by the Division;

(iii) email address;

(iv) contact phone number; and

(e) the written designation includes the following signatures:

(i) pharmacy technician or pharmacy intern;

(ii) pharmacist-in-charge (PIC); and

(iii) assigned pharmacist if different than the PIC.

([16]17) The Utah Department of Health may access Database information for purposes of scientific study regarding public health. To access information, the scientific investigator shall:

(a) demonstrate to the satisfaction of the Division that the research is part of an approved project of the Utah Department of Health;

(b) provide a description of the research to be conducted, including:

(i) a research protocol for the project; and

(ii) a description of the data needed from the Database to conduct that research;

(c) provide assurances and a plan that demonstrates all Database information will be maintained securely, with access being strictly restricted to the requesting scientific investigator;

(d) provide for electronic data to be stored on a secure database computer system with access being strictly restricted to the requesting scientific investigator; and

(e) pay all relevant expenses for data transfer and manipulation.

([17]18) Database information that may be disseminated under Section 58-37f-301 may be disseminated by the Database staff either:

(a) verbally;

(b) by facsimile;

(c) by email;

(d) by U.S. mail; or

(e) by electronic access, where adequate technology is in place to ensure that a record will not be compromised, intercepted, or misdirected.

 

KEY: controlled substance database, licensing

Date of Enactment or Last Substantive Amendment: [December 22, 2016]2017

Authorizing, and Implemented or Interpreted Law: 58-1-106(1)(a); 58-37f-301(1)