DAR File No. 43353

Commerce, Occupational and Professional Licensing

Rule R156-37f

Controlled Substance Database Act Rule

Notice of Proposed Rule

(Amendment)

DAR File No.: 43353
Filed: 11/01/2018 09:33:20 AM

RULE ANALYSIS

Purpose of the rule or reason for the change:

These proposed amendments update this rule regarding the data to be reported to the Controlled Substance Database (Database), pursuant to H.B. 158 (2018) which modified requirements for providing information to the Division of Occupational and Professional Licensing (Division) for inclusion in the Database. These proposed amendments also update this rule to encompass current definitions, standards, and practices and procedures with respect to access to Database information, and make non-substantive formatting changes for comprehensibility.

Summary of the rule or change:

Section R156-37f-102: These proposed amendments add definitions for the following acronyms: "EDS" means "electronic data system" as defined in Subsection 58-37f-303(1)(c), "EHR" means electronic health record, and "HIE" means health information exchange. Section R156-37f-203: These proposed amendments: 1) conform the language of this rule to Section 58-37f-203 by requiring both "the pharmacist-in-charge and the pharmacist" to report the required data; 2) specify certain data fields that must be completed; and 3) update terms and delete references to obsolete or unclear data requirements. Section R156-37f-301: These proposed amendments update citations, make non-substantive formatting changes for comprehensibility throughout, and make the following clarifications to conform this rule to current practices and procedures: 1) clarify that requests for database information may not be made verbally; 2) clarify that certain information may be included in a search warrant to assist the search, such as subject's birth date, the full name of the prescriber, and date range to be searched; 3) clarify that information provided as a result of a search warrant will be as set forth in this rule unless otherwise specified in the search warrant; 4) clarify that requests from an individual for his or her database information shall be in the form of an original signed and notarized request, and include a clearly legible, color copy of government-issued picture identification confirming the individual's identity; 5) require a third party requesting database information on behalf of an individual to provide: a) an original signed and notarized request form furnished by the Division together with a clearly legible, color copy of government-issued picture identification confirming the requester's identity; and b) an original or certified copy of properly executed legal documentation of the third-party requester's authority, in particular, an agent under a power of attorney must be a current agent under a power of attorney that either authorizes the agent to make health care decisions for the individual, allows the agent to have access to the patient's protected health information under HIPAA, or grants the agent specific authority to obtain database information; 6) deletes the requirement that the written designation provided to the Division by a practitioner and hospital operating an emergency department include the names of all emergency room practitioners employed at the hospital; 7) clarifies that requests to provide access to a designated employee should include the designating practitioner's email address account registered with the Database, and identify the employee's professional license number, if any; and 8) with respect to an individual's request for the Division to provide notice to a third party when a controlled substance prescription is dispensed to that individual: a) clarifies that the request to begin or discontinue notice shall be made on an original signed and notarized request form as furnished by the Division and include a clearly legible, color copy, of government-issued picture identification confirming the individual's identity; and b) increases from one to three the number of active third parties that an individual may designate to receive notice. Section R156-37f-303: These proposed amendments: 1) update the reference to the interface with the database as the "Division-approved Prescription Monitoring Program (PMP) Hub system"; and 2) clarify that to access information in the database via an electronic data system (EDS), the user must register to use the database by creating an approved account established by the Division pursuant to a memorandum of understanding with the Division, and must use the unique username and password associated with the account.

Statutory or constitutional authorization for this rule:

• Subsection 58-1-106(1)(a)
• Subsection 58-37f-301(1)

Anticipated cost or savings to:

the state budget:

Section R156-37f-102: These proposed amendments are not expected to impact state revenues or expenditures because these new definitions merely encompass current industry standards. Section R156-37f-203: These proposed amendments will apply to persons who provide pharmacy services and dispense controlled substances. This may include certain state government entities acting as businesses. However, because these amendments only make minor adjustments regarding required submissions to encompass current industry standards, in accordance with the Controlled Substance Database Act as amended by H.B. 158 (2018), the Division estimates that these proposed amendments will have no impact on the state budget. Sections R156-37f-301 and R156-37f-303: These proposed amendments, which update this rule to clarify standards and encompass current requirements for access to Database information, are not expected to have any impact on the state budget beyond a potential time savings for Division staff due to better explanation of the procedures that must be followed for requests and an improvement in the quality of information that will be provided to the staff. However, the exact savings cannot be estimated as it will vary depending on the circumstances and the nature of the requests that are made, and the relevant data is unavailable. Any savings will be absorbed within the Division's current budget. No other fiscal impact to the state is expected, beyond a minimal cost to the Division of approximately $75 to print and distribute this rule once these proposed amendments are made effective.

local governments:

These proposed amendments to Section R156-37f-203 may impact persons who provide pharmacy services and dispense controlled substances, which may include certain local government entities acting as businesses. However, because these amendments only make minor adjustments regarding required submissions to encompass current industry standards, in accordance with the Controlled Substance Database Act as amended by H.B. 158 (2018), the Division estimates that these proposed amendments will have no impact on local governments. None of the other amendments are expected to impact local governments' revenues or expenditures because they do not apply to local governments.

small businesses:

The Database collects data on the dispensing of Schedule II-V drugs from retail, institutional, and outpatient hospital pharmacies, and in-state/out-of-state mail order pharmacies. There are approximately 521 small business Class A pharmacies, 274 small business Class B pharmacies, 723 small business Class D pharmacies, and 573 small business Class E pharmacies licensed in Utah, and if any of these are involved in dispensing controlled substances they will be required to comply with these proposed amendments to Section R156-37f-203. For a complete listing of the NAICS codes used in this analysis, please contact the Division. However, the Division does not expect these amendments to impact the revenues or expenditures of these small businesses because these amendments only make minor adjustments to required submissions to encompass current industry standards, in accordance with the Controlled Substance Database Act as amended by H.B. 158 (2018). Additionally, the Division does not expect any of the other proposed amendments to impact small businesses' revenues or expenditures because the other amendments merely ensure that this rule encompasses current definitions, standards, and practices and procedures with respect to access to Database information.

persons other than small businesses, businesses, or local governmental entities:

Sections R156-37f-102: These proposed amendments are not expected to impact other persons because these new definitions merely encompass current industry standards. Section R156-37f-203: These proposed amendments will apply to the estimated 3,774 licensed pharmacists that provide pharmacy services and dispense controlled substances. However, because these proposed amendments only make minor adjustments to required submissions to encompass current industry standards, in accordance with the Controlled Substance Database Act as amended by H.B. 158 (2018), the Division estimates that these amendments will have no impact on these licensees. Section R156-37f-301: These proposed amendments are not expected to impact other persons because they merely update this rule to encompass current standards, and practices and procedures for access to Database information. These changes and clarifications will apply to individuals who choose to request information regarding the individual's records contained within the Database, and to individuals who wish to have the Division provide notice to third parties regarding the dispensing of controlled substances to those individuals. In addition, these amendments will apply to any third parties who choose to make such requests on behalf of such individuals. There could be a potential time savings and corresponding financial savings for these persons due to the clarification of the request procedures to be followed, but an amount cannot be estimated as it will vary substantially from person to person depending on each individual's circumstances and the nature of each request, and the relevant data is unavailable. Overall, the Division still expects that these amendments will have no aggregate impact on these other persons because Database staff already follows the practices and procedures provided in these amendments, including requiring requesters to submit an original signed and notarized request form as furnished by the Division, and to provide satisfactory documentation confirming the requester's identity and authority. Section R156-37f-303: These proposed amendments will apply to EDS users who wish to access Database information via the EDS, but these amendments are not expected to impact these persons because they merely update this rule to encompass current EDS access terms and standards.

Compliance costs for affected persons:

Sections R156-37f-102: These proposed amendments are not expected to impose any compliance costs for affected persons because these new definitions merely encompass current industry standards. Section R156-37f-203: These proposed amendments will apply to a licensed pharmacist that provides pharmacy services and dispenses controlled substances. However, because these proposed amendments only make minor adjustments to required submissions to encompass current industry standards, in accordance with the Controlled Substance Database Act as amended by H.B. 158 (2018), the Division estimates that these amendments will have no compliance costs for these affected persons. Sections R156-37f-301 and R156-37f-303: The Division does not expect any of these proposed amendments to impose compliance costs on any affected persons because these amendments merely ensure that this rule encompasses current definitions, standards, and practices and procedures with respect to access to Database information.

Comments by the department head on the fiscal impact the rule may have on businesses:

These proposed amendments update this rule regarding the data to be reported to the Controlled Substance Database, pursuant to H.B. 158 (2018), which modified requirements for providing information to the Division for inclusion in the Database. These proposed amendments also update this rule to encompass current definitions, standards, and practices and procedures with respect to access to Database information and make non-substantive formatting changes for comprehensibility. The Database collects data on the dispensing of Schedule II-V drugs from retail, institutional, and outpatient hospital pharmacies, and in-state/out-of-state mail order pharmacies. There are approximately 521 small business Class A pharmacies, 274 small business Class B pharmacies, 723 small business Class D pharmacies, and 573 small business Class E pharmacies licensed in Utah. If any of these are involved in dispensing controlled substances, they will be required to comply with these proposed amendments to Section R156-37f-203. However, the Division does not expect these amendments to impact the revenues or expenditures of these small businesses because these amendments only make minor adjustments to required submissions to encompass current industry standards, in accordance with the Controlled Substance Database Act as amended by H.B. 158 (2018). Additionally, the Division does not expect any of the other proposed amendments to impact small businesses revenues or expenditures because the other amendments merely ensure that this rule encompasses current definitions, standards, and practices and procedures with respect to access to Database information. Non-Small Businesses. The Database collects data on the dispensing of Schedule II-V drugs from retail, institutional, and outpatient hospital pharmacies, and in-state/out-of-state mail order pharmacies. There are approximately 10 non-small business Class A pharmacies, 5 non-small business Class B pharmacies, 15 non-small business Class D pharmacies, and 12 non-small business Class E pharmacies licensed in Utah. If any of these are involved in dispensing controlled substances, they will be required to comply with these proposed amendments to Section R156-37f-203. However, the Division does not expect these amendments to impact the revenues or expenditures of these non-small businesses because these amendments only make minor adjustments to required submissions to encompass current industry standards, in accordance with the Controlled Substance Database Act as amended by H.B. 158 (2018). The proposed amendment to Section R156-37f-301, that deletes the requirement that the written designation provided to the Division by a practitioner and hospital operating an emergency department include the names of all emergency department practitioners employed at the hospital, will apply to an estimated 91 non-small business facility hospitals or HMO medical centers (NAICS 622110). This amendment is expected to create a slight time savings and corresponding financial savings for these non-small businesses. However, the amount cannot be estimated as it will vary substantially depending on the characteristics of each emergency department. The Division does not expect any of the other proposed amendments to impact non-small businesses revenues or expenditures because the other amendments merely ensure that this rule encompasses current definitions, standards, and practices and procedures with respect to access to Database information.

Francine A. Giani, Executive Director

The full text of this rule may be inspected, during regular business hours, at the Office of Administrative Rules, or at:

Commerce
Occupational and Professional Licensing
HEBER M WELLS BLDG
160 E 300 S
SALT LAKE CITY, UT 84111-2316

Direct questions regarding this rule to:

• David Furlong at the above address, by phone at 801-530-6608, by FAX at 801-530-6511, or by Internet E-mail at dfurlong@utah.gov
• Ronald Larsen at the above address, by phone at 801-530-6197, by FAX at 801-530-6511, or by Internet E-mail at ronaldlarsen@utah.gov

Interested persons may present their views on this rule by submitting written comments to the address above no later than 5:00 p.m. on:

12/17/2018

Interested persons may attend a public hearing regarding this rule:

• 11/20/2018 09:30 AM, 160 East 300 South, Conference Room 464 (4th floor), Salt Lake City, Utah

This rule may become effective on:

12/24/2018

Authorized by:

Mark Steinagel, Director

Appendix 1: Regulatory Impact Summary Table*

Fiscal Costs	FY 2019	FY 2020	FY 2021
State Government	$0	$0	$0
Local Government	$0	$0	$0
Small Businesses	$0	$0	$0
Non-Small Businesses	$0	$0	$0
Other Person	$0	$0	$0
Total Fiscal Costs:	$0	$0	$0
Fiscal Benefits
State Government	$0	$0	$0
Local Government	$0	$0	$0
Small Businesses	$0	$0	$0
Non-Small Businesses	$0	$0	$0
Other Persons	$0	$0	$0
Total Fiscal Benefits:	$0	$0	$0
Net Fiscal Benefits:	$0	$0	$0

 

*This table only includes fiscal impacts that could be measured. If there are inestimable fiscal impacts, they will not be included in this table. Inestimable impacts for State Government, Local Government, Small Businesses and Other Persons are described above. Inestimable impacts for Non-Small Businesses are described below.

 

Appendix 2: Regulatory Impact to Non-Small Businesses (50 or more employees)

The Database collects data on the dispensing of Schedule II-V drugs from retail, institutional, and outpatient hospital pharmacies, and in-state/out-of-state mail order pharmacies. There are approximately 10 non-small business Class A pharmacies, 5 non-small business Class B pharmacies, 15 non-small business Class D pharmacies, and 12 non-small business Class E pharmacies licensed in Utah, and if any of these are involved in dispensing controlled substances they will be required to comply with the proposed amendments to Section R156-37f-203. (For a complete listing of the NAICS codes used in this analysis, please contact the Division.) However, the Division does not expect these amendments to impact the revenues or expenditures of these non-small businesses because the amendments only make minor adjustments to required submissions to encompass current industry standards, in accordance with the Controlled Substance Database Act as amended by H.B. 158 (2018). The proposed amendment to Section R156-37f-301 that deletes the requirement that the written designation provided to the Division by a practitioner and hospital operating an emergency department include the names of all emergency department practitioners employed at the hospital will apply to an estimated 91 non-small business facility hospitals or HMO medical centers (NAICS 622110), and this amendment is expected to create a slight time savings and corresponding financial savings for these non-small businesses. However, the amount cannot be estimated as it will vary substantially depending on the characteristics of each emergency department. The Division does not expect any of the other proposed amendments to impact non-small business revenues or expenditures because the other amendments merely ensure that the rule encompasses current definitions, standards, and practices and procedures with respect to access to Database information.

 

Agency sign off: The head of the Department of Commerce, Francine A. Giani, has reviewed and approved this fiscal analysis.

 

 

R156. Commerce, Occupational and Professional Licensing.

R156-37f. Controlled Substance Database Act Rule.

R156-37f-102. Definitions.

In addition to the definitions in Sections 58-17b-102, 58-37-2 and 58-37f-102, as used in this chapter:

(1) "ASAP" means the American Society for Automation in Pharmacy system.

(2) "DEA" means Drug Enforcement Administration.

(3) "EDS" means "electronic data system" as defined in Subsection 58-37f-303(1)(c).

(4) "EHR" means electronic health record.

(5) "HIE" means health information exchange.

([3]6) "NABP" means the National Association of Boards of Pharmacy.

([4]7) "NCPDP" means National Council for Prescription Drug Programs.

([5]8) "NDC" means National Drug Code.

([6]9) "Null report" means the same as zero report.

([7]10) "ORI" means Originating Agency Identifier Number.

([8]11) "Point of sale date", "POS date", or "Date Sold" means the date the prescription drug left the pharmacy (not the date the prescription drug was filled, if the dates differ). ASAP Version 4.2 uses the "DSP17" field to identify the point of sale date.

([9]12) "Positive identification" means:

(a) one of the following photo identifications issued by a foreign or domestic government:

(i) driver's license;

(ii) non-driver identification card;

(iii) passport;

(iv) military identification; or

(v) concealed weapons permit; or

(b) if the individual does not have government-issued identification, alternative evidence of the individual's identity as deemed appropriate by the pharmacist, as long as the pharmacist documents in a prescription record a description of how the individual was positively identified.

([10]13) "Research facility" means a facility in which research takes place that has policies and procedures describing such research.

([11]14) "Rx" means a prescription.

([12]15) "Zero report" means a report containing the data fields required by Subsection R156-37f-203(5), indicating that no controlled substance required to be reported has been dispensed since the previous submission of data.

 

R156-37f-203. Submission, Collection, and Maintenance of Data.

(1) In accordance with Subsection 58-37f-203(1), each pharmacy or pharmacy group shall submit the data required in this section on a daily basis, either in real time or daily batch file reporting. The submitted data shall be from the point of sale date.

(a) If the data is submitted by a single pharmacy entity, the data shall be submitted in chronological order according to the date each prescription was [filled]sold.

(b) If the data is submitted by a pharmacy group, the data shall be sorted by individual pharmacy within the group, and the data of each individual pharmacy within the group shall be submitted in chronological order according to the date each prescription was [filled]sold.

(2) In accordance with Subsections 58-37f-203(2), (3), and (6), the data required by this section shall be submitted to the Database through one of the following methods:

(a) electronic data sent via a secured internet transfer method, including sFTP site transfer;

(b) secure web base service; or

(c) any other electronic method approved by the Database administrator prior to submission.

(3) In accordance with Subsections 58-37f-203(2), (3), and (6), the format used for submission to the Database shall be Version 4.2 of the American Society for Automation in Pharmacy (ASAP) Format for Controlled Substances. The Division may approve alternative formats substantially similar to this standard.

(4) In accordance with Subsection 58-37f-203(6), the pharmacist-in-charge and the pharmacist identified in Subsections 58-37f-203(2) and (3) shall provide the following data fields to the Division:

(a) version of ASAP used to send transaction (ASAP 4.2 code = TH01);

(b) transaction control number (TH02);

(c) date transaction created (TH05);

(d) time transaction created (TH06);

(e) file type (production or test) (TH07);

(f) segment terminator character (TH09);

(g) information source identification number (IS01);

(h) information source entity name (IS02);

(i) reporting pharmacy's:

(i) National Provider Identifier (PHA01); and

(ii) identifier assigned [to reporting pharmacy assigned ]by NCPDP/NABP (PHA02), or if none, then[;

(j) ] DEA registration number[ of dispensing pharmacy] (PHA03);

([k]j) patient last name (PAT07);

([l]k) patient first name (PAT08);

([m]l) patient address (PAT12);

([n]m) patient city of residence (PAT14);

([o]n) patient zip code (PAT 16);

([p]o) patient date of birth (PAT18);

([q]p) dispensing status - new, revised, or void (DSP01);

([r]q) prescription number (DSP02);

([s]r) date prescription written by prescriber (DSP03);

([t]s) number of refills authorized by prescriber (DSP04);

([u]t) date prescription [dispensed]filled at dispensing pharmacy (DSP05);

([v]u) if current dispensed prescription is a refill, the number of the refill being dispensed (DSP06);

([w]v) product identification qualifier (DSP07);

([x]w) NDC 11-digit drug identification number (DSP08);

([y]x) quantity of drug dispensed in metric units (DSP09);

([z]y) days supply dispensed (DSP10)

([aa]z) date drug left the pharmacy , i.e. date sold (DSP17);

([bb]aa) DEA registration number of prescribing practitioner (PRE02);

([cc]bb) state that issued identification of individual picking up dispensed drug (AIR03);

([dd]cc) type of identification used by individual picking up dispensed drug (AIR04);

([ee]dd) identification number of individual picking up dispensed drug (AIR05);

([ff]ee) last name of individual picking up dispensed drug (AIR07);

([gg]ff) first name of individual picking up dispensed drug (AIR08);

([hh]gg) dispensing pharmacist last name or initial (AIR09);

([ii]hh) dispensing pharmacist first name (AIR10);

([jj]ii) number of detail segments included for the pharmacy (TP01);

([kk]jj) transaction control number (TT01); and

([ll]kk) total number of segments included in the transaction (TT02).

(5) In accordance with Subsection 58-37f-203(6), if no controlled substance required to be reported has been dispensed since the previous submission of data, then the [reporting pharmacist in charge]pharmacist-in-charge and the pharmacist shall submit a zero report to the Division, which shall include the following data fields:

(a) version of ASAP used to send transaction (TH01);

(b) transaction control number (TH02);

(c) [transaction type (value 1: send/request transaction) (TH03);

(d) ]date transaction created (TH05);

([e]d) time transaction created (TH06);

([f]e) file type (production or test) (TH07);

(f) segment terminator (TH09);

(g) information source identification number (IS01);

(h) information source entity name (IS02);

(i) [free form message]date range (IS03);

(j) reporting pharmacy's:

(i) National Provider Identifier (PHA01); and

(ii) identifier assigned by NCPDB/NABP (PHA02), or if none, then DEA registration number (PHA03);

(k) patient last name = "Report" (PAT07);

(l) patient first name = "Zero" (PAT08);

(m) date prescription dispensed at dispensing pharmacy (DSP05);

(n) number of detail segments included for the pharmacy (TP01);

(o) transaction control number (TT01); and

(p) total number of segments included in the transaction (TT02).

(6) In accordance with Subsection 58-37f-203(2), a Class A, B, [or ]D , or E pharmacy or pharmacy group that has a controlled substance license but is not dispensing controlled substances and does not anticipate doing so in the immediate future may request a waiver or submit a certification of such, in a form preapproved by the Division, in lieu of daily [null reporting]zero reports:

(a) The waiver or certification must be [resubmitted]renewed at the end of each calendar year.

(b) If a pharmacy or pharmacy group that has submitted a waiver or certification under this Subsection dispenses a controlled substance:

(i) the waiver or certification shall immediately and automatically terminate;

(ii) [the pharmacy or pharmacy group shall provide written notice of the waiver or certification termination to the Division within seven days of dispensing the controlled substance; and

(iii) ]the Database reporting requirements of Subsections 58-37f-203(1) and R156-37f-203(1) shall apply to the pharmacy or pharmacy group immediately upon the dispensing of the controlled substance ; and

(iii) the pharmacy or pharmacy group shall notify the Division in writing of the waiver or certification termination within 24 hours or the next business day of the dispensing of the controlled substance, whichever is later.

 

R156-37f-301. Access to Database Information.

In accordance with Subsections 58-37f-301(1)(a) and (b):

(1) The Division Director may designate those individuals employed by the Division who may have access to the information in the Database (Database staff).

(2)(a) An applicant to become a registered user of the Database shall apply for an online account and user name only under the specific subparagraph in Subsection 58-37f-301(2) under which he or she qualifies.

(b) A registered user shall not permit another person to have knowledge of or use the registered user's assigned password or PIN.

(3)(a) A request for information from the Database may be made:

(i) directly to the Database by electronic submission, if the requester is registered to use the Database; or

(ii) by [oral or ]written submission to the Database staff in accordance with the requirements of this section, if the requester is not registered to use the Database.

(b) [An oral request may be submitted by telephone or in person.

(c) ]A written request may be submitted by facsimile, email, regular mail, or in person except as otherwise provided herein.

([d]c) The Division [may in its discretion]shall require a [requestor]requester to verify the [requestor's]requester's identity.

(4) The following Database information may be disseminated to a verified [requestor]requester who is permitted to obtain the information:

(a) dispensing/reporting pharmacy ID number/name;

(b) subject's birth date;

(c) date prescription was [filled]sold;

(d) prescription (Rx) number;

(e) metric quantity;

(f) days supply;

(g) NDC code/drug name;

(h) prescriber ID/name;

(i) [date prescription was written;

(j) ]subject's last name;

([k]j) subject's first name; and

([l]k) subject's street address;

(5)(a) Federal, state and local law enforcement authorities and state and local prosecutors requesting information from the Database under Subsection 58-37f-301(2)([k]m) [must]shall provide a valid search warrant authorized by the courts, which may be provided using one of the following methods:

(i) in person;

(ii) [by ]email to csd@utah.gov;

(iii) facsimile; or

(iv) U.S. Mail.

(b) [Information in the]A search warrant [should be limited to]may include the following information to assist in the search:

(i) for an individual for whom a controlled substance has been prescribed or dispensed, the subject's name and birth date ;

(ii) for a prescriber who is the subject of the investigation, the prescriber's full name; and

(iii) the date range to be searched.

(c) Database information[Information] provided as a result of the search warrant shall be in accordance with Subsection ([3]4) unless otherwise specified in the search warrant.

(6) In accordance with Subsection 58-37f-301(2)(n), a probation or parole officer employed by the Department of Corrections or a political subdivision may have access to the database without a search warrant, for supervision of a specific probationer or parolee under the officer's direct supervision, if the following conditions have been met:

(a) a security agreement signed by the officer is submitted to the [d]Division for access, which contains:

(i) the agency's :

(A) name;

([ii]B) [the agency's ]complete address, including city and zip code; and

([iii]C) [the agency's ]ORI number;

([iv]ii) a copy of the officer's driver's license;

([v]iii) the officer's :

(A) full name;

([vi]B) [the officer's ]contact phone number; and

([vii]C) [the officer's]agency email address; and

(b) the online database account includes the officer's:

(i) full name;

(ii) agency email address;

(iii) complete home address, including city and zip code;

(iv) work title;

(v) contact phone number;

(vi) complete work address including city and zip code;

(vii) work phone number; and

(viii) driver's license number.

(7)[(a)] In accordance with Subsection s 58-37f-301(2)(q) and (r):[58-37f-302(q), ]

(a) [a]An individual may :

(i) obtain the individual's own information and records contained within the Database; and

(ii) unless the individual's record is subject to a pending or current investigation authorized under Subsection 58-37f-301(2)(r), receive an accounting of persons or entities that have requested or received Database information about the individual , to include:

(A) the role of the person that accessed the information;

(B) the date range of the information that was accessed, if available;

(C) the name of the person or entity that requested the information; and

(D) the name of the practitioner on behalf of whom the request was made, if applicable.

(b) [An]The individual may request the information [in person or in writing by the following means:]

[(i) email;

(ii) facsimile; or

(iii) U.S. Mail.

(c) The request for information shall include the following:

(i) individuals' full name, including all aliases;

(ii) birth date;

(iii) home address;

(iv) government issued identification; and

(v) date-range.

(d) The results may be disseminated in accordance with Subsection (18).

(e) The information provided in the report may include the following:

(i) the role of the person that accessed the information;

(ii) the date and a description of the information that was accessed;

(iii) the name of the person or entity that requested the information; and

(iv) the name of the practitioner on behalf of whom the request for information was made, if applicable.

(8) An individual whose records are contained within the Database may obtain his or her own information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity; or

(b) ]by submitting a n original signed and notarized request as furnished by the Division that includes :

(i) the [requester's]individual's:

([i]A) full name , including all aliases;

([ii]B) complete home address;

(C) telephone number; and

([iii]D) date of birth;[and]

([iv]ii) [driver license or state identification card number]a clearly legible, color copy of government-issued picture identification confirming the individual's identity; and

(iii) requested date range for the information.

(c) A third party may request information from the Database on behalf of an individual as provided in Subsection (7)(a), by submitting:

(i) an original signed and notarized request as furnished by the Division;

(ii) a clearly legible, color copy of government-issued picture identification confirming the requester's identity; and

(iii) an original, or certified copy, of properly executed legal documentation acceptable to the Database staff that the requester:

(A) is the individual's current agent under a power of attorney that:

(I) authorizes the agent to make health are decisions for the individual;

(II) allows the agent to have access to the patient's protected health information (PHI) under HIPAA; or

(III) otherwise grants the agent specific authority to obtain Database information on behalf of the individual;

(B) is the parent or court-appointed legal guardian of a minor individual;

(C) is the court-appointed legal guardian of an incapacitated adult individual; or

(D) has an original, signed, and notarized form for release of records from the individual in a format acceptable to the Database staff, that identifies the purpose of the release with respect to the Database.

[(9) A requester holding power of attorney for an individual whose records are contained within the Database may obtain the individual's information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity; and

(b) providing:

(i) an original, properly executed power of attorney designation; and

(ii) a signed and notarized request, executed by the individual whose information is contained within the Database, and including the individual's:

(A) full name;

(B) complete home address;

(C) date of birth; and

(D) driver license or state identification card number verifying the individual's identity.

(10) A requestor who is the legal guardian of a minor or incapacitated individual whose records are contained within the Database may obtain the individual information and records by:

(a) personally appearing before the Database staff with government-issued picture identification confirming the requester's identity;

(b) submitting the minor or incapacitated individual's:

(i) full name;

(ii) complete home address;

(iii) date of birth; and

(iv) if applicable, state identification card number verifying the individual's identity; and

(c) submitting legal proof that the requestor is the guardian of the individual who is the subject of the request for information from the Database.

(11) A requestor who has a release-of-records from an individual whose records are contained within the Database may obtain the individual's information and records by:

(a) submitting a request in writing;

(b) submitting an original, signed and notarized release-of-records in a format acceptable to the Database staff, identifying the purpose of the release; and

(c) submitting the individual's:

(i) full name;

(ii) complete home address;

(iii) telephone number;

(iv) date of birth; and

(v) driver license or state identification card number verifying the identity of the person who is the subject of the request.]

([12]8) An employee of a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(i) , if[,] prior to making the request:

(a) the licensed practitioner has provided to the Division a written designation that includes:

(i) the [designating ]practitioner's:

(A) DEA number; and

(B) email address account registered with the Database; and

(ii) the designated employee's:

([i]A) full name;

([ii]B) complete home address;

([iii]C) e-mail address;

([iv]D) date of birth;

([v]E) driver license number or state identification card number; and

(F) professional license number, if any; and

([vi]iii) [the written designation is manually signed by]manual signatures from both the [licensed ]practitioner and designated employee.

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

([13]9) An employee of a business that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(i), if[,] prior to making the request:

(a) the licensed practitioner and employing business have provided to the Division a written designation that includes:

(i) the [designating ]practitioner's:

(A) DEA number; and

(B) email address account registered with the Database;

(ii) the name of the employing business; and

(iii) the designated employee's:

(A) full name;

(B) complete home address;

(C) e-mail address;

(D) date of birth;[ and]

(E) driver license number or state identification card number; and

(F) professional license number, if any;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

([14]10) An individual who is employed in the emergency [room]department of a hospital that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information to the extent permissible under Subsection 58-37f-301[(2)(d)](4)(a) if, prior to making the request:

(a) the practitioner and the hospital operating the emergency [room]department have provided to the Division a written designation that includes:

(i) the [designating ]practitioner's:

(A) DEA number; and

(B) email address account registered with the Database;

(ii) the name of the hospital; and

(iii) [the names of all emergency room practitioners employed at the hospital; and

(iv) ]the designated employee's:

(A) full name;

(B) complete home address;

(C) e-mail address;

([C]D) date of birth;[ and]

([D]E) driver license number or state identification card number; and

(F) professional license number, if any;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(c) the designated employee has passed a Database background check of available criminal court and Database records; and

(d) the Database has issued the designated employee a user personal identification number (PIN) and activated the employee's Database account.

([15]11) In accordance with Subsection 58-37f-301(5), an individual's requests to the [d]Division regarding third-party notice when a controlled substance prescription is dispensed to that individual, shall be made as follows:

(a) [A request to provide notice to a third party shall be made in writing dated and signed by the requesting individual, and shall include the following information]To request that the Division begin providing notice to a third party, or to request that the Division discontinue providing notice to a third party, the individual shall submit an original signed and notarized request form as furnished by the Division, that includes:

(i) the [requesting ]individual's:

(A) full name, including all aliases;

(B) birth date;

([B]C) complete home address including city and zip code;

([C]D) email address; and

([D]E) contact phone number;[and]

(ii) a clearly legible, color copy of government-issued picture identification confirming the individual's identity; and

(iii) the designated third party's:

(A) full name;

(B) complete home address, including city and zip code;

([B]C) email address; and

([C]D) contact phone number.

(b) [A request to discontinue providing notice to a designated third party shall be made by a writing dated and signed by the requesting individual, after which the division]After receiving a request to discontinue third-party notice, the Division shall:

(i) provide notice to the requesting individual that the discontinuation notice was received; and

(ii) provide notice to the designated third party that the notification has been rescinded.

(c) [A requesting]An individual may [only ]have [one]up to three active designated third [party]parties.

([16]12) A licensed pharmacy technician or pharmacy intern employed by a pharmacy may obtain Database information to the extent permissible under Subsection 58-37f-301(2)(l) if, prior to making the request:

(a) the pharmacist-in-charge (PIC) has provided to the Division a written designation authorizing access to the pharmacy technician or pharmacy intern on behalf of a licensed pharmacist employed by the pharmacy;

(b) the written designation includes the pharmacy technician's or pharmacy intern's:

(i) full name;

(ii) professional license number assigned by the Division;

(iii) email address;

(iv) contact phone number;

(v) pharmacy name and location;

(vi) pharmacy DEA number;

(vii) pharmacy phone number;

(c) the written designation includes the pharmacist-in-charge's (PIC's):

(i) full name;

(ii) professional license number assigned by the Division;

(iii) email address;

(iv) contact phone number;

(d) the written designation includes the assigned pharmacist's:

(i) full name;

(ii) professional license number assigned by the Division;

(iii) email address;

(iv) contact phone number; and

(e) the written designation includes the following signatures:

(i) pharmacy technician or pharmacy intern;

(ii) pharmacist-in-charge (PIC); and

(iii) assigned pharmacist if different than the PIC.

([17]13) The Utah Department of Health may access Database information for purposes of scientific study regarding public health. To access information, the scientific investigator shall:

(a) demonstrate to the satisfaction of the Division that the research is part of an approved project of the Utah Department of Health;

(b) provide a description of the research to be conducted, including:

(i) a research protocol for the project; and

(ii) a description of the data needed from the Database to conduct that research;

(c) provide assurances and a plan that demonstrates all Database information will be maintained securely, with access being strictly restricted to the requesting scientific investigator;

(d) provide for electronic data to be stored on a secure database computer system with access being strictly restricted to the requesting scientific investigator; and

(e) pay all relevant expenses for data transfer and manipulation.

([18]14) Database information that may be disseminated under Section 58-37f-301 may be disseminated by the Database staff either:

(a) verbally;

(b) by facsimile;

(c) by email;

(d) by U.S. mail; or

(e) by electronic access, where adequate technology is in place to ensure that a record will not be compromised, intercepted, or misdirected.

 

R156-37f-303. Access to Opioid Prescription Information Via an Electronic Data System.

In accordance with Subsection 58-37f-301(1) and Section 58-37f-303:

(1) Pursuant to Subsection 58-37f-303(4)(a)(i), to access opioid prescription information in the database, an electronic data system must:

(a) interface with the database through the [Appriss]Division-approved Prescription Monitoring Program (PMP) [Gateway]Hub system; and

(b) comply with all restrictions on database access and use of database information, as established by the Utah Controlled Substances Database Act and the Controlled Substance Database Act Rule.

(2) Pursuant to Subsection 58-37f-303(4)(a)(ii), to access opioid prescription information in the database via an electronic data system (EDS), an EDS user must:

(a) register to use the database by creating an approved account established by the Division pursuant to a memorandum of understanding with the Division;

(b) use [a unique personal identification number (PIN) that is identical to the PIN the EDS user was issued]the unique user name and password associated with the account created for the EDS user to access database information through the original internet access system;

(c) comply with all restrictions on database access established by the Utah Controlled Substance Database Act and the Controlled Substance Database Act Rule; and

(d) use opioid prescription information in the database only for the purposes and uses designated in Section 58-37f-201, and as more particularly described in the Utah Controlled Substances Database Act and the Controlled Substances Database Act Rule.

(3) The [d]Division may immediately suspend, without notice or opportunity to be heard, an electronic data system's or an EDS user's access to the database, if the [d]Division determines by audit or other means that such access may lead to a violation of Section 58-37f-601 or may otherwise compromise the integrity, privacy, or security of the database's opioid prescription information. This remedy shall be in addition to the criminal and civil penalties imposed by Section 58-37f-601 for unlawful release or use of database information, and the [d]Division's obligation under Subsections 58-37f-303(5) and (6) to immediately suspend or revoke database access and pursue appropriate corrective or disciplinary action against a non-compliant electronic data system or EDS user.

 

KEY: controlled substance database, licensing

Date of Enactment or Last Substantive Amendment: [December 11, 2017]2018

Notice of Continuation: December 21, 2017

Authorizing, and Implemented or Interpreted Law: 58-1-106(1)(a); 58-37f-301(1)