ePrescribe Controlled Substances in 2010?
Posted: March 30th, 2010 | Author: Ken Tubman | Filed under: Controlled Substances, Public Policy, Security | Tags: DEA, IFR | 8 Comments »
FollowAfter a long anticipated wait, the DEA is revising its regulations to provide prescribers the ability to electronically prescribe controlled substances.
On June 27, 2008, DEA published a Notice of Proposed Rulemaking (NPRM) to revise the regulation to allow creation, signature, transmission and processing of controlled substances electronically. The DEA gave consideration to over 200 comments while drafting the IFR.
The DEA’s obligation as noted in the rule, is to ensure that the regulations minimize, to the greatest extent possible, the potential for diversion of a controlled substance resulting from non-registrants gaining access to electronic prescribing applications and systems. The concern of insufficient Security has been the main barrier to allowing the ePrescription of controlled substances. The authentication methods used in online or desktop applications is generally username and password. Passwords are easily guessed or broken by using various password guessing programs.
In response to these concerns, the DEA is adopting an approach to identity proofing (verifying that the authenticated user is who he/she claims to be) and logical access control (verifying that the authenticated user has the authority to perform the requested operation). Â The DEA will require registrants to apply to certain federally approved credential service providers (CSP) or certification authorities to obtain security certificates.
The strongest requirement of the IFR will be authentication. The DEA is proposing a two-factor authentication which is defined as two of the following: something you know, something you have, something you are. Authentication based only on knowledge factors, such as user names and passwords,  are easily compromised because they can be observed, guessed, or hacked and used without the practitioners knowledge.
The US Government has been using this similar approach for all electronic initiatives. A draft of the federal electronic authentication guideline can be found here: http://csrc.nist.gov/publications/drafts/800-63-rev1/SP800-63-Rev1_Dec2008.pdf
The Federal Register is expected to publish the Interim Final rule on March 31, 2010, which will kick off a 60-day comment period.
A draft of the interim final rule (IFR) was posted on March 24, 2010. The draft can be found here: http://www.federalregister.gov/OFRUpload/OFRData/2010-06687_PI.pdf
just wondering, do you know if any states currently prohibit e-prescribing controlled substances? i would imagine that they will need to change their regulations?
Hi Stacy, good question. Yes, some states do have individual laws that rest on the Federal Regulations. Once the DEA revises the rule and allows ePrescription of controlled substances the State laws will adjust accordingly. For instance, see Utah law on ePrescribing: http://www.dopl.utah.gov/laws/58-82.pdf
Do you happen to know by physician specialty which types of physicians have been quicker to adopt e prescribing.
Primary care physicians have been the quickest adopters of ePrescribing. Surescripts maintains an annual national progress report available at http://www.surescripts.com.
What factors will drive vendors to get their e-prescribing and pharmacy applications certified to send controlled substances electronically?
Do you see a future financial gain by institutions or individual practitioners by adopting this method as we do with advanced e-prescribing using med history and eligibility?
Meaningful use requires EMR’s to maintain an active medication list and the ability to prescribe electronically. The increase in demand for meaningful use-ful compliant EMR applications will drive demand. Prescriber’s and Pharmacies will demand the controlled substance feature sets to streamline workflow.
If you’re a prescriber, using an implemented EMR you will need to enter the medication into the clinical record. It would sure save time if you could click a button, scan your thumb and send the controlled substance to the pharmacy.
If you’re a pharmacy, you’ll save time. No more re-entering the handwritten prescription into the pharmacy system. No more calling the physician for clarification, refills etc.
Good question. I’m anticipating a short-term expense with long-term benefits due to the cost of authentication methods described in the article. The cost savings will mostly be derived from prescriber/pharmacy workflow changes.