Proposed Rule on E-Prescribing for Controlled Substances

The Drug Enforcement Administration (DEA) has released its proposed rule on electronic prescriptions for controlled substances with comments due on September 25. It is intended to be consistent with the Medicare Part D e-prescribing regulations. The focus is on standards to provide safeguards against the diversion of controlled substances. Key provisions of the proposed rule include:
* Identity Proofing - The service provider must check both the practitioners state license and DEA registration to determine that both are current and in good standing. Proposed entities for identity proofing include: hospital credentialing offices, the state professional entity that has authorized the practitioner to prescribe controlled substances (i.e. licensing board, etc), or a state or local law enforcement agency.
* Authentication - The system must require that practitioners eligible to issue controlled substance prescriptions use two factor authentications that meet National Institute of Standards and Technology requirements; one factor must be a cryptographic key stored on a hard token (i.e. a PDA, smart card, etc.).
* Signature Requirements - The authority to sign prescriptions will be specific and limited - the system must limit signing authority to those practitioners that have the legal right to sign prescriptions for controlled substances. The system must require that the DEA registrant whose DEA number is listed on the prescription sign the prescription.

Other requirements - A) Passwords/Keys DEA would require that practitioners who are registered in more than one state have a separate key to sign prescriptions for their registration in each state and the keys could be stored on the same hard token. The practitioner would be responsible for selecting the correct DEA registration to use to sign the prescription. B) Information Security The practitioner must ensure that he/she is the only user of the hard token and adopt procedures to secure the hard token. If there is reason to believe that the token has been lost or stolen the practitioner must notify the service provider within 12 hours. Failure to do so will result in the practitioner being held responsible by the DEA for any controlled substances prescriptions written. C) Prescription Logs -The practitioner will be required to review the log of his prescriptions transmitted by the service provider for any unusual activity and indicate the log has been reviewed. If a problem is found, the practitioner would be required to notify the DEA and the service provider with 12 hours. The log must be maintained for five years.

This is a voluntary program. The DEA does not require registrants to issue controlled substance prescriptions electronically. However, those registrants that wish to do so, would have to comply with the rules governing electronic prescribing of controlled substances. The rule can be found HERE or at
Angela Jeansonne (

Printer-Friendly Version