After years of waiting and anticipation by practitioners, in 2010, the DEA authorized the electronic transmission of controlled substance prescriptions (21 C.F.R. Part 1311). The regulations permit the e-prescribing and dispensing of controlled substances in schedule II-V.
The DEA structured the regulations to accomplish two purposes: (1) security, such that only authorized persons have access to the electronic system and that only the authorized persons are actually using the system; and (2) accountability, such that a prescription cannot be repudiated and that violators of the law can be readily identified.
To ensure that only authorized persons have access to an e-prescribing system, the regulations require that prescribers must undergo identity proofing, either in person or remotely, with a federally authorized entity. Once identity is proven, the prescriber is provided with an authentication credential or a digital certificate.
To sign and transmit e-prescriptions, the prescriber must use a two-factor authentication method. The prescriber must choose two of three factors for this purpose, which act as a digital signature. These factors include (1) something you know, such as a password or PIN number; (2) something you have, a hard token separate from the computer such as a personal digital assistant, cell phone, or flash drive; or (3) something you are (biometrics).
An agent of the prescriber may enter the appropriate prescription information into the system for later approval and authentication by the prescriber. However, an agent cannot have access to the two-factor authentication to sign the prescriptions. The prescription ultimately transmitted to the pharmacy must contain all of the information required on paper prescriptions.
When the electronic prescription is transmitted to the pharmacy, the first recipient of the e-prescription (either the pharmacy or its application service provider if it uses one) must digitally sign and the pharmacy must archive the e-prescription. If a prescription transmission fails, the prescriber may print a copy of the transmitted prescription and sign it. The copy must indicate that it was originally transmitted to a specific pharmacy and that the transmission failed. The pharmacy must check to ensure that the e-prescription was not received or dispensed before it dispenses the paper prescription. Similarly, if a pharmacist receives a paper or oral prescription indicating that it was originally transmitted electronically to another pharmacy, the pharmacist must check with that pharmacy to determine whether the e-prescription was received. If it was received but not dispensed, the pharmacy that received it must void it. If the original e-prescription was dispensed, the pharmacy with the paper prescription must void it.
A pharmacy may make changes to the electronic prescription after receipt in the same manner that it may make changes to paper-controlled substance prescriptions. The pharmacy must maintain a daily internal audit trail that compiles a list of auditable events (those that indicate a potential security problem). Pharmacies must back up all electronic prescription records daily and they must be kept for 2 years.
When a pharmacy receives an electronic prescription for a controlled substance and is unable to fill the prescription, the pharmacy can transfer the original unfilled electronic prescription to another pharmacy to fill it. In 2017, the DEA clarified that DEA policy allows this for schedule II, III, IV, and V controlled substances (http://www.ncbop.org/PDF/LMillerDEA GuidanceTransferofOnFileCSPrescriptions.pdf).
On August 28, 2023, DEA finalized regulations (88 Fed. Reg. 48365) to allow a retail pharmacy, upon patient request, to transfer a schedule II-V electronic prescription to another retail pharmacy for initial dispensing on a one-time basis. The procedures and documentation requirements include:
The prescription must be transferred from one retail pharmacy to another retail pharmacy in electronic form. At no time may an intermediary convert an electronic prescription to another form (e.g., facsimile) for transmission.
The required contents of the controlled substance prescription must not be altered during the transfer. Any change to the content during transfer, including truncation or removal of data, will render the electronic prescription invalid.
The transfer must be communicated directly between two licensed pharmacists.
The transferring pharmacist must add manually or if capable, capture the following to the electronic prescription record:
Information that the prescription has been transferred.
The name, address, and DEA registration number of the pharmacy to which the prescription was transferred and the name of the pharmacist receiving the prescription information.
The date of the transfer and the name of the pharmacist transferring the prescription information.
The receiving pharmacist must do the following:
Add the word "transfer" to the electronic prescription record at the receiving pharmacy.
Annotate the prescription record with the name, address, and DEA registration number of the pharmacy from which the prescription was transferred and the name of the pharmacist who transferred the prescription.
Record the date of the transfer and the name of the pharmacist receiving the prescription information.
The transfer of an electronic prescription for a controlled substance in schedule II-V for the purpose of initial dispensing is permissible only if allowable under existing state or other applicable laws.
The electronic records documenting the transfer must be maintained for a period of 2 years from the date of transfer by both the transferring and receiving pharmacy.
It is important to understand that these requirements are only for original, unfilled schedule II-V controlled substance electronic prescriptions. Pharmacies are not permitted to transfer any original, unfilled controlled substance prescription received in paper (including fax) or oral form to another pharmacy. However, after an original schedule III-V controlled substance prescription is filled and dispensed, any remaining refills may be transferred to another pharmacy regardless of how it was originally prescribed (e.g., paper, oral, fax, or electronic) as provided in 21 CFR § 1306.25 and discussed under "Transferring of Prescription Information."
Additional information regarding e-prescription requirements is available at https://www.deadiversion.usdoj.gov/ecomm/e_rx/.
The DEA has strongly emphasized that both the prescriber's and the pharmacy's application systems must either be approved by a third-party audit conducted by a qualified person or verified and certified by a certifying organization whose process has been approved by the DEA (76 Fed. Reg. 64813). All certifying organizations with an approved certification process are posted on the DEA's website: http://www.deadiversion.usdoj.gov, under electronic prescriptions. E-prescriptions may not be transmitted, received, or dispensed unless the application systems meet all DEA requirements. Thus, if doubts exist, the pharmacy should request proof from the prescriber that its system has been properly audited or certified.