Electronic Prescriptions for Controlled Substances Clarification, 64813-64816 [2011-26738]

Download as PDF Federal Register / Vol. 76, No. 202 / Wednesday, October 19, 2011 / Rules and Regulations IX. References sroberts on DSK5SPTVN1PROD with RULES The following references have been placed on display in the Division of Dockets Management, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852 and may be seen by interested persons between 9 a.m. and 4 p.m., Monday through Friday. (FDA has verified the Web site addresses, but FDA is not responsible for any subsequent changes to the Web sites after this document publishes in the Federal Register.) 1. Memorandum of telephone conversation to John Rost, Crown Packaging Technology, from Lauren Robin, FDA, January 5, 2010. 2. European Commission, 2007, Commission Directive 2007/19/EC of 30 March 2007 amending Directive 2002/72/EC relating to plastic materials and articles intended to come into contact with food and Council Directive 85/572/EEC laying down the list of simulants to be used for testing migration of constituents of plastic materials and articles intended to come into contact with foodstuffs, Official Journal of the European Union, 31.3.2007, L 91/17–36. 3. IBWA, 2007, IBWA Model Code, Version October 2007, accessed online at https:// www.bottledwater.org/public/pdf/2008code-of-practice.pdf. 4. E-mail from Bob Hirst, IBWA, to Lauren Robin, FDA, January 5, 2010. 5. U.S. EPA, Technical factsheet on di (2ethylhexyl) phthalate (DEHP), accessed online at https://www.epa.gov/safewater/ pdfs/factsheets/soc/tech/dehp.pdf. 6. Joseph K. Doss, IBWA, Testimony before the Subcommittee on Oversight and Investigations of the Energy and Commerce Committee, United States House of Representatives, Hearing on Bottled Water Regulation, July 8, 2009, accessed online at https:// democrats.energycommerce.house.gov/ Press_111/20090708/testimony_doss.pdf. 7. U.S. EPA, EPA Method 506, Rev. 1.1— ‘‘Determination of phthalate and adipate esters in drinking water by liquid/liquid extraction or liquid/solid extraction and gas chromatography with photoionization detection,’’ in ‘‘Methods for the Determination of Organic Compounds in Drinking Water, Supplement III,’’ EPA National Exposure Research Laboratory, EPA/600/R–95/131, August 1995, accessed online at https:// www.epa.gov/nscep/. 8. U.S. EPA, EPA Method 525.2, Rev. 2.0— ‘‘Determination of organic compounds in drinking water by liquid-solid extraction and capillary column gas chromatography/mass spectrometry,’’ In ‘‘Methods for the Determination of Organic Compounds in Drinking Water, Supplement III,’’ EPA National Exposure Research Laboratory, EPA/600/R–95/131, August 1995, accessed online at https:// www.epa.gov/nscep/. 9. International Bottled Water Association, comment to FDA Docket Number 1993N–0085, October 4, 1993. VerDate Mar<15>2010 17:49 Oct 18, 2011 Jkt 226001 List of Subjects in 21 CFR Part 165 Beverages, Bottled water, Food grades and standards, Incorporation by reference. Therefore, under the Federal Food, Drug, and Cosmetic Act and under authority delegated to the Commissioner of Food and Drugs, 21 CFR part 165 is amended as follows: PART 165—BEVERAGES 1. The authority citation for 21 CFR part 165 continues to read as follows: ■ Authority: 21 U.S.C. 321, 341, 343, 343– 1, 348, 349, 371, 379e. 2. In § 165.110, in the table in paragraph (b)(4)(iii)(C), alphabetically add an entry for ‘‘Di(2ethylhexyl)phthalate (117–81–7)’’; revise paragraph (b)(4)(iii)(F) introductory text; and add new paragraphs (b)(4)(iii)(F)(21) and (b)(4)(iii)(F)(22) to read as follows: ■ § 165.110 Bottled water. * * * * * (b) * * * (4) * * * (iii) * * * (C) The allowable levels for pesticides and other synthetic organic chemicals (SOCs) are as follows: Concentration in milligrams per liter Contaminant (CAS Reg. No.) * * * Di(2-ethylhexyl)phthalate (117–81–7) ...................... * * * * * 0.006 * * * * * * * (F) Analyses to determine compliance with the requirements of paragraphs (b)(4)(iii)(B) and (b)(4)(iii)(C) of this section shall be conducted in accordance with an applicable method or applicable revisions to the methods listed in paragraphs (b)(4)(iii)(F)(1) through (b)(4)(iii)(F)(22) of this section and described, unless otherwise noted, in ‘‘Methods for the Determination of Organic Compounds in Drinking Water,’’ Office of Research and Development, EMSL, EPA/600/4–88/ 039, December 1988, or in ‘‘Methods for the Determination of Organic Compounds in Drinking Water, Supplement 1,’’ Office of Research and Development, EMSL, EPA/600/4–90/ 020, July 1990, or in ‘‘Methods for the Determination of Organic Compounds in Drinking Water, Supplement III,’’ EPA National Exposure Research Laboratory, Office of Research and Development, EPA/600/R–95/131, PO 00000 Frm 00033 Fmt 4700 Sfmt 4700 64813 August 1995, including Errata, November 27, 1995. The Director of the Federal Register approves this incorporation by reference in accordance with 5 U.S.C. 552(a) and 1 CFR part 51. Copies of these publications are available from National Technical Information Service, U.S. Department of Commerce, 5285 Port Royal Rd., Springfield, VA 22161. You may inspect a copy at the Division of Dockets Management, 5630 Fishers Lane, rm. 1061, Rockville, MD 20852, 301–827–6860 or at the National Archives and Records Administration (NARA). Hearing-impaired or speechimpaired individuals may access this number through TTY by calling the tollfree Federal Relay Service at 800–877– 8339. For information on the availability of this material at NARA, call 202–741– 6030, or go to: https://www.archives.gov/ federal-register/cfr/ibr-locations.html. * * * * * (21) Method 506, Rev. 1.1— ‘‘Determination of phthalate and adipate esters in drinking water by liquid/liquid extraction or liquid/solid extraction and gas chromatography with photoionization detection,’’ EPA/600/R– 95/131, 1995, (applicable to di(2ethylhexyl)phthalate), which is incorporated by reference in accordance with 5 U.S.C. 552(a) and 1 CFR part 51, or (22) Method 525.2, Rev. 2.0— ‘‘Determination of organic compounds in drinking water by liquid-solid extraction and capillary column gas chromatography/mass spectrometry,’’ EPA/600/R–95/131, 1995, (applicable to di(2-ethylhexyl)phthalate), which is incorporated by reference in accordance with 5 U.S.C. 552(a) and 1 CFR part 51. * * * * * Dated: October 11, 2011. Leslie Kux, Acting Assistant Commissioner for Policy. [FR Doc. 2011–26707 Filed 10–18–11; 8:45 am] BILLING CODE 4160–01–P DEPARTMENT OF JUSTICE Drug Enforcement Administration 21 CFR Parts 1300, 1304, 1306 and 1311 [Docket No. DEA–360] Electronic Prescriptions for Controlled Substances Clarification Drug Enforcement Administration (DEA), Department of Justice. AGENCY: E:\FR\FM\19OCR1.SGM 19OCR1 64814 ACTION: Federal Register / Vol. 76, No. 202 / Wednesday, October 19, 2011 / Rules and Regulations Clarification and notification. DEA wishes to emphasize that third-party audits of software applications for Electronic Prescriptions for Controlled Substances (EPCS) must encompass all applicable requirements in our regulations, including security, and must address ‘‘processing integrity’’ as set forth in our regulations. Likewise, where questions or gaps may arise in reviewing a particular application, DEA recommends consulting federal guidelines set forth in NIST Special Publication 800–53A. DEA is also announcing the first DEA approved certification process for EPCS. Certifying organizations with a certification process approved by DEA pursuant to the regulations are posted on DEA’s Web site once approved. FOR FURTHER INFORMATION, CONTACT: Imelda L. Paredes, Office of Diversion Control, Drug Enforcement Administration, 8701 Morrissette Drive, Springfield, Virginia 22152; Telephone (202) 307–7165. SUPPLEMENTARY INFORMATION: SUMMARY: sroberts on DSK5SPTVN1PROD with RULES Background The Drug Enforcement Administration (DEA) is a component of the Department of Justice and is the primary agency responsible for coordinating the drug law enforcement activities of the United States. DEA also assists in the implementation of the President’s National Drug Control Strategy. The diversion control program (DCP) is a strategic component of the DEA’s law enforcement mission. It is primarily the DCP within DEA that implements and enforces Titles II and III of the Comprehensive Drug Abuse Prevention and Control Act of 1970, often referred to as the Controlled Substances Act (CSA) and the Controlled Substances Import and Export Act (CSIEA) (21 U.S.C. 801–971), as amended (hereinafter, ‘‘CSA’’).1 DEA drafts and publishes the implementing regulations for these statutes in Title 21 of the Code of Federal Regulations (CFR), parts 1300 to 1321. The CSA together with these regulations are designed to establish a closed system for controlled substances and to prevent, detect, and eliminate the diversion of controlled substances and listed chemicals into the illicit market while ensuring a sufficient supply of controlled substances and listed chemicals for legitimate medical, scientific, research, and industrial purposes. 1 The Attorney General’s delegation of authority to DEA may be found at 28 CFR 0.100. VerDate Mar<15>2010 15:51 Oct 18, 2011 Jkt 223001 The CSA and DEA’s implementing regulations establish the legal requirements for possession and dispensing of controlled substances, most notably pursuant to a prescription issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. ‘‘The responsibility for the proper prescribing and dispensing of controlled substances is upon the prescribing practitioner, but a corresponding responsibility rests with the pharmacist who fills the prescription.’’ 21 CFR 1306.04(a). A prescription serves both as a record of the practitioner’s determination of the legitimate medical need for the drug to be dispensed, and as a record of the dispensing, providing the pharmacy with the legal justification and authority to dispense the medication prescribed by the practitioner. The prescription also provides a record of the actual dispensing of the controlled substance to the ultimate user (the patient) and, therefore, is critical to documenting that controlled substances held by a pharmacy have been dispensed legally. The maintenance by pharmacies of complete and accurate prescription records is an essential part of the overall CSA regulatory scheme established by Congress. Electronic Prescriptions for Controlled Substances (EPCS) Historically, where federal law required that a prescription for a controlled substance be issued in writing, that requirement could only be satisfied through the issuance of a paper prescription. Given advancements in technology and security capabilities for electronic applications, DEA recently amended its regulations to provide practitioners with the option of issuing electronic prescriptions for controlled substances (EPCS) in lieu of paper prescriptions. Efforts to develop EPCS have been underway for a number of years. DEA’s Interim Final Rule for Electronic Prescriptions for Controlled Substances was published on March 31, 2010 at 75 FR 16236–16319 and became effective on June 1, 2010. While these regulations have paved the way for controlled substance prescriptions to be issued electronically, not all States have authorized electronic prescriptions for controlled substances, particularly Schedule II controlled substances which have a significant potential for abuse. The information technology industry is currently in the process of developing and testing applications to implement the requirements set forth in the Interim Final Rule. As this process continues, DEA believes it prudent to issue the following clarifications, PO 00000 Frm 00034 Fmt 4700 Sfmt 4700 recommendation, and update to help ensure that the requirements of the Interim Final Rule are properly implemented. Specifically, DEA is clarifying that third-party audits must be conducted by qualified persons and must determine that an application meets all of the applicable requirements in 21 CFR part 1311 as well as other requirements referenced in Part 1311. ‘‘Processing integrity’’ must be addressed in audits of EPCS applications. DEA recommends that federal guidelines as set forth by the National Institute of Standards and Technology (NIST), including NIST Special Publication 800–53A, be consulted where questions arise. DEA has also announced an approved certification process for EPCS applications and has posted this information on its Web site. DEA notes its concern that proposed EPCS applications receive careful review prior to being used to create, sign, transmit or process controlled substance prescriptions so as to ensure the closed system for controlled substances established by the CSA. Secure and safe dispensing of controlled substances is necessary to protect the public interest and prevent diversion of controlled substances to illicit purposes. As with any violations of the CSA or DEA’s implementing regulations, if diversion occurs in the EPCS environment, or if controlled substances are otherwise dispensed in violation of the EPCS regulations, those responsible may be subject to administrative and/or judicial action, to include civil injunction. Current Issues National Prescription Drug Abuse Epidemic Implementation of electronic prescriptions for controlled substances is occurring at the same time the President has declared current prescription drug misuse and abuse as an epidemic constituting a major public health and public safety crisis.2 The non-medical use of prescription drugs is on the rise in the United States. Drug induced deaths now exceed motor vehicle accident deaths in the United States.3 According to the ‘‘Drug Abuse Warning Network (DAWN), 2009: National Estimates of Drug-Related Emergency Department Visits,’’ the 2 ‘‘Epidemic: Responding to America’s Prescription Drug Abuse Crisis,’’ Office of National Drug Control Policy, Executive Office of the President of the United States, 2011. https:// www.whitehousedrugpolicy.gov/publications/pdf/ rx_abuse_plan.pdf. 3 National Vital Statistics Reports, Vol. 59, No. 4, March 16, 2011, https://www.cdc.gov/nchs/data/ nvsr59/nvsr59_04.pdf. E:\FR\FM\19OCR1.SGM 19OCR1 Federal Register / Vol. 76, No. 202 / Wednesday, October 19, 2011 / Rules and Regulations Substance Abuse and Mental Health Services Administration (SAMHSA),4 emergency department visits involving non-medical use of pharmaceuticals (misuse or abuse) almost doubled between 2004 and 2009 from 627,291 in 2004 to 1,244,679 visits in 2009 (a 98.4 percent increase).5 About half of the 2009 emergency department visits related to abuse or misuse of pharmaceuticals involved painkillers and more than one-third involved drugs to treat insomnia and anxiety.6 The 2009 National Survey on Drug Use and Health (NSDUH) 7 estimated that 7.0 million persons used prescription-type psychotherapeutic drugs—pain relievers, anti-anxiety medications, stimulants, and sedatives—non-medically. This represents 2.8 percent of the population aged twelve or older. These estimates were 13 percent higher than those from the 2008 Survey. In 2009, 2.2 million persons aged twelve or older used pain relievers non-medically for the first time; that averages to over 6,000 new users per day. Teenagers (grades 9–12) believe that prescription drugs are easier to obtain than illegal drugs. There is a concern that young people may perceive prescription and/or over-the-counter drugs as ‘‘safer’’ than illegal drugs because of their intended, legitimate medical use.8 sroberts on DSK5SPTVN1PROD with RULES Increased Security Breaches Cyber attacks are growing in frequency, size and complexity and are of concern as EPCS goes online. Responses by 583 U.S. businesses of all sizes to a recent independent survey conducted by the Ponemon Institute released June 22, 2011 found that 90 percent had at least one cyber security breach in the past 12 months. This survey found that the top two endpoints from which these security breaches occurred are employees’ laptop computers and employee’s mobile devices.9 Numerous recent news articles 4 Behavioral Health Statistics and Quality, ‘‘Highlights of the 2009 Drug Abuse Warning Network (DAWN) Findings on Drug-Related Emergency Department Visits,’’ The DAWN Report, December 28, 2010. 5 Id. at 4. 6 Id. at 3. 7 Substance Abuse and Mental Health Services Administration, ‘‘Results from the 2009 National Survey on Drug Use and Health: Volume I, Summary of National Findings,’’ Office of Applied Studies, 2010 (NSDUH Series H–38A, HHS Publication No. SMA 10–4856), https:// www.oas.samhsa.gov/nsduh/2k9NSDUH/ 2k9Results.pdf. 8 Partnership for a Drug-Free America and MetLife Foundation, ‘‘2009 Parents and Teens Attitude Tracking Study Report’’ March 2, 2010. 9 https://www.marketwire.com/ printer_friendly?id=1529987; https:// VerDate Mar<15>2010 15:51 Oct 18, 2011 Jkt 223001 describe incidents of major security breaches or hacking incidents into major U.S. private and government computer systems, including incidents involving electronic health records.10 These incidents occur for many reasons, but access to controlled substances has not been cited as an objective because such substances have not been communicated via an electronic system. With the impending implementation of electronic prescriptions for controlled substances, DEA wishes to reiterate that adequate security of EPCS has been and continues to be a primary consideration in any electronic system used to communicate a legitimate controlled substance prescription for the purpose of dispensing to an ultimate user. Clarifications DEA wishes to provide the following clarifications. Third-Party Audits of EPCS Applications EPCS, as with paper prescriptions, requires the individual practitioner be responsible for ensuring the prescription conforms to all legal requirements and the pharmacist, acting under the authority of the DEAregistered pharmacy, has a corresponding responsibility to ensure the prescription is valid and meets all legal requirements. Review of an EPCS application must be thorough in order to provide the prescriber and pharmacist the level of assurance needed in order to use the application. Before any application may be used for electronic prescriptions for controlled substances, it must be reviewed, tested and determined by a third party to meet all of the requirements of 21 CFR part 1311. See 21 CFR 1311.300(a). There are two alternative processes for review of EPCS applications: (1) A third-party audit conducted by a person qualified to conduct a SysTrust, WebTrust or SAS 70 audit or a Certified Information System Auditor as stated in 21 CFR 1311.300(b), which comports with the requirements of paragraphs (c) and (d) of 21 CFR 1300.300 or (2) A certification by a certifying organization whose certification process has been approved business.financialpost.com/2011/06/23/surveyfinds-90-of-u-s-companies-hacked-in-past-year/. 10 For example, among others, see Wall Street Journal articles May 19 (U.N. International Atomic Energy Agency), May 27 (Lockheed Martin), June 2 (Google), June 10 (Citigroup), June 11 (Sony), 2011; Workers’ Compensation California Medical Record Privacy Breach, August 23, 2011, https://workerscompensation.blogspot.com/2011/08/majorcalifornia-medical-record-privacy.html; New York Times article September 8, 2011 (electronic medical record breaches). PO 00000 Frm 00035 Fmt 4700 Sfmt 4700 64815 by DEA as stated in 21 CFR 1311.300(e), which certification verifies that the application meets all of the requirements of 21 CFR part 1311. 21 CFR 1311.300(c) and 21 CFR 1311.300(d) state respectively that an audit for installed applications and application service providers must, among other things, determine that the application meets all of the applicable requirements in Part 1311. This includes all of Part 1311 and references to Parts 1300, 1304 and 1306. Some individuals may be misinterpreting 21 CFR 1311.300(c) and (d), which state that audits ‘‘for installed applications must address processing integrity and determine that the application meets the requirements of this part,’’ and audits ‘‘for application service providers must address processing integrity and physical security and determine that the application meets the requirements of this part.’’ (emphasis added). To further clarify, the Code of Federal Regulations is organized by title, chapter, part, subpart, section and paragraph. Any audit must include all of the applicable requirements for electronic prescriptions of controlled substances found in 21 CFR part 1311 and not just section 1311.300 of part 1311. Part 1311 also cross-references Parts 1300, 1304 and 1306 which establish specific requirements that must be the subject of any audit. Thorough review and testing of all requirements is both required by the regulations and necessary to ensure secure and effective electronic prescribing and dispensing of controlled substances in the interests of public health and safety. ‘‘Processing Integrity’’ must be addressed in audits of EPCS prescriber and pharmacy applications. EPCS applications must address security to prevent insider threats and outsider attacks on any system. Careful review by an independent, qualified third-party of the ‘‘processing integrity’’ of any application is required to determine whether an application or application service provider has adequate protection against the range of potential security threats. Person qualified to conduct a thirdparty audit. DEA notes that 21 CFR 1311.300(b)(1) and (2) require that a third-party audit be conducted by a person qualified to conduct a SysTrust, WebTrust or SAS 70 audit or by a Certified Information System Auditor. The regulations do not require one of these types of audits, but rather that the person conducting the audit must have specified qualifications. As provided in 21 CFR 1311.300(c) and (d), any audit must address processing E:\FR\FM\19OCR1.SGM 19OCR1 64816 Federal Register / Vol. 76, No. 202 / Wednesday, October 19, 2011 / Rules and Regulations sroberts on DSK5SPTVN1PROD with RULES integrity and determine that the application meets the requirements of DEA’s regulations. DEA is reviewing the fact that the American Institute of Certified Public Accountants has replaced SAS 70 audits referenced in 21 CFR 1311.300(b)(1) and will necessarily address this issue in the final rule on EPCS. Recommendation Where questions arise in reviewing a particular EPCS prescriber or pharmacy application, DEA recommends that federal guidelines as set forth by the National Institute of Standards and Technology (NIST), specifically NIST Special Publication 800–53A, be consulted. Other NIST standards and publications are incorporated by reference in the Interim Final Rule and must be complied with as stated in the Interim Final Rule. Some of the questions surrounding interpretation of DEA’s EPCS regulations as applied to specific applications are addressed by federal guidelines articulated by the National Institute of Standards and Technology in NIST Special Publication (SP) 800– 53A, as revised. Federal computer systems must comply with federal guidelines as outlined in NIST SP 800– 53A.11 As NIST SP 800–53A states, the publication may be used by nongovernmental organizations on a voluntary basis. Although the Interim Final Rule does not require compliance with NIST SP 800–53A, DEA believes this publication provides useful guidance and that it is advisable for private sector entities to consult the publication when reviewing security requirements for EPCS applications. In addition, EPCS will be used on federal systems in the military, the Department of Veterans Affairs and elsewhere where such systems must comply with federal guidelines. DEA notes that the Notice of Proposed Rulemaking (NPRM) in June 27, 2008 discussed NIST SP 800–53A and whether or not it should be the basis for security requirements. 73 FR 36746–47 (June 27, 2008). DEA did not require application of NIST SP 800–53A in the Interim Final Rule due to the perceived need for flexibility and because security would be ensured by review of ‘‘processing integrity.’’ In light of developments since that time, DEA will be revisiting this issue as it is clear that a mechanism must be established in the EPCS regulations to keep EPCS 11 https://csrc.nist.gov/publications/nistpubs/80053A-rev1/sp800-53A-rev1-final.pdf. Note that the latest version of SP800–53A should be consulted as it is regularly updated to meet technology developments. VerDate Mar<15>2010 15:51 Oct 18, 2011 Jkt 223001 applications current with technology, particularly security requirements. Update All certifying organizations with a certification process approved by DEA pursuant to 21 CFR 1311.300(e) are posted on DEA’s Web site once approved. As noted above, the Interim Final Rule provides that, as an alternative to the audit requirements of 21 CFR 1311(b) through (d), an electronic prescription or pharmacy application may be verified and certified as meeting the requirements of 21 CFR Part 1311 by a certifying organization whose certification process has been approved by DEA. The preamble to the Interim Final Rule further indicated that, once a qualified certifying organization’s certification process has been approved by DEA in accordance with 21 CFR 1311.300(e), such information will be posted on DEA’s Web site. 75 FR 16243, March 31, 2010. On September 22, 2011, DEA approved the certification process developed by InfoGard Laboratories, Inc. and relevant information has been posted on DEA’s Web site at https:// www.DEAdiversion.usdoj.gov under electronic prescriptions. in the notice of proposed rulemaking on this subject in the Proposed Rules section in this issue of the Federal Register. Effective Date: These regulations are effective on October 18, 2011. Applicability Dates: For dates of applicability, see § 1.181–6T. FOR FURTHER INFORMATION CONTACT: Bernard P. Harvey, (202) 622–4930 (not a toll-free number). SUPPLEMENTARY INFORMATION: DATES: Internal Revenue Service (IRS), Treasury. ACTION: Final and temporary regulations. Background This document contains amendments to 26 CFR part 1 to provide regulations under section 181 of the Internal Revenue Code of 1986 (Code). Section 181 permits the deduction of certain production costs by the producer of a qualified film or television production. Section 181 was added to the Code by section 244 of the American Jobs Creation Act of 2004, Public Law 108– 357 (118 Stat. 1418) (October 22, 2004), and was modified by section 403(e) of the Gulf Opportunity Zone Act of 2005, Public Law 109–135 (119 Stat. 2577) (December 21, 2005). Section 502 of the Tax Extenders and Alternative Minimum Tax Relief Act of 2008, Public Law 110–343 (122 Stat. 3765) (October 3, 2008) further modified section 181 for film and television productions commencing after December 31, 2007, and extended section 181 to film and television productions commencing before January 1, 2010. Section 181 was extended again to film and television productions commencing before January 1, 2012, by section 744 of the Tax Relief, Unemployment Insurance Reauthorization, and Job Creation Act of 2010, Public Law 111–312 (December 17, 2010). On September 30, 2011, the IRS and the Treasury Department published in the Federal Register (TD 9551, 76 FR 60721) final regulations relating to deductions for the cost of producing film and television productions under section 181 as enacted by the American Jobs Creation Act of 2004 and modified by the Gulf Opportunity Zone Act of 2005. This document contains final and temporary regulations relating to deductions for the cost of producing film and television productions. These temporary regulations reflect changes to the law made by the Tax Extenders and Alternative Minimum Tax Relief Act of 2008, and affect taxpayers that produce films and television productions within the United States. The text of these temporary regulations also serves as the text of the proposed regulations set forth Explanation of Provisions Section 181 permits an owner of a qualified film or television production to elect to deduct production costs paid or incurred by that owner for the year the costs are paid or incurred, in lieu of capitalizing the costs and recovering them through depreciation allowances. For a qualified film or television production that commenced before January 1, 2008 (a ‘‘pre-amendment production’’), this deduction is available Dated: October 7, 2011. Joseph T. Rannazzisi, Deputy Assistant Administrator, Office of Diversion Control. [FR Doc. 2011–26738 Filed 10–18–11; 8:45 am] BILLING CODE 4410–09–P DEPARTMENT OF THE TREASURY Internal Revenue Service 26 CFR Part 1 [TD 9552] RIN 1545–BJ24 Deduction for Qualified Film and Television Production Costs AGENCY: SUMMARY: PO 00000 Frm 00036 Fmt 4700 Sfmt 4700 E:\FR\FM\19OCR1.SGM 19OCR1

Agencies

[Federal Register Volume 76, Number 202 (Wednesday, October 19, 2011)]
[Rules and Regulations]
[Pages 64813-64816]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-26738]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF JUSTICE

Drug Enforcement Administration

21 CFR Parts 1300, 1304, 1306 and 1311

 [Docket No. DEA-360]


Electronic Prescriptions for Controlled Substances Clarification

AGENCY: Drug Enforcement Administration (DEA), Department of Justice.

[[Page 64814]]


ACTION: Clarification and notification.

-----------------------------------------------------------------------

SUMMARY: DEA wishes to emphasize that third-party audits of software 
applications for Electronic Prescriptions for Controlled Substances 
(EPCS) must encompass all applicable requirements in our regulations, 
including security, and must address ``processing integrity'' as set 
forth in our regulations. Likewise, where questions or gaps may arise 
in reviewing a particular application, DEA recommends consulting 
federal guidelines set forth in NIST Special Publication 800-53A. DEA 
is also announcing the first DEA approved certification process for 
EPCS. Certifying organizations with a certification process approved by 
DEA pursuant to the regulations are posted on DEA's Web site once 
approved.

FOR FURTHER INFORMATION, CONTACT: Imelda L. Paredes, Office of 
Diversion Control, Drug Enforcement Administration, 8701 Morrissette 
Drive, Springfield, Virginia 22152; Telephone (202) 307-7165.

SUPPLEMENTARY INFORMATION: 

Background

    The Drug Enforcement Administration (DEA) is a component of the 
Department of Justice and is the primary agency responsible for 
coordinating the drug law enforcement activities of the United States. 
DEA also assists in the implementation of the President's National Drug 
Control Strategy. The diversion control program (DCP) is a strategic 
component of the DEA's law enforcement mission. It is primarily the DCP 
within DEA that implements and enforces Titles II and III of the 
Comprehensive Drug Abuse Prevention and Control Act of 1970, often 
referred to as the Controlled Substances Act (CSA) and the Controlled 
Substances Import and Export Act (CSIEA) (21 U.S.C. 801-971), as 
amended (hereinafter, ``CSA'').\1\ DEA drafts and publishes the 
implementing regulations for these statutes in Title 21 of the Code of 
Federal Regulations (CFR), parts 1300 to 1321. The CSA together with 
these regulations are designed to establish a closed system for 
controlled substances and to prevent, detect, and eliminate the 
diversion of controlled substances and listed chemicals into the 
illicit market while ensuring a sufficient supply of controlled 
substances and listed chemicals for legitimate medical, scientific, 
research, and industrial purposes.
---------------------------------------------------------------------------

    \1\ The Attorney General's delegation of authority to DEA may be 
found at 28 CFR 0.100.
---------------------------------------------------------------------------

    The CSA and DEA's implementing regulations establish the legal 
requirements for possession and dispensing of controlled substances, 
most notably pursuant to a prescription issued for a legitimate medical 
purpose by a practitioner acting in the usual course of professional 
practice. ``The responsibility for the proper prescribing and 
dispensing of controlled substances is upon the prescribing 
practitioner, but a corresponding responsibility rests with the 
pharmacist who fills the prescription.'' 21 CFR 1306.04(a). A 
prescription serves both as a record of the practitioner's 
determination of the legitimate medical need for the drug to be 
dispensed, and as a record of the dispensing, providing the pharmacy 
with the legal justification and authority to dispense the medication 
prescribed by the practitioner. The prescription also provides a record 
of the actual dispensing of the controlled substance to the ultimate 
user (the patient) and, therefore, is critical to documenting that 
controlled substances held by a pharmacy have been dispensed legally. 
The maintenance by pharmacies of complete and accurate prescription 
records is an essential part of the overall CSA regulatory scheme 
established by Congress.

Electronic Prescriptions for Controlled Substances (EPCS)

    Historically, where federal law required that a prescription for a 
controlled substance be issued in writing, that requirement could only 
be satisfied through the issuance of a paper prescription. Given 
advancements in technology and security capabilities for electronic 
applications, DEA recently amended its regulations to provide 
practitioners with the option of issuing electronic prescriptions for 
controlled substances (EPCS) in lieu of paper prescriptions. Efforts to 
develop EPCS have been underway for a number of years. DEA's Interim 
Final Rule for Electronic Prescriptions for Controlled Substances was 
published on March 31, 2010 at 75 FR 16236-16319 and became effective 
on June 1, 2010. While these regulations have paved the way for 
controlled substance prescriptions to be issued electronically, not all 
States have authorized electronic prescriptions for controlled 
substances, particularly Schedule II controlled substances which have a 
significant potential for abuse.
    The information technology industry is currently in the process of 
developing and testing applications to implement the requirements set 
forth in the Interim Final Rule. As this process continues, DEA 
believes it prudent to issue the following clarifications, 
recommendation, and update to help ensure that the requirements of the 
Interim Final Rule are properly implemented. Specifically, DEA is 
clarifying that third-party audits must be conducted by qualified 
persons and must determine that an application meets all of the 
applicable requirements in 21 CFR part 1311 as well as other 
requirements referenced in Part 1311. ``Processing integrity'' must be 
addressed in audits of EPCS applications. DEA recommends that federal 
guidelines as set forth by the National Institute of Standards and 
Technology (NIST), including NIST Special Publication 800-53A, be 
consulted where questions arise. DEA has also announced an approved 
certification process for EPCS applications and has posted this 
information on its Web site. DEA notes its concern that proposed EPCS 
applications receive careful review prior to being used to create, 
sign, transmit or process controlled substance prescriptions so as to 
ensure the closed system for controlled substances established by the 
CSA. Secure and safe dispensing of controlled substances is necessary 
to protect the public interest and prevent diversion of controlled 
substances to illicit purposes. As with any violations of the CSA or 
DEA's implementing regulations, if diversion occurs in the EPCS 
environment, or if controlled substances are otherwise dispensed in 
violation of the EPCS regulations, those responsible may be subject to 
administrative and/or judicial action, to include civil injunction.

Current Issues

National Prescription Drug Abuse Epidemic

    Implementation of electronic prescriptions for controlled 
substances is occurring at the same time the President has declared 
current prescription drug misuse and abuse as an epidemic constituting 
a major public health and public safety crisis.\2\ The non-medical use 
of prescription drugs is on the rise in the United States. Drug induced 
deaths now exceed motor vehicle accident deaths in the United 
States.\3\ According to the ``Drug Abuse Warning Network (DAWN), 2009: 
National Estimates of Drug-Related Emergency Department Visits,'' the

[[Page 64815]]

Substance Abuse and Mental Health Services Administration (SAMHSA),\4\ 
emergency department visits involving non-medical use of 
pharmaceuticals (misuse or abuse) almost doubled between 2004 and 2009 
from 627,291 in 2004 to 1,244,679 visits in 2009 (a 98.4 percent 
increase).\5\ About half of the 2009 emergency department visits 
related to abuse or misuse of pharmaceuticals involved painkillers and 
more than one-third involved drugs to treat insomnia and anxiety.\6\
---------------------------------------------------------------------------

    \2\ ``Epidemic: Responding to America's Prescription Drug Abuse 
Crisis,'' Office of National Drug Control Policy, Executive Office 
of the President of the United States, 2011. https://www.whitehousedrugpolicy.gov/publications/pdf/rx_abuse_plan.pdf.
    \3\ National Vital Statistics Reports, Vol. 59, No. 4, March 16, 
2011, https://www.cdc.gov/nchs/data/nvsr59/nvsr59_04.pdf.
    \4\ Behavioral Health Statistics and Quality, ``Highlights of 
the 2009 Drug Abuse Warning Network (DAWN) Findings on Drug-Related 
Emergency Department Visits,'' The DAWN Report, December 28, 2010.
    \5\ Id. at 4.
    \6\ Id. at 3.
---------------------------------------------------------------------------

    The 2009 National Survey on Drug Use and Health (NSDUH) \7\ 
estimated that 7.0 million persons used prescription-type 
psychotherapeutic drugs--pain relievers, anti-anxiety medications, 
stimulants, and sedatives--non-medically. This represents 2.8 percent 
of the population aged twelve or older. These estimates were 13 percent 
higher than those from the 2008 Survey. In 2009, 2.2 million persons 
aged twelve or older used pain relievers non-medically for the first 
time; that averages to over 6,000 new users per day. Teenagers (grades 
9-12) believe that prescription drugs are easier to obtain than illegal 
drugs. There is a concern that young people may perceive prescription 
and/or over-the-counter drugs as ``safer'' than illegal drugs because 
of their intended, legitimate medical use.\8\
---------------------------------------------------------------------------

    \7\ Substance Abuse and Mental Health Services Administration, 
``Results from the 2009 National Survey on Drug Use and Health: 
Volume I, Summary of National Findings,'' Office of Applied Studies, 
2010 (NSDUH Series H-38A, HHS Publication No. SMA 10-4856), https://www.oas.samhsa.gov/nsduh/2k9NSDUH/2k9Results.pdf.
    \8\ Partnership for a Drug-Free America and MetLife Foundation, 
``2009 Parents and Teens Attitude Tracking Study Report'' March 2, 
2010.
---------------------------------------------------------------------------

Increased Security Breaches

    Cyber attacks are growing in frequency, size and complexity and are 
of concern as EPCS goes online. Responses by 583 U.S. businesses of all 
sizes to a recent independent survey conducted by the Ponemon Institute 
released June 22, 2011 found that 90 percent had at least one cyber 
security breach in the past 12 months. This survey found that the top 
two endpoints from which these security breaches occurred are 
employees' laptop computers and employee's mobile devices.\9\ Numerous 
recent news articles describe incidents of major security breaches or 
hacking incidents into major U.S. private and government computer 
systems, including incidents involving electronic health records.\10\ 
These incidents occur for many reasons, but access to controlled 
substances has not been cited as an objective because such substances 
have not been communicated via an electronic system. With the impending 
implementation of electronic prescriptions for controlled substances, 
DEA wishes to reiterate that adequate security of EPCS has been and 
continues to be a primary consideration in any electronic system used 
to communicate a legitimate controlled substance prescription for the 
purpose of dispensing to an ultimate user.
---------------------------------------------------------------------------

    \9\ https://www.marketwire.com/printer_friendly?id=1529987; 
https://business.financialpost.com/2011/06/23/survey-finds-90-of-u-s-companies-hacked-in-past-year/.
    \10\ For example, among others, see Wall Street Journal articles 
May 19 (U.N. International Atomic Energy Agency), May 27 (Lockheed 
Martin), June 2 (Google), June 10 (Citigroup), June 11 (Sony), 2011; 
Workers' Compensation California Medical Record Privacy Breach, 
August 23, 2011, https://workers-compensation.blogspot.com/2011/08/major-california-medical-record-privacy.html; New York Times article 
September 8, 2011 (electronic medical record breaches).
---------------------------------------------------------------------------

Clarifications

    DEA wishes to provide the following clarifications.

Third-Party Audits of EPCS Applications

    EPCS, as with paper prescriptions, requires the individual 
practitioner be responsible for ensuring the prescription conforms to 
all legal requirements and the pharmacist, acting under the authority 
of the DEA-registered pharmacy, has a corresponding responsibility to 
ensure the prescription is valid and meets all legal requirements. 
Review of an EPCS application must be thorough in order to provide the 
prescriber and pharmacist the level of assurance needed in order to use 
the application.
    Before any application may be used for electronic prescriptions for 
controlled substances, it must be reviewed, tested and determined by a 
third party to meet all of the requirements of 21 CFR part 1311. See 21 
CFR 1311.300(a). There are two alternative processes for review of EPCS 
applications: (1) A third-party audit conducted by a person qualified 
to conduct a SysTrust, WebTrust or SAS 70 audit or a Certified 
Information System Auditor as stated in 21 CFR 1311.300(b), which 
comports with the requirements of paragraphs (c) and (d) of 21 CFR 
1300.300 or (2) A certification by a certifying organization whose 
certification process has been approved by DEA as stated in 21 CFR 
1311.300(e), which certification verifies that the application meets 
all of the requirements of 21 CFR part 1311.
    21 CFR 1311.300(c) and 21 CFR 1311.300(d) state respectively that 
an audit for installed applications and application service providers 
must, among other things, determine that the application meets all of 
the applicable requirements in Part 1311. This includes all of Part 
1311 and references to Parts 1300, 1304 and 1306.
    Some individuals may be misinterpreting 21 CFR 1311.300(c) and (d), 
which state that audits ``for installed applications must address 
processing integrity and determine that the application meets the 
requirements of this part,'' and audits ``for application service 
providers must address processing integrity and physical security and 
determine that the application meets the requirements of this part.'' 
(emphasis added). To further clarify, the Code of Federal Regulations 
is organized by title, chapter, part, subpart, section and paragraph. 
Any audit must include all of the applicable requirements for 
electronic prescriptions of controlled substances found in 21 CFR part 
1311 and not just section 1311.300 of part 1311. Part 1311 also cross-
references Parts 1300, 1304 and 1306 which establish specific 
requirements that must be the subject of any audit. Thorough review and 
testing of all requirements is both required by the regulations and 
necessary to ensure secure and effective electronic prescribing and 
dispensing of controlled substances in the interests of public health 
and safety.
    ``Processing Integrity'' must be addressed in audits of EPCS 
prescriber and pharmacy applications.
    EPCS applications must address security to prevent insider threats 
and outsider attacks on any system. Careful review by an independent, 
qualified third-party of the ``processing integrity'' of any 
application is required to determine whether an application or 
application service provider has adequate protection against the range 
of potential security threats.
    Person qualified to conduct a third-party audit.
    DEA notes that 21 CFR 1311.300(b)(1) and (2) require that a third-
party audit be conducted by a person qualified to conduct a SysTrust, 
WebTrust or SAS 70 audit or by a Certified Information System Auditor. 
The regulations do not require one of these types of audits, but rather 
that the person conducting the audit must have specified 
qualifications. As provided in 21 CFR 1311.300(c) and (d), any audit 
must address processing

[[Page 64816]]

integrity and determine that the application meets the requirements of 
DEA's regulations. DEA is reviewing the fact that the American 
Institute of Certified Public Accountants has replaced SAS 70 audits 
referenced in 21 CFR 1311.300(b)(1) and will necessarily address this 
issue in the final rule on EPCS.

Recommendation

    Where questions arise in reviewing a particular EPCS prescriber or 
pharmacy application, DEA recommends that federal guidelines as set 
forth by the National Institute of Standards and Technology (NIST), 
specifically NIST Special Publication 800-53A, be consulted. Other NIST 
standards and publications are incorporated by reference in the Interim 
Final Rule and must be complied with as stated in the Interim Final 
Rule.
    Some of the questions surrounding interpretation of DEA's EPCS 
regulations as applied to specific applications are addressed by 
federal guidelines articulated by the National Institute of Standards 
and Technology in NIST Special Publication (SP) 800-53A, as revised. 
Federal computer systems must comply with federal guidelines as 
outlined in NIST SP 800-53A.\11\ As NIST SP 800-53A states, the 
publication may be used by nongovernmental organizations on a voluntary 
basis. Although the Interim Final Rule does not require compliance with 
NIST SP 800-53A, DEA believes this publication provides useful guidance 
and that it is advisable for private sector entities to consult the 
publication when reviewing security requirements for EPCS applications. 
In addition, EPCS will be used on federal systems in the military, the 
Department of Veterans Affairs and elsewhere where such systems must 
comply with federal guidelines.
---------------------------------------------------------------------------

    \11\ https://csrc.nist.gov/publications/nistpubs/800-53A-rev1/sp800-53A-rev1-final.pdf. Note that the latest version of SP800-53A 
should be consulted as it is regularly updated to meet technology 
developments.
---------------------------------------------------------------------------

    DEA notes that the Notice of Proposed Rulemaking (NPRM) in June 27, 
2008 discussed NIST SP 800-53A and whether or not it should be the 
basis for security requirements. 73 FR 36746-47 (June 27, 2008). DEA 
did not require application of NIST SP 800-53A in the Interim Final 
Rule due to the perceived need for flexibility and because security 
would be ensured by review of ``processing integrity.'' In light of 
developments since that time, DEA will be revisiting this issue as it 
is clear that a mechanism must be established in the EPCS regulations 
to keep EPCS applications current with technology, particularly 
security requirements.

Update

    All certifying organizations with a certification process approved 
by DEA pursuant to 21 CFR 1311.300(e) are posted on DEA's Web site once 
approved.
    As noted above, the Interim Final Rule provides that, as an 
alternative to the audit requirements of 21 CFR 1311(b) through (d), an 
electronic prescription or pharmacy application may be verified and 
certified as meeting the requirements of 21 CFR Part 1311 by a 
certifying organization whose certification process has been approved 
by DEA. The preamble to the Interim Final Rule further indicated that, 
once a qualified certifying organization's certification process has 
been approved by DEA in accordance with 21 CFR 1311.300(e), such 
information will be posted on DEA's Web site. 75 FR 16243, March 31, 
2010. On September 22, 2011, DEA approved the certification process 
developed by InfoGard Laboratories, Inc. and relevant information has 
been posted on DEA's Web site at https://www.DEAdiversion.usdoj.gov 
under electronic prescriptions.

    Dated: October 7, 2011.
Joseph T. Rannazzisi,
Deputy Assistant Administrator, Office of Diversion Control.
[FR Doc. 2011-26738 Filed 10-18-11; 8:45 am]
BILLING CODE 4410-09-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.