Suspicious Orders of Controlled Substances, 69282-69299 [2020-21302]

Agencies

• Drug Enforcement Administration
• Department of Justice

[Federal Register Volume 85, Number 212 (Monday, November 2, 2020)]
[Proposed Rules]
[Pages 69282-69299]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-21302]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF JUSTICE

Drug Enforcement Administration

21 CFR Parts 1300 and 1301

[Docket No. DEA-437]
RIN 1117-AB47


Suspicious Orders of Controlled Substances

AGENCY: Drug Enforcement Administration, Department of Justice.

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: The Drug Enforcement Administration (DEA) is proposing to 
revise its regulations relating to suspicious orders of controlled 
substances, in order to implement the Preventing Drug Diversion Act of 
2018 (PDDA) and to clarify the procedures a registrant must follow for 
orders received under suspicious circumstances (ORUSCs). Upon receipt 
of an ORUSC, registrants authorized to distribute controlled substances 
would have a choice of proceeding under one of two options (the ``two 
option framework''). In addition, these registrants would be required 
to submit all suspicious order reports to a DEA centralized database, 
and keep records pertaining to suspicious orders and ORUSCs.

DATES: Electronic comments must be submitted, and written comments must 
be postmarked, on or before January 4, 2021.

ADDRESSES: To ensure proper handling of comments, please reference 
``RIN 1117-AB47/Docket No. DEA-437'' on all correspondence, including 
any attachments.
    Electronic comments: The DEA encourages that all comments be 
submitted electronically through the Federal eRulemaking Portal, which 
provides the ability to type short comments directly into the comment 
field on the web page or attach a file for lengthier comments. Please 
go to https://www.regulations.gov and follow the online instructions at 
that site for submitting comments. Upon submission of your comment, you 
will receive a Comment Tracking Number. Please be aware that submitted 
comments are not instantaneously available for public view on https://www.regulations.gov. If you have received a Comment Tracking Number, 
your comment has been successfully submitted and there is no need to 
resubmit the same comment. Commenters should be aware that the 
electronic Federal Docket Management System will not accept comments 
after 11:59 p.m. Eastern Time on the last day of the comment period.
    Paper comments: Paper comments that duplicate the electronic 
submission are not necessary and are discouraged. Should you wish to 
mail a paper comment in lieu of an electronic comment, it should be 
sent via regular or express mail to: Drug Enforcement Administration, 
Attn: DEA Federal Register Representative/DPW, 8701 Morrissette Drive, 
Springfield, VA 22152.
    Paperwork Reduction Act (PRA) Comments: All comments concerning 
collections of information under the PRA must be submitted to the 
Office of Information and Regulatory Affairs, Office of Management and 
Budget (OMB), Attention: Desk Officer for Department of Justice (DOJ), 
Washington, DC 20503. Please state that

[[Page 69283]]

your comment refers to ``RIN 1117-AB47/Docket No. DEA-437.''

FOR FURTHER INFORMATION CONTACT: Scott A. Brinks, Diversion Control 
Division, Drug Enforcement Administration; Mailing Address: 8701 
Morrissette Drive, Springfield, VA 22152, Telephone: (571) 362-3261.

SUPPLEMENTARY INFORMATION:

Posting of Public Comments

    Please note that all comments received are considered part of the 
public record. They will, unless reasonable cause is given, be made 
available by the DEA for public inspection online at https://www.regulations.gov. Such information includes personal identifying 
information (such as your name, address, etc.) voluntarily submitted by 
the commenter. The Freedom of Information Act applies to all comments 
received. If you want to submit personal identifying information (such 
as your name, address, etc.) as part of your comment, but do not want 
it to be made publicly available, you must include the phrase 
``PERSONAL IDENTIFYING INFORMATION'' in the first paragraph of your 
comment. You must also place the personal identifying information you 
do not want to be made publicly available in the first paragraph of 
your comment and identify what information you want redacted.
    If you want to submit confidential business information as part of 
your comment, but do not want it to be made publicly available, you 
must include the phrase ``CONFIDENTIAL BUSINESS INFORMATION'' in the 
first paragraph of your comment. You must also prominently identify 
confidential business information to be redacted within the comment.
    Comments containing personal identifying information and 
confidential business information identified as directed above will 
generally be made publicly available in redacted form. If a comment has 
so much personal identifying information or confidential business 
information that it cannot be effectively redacted, all or part of that 
comment may not be made publicly available. Comments posted to https://www.regulations.gov may include any personal identifying information 
(such as name, address, and phone number) or confidential business 
information included in the text of your electronic submission that is 
not identified as directed above as confidential.
    For easy reference, an electronic copy of this document and 
supplemental information (including the complete Economic Impact 
Analysis to this notice of proposed rulemaking) are available in their 
entirety under the tab ``Supporting Documents'' of the public docket 
for this action at https://www.regulations.gov under FDMS Docket ID: 
DEA: (RIN 1117-AB47/Docket Number DEA-437) for easy reference.

I. Executive Summary

A. Summary of the Rule

    The DEA is revising its regulations relating to suspicious orders 
of controlled substances in order to implement the Preventing Drug 
Diversion Act of 2018 (PDDA) and, through the adoption of the two-
option framework, to clarify the procedures a registrant must follow 
for orders received under suspicious circumstances (ORUSCs). Upon 
receipt of an ORUSC, registrants authorized to distribute controlled 
substances \1\ will have a choice (under the two-option framework) to 
either: (1) Immediately file a suspicious order report through the DEA 
centralized database, decline to distribute pursuant to the suspicious 
order, and maintain a record of the suspicious order and any due 
diligence related to the suspicious order,\2\ or (2) before 
distributing pursuant to the order, conduct due diligence to 
investigate each suspicious circumstance surrounding the ORUSC, and 
maintain a record of its due diligence regarding the ORUSC.\3\
---------------------------------------------------------------------------

    \1\ See Section IV.E titled ``Scope of the Rule,'' below.
    \2\ Proposed new 21 CFR 1301.78(a)(1). Although the registrant 
may not be conducting due diligence to dispel each suspicious 
circumstance under the first option, it could conduct due diligence 
related to its initial determination to decline the order. See 
proposed new 21 CFR 1300.01(b)'s definition of ``due diligence'' 
which includes ``examination of each suspicious circumstance 
surrounding an order, and examination of all facts and circumstances 
that may be relevant indicators of diversion in determining whether 
a person (or a person submitting an order) is engaged in, or is 
likely to engage in, the diversion of controlled substances.''
    \3\ Proposed new 21 CFR 1301.78(a)(2).
---------------------------------------------------------------------------

    Under the second option, if, through its due diligence, the 
registrant is able to dispel each suspicious circumstance surrounding 
the ORUSC within seven calendar days after receipt of the order, it is 
not a suspicious order. After that determination is made, the 
registrant may thereafter distribute pursuant to the order. The order 
need not be reported to the DEA as a suspicious order, but the 
registrant must maintain a record of its due diligence.\4\ However, if 
the registrant is unable, through its due diligence, to dispel each 
suspicious circumstance surrounding the ORUSC within seven calendar 
days after receiving the order, it is a suspicious order. The 
registrant must then promptly file a suspicious order report through 
the DEA centralized database, decline to distribute pursuant to the 
suspicious order, and maintain a record of its due diligence.\5\ All 
suspicious order reports must be made to the DEA centralized database 
and contain certain required information,\6\ and all records of 
suspicious orders and ORUSCs must be prepared and maintained in 
accordance with DEA regulations, and must contain certain required 
information.\7\
---------------------------------------------------------------------------

    \4\ Proposed new 21 CFR 1301.78(a)(2)(i).
    \5\ Proposed new 21 CFR 1301.78(a)(2)(ii).
    \6\ Proposed new 21 CFR 1301.78(b).
    \7\ Proposed new 21 CFR 1301.78(c).
---------------------------------------------------------------------------

    Related to this two-option framework, and as discussed in more 
detail below,\8\ the DEA is also defining four terms in its 
regulations: ``due diligence'', ``order'', ``order received under 
suspicious circumstances'', and ``suspicious order.'' \9\
---------------------------------------------------------------------------

    \8\ See Section V.B.3 titled ``Procedures for Identifying and 
Reporting Suspicious Orders of Controlled Substances,'' below.
    \9\ Proposed new 21 CFR 1300.01(b).
---------------------------------------------------------------------------

B. Summary of the Impact of the Rule

    The DEA has analyzed the impact of the rule under Executive Order 
12866 (E.O.),\10\ E.O. 13771,\11\ and the Regulatory Flexibility Act 
(RFA).\12\ The Office of Information and Regulatory Affairs (OIRA) in 
the Office of Management and Budget has determined that this rulemaking 
is a significant regulatory action within the meaning of E.O. 12866. 
The DEA has therefore submitted this rule for review by OMB. In 
addition, the DEA has determined that this rule has a total cost 
savings of $2,931,000 and is therefore expected to be an E.O. 13771 
deregulatory action. Finally, the DEA is certifying that this rule will 
not have a significant economic impact on a substantial number of small 
entities within the meaning of the RFA. The DEA's analysis and 
conclusions regarding E.O. 12866, E.O. 13771, and the RFA are discussed 
in further detail, below.\13\
---------------------------------------------------------------------------

    \10\ E.O. 12866, ``Regulatory Planning and Review,'' September 
30, 1993, published in the Federal Register at 58 FR 51735 on 
October 4, 1993.
    \11\ E.O. 13771, ``Reducing Regulation and Controlling 
Regulatory Costs,'' January 30, 2017, published in the Federal 
Register at 82 FR 9339 on February 3, 2017.
    \12\ 5 U.S.C. 601-612.
    \13\ See Part VI titled ``Impact of Regulatory Changes and 
Regulatory Analysis,'' below.
---------------------------------------------------------------------------

II. Suspicious Orders and the Opioid Epidemic

    Identifying and reporting suspicious orders of controlled 
substances (and refusing to distribute based on such

[[Page 69284]]

orders), has always been, and remains, the responsibility of the DEA 
registrant.\14\ This responsibility is of critical importance because 
diversion methods are constantly evolving, and because registrants are 
best situated to know their customers. As the DEA has previously 
stated, cutting off the controlled substance supply sources of ``drug 
pushers operating under the patina of legitimate authority'' is not 
something the DEA can do entirely by itself--rather, the DEA ``must 
rely on registrants to fulfill their obligation under the [Controlled 
Substances Act (CSA)] to ensure that they do not supply controlled 
substances to entities which act as drug pushers.'' \15\
---------------------------------------------------------------------------

    \14\ ``DEA registrant'' in this context refers generally to the 
responsibility of all registrants, and not specifically to any 
particular group.
    \15\ Southwood Pharmaceuticals, Inc.; Revocation of 
Registration, published in the Federal Register at 72 FR 36487, 
36504 on July 3, 2007.
---------------------------------------------------------------------------

    Five closely related legal obligations contained in the CSA \16\ 
and DEA regulations relate to the identification and reporting of 
suspicious orders: The obligation to maintain effective controls 
against diversion,\17\ to conduct due diligence,\18\ to design and 
operate a system to identify suspicious orders for the registrant,\19\ 
to report suspicious orders (the reporting requirement),\20\ and to 
refuse to distribute controlled substances that are likely to be 
diverted into illegitimate channels (the shipping requirement).\21\ The 
purpose of identifying and reporting suspicious orders to DEA is to 
provide DEA investigators in the field with information regarding 
potential illegal activity in an expeditious manner.
---------------------------------------------------------------------------

    \16\ The DEA implements and enforces Titles II and III of the 
Comprehensive Drug Abuse Prevention and Control Act of 1970 (Pub. L. 
91-513), as amended. Titles II and III are known as the ``Controlled 
Substances Act'' and the ``Controlled Substances Import and Export 
Act,'' respectively, and are collectively referred to as the 
``Controlled Substances Act'' or ``CSA'' for purposes of this 
document. The CSA is codified at 21 U.S.C. 801-971. The DEA 
publishes implementing regulations for these statutes in Title 21 of 
the Code of Federal Regulations (CFR), chapter II.
    \17\ See 21 U.S.C. 823(b)(1) and (e)(1) (requiring the Attorney 
General to consider ``maintenance of effective controls against 
diversion'' in determining whether to register an applicant to 
distribute controlled substances) and 21 CFR 1301.71(a) (``[a]ll 
applicants and registrants shall provide effective controls and 
procedures to guard against theft and diversion of controlled 
substances'').
    \18\ See Section IV.D titled ``The Due Diligence Requirement,'' 
below.
    \19\ Current DEA regulations require that ``[t]he registrant 
shall design and operate a system to disclose to the registrant 
suspicious orders of controlled substances.'' 21 CFR 1301.74(b). 
Similarly, the PDDA required that the system be designed and 
operated to ``identify'' suspicious orders for the registrant. For 
purposes of this document, the PDDA phrase ``identify for'' will be 
used in place of the phrase ``disclose to.''
    \20\ See 21 CFR 1301.74(b), and Sections III.B (titled ``Legal 
Authority for the Rule: Centralized Reporting Under the PDDA''), 
III.C (titled ``Legal Authority for the Rule: Other Provisions of 
the PDDA''), and IV.A (titled ``History of Relevant DEA 
Regulations''), below.
    \21\ See Section IV.D, titled ``The Due Diligence Requirement,'' 
below.
---------------------------------------------------------------------------

    However, at various times, and in various places and manners, some 
registrants have failed to fulfill their obligations regarding the 
identification and reporting of suspicious orders. For example, some 
registrants failed to design or operate any system to identify 
suspicious orders. Other registrants designed a system, but in doing so 
relied solely on rigid formulas that may not identify suspicious 
orders.\22\ Still other registrants failed to properly operate a 
system, by, for example, failing to implement their internal policies 
regarding due diligence in the identification and reporting of 
suspicious orders.
---------------------------------------------------------------------------

    \22\ Examples of terms used to describe information system 
formulas in the context of suspicious orders include ``algorithm,'' 
``blocked,'' ``flagged,'' ``held,'' ``order of interest,'' 
``pended,'' or ``threshold.''
---------------------------------------------------------------------------

    Some registrants failed to file timely and specific suspicious 
order reports, opting instead to file no reports, or rely on the 
submission of Automation of Reports and Consolidated Information 
Systems (ARCOS) \23\ reports as a purported substitute for submitting 
suspicious order reports.\24\ Other registrants filed end-of-month 
``excessive purchase'' reports (that were reported after the order had 
already been filled), submitted a list of largest purchasers, or 
reported customers with whom the registrant had terminated a business 
relationship. Some registrants interpreted the definition of suspicious 
order found in DEA regulations to extend no further than orders deemed 
suspicious based on the size, pattern, or frequency of the order or 
orders.\25\ Reports were often filed with DEA Field Division Offices, 
with no fixed format, and often without a stated reason as to why the 
order was considered suspicious.
---------------------------------------------------------------------------

    \23\ The CSA requires manufacturers and distributors to report 
their controlled substance transactions to the DEA on a quarterly 
basis, and the DEA implements this requirement through ARCOS. ARCOS 
and the ARCOS Distributor Tool are discussed in further detail in 
Sections IV.B and IV.C, below.
    \24\ The ARCOS reporting requirement and the suspicious orders 
serve two different purposes. While ARCOS provides the DEA with 
information regarding trends in the diversion of controlled 
substances, the reports need not be submitted until fifteen days 
after the end of the reporting period. In contrast, a suspicious 
order must be reported when discovered by the registrant. The 
suspicious orders reporting requirement exists to provide 
investigators in the field with information regarding potential 
illegal activity in an expeditious manner. See, e.g., Southwood 
Pharmaceuticals, Inc.; Revocation of Registration, published in the 
Federal Register at 72 FR 36487, 36501 on July 3, 2007.
    \25\ 21 CFR 1301.74(b) (suspicious orders ``include orders of 
unusual size, orders deviating substantially from a normal pattern, 
and orders of unusual frequency''). For purposes of this document, 
orders of unusual size, orders deviating substantially from a normal 
pattern, and orders of unusual frequency will be referred to as 
``size, pattern, and frequency orders.'' As discussed below in 
Section III.C titled ``Legal Authority for the Rule: Other 
Provisions of the PDDA,'' the PDDA provided that the term suspicious 
order ``may include, but is no limited to'' size, pattern, and 
frequency orders.
---------------------------------------------------------------------------

    Other registrants filed suspicious order reports, but then 
distributed controlled substances pursuant to the order anyway--failing 
to conduct due diligence prior to distributing controlled substances 
by, for example, keeping sparse or inadequate records and due diligence 
files, or by merely verifying that their customer was a DEA registrant.
    As a consequence of failing to fulfill their obligations regarding 
the identification and reporting of suspicious orders, some registrants 
were required to pay large fines and enter into Memorandums of 
Agreement (MOAs) with DEA requiring, among other things, that they 
report suspicious orders electronically and centrally to DEA 
Headquarters.\26\
---------------------------------------------------------------------------

    \26\ Registrants were already under a legal obligation to report 
suspicious orders. The MOAs required that the reports be filed 
electronically and centrally. Since the deployment of the ARCOS 
distributor tool and the on-line reporting system, the number of 
suspicious order reports has increased.
---------------------------------------------------------------------------

    In sum, this was unsuccessful in detecting and preventing 
diversion. Suspicious orders ultimately rose to national significance 
through various cases. For example, one investigation revealed that 
between 2007 and 2012, wholesale distributors shipped 780 million 
hydrocodone and oxycodone pills to West Virginia, and 1,728 West 
Virginians fatally overdosed on these two substances.\27\ And in 2013, 
the nation's largest drug store chain entered into the largest 
settlement in DEA history, agreeing to pay $80 million in civil fines 
for, among other things, allegations that it failed to report 
suspicious orders.\28\
---------------------------------------------------------------------------

    \27\ See ``Drug firms poured 780M painkillers into WV amid rise 
of overdoses,'' Eric Eyre Staff Writer, Charleston Gazette-Mail, 
December 17, 2016. https://www.wvgazettemail.com/news/cops_and_courts/drug-firms-poured-m-painkillers-into-wv-amid-rise-of/article_99026dad-8ed5-5075-90fa-adb906a36214.html. The relevance 
of West Virginia to suspicious orders has been generally recognized 
and accepted, including by congressional committees, as it 
illustrated the nature of the relationship and interaction between 
distributors and their customer pharmacies with respect to 
controlled substances.
    \28\ See DEA Press Release, ``Walgreens Agrees to Pay a Record 
Settlement of $80 Million for Civil Penalties Under the Controlled 
Substances Act,'' June 11, 2013. https://www.dea.gov/press-releases/2013/06/11/walgreens-agrees-pay-record-settlement-80-million-civil-penalties-under.

---------------------------------------------------------------------------

[[Page 69285]]

    Over the years, DEA has taken steps to address suspicious orders 
based on its own initiative, based on registrant requests that DEA 
further clarify their obligations under the law and provide registrants 
with the ability to see the distributions a particular customer has 
received from other distributors, and based on the PDDA. DEA has 
provided guidance, training, and individualized meetings for the 
regulated industry,\29\ and has utilized the various enforcement tools 
available to it under the CSA.\30\ DEA has also proactively leveraged 
the data that is available to it through ARCOS, and has developed a 
tool through ARCOS to assist distributors in making their suspicious 
order assessments (the ``ARCOS distributor tool'').\31\ In addition, 
DEA has taken appropriate criminal, civil, and administrative action 
against distributors, pharmacies, and other practitioners. By proposing 
this regulation to implement the PDDA and clarify the procedures a 
registrant must follow in identifying and reporting suspicious orders 
(and refusing to distribute based on such orders), DEA is taking the 
next step to address suspicious orders and combat the opioid epidemic.
---------------------------------------------------------------------------

    \29\ For example, through its Distributor Initiative, the DEA 
educated registrants on identification and reporting of suspicious 
orders and on maintaining effective controls against diversion. As 
part of the Initiative, the DEA polled ARCOS data and met with 
individual distributors to highlight various indicia of suspicious 
orders for their consideration. In addition, the DEA held industry 
conferences and sent guidance letters to industry regarding 
suspicious orders.
    \30\ The CSA provides that it shall be unlawful for any person . 
. . to refuse or negligently fail to make, keep, or furnish any 
record, report, notification, declaration, order or order form, 
statement, invoice, or information required under this subchapter or 
subchapter II of this chapter . . . .'' 21 U.S.C. 842(a)(5). The CSA 
also provides that a violation of this section carries a civil 
penalty which shall not exceed $10,000, but that ``[i]f a violation 
of this section is prosecuted by an information or indictment which 
alleges that the violation was committed knowingly and the trier of 
fact specifically finds that the violation was so committed, such 
person shall . . . be sentenced to imprisonment of not more than one 
year or a fine under Title 18, or both. 21 U.S.C. 842(c)(1)(B) and 
842(c)(2)(A).In addition to the loss of registration through 
administrative actions such as Orders to Show Cause and Immediate 
Suspension Orders, the DEA uses a wide array of diversion 
enforcement tools to ensure its registrants are in compliance with 
the CSA. These include civil penalties and criminal charges. See, 
e.g., https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-and-dea-announce-charges-against-rochester-drug-co-operative-and.
    \31\ See Section IV.C titled ``ARCOS Distributor Tool,'' below.
---------------------------------------------------------------------------

III. Legal Authority for the Rule

A. Legal Authority for the Rule: The CSA and Rulemaking Authority

    The CSA and its implementing regulations are designed to prevent, 
detect, and eliminate the diversion of controlled substances into the 
illicit market while ensuring an adequate supply is available for the 
legitimate medical, scientific, research, and industrial needs of the 
United States. Controlled substances have the potential for abuse and 
dependence and are controlled to protect the public health and safety. 
Through the enactment of the CSA, Congress has established a closed 
system of distribution by making it unlawful to handle any controlled 
substance except in a manner authorized by the CSA. In order to 
maintain this closed system of distribution, the CSA imposes 
registration requirements on handlers of controlled substances.
    The CSA also grants the Attorney General authority to promulgate 
and enforce any rules, regulations, and procedures which he may deem 
necessary and appropriate for the efficient executions of his functions 
under the CSA.\32\ The Attorney General delegated these authorities to 
the Administrator of the DEA, who in turn redelegated many of these 
authorities to the Deputy Administrator of the DEA and the Assistant 
Administrator of the DEA Office of Diversion Control.\33\
---------------------------------------------------------------------------

    \32\ 21 U.S.C. 871.
    \33\ 28 CFR 0.100 through 0.104.
---------------------------------------------------------------------------

B. Legal Authority for the Rule: Centralized Reporting Under the PDDA

    On October 24, 2018, President Trump signed into law the 
``Substance Use-Disorder Prevention that Promotes Opioid Recovery and 
Treatment for Patients and Communities Act'' (SUPPORT Act).\34\ The 
PDDA was contained within the SUPPORT Act.\35\ The PDDA required DEA to 
establish a centralized database for collecting reports of suspicious 
orders not later than one year from the date of the PDDA's enactment. 
Upon discovering a suspicious order or series of orders, the PDDA 
required registrants to notify the DEA Administrator and Special Agent 
in Charge of the Division Office of the DEA for the area in which the 
registrant is located or conducts business, but provided that ``[i]f a 
registrant reports a suspicious order to the DEA centralized database . 
. . the registrant shall be considered to have complied with the 
[notification] requirement . . . .'' \36\ With these provisions, the 
PDDA replaced DEA Field Division Office reporting (reflected in current 
DEA regulations at 21 CFR 1301.74(b)) with centralized reporting to DEA 
Headquarters.
---------------------------------------------------------------------------

    \34\ Public Law 115-271.
    \35\ The PDDA is comprised of Sections 3291 and 3292 of the 
SUPPORT Act.
    \36\ SUPPORT Act, Section 3292. The registrant's notification 
requirement is codified at 21 U.S.C. 832(a)(3). The DEA's 
requirement to establish a centralized database is codified at 21 
U.S.C. 832(b).
---------------------------------------------------------------------------

C. Legal Authority for the Rule: Other Provisions of the PDDA

    In addition to centralized reporting of suspicious orders, the PDDA 
required each registrant to design and operate a system to identify 
suspicious orders for the registrant,\37\ and to ensure that the system 
complies with applicable Federal and State privacy laws. The PDDA also 
provided that the term suspicious order ``may include, but is not 
limited to'' \38\ size, pattern, and frequency orders.
---------------------------------------------------------------------------

    \37\ As noted above, the PDDA provisions are similar to current 
DEA regulations with respect to the system to identify suspicious 
orders for the registrant.
    \38\ SUPPORT Act, Section 3292, codified at 21 U.S.C. 802(57). 
The PDDA's ``may include, but is not limited to'' clause is an 
addition to existing law, which currently provides that 
``[s]uspicious orders include orders of unusual size, orders 
deviating substantially from a normal pattern, and orders of unusual 
frequency.'' 21 CFR 1301.74(b).
---------------------------------------------------------------------------

    By its codification of the phrase ``may include, but is not limited 
to,'' the PDDA clarified that an order for controlled substances can be 
deemed suspicious for reasons other than size, pattern, or frequency 
(including reasons related to the characteristics of the customer 
submitting the order).\39\ Therefore, systems to identify suspicious 
orders should be designed and operated in light of the ultimate goal of 
the suspicious order inquiry: to provide DEA investigators in the field 
with information regarding potential illegal activity in an expeditious 
manner. To this end, DEA is proposing to amend its regulations to 
provide that registrants should design privacy-law-compliant systems 
\40\ not only to identify size, pattern, and frequency orders, but also 
to identify suspicious orders based on facts and circumstances that may 
be relevant indicators of diversion in determining whether a person (or 
a person submitting an order)

[[Page 69286]]

is engaged in, or is likely to engage in, the diversion of controlled 
substances.\41\
---------------------------------------------------------------------------

    \39\ See Section IV.D. titled ``The Due Diligence Requirement,'' 
below.
    \40\ The PDDA, Section 3292, as codified at 21 U.S.C. 832(a)(2), 
provides that ``[e]ach registrant shall . . . ensure that the system 
designed and operated . . . by the registrant complies with 
applicable Federal and State privacy laws . . . .``
    \41\ Proposed amended 1301.74(b)(1). See also Section V.B. 
titled ``Discussion of Regulatory Changes,'' below.
---------------------------------------------------------------------------

IV. Background Discussion

A. History of Applicable DEA Regulations

    Since the CSA became law in 1970, all DEA registrants who 
distribute controlled substances have had a duty to maintain effective 
controls against diversion of controlled substances into other than 
legitimate medical, scientific, and industrial channels.\42\ In 
addition, the first regulations implementing the CSA in 1971 contained 
provisions regarding suspicious orders of controlled substances.\43\ 
These provisions, as currently codified in DEA regulations, require 
that registrants design and operate a system to disclose to the 
registrant suspicious orders of controlled substances, i.e., orders of 
unusual size, orders deviating substantially from a normal pattern, and 
orders of unusual frequency.\44\ It also requires the registrant to 
``inform the Field Division Office of the Administration in his area of 
suspicious orders when discovered by the registrant.'' \45\
---------------------------------------------------------------------------

    \42\ 21 U.S.C. 823(b)(1) and (e)(1) (requiring the Attorney 
General to consider ``maintenance of effective controls against 
diversion'' in determining whether to register an applicant to 
distribute controlled substances); 21 CFR 1301.71(a) (``[a]ll 
applicants and registrants shall provide effective controls and 
procedures to guard against theft and diversion of controlled 
substances'').
    \43\ Bureau of Narcotics and Dangerous Drugs, DOJ, ``Regulations 
Implementing the Comprehensive Drug Abuse Prevention Control Act of 
1970,'' published in the Federal Register at 36 FR 7775, 7785 on 
April 24, 1971.
    \44\ 21 CFR 1301.74(b).
    \45\ 21 CFR 1301.74(b). As discussed above in Section III.B 
titled ``Legal Authority for the Rule: Centralized Reporting Under 
the PDDA,'' the PDDA replaced DEA Field Division Office reporting 
with centralized reporting to DEA Headquarters.
---------------------------------------------------------------------------

B. History of ARCOS

    In addition to the suspicious order provisions, the CSA and DEA 
regulations also require manufacturers and distributors to report their 
controlled substance transactions to DEA.\46\ DEA implements this 
requirement through ARCOS.\47\ ARCOS is an automated, comprehensive 
drug reporting system which monitors the flow of controlled substances 
from their point of manufacture through commercial distribution 
channels to point of sale or distribution at the dispensing level 
through the use of acquisition/distribution transaction reports.
---------------------------------------------------------------------------

    \46\ 21 U.S.C. 827(d) (``Every manufacturer registered under 
section 823 of this title shall . . . make periodic reports to the 
[DEA] of every sale, delivery or other disposal by him of any 
controlled substance, and each distributor shall make such report 
with respect to narcotic controlled substances, identifying by the 
registration number assigned under this subchapter the person or 
establishment (unless exempt from registration under section 822(d) 
of this title) to whom such sale, delivery, or other disposal was 
made.'').
    \47\ The DEA ARCOS regulations are found at 21 CFR 1304.33.
---------------------------------------------------------------------------

    Included in the list of controlled substance transactions tracked 
by ARCOS are the following: All schedule I and II materials 
(manufacturers and distributors), schedule III narcotic and gamma-
hydroxybutyric acid (GHB) materials (manufacturers and distributors), 
and selected schedule III and IV psychotropic drugs (manufacturers 
only).\48\ ARCOS accumulates these transactions which are then 
summarized into reports which give investigators in Federal and State 
government agencies information that can then be used to identify the 
diversion of controlled substances into illicit channels of 
distribution. DEA regulations require that ARCOS acquisition/
distribution reports be filed every quarter, not later than the 15th 
day of the month succeeding the quarter for which it is submitted.\49\
---------------------------------------------------------------------------

    \48\ 21 CFR 1304.33(c).
    \49\ 21 CFR 1304.33(b).
---------------------------------------------------------------------------

C. ARCOS Distributor Tool

    Prior to the SUPPORT Act, the DEA developed an ARCOS tool that 
allowed registrants to obtain a count of the number of registrants who 
had sold a particular controlled substance to a prospective customer in 
the last six months.\50\ On February 26, 2019, as part of its 
implementation of the SUPPORT Act, the DEA announced the launch of an 
enhanced tool to help more than 1,500 registered drug manufacturers and 
distributors in the U.S. more effectively identify potential illicit 
drug diversion.\51\ The enhancement allows DEA-registered manufacturers 
and distributors to view and download the number of distributors and 
the amount (anonymized data in both grams and dosage units) each 
distributor sold to a prospective customer in the last available six 
months of data.
---------------------------------------------------------------------------

    \50\ https://www.dea.gov/press-releases/2018/02/14/dea-creates-new-resource-help-distributors-avoid-oversupplying-opioids.
    \51\ https://www.dea.gov/press-releases/2019/02/26/dea-announces-enhanced-tool-registered-drug-manufacturers-and.
---------------------------------------------------------------------------

D. The Due Diligence Requirement

1. Due Diligence and Southwood
    In Southwood,\52\ the registrant failed repeatedly to comply with 
the effective controls requirement, the system requirement, and the 
reporting requirement.\53\ In Southwood, DEA noted that Respondent's 
due diligence measures, which initially involved nothing more than 
verifying license and registration, were wholly deficient.\54\ DEA 
stated that:
---------------------------------------------------------------------------

    \52\ Southwood Pharmaceuticals, Inc.; Revocation of 
Registration, published in the Federal Register at 72 FR 36487 on 
July 3, 2007.
    \53\ Southwood Pharmaceuticals, Inc.; Revocation of 
Registration, published in the Federal Register at 72 FR 36487, 
36498 on July 3, 2007.
    \54\ Southwood Pharmaceuticals, Inc.; Revocation of 
Registration, published in the Federal Register at 72 FR 36487, 
36498 on July 3, 2007.

    ``even after being advised by agency officials that its internet 
pharmacy customers were likely engaged in illegal activity, 
Respondent failed miserably to conduct adequate due diligence. 
Notwithstanding the breadth of information provided during the 
conference call, Respondent did not stop selling to any of its 
internet pharmacy customers while it investigated the legitimacy of 
their business activities.'' \55\
---------------------------------------------------------------------------

    \55\ Southwood Pharmaceuticals, Inc.; Revocation of 
Registration, published in the Federal Register at 72 FR 36487, 
36500 on July 3, 2007.
---------------------------------------------------------------------------

    In addition, the DEA concluded that:
    ``Respondent repeatedly violated federal regulations by failing 
to report suspicious orders . . . Respondent's experience in 
distributing controlled substances is characterized by recurring 
distributions of extraordinary quantities of controlled substances 
to entities which then likely diverted the drugs by filling 
prescriptions which were unlawful. Moreover, Respondent's due 
diligence measures were wholly inadequate to protect against the 
diversion of the drugs. Respondent's failure to maintain effective 
controls against diversion and its experience in distributing 
controlled substances thus support the conclusion that its continued 
registration would be `inconsistent with the public interest.' '' 
\56\
---------------------------------------------------------------------------

    \56\ Southwood Pharmaceuticals, Inc.; Revocation of 
Registration, published in the Federal Register at 72 FR 36487, 
36501-36502 on July 3, 2007.
---------------------------------------------------------------------------

    In reaching these conclusions, DEA noted:
    ``In short, the direct and foreseeable consequence of the manner 
in which Respondent conducted its due diligence program was the 
likely diversion of millions of dosage units of hydrocodone. Indeed, 
it is especially appalling that notwithstanding the information 
Respondent received from both this agency and the pharmacies, it did 
not immediately stop distributing hydrocodone to any of the 
pharmacies.'' \57\
---------------------------------------------------------------------------

    \57\ Southwood Pharmaceuticals, Inc.; Revocation of 
Registration, published in the Federal Register at 72 FR 36487, 
36500 on July 3, 2007.
---------------------------------------------------------------------------

2. Due Diligence and DEA I and II
    In 2006 and 2007, DEA sent letters to DEA registrants outlining 
their legal

[[Page 69287]]

obligations to report suspicious orders and conduct due diligence.\58\ 
These letters emphasized that, as a condition of maintaining their 
registration, all legitimate handlers of controlled substances must 
take reasonable steps to ensure that their registration is not being 
utilized as a source of diversion.\59\ If the closed system is to 
function properly, registrants must be vigilant in deciding whether a 
prospective customer can be trusted to deliver controlled substances 
only for lawful purposes.\60\ The requirement to report suspicious 
orders is in addition to, and not in lieu of, the general requirement 
to maintain effective controls against diversion.\61\ Thus, in addition 
to reporting all suspicious orders, a distributor has a statutory 
responsibility to exercise due diligence to avoid filling suspicious 
orders that might be diverted into other than legitimate medical, 
scientific, and industrial channels.\62\ Failure to exercise such due 
diligence could, as circumstances warrant, provide a statutory basis 
for revocation or suspension of a distributor's registration.\63\ In a 
similar vein, given the requirement that a registrant maintain 
effective controls against diversion, a distributor may not simply rely 
on the fact that the person placing the suspicious order is a DEA 
registrant and turn a blind eye to the suspicious circumstances.\64\ To 
maintain effective controls against diversion, the registrant should 
exercise due care in confirming the legitimacy of all orders prior to 
filling.\65\
---------------------------------------------------------------------------

    \58\ Letters from Joseph T. Rannazzisi, Deputy Assistant 
Administrator, DEA Office of Diversion Control to DEA Registrants, 
September 27, 2006 (``DEA I'') and December 20, 2007 (``DEA II''). 
Whereas DEA I discussed the responsibility to exercise due diligence 
to avoid filling suspicious orders that might be diverted, DEA II 
reiterated the responsibility to inform the DEA of suspicious 
orders.
    \59\ DEA I, pg. 1.
    \60\ DEA I, pg. 1.
    \61\ DEA I, pg. 2.
    \62\ DEA I, pg. 2.
    \63\ DEA I, pg. 2.
    \64\ DEA I, pg. 2.
    \65\ DEA I, pg. 2.
---------------------------------------------------------------------------

    In addition, registrants' responsibility does not end merely with 
the filing of a suspicious order report.\66\ Registrants must conduct 
an independent analysis of suspicious orders prior to completing a sale 
to determine whether the controlled substances are likely to be 
diverted from legitimate channels.\67\ Reporting an order as suspicious 
will not absolve the registrant of responsibility if the registrant 
knew, or should have known, that the controlled substances were being 
diverted.\68\ Registrants that routinely report suspicious orders, yet 
fill these orders without first determining that order is not being 
diverted, may be failing to maintain effective controls against 
diversion; and failure to maintain effective controls against diversion 
is inconsistent with the public interest as that term is used in the 
CSA and may result in the revocation of the registrant's DEA 
Certificate of Registration.\69\
---------------------------------------------------------------------------

    \66\ DEA II, pg. 1.
    \67\ DEA II, pg. 1.
    \68\ DEA II, pg. 1.
    \69\ DEA II, pg. 2.
---------------------------------------------------------------------------

3. Due Diligence and Masters
    The Masters case,\70\ which involved due diligence within the 
context of a two-part system that the registrant failed to properly 
operate, illustrates how the due diligence requirement is relevant to 
both the reporting and shipping requirement. In Masters, the registrant 
created a system consisting of a computer program and a compliance 
protocol. The computer program was designed to identify and hold any 
order that met or exceeded the criteria for suspicious orders set out 
in DEA regulations. Once an order was held, the registrant's staff 
would implement the compliance protocol, which required an 
investigation of the order to determine whether it was legitimate. 
After this investigation, the staff could deem the order non-suspicious 
and ship it, or treat the order as suspicious, report it to the DEA, 
and decline to fill the order.\71\ However, despite having designed its 
system to require additional due diligence into ``held'' orders,\72\ 
the registrant failed to actually conduct the additional due diligence.
---------------------------------------------------------------------------

    \70\ The Masters case is comprised of a decision by the United 
States Court of Appeals for the District of Columbia Circuit 
Decision and a DEA Decision and Order. See Masters Pharmaceuticals, 
Inc. v. DEA, 861 F.3d 206 (D.C. Cir. 2017) and Masters 
Pharmaceuticals, Inc.; Decision and Order, published in the Federal 
Register at 80 FR 55418 on September 15, 2015.
    \71\ Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206, 213-214 
(D.C. Cir. 2017).
    \72\ In Masters, the registrant's system provided that held 
orders ``be subject to additional due diligence.'' Masters 
Pharmaceuticals, Inc.; Decision and Order, published in the Federal 
Register at 80 FR 55418, 55427 on September 15, 2015.
---------------------------------------------------------------------------

    In the Masters Decision and Order, the DEA stated that ``upon 
investigating an order, a distributor may determine that an order is 
not suspicious . . . .'' \73\ The DEA further explained:
---------------------------------------------------------------------------

    \73\ Masters Pharmaceuticals, Inc.; Decision and Order, 
published in the Federal Register at 80 FR 55418, 55420 on September 
15, 2015.

    ``[W]hile . . . a distributor's investigation of the order 
(coupled with its previous due diligence efforts) may properly lead 
it to conclude that the order is not suspicious, the investigation 
must dispel all red flags indicative that a customer is engaged in 
diversion to render the order non-suspicious and exempt it from the 
requirement that the distributor `inform' the Agency about the 
order. Put another way, if even after investigating the order, there 
is any remaining basis to suspect that a customer is engaged in 
diversion, the order must be deemed suspicious and the Agency must 
be informed.'' \74\
---------------------------------------------------------------------------

    \74\ Masters Pharmaceuticals, Inc.; Decision and Order, 
published in the Federal Register at 80 FR 55418, 55478 on September 
15, 2015.

    On appeal in Masters, the United States Court of Appeals for the 
---------------------------------------------------------------------------
District of Columbia Circuit (the Masters Court) stated:

    ``[o]nce a distributor has reported a suspicious order, it must 
make one of two choices: decline to ship the order, or conduct some 
`due diligence' and--if it is able to determine that the order is 
not likely to be diverted into illegitimate channels--ship the order 
. . . .'' \75\
---------------------------------------------------------------------------

    \75\ Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206, 212-213 
(D.C. Cir. 2017).

---------------------------------------------------------------------------
    The Masters Court also added:

    ``it is not necessary for a distributor of controlled substances 
to investigate suspicious orders if it reports them to DEA and 
declines to fill them. But if a distributor chooses to shoulder the 
burden of dispelling suspicion in the hopes of shipping any it finds 
to be non-suspicious, and the distributor uses something like the 
[Suspicious Order Monitoring Program] Protocol to guide its efforts, 
then the distributor must actually undertake the investigation.'' 
\76\
---------------------------------------------------------------------------

    \76\ Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206, 222 
(D.C. Cir. 2017).

    Finally, the Masters Court rooted due diligence in the reporting 
requirement, as something that a registrant would perform as part of 
---------------------------------------------------------------------------
its duty to report suspicious orders:

    ``In Masters' view, the Administrator amended two notice-and-
comment rules in adjudicating this case: [the regulation defining 
suspicious orders and the regulation defining effective controls 
against the diversion of controlled substances]. We need not opine 
on DEA's statutory authority to use an adjudication to modify a rule 
enacted through notice and comment because the Administrator neither 
created not imposed any new duties. He relied on the existing 
Reporting Requirement.'' \77\
---------------------------------------------------------------------------

    \77\ Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206, 220 
(D.C. Cir. 2017).
---------------------------------------------------------------------------

V. Need for Regulatory Changes and Discussion of Regulatory Changes

A. Need for Regulatory Changes

    A change to existing DEA regulations regarding suspicious orders is 
necessary in order to implement the provisions of the PDDA, and to 
clarify registrant

[[Page 69288]]

obligations under the CSA in light of the issues discussed above.\78\
---------------------------------------------------------------------------

    \78\ See Section II titled ``Suspicious Orders and the Opioid 
Epidemic,'' above.
---------------------------------------------------------------------------

B. Discussion of Regulatory Changes

1. Implementation of the PDDA
    The DEA's implementation of the PDDA will involve amending existing 
DEA regulations in two sections (21 CFR 1300.01 and 21 CFR 1301.74), 
and adding a new section to DEA regulations at 21 CFR 1301.78.\79\ 
Specifically, the DEA will implement the PDDA by: (1) Establishing a 
DEA centralized database for collecting reports of suspicious orders; 
(2) amending DEA regulations to require that all reports of suspicious 
orders be submitted through the DEA centralized database; \80\ (3) 
incorporating the PDDA's definition of ``suspicious order'' into DEA 
regulations; \81\ and (4) incorporating the PDDA's requirement that 
registrants design and operate privacy-law-compliant suspicious order 
system into DEA regulations.\82\
---------------------------------------------------------------------------

    \79\ The existing regulations to be amended at 21 CFR 1300.01 
are titled ``Definitions relating to controlled substances'' and at 
21 CFR 1301.74 are titled ``Other security controls for non-
practitioners; narcotic treatment programs and compounders for 
narcotic treatment programs.'' In addition to amending the text of 
21 CFR 1301.74, the DEA is amending the title of 21 CFR 1301.74 to 
clarify that it applies to ``non-practitioners and practitioners for 
orders received under suspicious circumstances.'' The new 
regulations at 21 CFR 1301.78 are titled ``Procedures for 
identifying and reporting suspicious orders of controlled 
substances.''
    \80\ Proposed new 21 CFR 1301.78(a)(1) and (a)(2)(ii).
    \81\ Proposed amended 21 CFR 1300.01(b).
    \82\ Proposed amended 21 CFR 1301.74(b).
---------------------------------------------------------------------------

2. Clarification of Registrant Procedures Regarding Suspicious Orders
    In addition to implementing the PDDA, DEA is proposing to amend its 
regulations to provide registrants with additional clarity regarding 
the procedures that must be followed upon receiving an order under 
suspicious circumstances by: (1) Clarifying the scope of the rule (as 
discussed below); \83\ (2) adding definitions of ``order,'' ``order 
received under suspicious circumstances,'' and ``due diligence'' to DEA 
regulations; \84\ and (3) amending DEA regulations to include 
procedures for identifying and reporting suspicious orders of 
controlled substances \85\ consistent with the due diligence 
requirement articulated in the Masters and Southwood decisions. The 
proposed definition of ``order'' is intended to reflect existing 
business practices. The proposed definition of ``order received under 
suspicious circumstances'' is intended to capture any circumstances 
that might be indicative of diversion, including but not limited to 
orders ``blocked,'' ``flagged,'' ``held,'' or ``pended'' by a system 
designed and operated by a registrant to identify suspicious orders. In 
addition, DEA is proposing to amend its regulations to clarify that the 
system to identify suspicious orders shall be designed and operated by 
the registrant to identify suspicious orders based on facts and 
circumstances that may be relevant indicators of diversion in 
determining whether a person (or a person submitting an order) is 
engaged in, or is likely to engage in, the diversion of controlled 
substances.\86\
---------------------------------------------------------------------------

    \83\ Proposed amended title to 21 CFR 1301.74 and proposed 
amended 21 CFR 1301.74(b).
    \84\ Proposed amended 21 CFR 1300.01(b).
    \85\ Proposed amended 21 CFR 1301.74(b) and proposed new 21 CFR 
1301.78.
    \86\ Proposed amended 21 CFR 1301.74(b).
---------------------------------------------------------------------------

3. Procedures for Identifying and Reporting Suspicious Orders of 
Controlled Substances
    Building on the due diligence requirement discussed in Southwood 
and the two-part system discussed in Masters, DEA is amending its 
regulations to provide that, upon receipt of an ORUSC, registrants 
shall proceed under the following two-option framework: Either (1) 
immediately file a suspicious order report through the DEA centralized 
database, decline to distribute pursuant to the suspicious order, and 
maintain a record of the suspicious order and any due diligence related 
to the suspicious order,\87\ or (2) before distributing pursuant to the 
order, conduct due diligence to investigate each suspicious 
circumstance surrounding the ORUSC, and maintain a record of its due 
diligence regarding the ORUSC.\88\
---------------------------------------------------------------------------

    \87\ Proposed new 21 CFR 1301.78(a)(1).
    \88\ Proposed new 21 CFR 1301.78(a)(2).
---------------------------------------------------------------------------

    If, through its due diligence, the registrant is able to dispel 
each suspicious circumstance surrounding the ORUSC within seven 
calendar days after receipt of the order, it is not a suspicious order; 
after that determination is made, the registrant may then distribute 
pursuant to the order, and the order need not be reported to DEA as a 
suspicious order, but the registrant must maintain a record of its due 
diligence.\89\ However, if the registrant is unable, through its due 
diligence, to dispel each suspicious circumstance surrounding the ORUSC 
within seven calendar days after receiving the order, it is a 
suspicious order. The registrant must file a suspicious order report 
through the DEA centralized database and maintain a record of its due 
diligence.\90\
---------------------------------------------------------------------------

    \89\ Proposed new 21 CFR 1301.78(a)(2)(i).
    \90\ Proposed new 21 CFR 1301.78(a)(2)(ii).
---------------------------------------------------------------------------

    All suspicious order reports must be made to the DEA centralized 
database and contain certain required information,\91\ and all records 
of suspicious orders and ORUSCs must be prepared and maintained in 
accordance with DEA regulations, and must contain certain required 
information.\92\ Regarding recordkeeping, the proposed rule would 
require more than just a ``check-the-box'' type of documentation. For 
example, new proposed Sec.  1301.78(d) requires that the record include 
``how the registrant handled such orders,'' ``[w]hat information and 
circumstances rendered the order actually or potentially suspicious,'' 
[w]hat steps, if any, the registrant took to investigate the order,'' 
and ``[i]f the registrant investigated the order, what information it 
obtained during its investigation, and where the registrant concludes 
that each suspicious circumstance has been dispelled, the specific 
basis for each such conclusion . . . .''
---------------------------------------------------------------------------

    \91\ Proposed new 21 CFR 1301.78(b).
    \92\ Proposed new 21 CFR 1301.78(c).
---------------------------------------------------------------------------

    Upon notification from DEA that a suspicious order report or 
reports contain inaccurate or incomplete information, the registrant 
shall have seven calendar days to correct the inaccurate or incomplete 
information.\93\
---------------------------------------------------------------------------

    \93\ Proposed new 21 CFR 1301.78(b).
---------------------------------------------------------------------------

    DEA believes that seven calendar days to conduct due diligence is 
consistent with the Masters and Southwood decisions, and with the 
PDDA's mandate that a registrant notify DEA ``upon discovering'' \94\ a 
suspicious order. The seven calendar day timeframe strikes an 
appropriate balance between giving registrants sufficient time to act 
and also allowing DEA to promptly investigate potential diversion, 
while also recognizing that discovering a suspicious order sometimes 
involves a process of dispelling suspicious circumstances, and that any 
ORUSC that cannot be dispelled within seven days is a suspicious order 
(assuming that the system to identify suspicious orders for the 
registrant is properly designed and operated).
---------------------------------------------------------------------------

    \94\ Sec. 3292.
---------------------------------------------------------------------------

4. Scope of the Rule
    Because the requirements related to suspicious orders are based on 
the CSA definition of ``distribute,'' \95\ this

[[Page 69289]]

proposed rule applies to registrants authorized to distribute 
controlled substances either directly (under the registrant's business 
activity), indirectly (as a coincident activity to the business 
activity), under the five percent rule, or as a treatment program 
compounding narcotics for treatment programs and other locations.\96\ 
The five percent rule permits a practitioner dispenser, under certain 
circumstances, to distribute controlled substances to another 
practitioner without having to obtain a separate DEA registration as a 
distributor a practitioner who is registered to dispense a controlled 
substance may distribute (without being registered to distribute) a 
quantity of such substance to another practitioner for the purpose of 
general dispensing by the practitioner to patients, provided inter alia 
that the total number of dosage units of all controlled substances 
distributed by the practitioner during each calendar year does not 
exceed 5 percent of the total number of dosage units of all controlled 
substances distributed and dispensed by the practitioner during the 
same calendar year.\97\
---------------------------------------------------------------------------

    \95\ See 21 U.S.C. 802(11) (``[t]he term `distribute' means to 
deliver (other than by administering or dispensing) a controlled 
substance''), 21 U.S.C. 823(b)(1) and (e)(1) (requiring the Attorney 
General to consider ``maintenance of effective controls against 
diversion'' in determining whether to register an applicant to 
distribute controlled substances) and 21 CFR 1301.74(a) (``[b]efore 
distributing a controlled substance'' a registrant shall make a good 
faith inquiry to determine that their customer is registered to 
possess the controlled substance) (emphasis added).
    \96\ See 21 CFR 1304.25(a)(7) (requiring persons registered or 
authorized to compound narcotic drugs for off-site use in a narcotic 
treatment program to maintain records of the quantity distributed in 
bulk form to other programs) (emphasis added).
    \97\ 21 CFR 1307.11(a)(1)(iv).
---------------------------------------------------------------------------

    Therefore, this proposed rule applies not only to persons who are 
registered with DEA under the business activity of distributor, but 
also to manufacturers and importers (who are permitted to distribute 
controlled substances as a coincident activity to their manufacturer or 
importer registration),\98\ practitioners,\99\ (who are permitted to 
distribute controlled substances pursuant to the five percent rule 
without obtaining a separate registration as a distributor), and 
Narcotic Treatment Programs (NTPs) distributing in controlled 
substances in bulk form to other NTPs. These registrants are authorized 
to distribute controlled substances after receiving an order from 
another DEA registrant.
---------------------------------------------------------------------------

    \98\ 21 CFR 1301.13(e)(1)(i) and (viii).
    \99\ 21 U.S.C. 802(21) (``[t]he term `practitioner' means a 
physician, dentist, veterinarian, scientific investigator, pharmacy, 
hospital, or other person licensed, registered, or otherwise 
permitted, by the United States or the jurisdiction in which he 
practices or does research, to distribute, dispense, conduct 
research with respect to, administer, or use in teaching or chemical 
analysis, a controlled substance in the course of professional 
practice or research''). As discussed below, the specific 
practitioners affected by this rule are pharmacies, hospital/clinics 
teaching institutions, practitioners, mid-level practitioners 
(MLPs), MLP-ambulance service, researchers, and analytical labs.
---------------------------------------------------------------------------

    However, the rule does not apply to reverse distributors, who are 
authorized by their registration to acquire controlled substances for 
the purpose of return or destruction \100\ after receiving an order 
from another DEA registrant. In addition, because the CSA distinguishes 
the terms ``dispense'' and ``administer'' from the term ``distribute,'' 
\101\ the rule does not apply to controlled substances dispensed or 
administered within the normal course of professional practice of a 
practitioner, to include prescriptions filled by a pharmacy. Therefore, 
pursuant to the five percent rule, a pharmacy will have to report 
suspicious orders for distributions of controlled substances, but would 
not, for example, have to report as a suspicious order, suspicious 
requests by a patient to have a controlled substance prescription 
filled.\102\
---------------------------------------------------------------------------

    \100\ See 21 CFR 1300.01(b) (defining ``Reverse distribute'' and 
``Reverse distributor'').
    \101\ See 21 U.S.C. 802(2) (defining ``administer''), 21 U.S.C. 
802(10) (defining ``dispense''), and 21 U.S.C. 802(11) (defining 
``distribute''). Compare 21 U.S.C. 802(11) (defining distribute as 
``to deliver [a controlled substance] (other than by administering 
or dispensing) . . . .'') with 21 U.S.C. 802(10) (defining dispense 
as ``to deliver a controlled substance to an ultimate user or 
research subject by, or pursuant to the lawful order of, a 
practitioner, including the prescribing and administering of a 
controlled substance . . . .'').
    \102\ Although, in this example, the pharmacy would not have a 
duty to report a suspicious order, this scenario would nevertheless 
be relevant to the pharmacist's ``corresponding responsibility.'' 
See 21 CFR 1306.04(a) (``[t]he responsibility for the proper 
prescribing and dispensing of controlled substances is upon the 
prescribing practitioner, but a corresponding responsibility rests 
with the pharmacist who fills the prescription'').
---------------------------------------------------------------------------

VI. Impact of Regulatory Changes and Regulatory Analysis

A. Executive Orders 12866 (Regulatory Planning and Review), 13563 
(Improving Regulation and Regulatory Review), and 13771 (Reducing 
Regulation and Controlling Regulatory Costs)

1. Introduction
    E.O. 12866 directs agencies to assess all costs and benefits of 
available regulatory alternatives, and, when regulation is necessary, 
to select regulatory approaches that maximize net benefits (including 
potential economic, public health and safety, and environmental 
advantages, as well as distributive impacts and equity). E.O. 13563 is 
supplemental to and reaffirms the principles, structures, and 
definitions governing regulatory review as established in E.O. 12866.
    Under E.O. 12866, significant regulatory actions require review by 
OMB. Significant regulatory actions can be either economically 
significant or non-economically significant. An economically 
significant regulatory action is any regulatory action that is likely 
to result in a rule that may have an annual effect on the economy of 
$100 million or more, or adversely affect in a material way the 
economy, a sector of the economy, productivity, competition, jobs, 
environment, public health or safety, or State, local, or tribal 
governments or communities.\103\ A non-economically significant 
regulatory action is any regulatory action that is likely to result in 
a rule that may create a serious inconsistency or otherwise interfere 
with an action taken or planned by another agency, may materially alter 
the budgetary impact of entitlements, grants, user fees, or loan 
programs or the rights and obligations of recipients thereof, or may 
raise novel legal or policy issues arising out of legal mandates, the 
President's priorities, or the principles set forth in E.O 12866.\104\
---------------------------------------------------------------------------

    \103\ Executive Order 12866, Sec. 3(f)(1).
    \104\ Executive Order 12866, Sec. 3(f)(2)-(4).
---------------------------------------------------------------------------

    E.O. 13771 requires an agency, unless prohibited by law, to 
identify at least two existing regulations to be repealed when the 
agency publicly proposes for notice and comment or otherwise 
promulgates a new regulation.\105\ In furtherance of this requirement, 
E.O. 13771 requires that the new incremental costs associated with new 
regulations, to the extent permitted by law, be offset by the 
elimination of existing costs associated with at least two prior 
regulations.\106\ According to OMB guidance implementing E.O. 13771, 
the requirements of E.O. 13771 only apply to each new E.O. 12866 
``significant regulatory action . . . that has been finalized and that 
imposes total costs greater than zero.'' \107\ Furthermore, an action 
that has been finalized and has total costs less than zero is an 
``Executive Order 13771 deregulatory action.'' \108\
---------------------------------------------------------------------------

    \105\ Executive Order 13771, Sec. 2(a).
    \106\ Executive Order 13771, Sec. 2(c).
    \107\ Executive Office of the President, Office of Management 
and Budget, M-17-21, April 5, 2017. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/M-17-21-OMB.pdf, pg. 
3.
    \108\ Executive Office of the President, Office of Management 
and Budget, M-17-21, April 5, 2017. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/M-17-21-OMB.pdf, pg. 
4.
---------------------------------------------------------------------------

    DEA has analyzed the economic impact of each provision of this rule 
and, for the reasons discussed in detail

[[Page 69290]]

below, estimates this rule will have a cost savings of approximately 
$2.9 million. Additionally, DEA does not anticipate that this 
rulemaking will have an annual effect on the economy of $100 million or 
more or adversely affect in a material way the economy, a sector of the 
economy, productivity, competition, jobs, the environment, public 
health or safety, or State, local, or tribal governments or 
communities. OIRA has determined that this rulemaking is a significant 
regulatory action within the meaning of E.O. 12866. DEA has, therefore, 
submitted this rule for review by OMB.
    Because this rule is estimated to have total costs less than zero, 
it is expected to be an E.O. 13771 deregulatory action.
2. Four Key Areas of Change
    There are four key areas of regulatory change in this rule: (1) 
Definitions of new terms, (2) explicit inclusion of registrants, other 
than reverse distributors, who are authorized to distribute, (3) 
procedures for identifying and reporting suspicious orders, and (4) 
reporting and recordkeeping requirements.
    With the exception of reverse distributors, this rule affects all 
registrants who are authorized to distribute controlled substances: 
Distributors, manufacturers, importers, pharmacies, hospital/clinics 
teaching institutions, practitioners, mid-level practitioners (MLPs), 
MLP-Ambulance Service, Researchers, Analytical Labs, and NTPs. As of 
May 6, 2019, there were 1,731 registrations authorizing the 
distribution of controlled substances, either directly (under the 
registrant's business activity) (873 distributor), or indirectly as a 
coincident activity to the business activity (586 manufacturer and 272 
importer). Additionally, based on a sampling of DEA Forms 222 received 
at DEA Field Division Offices pursuant to 21 CFR 1305.13(d), DEA 
estimates that there are approximately 15,974 practitioners and NTPs 
who distribute controlled substances under the five percent rule or as 
a treatment program compounding narcotics for treatment programs and 
other locations.
a. Definition of Terms
    The rule will incorporate the PDDA's definition of ``suspicious 
order'' into DEA regulations. Furthermore, to provide clarity, the rule 
also adds definitions of three additional terms: ``order,'' ``order 
received under suspicious circumstances,'' and ``due diligence.'' The 
PDDA definition of ``suspicious order'' parallels the long-standing 
definition of ``suspicious orders'' in DEA regulations, and does not 
expand or contract the current understanding of what are suspicious 
orders.
    The definition of ``order'' clarifies and codifies the meaning in 
the context of suspicious orders. The DEA believes that this is 
consistent with the current understanding of the term order and 
anticipates this definition will not cause a change in the number of 
suspicious orders or change in registrant business activities. 
Therefore, DEA believes defining order in DEA regulations will have no 
economic impact on affected registrants.
    The rule also includes definitions of ``order received under 
suspicious circumstances'' and ``due diligence.'' These definitions are 
intended to provide clarity in describing the procedures for 
identifying and reporting suspicious orders. DEA does not anticipate an 
increase or decrease in the number of suspicious orders reported as a 
direct result of the new definitions. Therefore, DEA estimates this 
definition will have no economic impact.
b. Explicit Inclusion of Registrants, Other Than Reverse Distributors, 
Who Are Authorized To Distribute
    The rule amends DEA regulations to clarify that, in addition to 
entities that hold registration as distributors, the requirement to 
design and operate a system to identify suspicious orders of controlled 
substances for the registrant that complies with applicable Federal and 
State privacy laws shall also apply to practitioners when such 
distributions are made pursuant to the five percent rule.
    This is a clarification of currently existing requirements. As all 
registrants are required to maintain effective controls against 
diversion of controlled substances, the DEA believes all practitioners 
who distribute pursuant to the provisions of the five percent rule 
already understand the requirement to ``design and operate a system'' 
also applies to them as well. A ``system'' in this context is a 
combination of people, process, and tools (such as an information 
system). Some registrants may rely more on information systems while 
other may rely more on manual processes. Regardless of whether the 
system is automated or manual, DEA believes the pharmacies and other 
practitioners who distribute pursuant to the five percent rule 
currently understand and operate such a system. Therefore, this 
proposed explicit inclusion of pharmacies and other practitioners in 21 
CFR 1301.74(b) is estimated to result in no cost to affected 
registrants.
c. Procedures for Identifying and Reporting Suspicious Orders of 
Controlled Substances
    The two-option framework for identifying suspicious orders is a 
codification of existing practices, and therefore, there is no added 
cost associated with the proposed suspicious order determination 
process. Masters and Southwood interpreted the suspicious order 
provisions by articulating that, upon receiving a suspicious order, a 
registrant has a duty to conduct due diligence before distributing 
pursuant to the order. DEA believes nearly all affected registrants 
explicitly or implicitly utilize the two-option framework. All 
suspicious order reports must be made to the DEA centralized database 
and contain certain required information, and all records of suspicious 
orders and ORUSCs must be prepared and maintained in accordance with 
DEA regulations, and must contain certain required information. 
Moreover, DEA estimates there is time and cost savings resulting from 
using the ARCOS Distributor Tool while conducting due diligence.
    Between 2014 and 2018, there were an average of 338,840 suspicious 
order reports per year. This figure includes an estimated average of 
308,540 suspicious orders per year reported to the central database and 
an estimated average of 30,300 orders per year reported to field 
offices.\109\ While the two-option framework has been in practice for a 
long time, DEA believes the reporting of suspicious orders versus 
reporting of ORUSCs has the potential to be more consistent. DEA 
believes, under current regulations, registrants make suspicious order 
reports for all ORUSCs, regardless of whether due diligence was 
conducted and suspicions were dispelled.
---------------------------------------------------------------------------

    \109\ A suspicious orders central database has been in operation 
since prior to 2014 to allow certain registrants to report 
electronically pursuant to an MOA. The number of suspicious order 
reports steadily decreased from 447,140 in 2014 to 102,434 in 2018 
due to the decrease in number of registrants under an MOA. Despite 
this decrease, the DEA uses an average (rather than projecting a 
trend) of 338,840 because the decrease is a result of fewer 
registrants reporting, not decreasing number of reported suspicious 
orders. Since the DEA does not have much data beyond what was 
reported to the central database, it decided to use the data as-is. 
The average number of suspicious orders reported to the field is 
based on a poll of field offices conducted in 2017.
---------------------------------------------------------------------------

    Under the proposed rule, the DEA estimates all reported average of 
338,840 suspicious orders per year are ORUSCs. Based on general 
understanding of registrant operations and informal anecdotal 
discussions with registrants, DEA assumes for the purposes of this 
analysis that of the 338,840 suspicious

[[Page 69291]]

orders that would be classified as ORUSC under the proposed rule, 10 
percent (33,884) would fall under option 1, immediately deemed 
suspicious and reported as ``suspicious orders.'' Accordingly, the 
registrant would conduct due diligence on the remaining 90 percent 
(304,956), with the suspicion dispelled and order filled for 80 percent 
(271,072), and suspicion not dispelled and order rejected for the 
remaining 10 percent (33,884). In summary, DEA assumes that 20 percent 
of ORUCSs would be reported as suspicious orders and rejected, while 
the suspicion would be dispelled and order filled for 80 percent. DEA 
believes many orders previously (and currently) reported as 
``suspicious orders'' to the central database were eventually filled 
after conducting due diligence and dispelling suspicion.
    DEA estimates many registrants will use the ARCOS Distributor Tool 
in conducting due diligence. Estimated time savings is zero for those 
registrants who do not use the tool and approximately 30 minutes for 
those registrants using the tool to conduct due diligence. DEA does not 
have a strong basis to estimate the number of registrants who use the 
ARCOS Distributor Tool for conducting due diligence, but conservatively 
estimates the use of the tool will save registrants, on average, 10 
minutes each time due diligence is conducted. Therefore, DEA estimates 
using the ARCOS Distributor Tool will save a total of 50,826 hours per 
year \110\ while conducting due diligence. Based on a loaded hourly 
rate of $52.46 for a ``compliance officer,'' \111\ DEA estimates the 
cost savings (negative cost) from using the ARCOS Distributor Tool 
while conducting due diligence is approximately $2,666,000 (50,826 x 
$52.46, rounded). As indicated above, DEA does not have a strong basis 
to estimate the number of times due diligence is conducted and how much 
time the ARCOS Distributor Tool saves per each time due diligence is 
conducted.\112\ DEA welcomes any comments related to this estimate.
---------------------------------------------------------------------------

    \110\ 304,956 x 10 x (1/60) = 50,826.
    \111\ The DEA utilizes the wage rate for ``Compliance Officer'' 
(SOC 13-1041, 2018 Standard Occupational Classification, https://www.bls.gov/soc/2018/major_groups.htm), in the ``Merchant 
Wholesalers, Nondurable Goods (4242 and 4246 only)'' industry. The 
mean hourly wage for that position and industry according to the May 
2018 National Occupational Employment and Wage Estimates United 
States (https://www.bls.gov/oes/current/oes_nat.htm) is $36.76. 
Based on the BLS report, ``Employer Costs for Employee 
Compensation--March 2019,'' (ECEC) (https://www.bls.gov/news.release/pdf/ecec.pdf) an additional 42.7% load (for ``private 
industry'') is added to the wage rate to account for benefits. 
$36.76 x 1.427 = $52.46.
    \112\ In addition to cost savings resulting from the use of the 
ARCOS Distributor Tool in conducting due diligence of an ORUSC, DEA 
anticipates there will be a cost savings to registrants from using 
the ARCOS Distributor Tool during a manufacturer or distributor's 
``on-boarding'' process for accepting a new customer. While the 
ARCOS Distributor Tool is expected to save manufacturers and 
distributors time and cost associated with due diligence conducted 
during the evaluation of a prospective customer, each registrant is 
expected to have its own proprietary process for the evaluation and 
DEA does not have a strong basis to quantify the cost savings.
---------------------------------------------------------------------------

d. Reporting and Recordkeeping Requirements
    The rule contains new requirements that specify the reporting 
method, time limit for reporting, recordkeeping, and contents of the 
record. The rule requires, regardless of whether the suspicious order 
determination resulted from option 1 or option 2, a suspicious order 
report be submitted no later than seven calendar days after the order 
was received. The rule also requires suspicious order reports be made 
to the DEA centralized database. The report must include:
    (1) The DEA registration number of the registrant placing the order 
for controlled substances;
    (2) The date the order was received;
    (3) The DEA registration number of the registrant reporting the 
suspicious order;
    (4) The National Drug Code number, unit, dosage strength, and 
quantity of the controlled substances ordered;
    (5) The order form number for schedule I and schedule II controlled 
substances;
    (6) The unique transaction identification number for the suspicious 
order; and
    (7) What information and circumstances rendered the order actually 
suspicious.
    The seven calendar day reporting timeframe and the reporting of 
specific information to the DEA centralized database provide 
standardization and consistency for reporting suspicious orders. First, 
the seven calendar day time limit on reporting suspicious orders is 
estimated to impose minimal additional cost. DEA believes the 
requirement to report suspicious orders within seven calendar days of 
receiving the order is a reasonable balance between registrant 
operational demands, and prompt action that can lead to investigative 
leads. The current requirement is to report suspicious orders ``when 
discovered'' by the registrant.'' \113\ DEA believes the vast majority 
of suspicious orders are already reported within the seven calendar day 
period. Therefore, DEA estimates any cost associated with the seven 
calendar day time requirement is minimal.
---------------------------------------------------------------------------

    \113\ 21 CFR 1301.74(b).
---------------------------------------------------------------------------

    Second, reporting to the DEA centralized database is estimated to 
impose no additional burden. Based on DEA's registration data, nearly 
99 percent of applications for registration or renewal of registration 
in the previous 12 months (May 2018 to April 2019) were made online. 
Furthermore, although the email address is an optional data field, 
nearly all registrations have an email address on record. Based on 
these facts and the high rate of internet use in the general U.S. 
population,\114\ it is reasonable to estimate virtually all affected 
registrants have information systems capable of completing, submitting, 
and retaining electronic suspicious order reports at minimal additional 
cost. DEA acknowledges that is possible for an affected registrant not 
to have broadband internet access, especially in rural areas. DEA 
welcomes any comments regarding cost of obtaining broadband access or 
the cost of complying with the proposed regulations without onsite 
broadband internet access. No special software or equipment will be 
required to access and make reports to the DEA centralized database. 
Also, the DEA centralized database interface is very similar to ARCOS 
which a majority of manufacturers and distributors already use. Thus, a 
manufacturer or distributor familiar with ARCOS would require minimal 
learning when initially using the DEA centralized database. 
Additionally, the proposed content of suspicious order reports is a 
codification of content expected of current suspicious order reports or 
content subsequently requested by DEA if not provided in a suspicious 
order report. Furthermore, DEA estimates, for the estimated 30,300 
suspicious order reports currently reported to the field offices, there 
will be an average time savings of ten minutes per report. The 
centralized database programmatically requires the required information 
in a suspicious order report. Currently, when a suspicious order report 
is received in the field office, it often lacks needed information. In 
such instances, the reporting registrant is highly likely to receive a 
call-back or an on-site interview from the field office, requiring more 
of the registrant's time to respond

[[Page 69292]]

to DEA's inquiries. Additionally, the reduction in the number of ORUSC 
reported as suspicious order is expected to contribute to this 
decrease.\115\ Therefore, DEA estimates reporting to the centralized 
database will save a total of 5,050 hours per year.\116\ Based on a 
loaded hourly rate of $52.46 for a ``compliance officer,'' \117\ DEA 
estimates the cost savings (negative cost) from using the centralized 
database is approximately $265,000 (5,050 x $52.46, rounded). DEA does 
not have a strong basis to estimate the time savings per a suspicious 
order report currently received in the field. DEA welcome any comments 
related to this estimate.
---------------------------------------------------------------------------

    \114\ An estimated 81% of households in U.S. households had a 
broadband internet subscription in 2016. Camille Ryan, U.S. Census 
Bureau, Computer and Internet Use in the United States: 2016, Issued 
August 2018.
    \115\ Similar to the discussion above, a total of 20% of ORUSCs 
are suspicious orders that require reporting to the DEA. The 
remaining 80% of ORUSCs are estimated to have suspicion dispelled.
    \116\ 30,300 x 10 x (1/60) = 50,826.
    \117\ See Footnote 78, above.
---------------------------------------------------------------------------

    Additionally, the rule requires registrants to maintain a record of 
every suspicious order and every ORUSC, and how the registrant handled 
such orders.\118\ The record must be prepared no later than seven 
calendar days after the suspicious order or ORUSC was received and must 
include the following information:
---------------------------------------------------------------------------

    \118\ Proposed new 21 CFR 1301.78(c).
---------------------------------------------------------------------------

    (1) What information and circumstances rendered the order actually 
or potentially suspicious;
    (2) What steps, if any, the registrant took to conduct due 
diligence;
    (3) If the registrant conducted due diligence, what information it 
obtained during its investigation, and where the registrant concludes 
that each suspicious circumstance has been dispelled, the specific 
basis for each such conclusion; and
    (4) Whether or not the registrant distributed controlled substances 
pursuant to the order.
    DEA believes registrants already maintain all records documenting 
each suspicious order and ORUSC. DEA believes these records, in form of 
notations made in their internal order management systems, are 
maintained for at least two years as part of their ordinary business 
operations, even if the registrants are able to dispel the suspicious 
circumstances. DEA estimates the number of ORUSC will not increase as a 
result of the rule and remain at current levels. DEA estimates any 
additional costs associated with the recordkeeping requirements are 
minimal.
3. Summary of Costs
    DEA has analyzed the economic impact of each provision of this rule 
and estimates there will be a total cost savings of $2,931,000. The 
two-option framework for identifying suspicious orders is a 
codification of current practices, and DEA believes nearly all affected 
registrants explicitly or implicitly utilize the two-option framework. 
DEA estimates there will be a cost savings of $2,666,000 from the 
implementation of the ARCOS Distributor Tool, which saves time when 
conducting due diligence. Additionally, reporting suspicious orders to 
the DEA centralized database, which saves time when reporting 
suspicious orders, is estimated to save of $265,000. All DEA 
registrants are believed to have access to the use of an internet-
connected computer at no additional cost. Based on DEA's registration 
data, nearly 99 percent of applications for registration or renewal of 
registration in the previous 12 months (May 2018 to April 2019) were 
made online. Although the email address is an optional data field, 
virtually all registrations have an email address on record. No special 
software or equipment will be required to access and make reports to 
the DEA centralized database. Finally, the DEA believes registrants 
already create and maintain all records documenting each suspicious 
order and ORUSC in the form of notations made in their internal order 
management systems.
4. Summary of Benefits
    DEA believes there are numerous non-quantifiable benefits 
associated with this rule. First, adding the definition of ``suspicious 
order'' aligns DEA's regulations with the PDDA, and adding other terms 
provides clarity and enhances understanding of required procedures when 
an ORUSC is received. Second, the rule's suspicious order determination 
process would formalize current business practices and create 
consistency across all registrants and DEA Field Division Offices. 
Third, reporting suspicious orders to the DEA centralized database 
would standardize reporting procedures, content of the reports, and how 
the reports are handled within the DEA. Suspicious orders are being 
reported centrally to DEA by some registrants, and the ease and 
efficiency of this electronic submission has been embraced by these 
registrants. Finally, the DEA centralized database would allow DEA to 
efficiently collect the data in a single database, and to generate 
macro-level reports and investigative leads.

B. Executive Order 12988

    This rule meets the applicable standards set forth in sections 3(a) 
and 3(b)(2) of E.O. 12988, Civil Justice Reform to eliminate ambiguity, 
minimize litigation, establish clear legal standards, and reduce 
burden.

C. Executive Order 13132

    This rule does not have federalism implications warranting the 
application of E.O. 13132. The rule does not have substantial direct 
effects on the States, on the relationship between the National 
Government and the States, or the distribution of power and 
responsibilities among the various levels of government.

D. Executive Order 13175

    This rule does not have substantial direct effects on the States, 
on the relationship between the National Government and the States, or 
the distribution of power and responsibilities between the Federal 
Government and Indian tribes.

E. Regulatory Flexibility Act

    In accordance with the RFA,\119\ the DEA evaluated the impact of 
this rule on small entities. DEA's evaluation of economic impact by 
size category indicates that the rule will not, if promulgated, have a 
significant economic impact on a substantial number of these small 
entities.
---------------------------------------------------------------------------

    \119\ 5 U.S.C. 601-612.
---------------------------------------------------------------------------

    The RFA requires agencies to analyze options for regulatory relief 
of small entities unless it can certify that the rule will not have a 
significant impact on a substantial number of small entities. For 
purposes of the RFA, small entities include small businesses, nonprofit 
organizations, and small governmental jurisdictions. DEA has analyzed 
the economic impact of each provision of this rule and estimates the 
rule will have minimal economic impact on affected persons, including 
small entities.
    The PDDA definition of suspicious order parallels the long-standing 
definition of suspicious order in DEA regulations, and does not expand 
or contract the current understanding of what is a suspicious order. 
The definition of ``order'' clarifies and codifies the meaning of the 
word in the context of suspicious orders. DEA believes that this is not 
a departure from the current understanding of the term order, and 
anticipates this definition will not cause a change in the number of 
suspicious orders or change in registrant business activities. The 
definitions of ``order received under suspicious circumstances'' and 
``due diligence'' codify current understanding of the term and provide 
clarity in describing the procedures for

[[Page 69293]]

identifying and reporting suspicious orders. Therefore, DEA believes 
the number of ORUSCs that are investigated, and the number of 
suspicious orders that are reported will remain consistent with current 
levels, and will not increase as result of this rule.
    The requirement to design and operate a system to identify 
suspicious orders of controlled substances is not new, but is a 
clarification of existing requirements for distributors, manufacturers, 
importers, practitioners, and NTPs. All registrants are required to 
maintain effective controls, and to design and operate the system. 
Regardless of whether the system (understood as a combination of 
people, process, and tools) is automated or manual, DEA believes that 
distributors, manufacturers, importers, practitioners, and NTPs 
currently understand and operate such a system. Therefore, the system 
requirement is estimated to result in no cost to affected registrants.
    This two-option framework for identifying suspicious orders is a 
codification of current practices. Masters and Southwood interpreted 
the suspicious order provisions by articulating that, upon receiving a 
suspicious order, a registrant has a duty to conduct due diligence 
before distributing pursuant to the order. DEA believes nearly all 
affected registrants explicitly or implicitly utilize the two-option 
framework. All suspicious order reports must be made to the DEA 
centralized database and contain certain required information, and all 
records of suspicious orders and ORUSCs must be prepared and maintained 
in accordance with DEA regulations, and must contain certain required 
information. DEA believes the two-option framework is a codification of 
existing business practices, and therefore, the number of ORUSCs and 
the number of suspicious orders reported will remain consistent with 
current levels. As discussed earlier, Masters and Southwood interpreted 
the suspicious order provisions by articulating that, upon receiving a 
suspicious order, a registrant has a duty to conduct due diligence 
before distributing pursuant to the order. DEA believes nearly all 
affected registrants explicitly or implicitly utilize the two-option 
framework. Moreover, DEA estimates there is time and cost savings 
resulting from using the ARCOS Distributor Tool while conducting due 
diligence.
    As previously detailed,\120\ DEA estimates due diligence will be 
conducted on 90 percent (304,956) of all ORUSCs. DEA believes all 
registrants will use the ARCOS Distributor Tool in conducting due 
diligence and the use of the tool will save registrants 10 minutes each 
time due diligence is conducted. Therefore, DEA estimates using the 
ARCOS Distributor Tool will save a total of 50,826 hours per year while 
conducting due diligence. Based on a loaded hourly rate of $52.46 for a 
``compliance officer'' \121\ DEA estimates the cost savings from using 
the ARCOS Distributor Tool while conducting due diligence is 
approximately $2,666,000.
---------------------------------------------------------------------------

    \120\ See Section VI.A.2.c. titled ``Procedures for Identifying 
and Reporting Suspicious Orders of Controlled Substances,'' above.
    \121\ See Footnote 78, above.
---------------------------------------------------------------------------

    The rule requires, regardless of whether the suspicious order 
determination resulted from option 1 or option 2, a suspicious order 
report be submitted no later than seven calendar days after the order 
was received. The report must be made to the DEA centralized database 
with certain required information. DEA believes the requirement to 
report suspicious orders within seven calendar days of receiving the 
order is a reasonable balance between registrant operational demands, 
and DEA's need for prompt action that can lead to investigative leads. 
DEA believes the vast majority of suspicious orders are already 
reported within the seven calendar day period. Therefore, DEA estimates 
any cost associated with the seven calendar day time requirement is 
minimal. Additionally, reporting to the DEA centralized database is 
estimated to impose no additional burden. All DEA registrants are 
believed to have access to the use of an internet-connected computer at 
no additional cost. Based on DEA's registration data, nearly 99 percent 
of applications for registration or renewal of registration in the 
previous 12 months (May 2018 to April 2019) were made online. Although 
the email address is an optional data field, virtually all 
registrations have an email address on record. No special software or 
equipment will be required to access and make reports to the DEA 
centralized database. Based on these facts it is reasonable to estimate 
virtually all affected registrants have information systems capable of 
completing, submitting, and retaining electronic suspicious order 
reports at no additional cost. Furthermore, as detailed in section 
IV.1.b.iv, DEA estimates, for the estimated 30,300 suspicious order 
reports reported to the field, there will be a time savings of ten 
minutes per report. The centralized database programmatically requires 
the required information in a suspicious order report. Currently, when 
a suspicious order report is received in the field office, it often 
lacks needed information. In such instances, the reporting registrant 
is highly likely to receive a call-back or an on-site interview from 
the field office, requiring more of registrant's time to respond to 
DEA's inquiries. Additionally, the reduction in the number of ORUSC 
reported as suspicious order is expected to contribute to this 
decrease. Therefore, DEA estimates reporting to the centralized 
database will save a total of 5,050 hours per year. Based on a loaded 
hourly rate of $52.46 for a ``compliance officer,'' \122\ DEA estimates 
the cost savings (negative cost) from using the centralized database is 
approximately $265,000.
---------------------------------------------------------------------------

    \122\ Ibid.
---------------------------------------------------------------------------

    Finally, the registrant must maintain a record of each suspicious 
order and ORUSC, and how the registrant handled the order, for two 
years. The record must be prepared no later than seven calendar days 
after the suspicious order or ORUSC was received and must include the 
following information:
    (1) What information and circumstances rendered the order actually 
or potentially suspicious;
    (2) What steps, if any, the registrant took to conduct due 
diligence;
    (3) If the registrant conducted due diligence, what information it 
obtained during its investigation, and where the registrant concludes 
that each suspicious circumstance has been dispelled, the specific 
basis for each such conclusion; and
    (4) Whether or not the registrant distributed controlled substances 
pursuant to the order.
    DEA believes the registrants already maintain all records 
documenting each suspicious order and ORUSC. DEA believes these 
records, in the form of notations made in their internal order 
management systems, are already maintained for at least two years as 
part of their ordinary business operations, even if the registrant is 
able to dispel the suspicious circumstances. DEA estimates any 
additional costs associated with the recordkeeping requirements are 
minimal.
    In conclusion, the rule includes clarification and codification of 
generally understood terms, codification of existing practices, and 
standardization of information submitted to the DEA (in terms of both 
method and content of submissions).

[[Page 69294]]

Furthermore, DEA estimates a cost savings of $2,666,000 from the use of 
the ARCOS Distributor Tool and $265,000 from the use of the centralized 
database for the reporting of suspicious orders. Therefore, DEA 
estimates a total cost savings of $2,931,000.
1. Affected Registrations
    With the exception of reverse distributors, this rule affects all 
persons who are authorized to distribute controlled substances: 
Distributors, manufacturers, importers, practitioners, and NTPs. As of 
May 6, 2019, there were 1,731 registrations authorized to distribute as 
distributors, manufacturers, and importers: 873 distributor, 586 
manufacturer, and 272 importer. Additionally, based on sampling of DEA 
Forms 222 received at DEA Field Division Offices pursuant to 21 CFR 
1305.13(d), DEA estimates there are approximately 15,974 practitioner 
and NTP registrations engaged in distribution. Therefore, DEA estimates 
17,705 total registrations are affected by this rule. Table 1 details 
the number of affected registrations by business activity.

   Table 1--Number of DEA Registrations Affected by Business Activity
------------------------------------------------------------------------
                                                             Number of
                    Business activity                      registrations
------------------------------------------------------------------------
Distributor.............................................             873
Manufacturer............................................             586
Importer................................................             272
Pharmacy................................................          11,009
Hospital/Clinic.........................................           2,557
Teaching Institution....................................               6
Practitioner............................................           1,150
MLP.....................................................              14
MLP-Ambulance Service...................................              37
Researcher..............................................              45
Analytical Lab..........................................              32
Narcotic Treatment Program (NTP)........................           1,124
                                                         ---------------
    Total...............................................          17,705
------------------------------------------------------------------------
Source: DEA, May 2019.

2. Number of Entities
    It is common for DEA registrants to hold more than one 
registration, such as where a registrant handles controlled substances 
at multiple locations or engages in multiple types of DEA registered 
activities. However, RFA requirements and Small Business Administration 
(SBA) size standards are applicable to entities and businesses. DEA 
does not, in the general course of business, collect or otherwise 
maintain information regarding associated or parent organizations 
holding multiple registrations. Therefore, DEA needs some way of 
correlating and applying the parameters of the RFA and corresponding 
SBA size standards to DEA registrations (i.e., develop a relationship 
between the number of registrations/establishments and the number of 
entities).
    DEA estimated the number of entities represented by the number of 
DEA registrations by first determining which North American Industry 
Classification System (NAICS) classification codes most closely 
represent each of the affected business activities, and then 
researching economic data for those codes. The business activities and 
their corresponding representative NAICS codes are listed in table 2 
below.

       Table 2--Business Activities and Representative NAICS Codes
------------------------------------------------------------------------
                                      NAICS
         Business activity             code      NAICS code-description
------------------------------------------------------------------------
Distributor.......................     424210  Drugs and Druggists'
                                                Sundries Merchant
                                                Wholesalers.
Manufacturer......................     325412  Pharmaceutical
                                                Preparation
                                                Manufacturing.
Importer..........................     424210  Drugs and Druggists'
                                                Sundries Merchant
                                                Wholesalers.
Pharmacy..........................     446110  Pharmacies and Drug
                                                Stores.
Hospital/Clinic...................     622110  General Medical and
                                                Surgical Hospitals.
Teaching Institution..............     611310  Colleges, Universities
                                                and Professional
                                                Schools.
Practitioner......................     621111  Offices of Physicians
                                                (except Mental Health
                                                Specialists).
MLP...............................     621111  Offices of Physicians
                                                (except Mental Health
                                                Specialists).
MLP-Ambulance Service.............     621910  Ambulance Services.
Researcher........................     541712  Research and Development
                                                in the Physical,
                                                Engineering, and Life
                                                Sciences (except
                                                Biotechnology).
Analytical Lab....................     541380  Testing Laboratories.
NTP...............................     621420  Outpatient Mental Health
                                                and Substance Abuse
                                                Centers.
------------------------------------------------------------------------

    The U.S. Census Bureau's Statistics of U.S. Businesses (SUSB) is an 
annual series that provides national and subnational data on the 
distribution of economic data by enterprise size and industry. 
Additionally, the SBA Office of Advocacy partially funds the U.S. 
Census Bureau to produce data on employer firm size in the SUSB 
program. SUSB employer data contain the number of firms, number of 
establishments, employment, and annual payroll for employment size of 
firm categories by location and industry. From the SUSB data, the 
number of firms and the number of establishments were noted and the 
firm-to-establishment ratio was calculated for each related NAICS code. 
For the purposes of this analysis, the term ``firm'' as defined in the 
SUSB is used interchangeably with ``entity'' as defined in the RFA. See 
table 3 below.\123\
---------------------------------------------------------------------------

    \123\ Two different data sources were used to develop Table 3. 
Data table directly from SUSB contained detailed firm size by number 
of employees, while the data table from the Advocacy contained 
detailed firm size by annual receipts. Therefore, for NAICS codes 
325412, 424210, and 541712, which size determination is by the 
number of employees, the data set from SUSB is used--2015 SUSB 
Annual Datasets by Establishment Industry, table: ``U.S. & states, 
NAICS, detailed employment sizes (U.S., 6-digit and states, NAICS 
sectors), https://www.census.gov/data/datasets/2015/econ/susb/2015-
susb.html.'' (Accessed July 3, 2019). For the remaining NAICS codes, 
which size determination is by annual receipts, the data set from 
the advocacy is used--SBA Office of Advocacy, Firm Size Data, U.S. 
static data, https://www.sba.gov/advocacy/firm-size-data. (Accessed 
July 3, 2019.)

[[Page 69295]]



                            Table 3--Firm-to-Establishment Ratio for Each NAICS Code
----------------------------------------------------------------------------------------------------------------
                                                                                                     Firm-to-
             NAICS code                NAICS code-description         Firms       Establishments   establishment
                                                                                                       ratio
----------------------------------------------------------------------------------------------------------------
325412.............................  Pharmaceutical Preparation             988            1,290          0.7659
                                      Manufacturing.
424210.............................  Drugs and Druggists'                 6,812           10,129          0.6725
                                      Sundries Merchant
                                      Wholesalers.
446110.............................  Pharmacies and Drug Stores          18,852           43,343          0.4349
622110.............................  General Medical and                  2,904            5,281          0.5499
                                      Surgical Hospitals.
611310.............................  Colleges, Universities and           2,282            4,329          0.5271
                                      Professional Schools.
621111.............................  Offices of Physicians              174,901          210,721          0.8300
                                      (except Mental Health
                                      Specialists).
621910.............................  Ambulance Services........           3,390            5,051          0.6712
541712.............................  Research and Development             9,634           13,411          0.7184
                                      in the Physical,
                                      Engineering, and Life
                                      Sciences (except
                                      Biotechnology).
541380.............................  Testing Laboratories......           5,191            6,599          0.7866
621420.............................  Outpatient Mental Health             4,987            9,685          0.5149
                                      and Substance Abuse
                                      Centers.
----------------------------------------------------------------------------------------------------------------

    The calculated firm-to-establishment ratios were applied to the 
corresponding business activities to estimate the number of entities. 
For example, the firm-to-establishment ratio of 0.7659 is applied to 
the affected 586 manufacturer registrations for an estimated 449 
entities, and the firm-to-establishment ratio of 0.6725 was applied to 
the affected 1,145 distributor and importer registrations for an 
estimated 770 distributor and importer entities. In total, the 17,705 
affected registrations/establishments represent 9,043 entities. Table 4 
below summarizes the number of entities for each business activity.

                                Table 4--Number of Entities by Business Activity
----------------------------------------------------------------------------------------------------------------
                                                                    Affected         Firm-to-
                 Business activity                     NAICS     registration/    establishment   Affected firms
                                                        code     establishments       ratio
----------------------------------------------------------------------------------------------------------------
Manufacturer.......................................     325412              586           0.7659             449
Distributor, Importer..............................     424210            1,145           0.6725             770
Pharmacy...........................................     446110           11,009           0.4349           4,788
Hospital/Clinic....................................     622110            2,557           0.5499           1,406
Teaching Institution...............................     611310                6           0.5271               3
Practitioner, MLP..................................     621111            1,164           0.8300             966
MLP-Ambulance Service..............................     621910               37           0.6712              25
Researcher.........................................     541712               45           0.7184              32
Analytical Lab.....................................     541380               32           0.7866              25
NTP................................................     621420            1,124           0.5149             579
                                                    ------------------------------------------------------------
    Total..........................................  .........           17,705  ...............           9,043
----------------------------------------------------------------------------------------------------------------

3. Number of Small Entities
    SUSB data includes the number of firms at various size ranges. To 
estimate the number of affected entities that are small entities, DEA 
compared the firm size ranges with SBA size standards for each of the 
representative NAICS codes from Table 2. The SBA size standard is the 
firm size based on the number of employees or annual receipts depending 
on industry.\124\ If the entire size range for the firms in the SUSB 
data was below the SBA size standard, all of the firms in the SUSB data 
size range were considered ``small.'' If only part of the size range 
for the firms in the SUSB data was below the SBA size standard, only 
the proportional number of firms in the SUSB data size range was 
considered ``small.''
---------------------------------------------------------------------------

    \124\ ``U.S. Small Business Administration Table of Small 
Business Size Standards Matched to North American Industry 
Classification System Codes,'' October 1, 2017. https://www.sba.gov/sites/default/files/files/Size_Standards_Table.pdf.
---------------------------------------------------------------------------

    The number of firms below the SBA size standard for each NAICS code 
was added to determine the total number of small firms for that NAICS 
code. The number of small firms was divided by the total number of 
firms to estimate the ``percent small firms of total'' (i.e., the 
percent of total firms that are small firms) for all firms in the 
related NAICS code. The percent small firms of total firms were applied 
to the estimated number of entities for each business activity to 
estimate the number of affected entities that are small entities. DEA 
estimates that 7,940 (87.8 percent) of the total 9,043 affected 
entities are small entities. The analysis is summarized in Table 5 
below.

                       Table 5--Number of Entities and Small Entities by Business Activity
----------------------------------------------------------------------------------------------------------------
                                     Affected        Firm-to-
        Business activity          registration/   establishment  Affected firms      % Small     Affected small
                                  establishments       ratio                         entities        entities
----------------------------------------------------------------------------------------------------------------
Distributor, Importer...........           1,145          0.6725             770            96.2             741
Manufacturer....................             586          0.7659             449            93.2             419
Pharmacy........................          11,009          0.4349           4,788            98.0           4,694
Hospital/Clinic.................           2,557          0.5499           1,406            39.8             560

[[Page 69296]]

 
Teaching Institution............               6          0.5271               3            58.8               2
Practitioner, MLP...............           1,164          0.8300             966            97.2             939
MLP-Ambulance Service...........              37          0.6712              25            94.7              24
Researcher......................              45          0.7184              32            94.4              30
Analytical Lab..................              32          0.7866              25            94.1              24
NTP.............................           1,124          0.5149             579            87.6             507
                                 -------------------------------------------------------------------------------
    Total.......................          17,705  ..............           9,043  ..............           7,940
    Percent small entity of       ..............  ..............  ..............  ..............           87.8%
     total entities.............
----------------------------------------------------------------------------------------------------------------

4. Impact on Small Entities
    To comply with the RFA, DEA conducted a preliminary analysis to 
determine whether, if promulgated, this rule will have a significant 
economic impact on a substantial number of small entities. As described 
above, DEA estimates this rule will result in a total cost savings of 
$2,931,000, or an average of $324 per entity ($2,931,000/9,043), 
including small entities. Average cost savings of $324 is a high 
estimate for small entities as small entities are expected to have 
lower volume of distribution and fewer times due diligence is conducted 
or suspicious order is reported to the centralized database.
    The average cost savings of $324 per entity per year was compared 
to the average annual receipt for the smallest of small businesses in 
the NAICS codes that represent the affected entities (described in 
Table 2). For example, for NAICS code `424210-Drugs and Druggists' 
Sundries Merchant Wholesalers' the smallest size category is firm size 
with annual receipts ``less than $100,000.'' There are 585 firms in 
this size category with an estimated combined total of $31,248,000 for 
an average annual receipt of $53,415 per firm.\125\ The $324 in annual 
cost savings per firm is 0.61 percent of $53,415. The results for each 
of the NAICS codes are listed in Table 6.
---------------------------------------------------------------------------

    \125\ SBA Office of Advocacy, Firm Size Data, U.S. static data, 
https://www.sba.gov/advocacy/firm-size-data. (Accessed July 3, 
2019.)

                                           Table 6--Cost Savings as Percent of Annual Receipts by NAICS Codes
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                                                                           Cost savings
  NAICS                                                   Firm size in                       Estimated        Average      Average cost    as percent of
   code              NAICS code- description              receipts ($)         Firms       receipts ($)     receipt per     savings ($)       annual
                                                                                                             firm ($)                        receipts
--------------------------------------------------------------------------------------------------------------------------------------------------------
   325412  Pharmaceutical Preparation Manufacturing..  * 100,000-499,000              91      35,834,000         393,780             324            0.08
   424210  Drugs and Druggists' Sundries Merchant               <100,000             585      31,248,000          53,415             324            0.61
            Wholesalers..............................
   446110  Pharmacies and Drug Stores................           <100,000             751      36,066,000          48,024             324            0.67
   622110  General Medical and Surgical Hospitals....  * 100,000-499,000              14       3,812,000         272,286             324            0.12
   611310  Colleges, Universities and Professional              <100,000             163       7,510,000          46,074             324            0.70
            Schools..................................
   621111  Offices of Physicians (except Mental                 <100,000          15,275     771,280,000          50,493             324            0.64
            Health Specialists)......................
   621910  Ambulance Services........................           <100,000             373      16,468,000          44,150             324            0.73
   541712  Research and Development in the Physical,            <100,000           1,457      71,428,000          49,024             324            0.66
            Engineering, and Life Sciences (except
            Biotechnology)...........................
   541380  Testing Laboratories......................           <100,000             738      35,527,000          48,140             324            0.67
   621420  Outpatient Mental Health and Substance               <100,000             800      41,204,000          51,505             324            0.63
            Abuse Centers............................
--------------------------------------------------------------------------------------------------------------------------------------------------------
* ``Estimated Receipts'' not available for the smallest size range of ``<100,000; therefore, used next size range of ``100,000-499,000'' for comparison.

    DEA generally considers impacts that are greater than three percent 
of annual revenue to be a ``significant economic impact'' on an entity. 
As indicated in Table 6 above, the cost savings is far below the three 
percent threshold. Accordingly, DEA estimates that this rule will not, 
if promulgated, have a

[[Page 69297]]

significant economic impact on a substantial number of small entities.

F. Unfunded Mandates Reform Act of 1995

    This rule will not result in the expenditure by State, local and 
tribal governments, in the aggregate, or by the private sector, of 
$100,000,000 or more (adjusted for inflation) in any one year, and will 
not significantly or uniquely affect small governments. Therefore, no 
actions were deemed necessary under the provisions of the Unfunded 
Mandates Reform Act of 1995, 2 U.S.C. 1532.

G. Paperwork Reduction Act

    Under the PRA,\126\ the DEA is not authorized to impose a penalty 
on persons for violating information collection requirements which do 
not display a current OMB control number, if one is required. Copies of 
existing information collections approved by OMB may be obtained at 
https://www.reginfo.gov/public/do/PRAMain.
---------------------------------------------------------------------------

    \126\ 44 U.S.C. 3501 et seq.
---------------------------------------------------------------------------

1. Collections of Information Associated With the Rule
    Title: Reporting and Recordkeeping Requirements Related to 
Suspicious Orders.
    OMB Control Number: 1117-New.
    Form Number: N/A.
    Pursuant to the PRA, the DEA is seeking approval from OMB for a new 
information collection related to suspicious orders. The collection 
would include two distinct components: The reporting of suspicious 
orders, and recordkeeping related to suspicious orders and ORUSCs. The 
rule applies to all registrants that distribute controlled substances, 
including manufacturers, distributors, importers, and pharmacies (and 
other practitioners in certain cases). The rule would amend two 
existing sections of DEA regulations,\127\ and would create a new 
section of DEA regulations \128\ to include provisions relating to 
suspicious orders.
---------------------------------------------------------------------------

    \127\ Proposed amended 21 CFR 1300.01 and proposed amended 21 
CFR 1301.74.
    \128\ Proposed new 21 CFR 1301.78.
---------------------------------------------------------------------------

a. Reporting of Suspicious Orders
    Registrants must file suspicious order reports through the DEA 
centralized database.\129\ Each suspicious order report must contain 
the following information:
---------------------------------------------------------------------------

    \129\ Proposed new Sec.  1301.78(b).
---------------------------------------------------------------------------

     The DEA registration number of the registrant placing the 
order for controlled substances;
     The date the order was received;
     The DEA registration number of the registrant reporting 
the suspicious order;
     The National Drug Code number, unit, dosage strength, and 
quantity of the controlled substances ordered;
     The order form number for schedule I and schedule II 
controlled substances;
     The unique transaction identification number for the 
suspicious order; and
     What information and circumstances rendered the order 
actually suspicious.\130\
---------------------------------------------------------------------------

    \130\ Proposed new 21 CFR 1301.78(b).
---------------------------------------------------------------------------

    Currently, DEA is not able to accurately estimate the number of 
suspicious orders being reported because there is no central database 
tracking all of these orders. For the purpose of this analysis and 
fulfilling this new information collection requirement, DEA initially 
estimates the following number of respondents, responses, and burden. 
Burden estimates will be updated with actual figures on next 
information collection renewal request. DEA estimates there will be an 
average of 338,840 ORUSCs, of which approximately 20 percent are 
reported as suspicious orders. The suspicious order reports are made as 
they occur, with no set frequency, and have an estimated burden of 20 
minutes per response. The `number of respondents' is estimated based on 
the number of unique DEA numbers reporting to the centralized database; 
DEA does not have an estimate of the number of respondents reporting to 
the field offices. DEA estimates the following number of respondents 
and burden associated with this collection of information:
    Number of respondents: 100.
    Frequency of response: 677.78 per year (calculated).
    Number of responses: 67,768 average per year.
    Burden per response: 0.33 hour (20 minutes).
    Total annual hour burden: 22,589 hours.
b. Recordkeeping for Suspicious Orders and ORUSCs
    Registrants must keep records for suspicious orders and 
ORUSCs.\131\ These records must be kept by the registrant and be 
available, for at least 2 years from the date of the record, for 
inspection and copying by authorized employees of DEA.\132\ Each record 
must be prepared no later than seven calendar days after the suspicious 
order or ORUSC was received, must include how the registrant handled 
such orders, and must include the following information:
---------------------------------------------------------------------------

    \131\ Proposed new 21 CFR 1301.78(c).
    \132\ 21 CFR 1304.04(a).
---------------------------------------------------------------------------

     What information and circumstances rendered the order 
actually or potentially suspicious;
     What steps, if any, the registrant took to investigate the 
order;
     If the registrant investigated the order, what information 
it obtained during its investigation, and where the registrant 
concludes that each suspicious circumstance has been dispelled, the 
specific basis for each such conclusion; and
     Whether or not the registrant distributed controlled 
substances pursuant to the order.\133\
---------------------------------------------------------------------------

    \133\ Proposed new 21 CFR 1301.78(c).
---------------------------------------------------------------------------

    Currently, DEA is not able to accurately estimate the number of 
suspicious orders or ORUSCs. For the purpose of this analysis and 
fulfilling this new information collection requirement, DEA initially 
estimates the following number of respondents, responses, and burden. 
Burden estimates will be updated with actual figures on next 
information collection renewal request. DEA estimates there will be an 
average of 338,840 ORUSCs, of which approximately 20 percent are 
reported as suspicious orders and the remaining 80 percent are ORUSCs 
that require keeping of the abovementioned records. The recordkeeping 
is conducted as the events occur, with no set frequency, and have an 
estimated burden of 15 minute per response. The `number of respondents' 
is estimated based on the number of unique DEA numbers reporting to the 
centralized database; DEA does not have an estimate of the number of 
respondents reporting to the field offices. DEA estimates the following 
number of respondents and burden associated with this collection of 
information:
    Number of respondents: 100.
    Frequency of response: 2,710.72 per year (calculated).
    Number of responses: 271,072 average per year.
    Burden per response: 0.25 hour (15 minutes).
    Total annual hour burden: 67,768 hours.
2. Request for Comments Regarding the Proposed Information Collections
    Written comments and suggestions from the public and affected 
entities concerning the proposed collections of information are 
encouraged. Under the PRA, DEA is required to provide a notice 
regarding the proposed collections of information in the Federal 
Register with the notice of proposed

[[Page 69298]]

rulemaking and solicit public comment.\134\ The PRA requires DEA to 
solicit comment on the following issues:
---------------------------------------------------------------------------

    \134\ 44 U.S.C. 3506(c)(2).
---------------------------------------------------------------------------

     Whether the proposed collection of information is 
necessary for the proper performance of the functions of DEA, including 
whether the information shall have practical utility.
     The accuracy of DEA's estimate of the burden of the 
proposed collection of information, including the validity of the 
methodology and assumptions used.
     Recommendations to enhance the quality, utility, and 
clarity of the information to be collected.
     Recommendations to minimize the burden of the collection 
of information on those who are to respond, including through the use 
of automated collection techniques or other forms of information 
technology.
    Please send written comments to the Office of Information and 
Regulatory Affairs, OMB, Attention: Desk Officer for DOJ, Washington, 
DC 20503. Please state that your comments refer to RIN 1117-AB47/Docket 
No. DEA-437. All comments must be submitted to OMB on or before January 
4, 2021. The final rule will respond to any OMB or public comments on 
the information collection requirements contained in this proposal.

List of Subjects

21 CFR Part 1300

    Chemicals, Drug traffic control.

21 CFR Part 1301Administrative practice and procedure, Drug traffic 
control, Exports, Imports, Security measures.

    Administrative practice and procedure, Drug traffic control, 
Exports, Imports, Security measures.

    For the reasons set forth above, the DEA proposes to amend 21 CFR 
parts 1300 and 1301 as follows:

PART 1300--DEFINITIONS

0
1. The authority citation for part 1300 is revised to read as follows:

    Authority: 21 U.S.C. 802, 821, 822, 823, 829, 832, 871(b), 951, 
958(f).

0
2. In Sec.  1300.01, amend paragraph (b) by adding definitions of ``Due 
diligence,'' ``Order,'' ``Order received under suspicious 
circumstances,'' and ``Suspicious order'' in alphabetical order to read 
as follows:


Sec.  1300.01   Definitions relating to controlled substances.

* * * * *
    (b) * * *
    Due diligence means a reasonable and documented investigation into 
persons and orders (coupled with other appropriate investigations, 
including previous investigations into persons and orders) that 
includes, but is not limited to, verification that a person (or a 
person submitting an order) holds the appropriate DEA registration, 
verification that a person (or a person submitting an order) holds all 
licenses required by the state(s) in which a person (or a person 
submitting an order) conducts business with respect to controlled 
substances, examination of each suspicious circumstance surrounding an 
order, and examination of all facts and circumstances that may be 
relevant indicators of diversion in determining whether a person (or a 
person submitting an order) is engaged in, or is likely to engage in, 
the diversion of controlled substances.
* * * * *
    Order means any communication by a person to a registrant proposing 
or requesting a distribution of a controlled substance, regardless of 
how it is labeled by the person or the registrant, and regardless of 
whether a distribution is made by the registrant, except that simple 
price/availability inquiries, standing alone, do not constitute an 
order.
    Order received under suspicious circumstances means an order 
potentially meeting the definition of suspicious order.
* * * * *
    Suspicious order includes, but is not limited to, an order of 
unusual size, an order deviating substantially from a normal pattern, 
or an order of unusual frequency.
* * * * *

PART 1301--REGISTRATION OF MANUFACTURERS, DISTRIBUTORS, AND 
DISPENSERS OF CONTROLLED SUBSTANCES

0
3. The authority citation for part 1301 is revised to read as follows:

    Authority: 21 U.S.C. 821, 822, 823, 824, 831, 832, 871(b), 875, 
877, 886a, 951, 952, 953, 956, 957, 958, 965.

0
4. In Sec.  1301.74, revise the section heading and paragraph (b) to 
read as follows:


Sec.  1301.74   Other security controls for non-practitioners; non-
practitioners and practitioners for orders received under suspicious 
circumstances; narcotic treatment programs and compounders for narcotic 
treatment programs.

* * * * *
    (b)(1) Each registrant shall design and operate a system to 
identify suspicious orders of controlled substances for the registrant 
that complies with applicable Federal and State privacy laws. The 
system shall be designed and operated to identify orders of unusual 
size, orders deviating substantially from a normal pattern, and orders 
of unusual frequency. In addition, the system shall be designed and 
operated to identify suspicious orders based on facts and circumstances 
that may be relevant indicators of diversion in determining whether a 
person (or a person submitting an order) is engaged in, or is likely to 
engage in, the diversion of controlled substances.
    (2) Registrants in receipt of an order received under suspicious 
circumstances shall follow the procedures set forth in Sec.  
1301.78(a).
    (3) In addition to entities that are registered as distributors, 
the requirements in this paragraph (b) shall also apply to registrants 
authorized to distribute controlled substances. However, controlled 
substances dispensed or administered within the normal course of 
professional practice of a practitioner, to include prescriptions 
filled by a pharmacy, and orders placed by registrants to DEA 
registered reverse distributors requesting the return or destruction of 
controlled substances, are not distributions subject to the provisions 
of this part.
* * * * *
0
5. Add Sec.  1301.78 to read as follows:


Sec.  1301.78   Procedures for identifying and reporting suspicious 
orders of controlled substances.

    (a) Upon receipt of an order received under suspicious 
circumstances, the registrant shall proceed under one of the following 
two options:
    (1) The registrant shall decline to distribute pursuant to the 
suspicious order, immediately file a suspicious order report through 
the DEA centralized database (which includes the information described 
in paragraph (b) of this section), and maintain a record of the 
suspicious order and any due diligence related to the suspicious order 
(which includes at least the information described in paragraph (c) of 
this section); or
    (2) The registrant, before distributing pursuant to the order 
received under suspicious circumstances, shall conduct due diligence to 
investigate each suspicious circumstance surrounding the order.
    (i) If, through its due diligence, the registrant is able to dispel 
each suspicious circumstance surrounding the order received under 
suspicious circumstances within seven calendar days after receiving the 
order, it is not a suspicious order; the registrant may

[[Page 69299]]

then distribute pursuant to the order, and the order need not be 
reported to the DEA as a suspicious order, but the registrant must 
maintain a record of its due diligence which includes at least the 
information described in paragraph (c) of this section.
    (ii) If the registrant, through its due diligence, is unable to 
dispel each suspicious circumstance surrounding the order received 
under suspicious circumstances within seven calendar days after 
receiving the order, it is a suspicious order; the registrant shall 
file a suspicious order report through the DEA centralized database, 
which includes the information described in paragraph (b) of this 
section, decline to distribute pursuant to the suspicious order, and 
maintain a record of its due diligence which includes at least the 
information described in paragraph (c) of this section.
    (b)(1) Registrants shall report suspicious orders to the DEA 
centralized database. The report, identifying each suspicious order, 
must include the following information:
    (i) The DEA registration number of the registrant placing the order 
for controlled substances;
    (ii) The date the order was received;
    (iii) The DEA registration number of the registrant reporting the 
suspicious order;
    (iv) The National Drug Code number, unit, dosage strength, and 
quantity of the controlled substances ordered;
    (v) The order form number for schedule I and schedule II controlled 
substances;
    (vi) The unique transaction identification number for the 
suspicious order; and
    (vii) What information and circumstances rendered the order 
actually suspicious.
    (2) Upon notification from the DEA that a suspicious order report 
or reports contain inaccurate or incomplete information, the registrant 
shall have seven calendar days to correct the inaccurate or incomplete 
information.
    (c) Registrants shall maintain a record of every suspicious order 
and every order received under suspicious circumstances for at least 
two years from the date of such record in accordance with 21 CFR 
1304.04(a), and how the registrant handled such orders. The record must 
be prepared no later than seven calendar days after the suspicious 
order or order received under suspicious circumstances was received and 
must include the following information:
    (1) What information and circumstances rendered the order actually 
or potentially suspicious;
    (2) What steps, if any, the registrant took to conduct due 
diligence;
    (3) If the registrant conducted due diligence, what information it 
obtained during its investigation, and where the registrant concludes 
that each suspicious circumstance has been dispelled, the specific 
basis for each such conclusion; and
    (4) Whether or not the registrant distributed controlled substances 
pursuant to the order.

Timothy J. Shea,
Acting Administrator.
[FR Doc. 2020-21302 Filed 10-30-20; 8:45 am]
BILLING CODE 4410-09-P