Neeraj B. Shah, M.D.; Decision and Order, 84195-84199 [2024-24189]

Agencies

• Drug Enforcement Administration
• Department of Justice

[Federal Register Volume 89, Number 203 (Monday, October 21, 2024)]
[Notices]
[Pages 84195-84199]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-24189]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF JUSTICE

Drug Enforcement Administration

[Docket No. 23-65]


Neeraj B. Shah, M.D.; Decision and Order

    On August 30, 2023, the Drug Enforcement Administration (DEA or 
Government) issued an Order to Show Cause (OSC) to Neeraj B. Shah, 
M.D., (Respondent) of Austin, Texas. Administrative Law Judge Exhibit 
(ALJX) 1 (OSC), at 1. The OSC proposed the revocation of Respondent's 
DEA Certificate of Registration (registration), No. FS2968444, and 
alleged that Respondent's continued registration is inconsistent with 
the public interest. Id. (citing 21 U.S.C. 823(g)(1), 824(a)(4)).
    A hearing was held before DEA Administrative Law Judge (ALJ) Teresa 
A. Wallbaum who, on March 8, 2024, issued her Recommended Rulings, 
Findings of Fact, Conclusions of Law, and Decision of the 
Administrative Law Judge (RD). The RD recommended that Respondent's 
registration be revoked. RD, at 33. Neither party filed exceptions to 
the RD. Having reviewed the entire record, the Agency adopts and hereby 
incorporates by reference the entirety of the ALJ's rulings, 
credibility findings,\1\ findings of fact, conclusions of law, 
sanctions analysis, and recommended sanction in the RD and summarizes 
and expands upon portions thereof herein.\2\
---------------------------------------------------------------------------

    \1\ The Agency adopts the ALJ's summary of the witnesses' 
testimonies as well as the ALJ's assessment of the witnesses' 
credibility. RD, at 3-21.
    \2\ On May 30, 2024, Respondent signed a DEA Form 104, Surrender 
for Cause of DEA Certificate of Registration. See 21 CFR 1301.52(a). 
Even when a registration is terminated, the Agency has discretion to 
adjudicate the OSC to finality. See Jeffrey D. Olsen, M.D., 84 FR 
68,474, 68,479 (2019) (declining to dismiss an immediate suspension 
order when the registrant allowed the registration to expire before 
final adjudication); Steven M. Kotsonis, M.D., 85 FR 85667, 85668-69 
(2020) (concluding that termination of a registration under 21 CFR 
1301.52 does not preclude DEA from issuing a final decision and that 
the Agency would assess such matters on a case-by-case basis to 
determine if a final adjudication is warranted); The Pharmacy Place, 
86 FR 21008, 21008-09 (2021) (``Adjudicating this matter to finality 
will create a public record to educate current and prospective 
registrants about the Agency's expectations regarding the 
responsibilities of registrant[s] . . . under the CSA and allow 
stakeholders to provide feedback regarding the Agency's enforcement 
priorities and practices.''); Creekbend Community Pharmacy, 86 FR 
40627, 40628 n.4 (2021) (``Adjudicating this matter to finality will 
create an official record the Agency can use in any future 
interactions with Respondent . . . or other persons who were 
associated with Respondent.''). As in these cases, the Agency has 
evaluated the circumstances of this matter and determined that the 
matter should be adjudicated to finality for the purpose of creating 
an official record of the allegations and evidence, and educating 
the registrant community, the public, and stakeholders about the 
responsibilities associated with holding a DEA registration and the 
Agency's enforcement priorities.
---------------------------------------------------------------------------

I. Findings of Fact

    The Agency finds from clear, unequivocal, and convincing evidence 
that Respondent failed to maintain sole possession of his hard token 
for issuing electronic controlled substance prescriptions, that he 
allowed unauthorized individuals to issue electronic controlled 
substance prescriptions using his DEA credentials, and that in doing 
so, he allowed controlled substances to be prescribed outside the usual 
course of professional practice and without a legitimate medical 
purpose. RD, at 24-27.

Respondent's Hard Token, Credentials, and Electronic Prescribing

    In July 2019, Respondent \3\ received an unsolicited fax offering 
employment as a prescribing practitioner with a telemedicine platform 
called Church Ekklasia Sozo (CES).\4\ RD, at 11-12; Tr. 184-86, 327; 
Respondent's Exhibit (RX) 1. The company was based out of North 
Carolina and Respondent lived and worked in Texas. RD, at 4, 10, 12; 
ALJX 8, at 2, Stips. 1-3. Respondent joined CES in September 2019 and 
had his first patient intake and clinical encounter in May 2020. RD, at 
12; Tr. 197-98. Respondent worked as a contractor physician for CES 
from September 9, 2019, to December 13, 2021. RD, at 4, 11-12; Tr. 40, 
192-94; ALJX 8, at 2, Stip. 2. As a condition of employment at CES, 
Respondent was required to obtain a hard token \5\ for the purpose of 
issuing electronic controlled substance prescriptions and to give the 
hard token to CES staff in North Carolina. RD, at 4, 6-7, 13; Tr. 44-
45, 58-59, 227-29, 231, 280, 284. Respondent admitted to giving his 
hard token to CES and allowing the company to keep his electronic 
signature on file to issue controlled substance prescriptions under his 
DEA registration. Id.
---------------------------------------------------------------------------

    \3\ The ALJ found that ``to the extent [Respondent's] testimony 
contradicts with that offered by [the Diversion Investigator], [she] 
gives full credit to the [Diversion Investigator]'s testimony.'' RD, 
at 21. The Agency agrees with the amount of weight that the ALJ 
afforded Respondent's testimony.
    \4\ CES's staff did not hold DEA registrations. RD, at 5, 16; 
Tr. 50, 225-26.
    \5\ A hard token is a physical device similar to a key fob that 
may be used to authenticate an electronic prescription. Tr. 45; 21 
CFR 1311.115(a)(3), 1311.140(a)(5). The hard token which Respondent 
used was not offered into evidence. Tr. 47. Instead, a picture of a 
hard token similar to one used by Respondent was admitted into 
evidence. Tr. 45-48; GX 22. The picture shows a small device, 
roughly two inches in length, with a small screen on which a PIN 
number would be displayed. Id. When a hard token is used to sign a 
prescription, the token generates a unique identification PIN number 
which serves as the signature on the prescription. RD, at 5; Tr. 46. 
The PIN is unique to each prescription and can be traced to the 
prescriber. Id.
---------------------------------------------------------------------------

    On December 1, 2021, a DEA Diversion Investigator (DI) \6\ 
conducted a regulatory inspection of Respondent's registered premises. 
RD, at 3-4; Tr. 28, 31-38, 138, 141-42, 156; Government's Exhibit (GX) 
2. At the inspection, the DI informed Respondent that over 1,900 
prescriptions for buprenorphine products (a schedule III controlled 
substance) had been issued under his registration in the past two 
years. RD, at 4; Tr. 41-43. Respondent stated that this number was 
``too high'' because he only saw ``about 20 to 25 patients.'' Id. The 
DI asked Respondent to show her a prescription that he had issued, and 
Respondent pulled up a recently issued controlled substance 
prescription for patient J.O. RD, at 5-6; Tr. 50-53; GX 20, at 29. The 
prescription bore a time stamp indicating that it had been signed by 
Respondent while the DI was conducting the inspection. Id. Although the 
prescription for J.O. purported to be signed by Respondent, Respondent 
told the DI that he did not know this patient,

[[Page 84196]]

had never conducted a telemedicine appointment for this patient, and 
had never established a doctor-patient relationship with this patient. 
RD, at 8-9, 18; Tr. 107-09, 148-56, 161-63, 234, 236, 286-87, 296-97, 
332; GX 24.
---------------------------------------------------------------------------

    \6\ The Agency agrees with the ALJ's assessment that the DI was 
``a credible, reliable'' witness and that her testimony was clear, 
objective, consistent, precise, and ``corroborated by the 
documentary evidence.'' RD, at 9. The ALJ found that ``[t]o the 
extent her testimony conflicts with Respondent's testimony, . . . 
[she] credits [the DI].'' Id. The Agency agrees with the amount of 
weight that the ALJ afforded Respondent's testimony.
---------------------------------------------------------------------------

    The DI asked how Respondent could have signed and issued this 
prescription during the inspection when Respondent had not conducted 
any telemedicine visits during that time. RD, at 5-6; Tr. 53. 
Respondent explained that CES had his signature on file, which allowed 
the company's unregistered staff to issue electronic prescriptions on 
his behalf. RD, at 4; Tr. 44-45. Respondent also stated that he had 
given his hard token to CES in North Carolina as a condition of his 
employment with CES.\7\ RD, at 6-7, 13; Tr. 58-59, 227-29, 231, 280, 
284-85. Further, CES's owner telephonically explained that it was CES's 
standard procedure for nurses to sign the prescriptions, ``because the 
[ nurses] were [ ] agent[s] of the doctor.'' RD, at 4-6; Tr. 53-54.
---------------------------------------------------------------------------

    \7\ The DI informed Respondent and CES's owner that CES must 
cease using Respondent's registration for prescribing controlled 
substances and that the hard token must be returned to Respondent. 
RD, at 6; Tr. 58, 157, 163. After the inspection ended, Respondent 
sent an email to CES's owner directing CES to stop using his 
registration for issuing prescriptions and to overnight return his 
hard token to his home. RD, at 7, 17; Tr. 62, 66-69, 159, 237; GX 
14.
---------------------------------------------------------------------------

II. Discussion

A. The Five Public Interest Factors

    Under the CSA, ``[a] registration . . . to . . . dispense a 
controlled substance . . . may be suspended or revoked by the Attorney 
General upon a finding that the registrant . . . has committed such 
acts as would render his registration under [21 U.S.C. 823] 
inconsistent with the public interest as determined under such 
section.'' 21 U.S.C. 824(a). In making the public interest 
determination, the CSA requires consideration of the following factors:

    (A) The recommendation of the appropriate State licensing board 
or professional disciplinary authority.
    (B) The [registrant's] experience in dispensing, or conducting 
research with respect to controlled substances.
    (C) The [registrant's] conviction record under Federal or State 
laws relating to the manufacture, distribution, or dispensing of 
controlled substances.
    (D) Compliance with applicable State, Federal, or local laws 
relating to controlled substances.
    (E) Such other conduct which may threaten the public health and 
safety.

21 U.S.C. 823(g)(1).
    The Agency considers these public interest factors in the 
disjunctive. Robert A. Leslie, M.D., 68 FR 15227, 15230 (2003). Each 
factor is weighed on a case-by-case basis. Morall v. Drug Enf't Admin., 
412 F.3d 165, 173-74 (D.C. Cir. 2005). Any one factor, or combination 
of factors, may be decisive. David H. Gillis, M.D., 58 FR 37507, 37508 
(1993). The inquiry is ``focuse[d] on protecting the public interest.'' 
Jayam Krishna-Iyer, M.D., 74 FR 459, 462 (2009).
    The Government has the burden of proof in this proceeding. 21 CFR 
1301.44. While the Agency has considered all the public interest 
factors in 21 U.S.C. 823(g)(1), the Government's evidence in support of 
its prima facie case for revoking Respondent's registration is confined 
to Factors B and D. RD, at 24 n.24 (finding that Factors A, C, and E do 
not weigh for or against the sanction sought by the Government). Having 
reviewed the record and the RD, the Agency adopts the ALJ's analysis, 
and agrees that the Government's evidence satisfies its prima facie 
burden of showing that Respondent's continued registration would be 
inconsistent with the public interest. RD, at 27, 33; 21 U.S.C. 
824(a)(4).

B. Factors B and D

    Evidence is considered under public interest factors B and D when 
it reflects compliance or non-compliance with laws related to 
controlled substances and experience dispensing controlled substances. 
See Sualeh Ashraf, M.D., 88 FR 1,095, 1,097 (2023); Kareem Hubbard, 
M.D., 87 FR 21,156, 21,162 (2022).
    DEA regulations allow registrants to issue electronic prescriptions 
for controlled substances in schedules II-V. 21 CFR 1311.100(b); RD, at 
23. To issue an electronic prescription for a controlled substance, the 
prescriber must authenticate the prescription using at least two of the 
following factors: (1) ``Something only the practitioner knows, such as 
a password or response to a challenge question''; (2) ``Something the 
practitioner is, biometric data such as a fingerprint or iris scan''; 
and/or (3) ``Something the practitioner has, a device (hard token) 
separate from the computer to which the practitioner is gaining 
access.'' 21 CFR 1311.115(a), 1311.120(b)(5), (11); RD, at 23; Tr. 45. 
This two-factor authentication process ``constitute[s] the signing of 
the prescription by the practitioner.'' 21 CFR 1311.140(a)(5). ``[O]nly 
the registrant may sign the prescription,'' and when signing the 
prescription, the registrant must comply with the two-factor 
authentication requirement. 21 CFR 1311.135(a); RD, at 23. Although DEA 
regulations permit a non-registered agent to enter data on the 
prescription, the registrant must sign the prescription himself. Id.
    DEA regulations make clear that ``[t]he practitioner must retain 
sole possession of the hard token'' and ``must not allow any other 
person to use the token.'' \8\ 21 CFR 1311.102(a); RD, at 23. The 
regulation further states that the practitioner ``must not share the 
password or other knowledge factor, or biometric information, with any 
other person'' and ``[t]he practitioner must not allow any other person 
to use the token or enter the knowledge factor or other identification 
means to sign prescriptions for controlled substances.'' Id. ``Failure 
by the practitioner to secure the hard token, knowledge factor, or 
biometric information may provide a basis for revocation or suspension 
of registration.'' Id.
---------------------------------------------------------------------------

    \8\ It is important to emphasize the clarity with which this 
requirement is stated in the regulation. The requirement to ``retain 
sole possession'' is stated simply, clearly, and unambiguously in 
plain language. See Electronic Prescriptions for Controlled 
Substances, 75 FR 16236, 16277 (Mar. 31, 2010). To further emphasize 
this point, the RD put it well: the requirement to retain sole 
possession of the hard token is set forth ``in plain, simple 
English, and is consistent with basic common sense.'' RD, at 32.
---------------------------------------------------------------------------

    Regarding the hard token, substantial record evidence, including 
Respondent's admission, establishes that Respondent gave his hard token 
to CES staff in North Carolina and allowed them to maintain physical 
possession of it. RD, at 25-26; Tr. 53-59, 66-67, 227-31, 237, 285. 
Accordingly, substantial record evidence establishes that Respondent 
failed to ``retain sole possession of the hard token,'' in violation of 
21 CFR 1311.102(a). RD, at 25-26; see also Allan Alexander Rashford, 
M.D., 87 FR 77637, 77637-38 (2022) (revoking respondent's registration, 
in part, for violating 21 CFR 1311.102(a) due to ``entrusting his 
secure credentials to his wife and son and allowing them to access and 
provide his PIN'' to prescribe controlled substances).
    Regarding credentials, substantial record evidence, including 
Respondent's admission, establishes that Respondent allowed CES to keep 
his signature on file to use in conjunction with the hard token in 
order to complete the two-factor authentication process for signing and 
issuing electronic controlled substance prescriptions on his behalf. 
RD, at 26; Tr. 44-45, 53-59, 157, 163, 222, 225-27, 229, 231, 280, 284; 
GX 14; GX 20-21 (prescriptions issued by CES staff to J.O. and three 
other patients). In so doing, Respondent violated federal and state 
regulations that prohibit any person other than the registrant from 
signing

[[Page 84197]]

and authenticating an electronic controlled substance prescription. RD, 
at 26; Tr. 57-58; 21 CFR 1311.135(a); 22 Tex. Admin. Code Sec.  
315.3(c)(1) (requiring Texas practitioners to comply with the 
requirements set forth in 21 CFR 1311).
    Respondent allowed illegal electronic controlled substance 
prescriptions to be issued under his registration by giving away his 
hard token and two-factor authentication credentials.\9\ RD, at 4-5, 
16, 26, 32; Tr. 42-43, 226. The regulations governing the issuance of 
electronic controlled substance prescriptions do not ``relieve[] a 
practitioner of his responsibility to dispense controlled substances 
only for a legitimate medical purpose while acting in the usual course 
of his professional practice.'' 21 CFR 1311.102(k); RD, at 23; see also 
21 CFR 1311.100(f). ``The practitioner has the same responsibilities 
when issuing [an electronic prescription] as when issuing a paper or 
oral prescription,'' including the requirement ``to ensure the validity 
of [that] prescription.'' 21 CFR 1311.102(k); RD, at 23.
---------------------------------------------------------------------------

    \9\ The Agency finds that it is not necessary to determine the 
precise number of prescriptions that were issued by CES with 
Respondent's hard token and credentials. RD, at 26. The record 
clearly establishes and Respondent admitted that prescriptions were 
being issued under Respondent's registration for at least one 
patient he never saw (J.O.) and at quantities that exceeded the 
patients he did see. See RD, at 4, 20, 26; GX 20, at 17-29; Tr. 41-
43 (when the DI informed Respondent that the PMP showed 1,900 
prescriptions had been issued under his registration, he responded 
that this number was ``too high'' because he only saw ``about 20 to 
25 patients''); Tr. 234, 236, 286-87, 297, 332.
---------------------------------------------------------------------------

    Under DEA regulations, a controlled substance prescription may only 
``be issued for a legitimate medical purpose by an individual 
practitioner acting in the usual course of his professional practice.'' 
21 CFR 1306.04(a). Similarly, under Texas law, a controlled substance 
prescription may only be issued ``for a valid medical purpose and in 
the course of medical practice.'' Tex. Health & Safety Code Sec.  
481.071(a). Texas law states that prescribing a controlled substance 
``without first establishing a valid practitioner-patient 
relationship'' falls outside the scope of professional medical 
practice. 22 Tex. Admin. Code Sec.  190.8(1)(L).
    Respondent admitted that he never established a doctor-patient 
relationship with J.O., yet thirteen prescriptions were written for 
J.O. using Respondent's hard token and electronic signature.\10\ RD, at 
8-9, 18, 26; Tr. 107-09, 148-56, 161-63, 234, 286-87, 296-97, 332; GX 
20, 24. Accordingly, these prescriptions were issued without a 
legitimate medical purpose and outside the usual course of professional 
practice, in violation of federal and state law.\11\ RD, at 26; 21 CFR 
1306.04(a); Tex. Health & Safety Code Sec.  481.071(a); 22 Tex. Admin. 
Code Sec.  190.8(1)(L).
---------------------------------------------------------------------------

    \10\ The allegation that Respondent failed to establish a 
doctor-patient relationship in this case pertains only to J.O. Tr. 
92. Although the Government admitted additional prescriptions into 
evidence that CES staff issued using Respondent's hard token--all of 
which were issued in violation of 21 CFR 1311.135(a)--the Government 
has not alleged that Respondent failed to establish a doctor-patient 
relationship with these patients. Tr. 81-82, 92.
    \11\ It is a long-standing principle of diversion law that DEA 
registrants are ``strictly liable for all activities which occur 
under the authority of their registrations.'' Sigrid Sanchez, M.D., 
78 FR 39331, 39336 (2013). In line with this well-established 
principle, it is reasonable to find that a registrant can be held 
liable for controlled substances being prescribed outside the usual 
course of professional practice even when issued by someone else 
under his registration. For instance, where a registrant's actions 
allow an unregistered person to prescribe controlled substances, as 
Respondent did here, the registrant can be found in violation of 21 
CFR 1306.04(a). Robert G. Hallermeier, M.D., 62 FR 26818, 26820 
(1997). This is because the purpose of Sec.  1306.04(a)--to ensure 
that ``patients use controlled substances under the supervision of a 
doctor so as to prevent'' diversion--is thwarted when a registrant 
allows an unregistered person to prescribe controlled substances 
under the registrant's registration to patients the registrant has 
never seen, which occurred in this case. Gonzales v. Oregon, 546 
U.S. 243, 274 (2006). When a registrant allows an unauthorized 
person to prescribe controlled substances, such as when Respondent 
allowed CES's unregistered staff to prescribe controlled substances 
to patients Respondent had never seen, the registrant creates a 
``substantial risk that the drugs would be diverted and abused,'' 
which undermines the purpose of Sec.  1306.04(a)'s prescription 
requirement. Arvinder Singh, M.D., 81 FR 8247, 8249 (2016).
     Holding a registrant liable for violating Sec.  1306.04(a) 
where prescriptions are issued by someone else under his 
registration is an extension of the Agency's precedent and the 
principle that registrants are ``strictly liable for all activities 
which occur under the authority of their registrations.'' Sigrid 
Sanchez, M.D., 78 FR at 39336. For example, in the context of 
electronic prescriptions, the Agency has revoked a registration, in 
part, due to the registrant ``improperly issu[ing] electronic 
controlled substance prescriptions by entrusting his secure 
credentials to his wife and son and allowing them to access and 
provide his PIN in the issuance of those prescriptions.'' Allen 
Alexander Rashford, M.D., 87 FR at 77638. Similarly, DEA has long 
held that when a registrant allows other individuals to use their 
registration, a serious violation is committed. See Brian Thomas 
Nichol, M.D., 83 FR 47352, 47367 (2018) (concluding respondent 
committed a ``serious violation of the CSA'' when he pre-signed 
prescriptions and gave them to unregistered staff, creating a 
``substantial risk'' of diversion and abuse); Rose Mary Jacinta 
Lewis, M.D., 72 FR 4035, 4041-42 (2007) (affirming an immediate 
suspension order where a registrant allowed another person to use 
her DEA credentials to obtain controlled substances and where such 
misconduct demonstrated ``indifference to her obligations'' and 
created a danger to public safety); Anthony L. Cappelli, M.D., 59 FR 
42288, 42288 (1994) (``By allowing an unregistered and unauthorized 
person to use his DEA number, Respondent was responsible for any use 
and misuse of that number. Moreover, such a violation is aggravated 
by the fact that Respondent allowed a non-practitioner to use his 
DEA number at an unregistered location.'').
---------------------------------------------------------------------------

    In sum, and in agreement with the RD, the Agency finds that the 
record contains substantial evidence that Respondent acted in violation 
of both federal and state law. RD, at 24-27; 21 U.S.C. 823(g)(1), 
824(a)(4); 21 CFR 1306.04(a), 1311.100(f), 1311.102(a), (k), 
1311.115(a), 1311.120(b)(5), (b)(11), 1311.125(c), 1311.135(a), 
1311.140(a)(5); 22 Tex. Admin. Code Sec.  315.3(c)(1); Tex. Health & 
Safety Code Sec.  481.071(a). In weighing factors B and D, the Agency 
finds that the Government has established a prima facie case that 
Respondent committed acts that render his registration inconsistent 
with the public interest and support revocation of his registration. 21 
U.S.C. 823(g)(1); RD, at 27.

III. Sanction

    Where, as here, the Government has established sufficient grounds 
to issue a sanction against Respondent's registration, the burden 
shifts to the registrant to show why he can be entrusted with the 
responsibility carried by a registration. Garret Howard Smith, M.D., 83 
FR 18882, 18910 (2018). ``[T]rust is necessarily a fact-dependent 
determination based'' on individual circumstances; therefore, the 
Agency looks at factors such as ``the acceptance of responsibility and 
the credibility of that acceptance as it relates to the probability of 
repeat violations or behavior,'' ``the nature of the misconduct that 
forms the basis for sanction,'' and ``the Agency's interest in 
deterring similar acts.'' Robert Wayne Locklear, M.D., 86 FR 33738, 
33746 (2021). To be effective, acceptance of responsibility must be 
unequivocal. Mohammed Asgar, M.D., 83 FR 29569, 29573 (2018). When a 
registrant has committed acts inconsistent with the public interest, he 
must both accept responsibility and demonstrate that he has undertaken 
corrective measures. Holiday CVS, L.L.C., d/b/a CVS/Pharmacy Nos. 219 
and 5195, 77 FR 62316, 62339 (2012) (internal quotations omitted).
    Here, Respondent has failed to fully and credibly accept 
responsibility for the proven misconduct. RD, at 27-29. When asked 
about his decision to surrender physical possession of the hard token 
to CES, Respondent expressed regret and remorse. RD, at 28; Tr. 229, 
316. Respondent testified that turning over the hard token was ``a 
decision that [he] now regret[s] and [is] extremely remorseful about.'' 
RD, at 28; Tr. 229, 316. Regret and remorse, however, are not the same 
as taking

[[Page 84198]]

ownership of the misconduct, its gravity, and its threat to public 
safety.\12\
---------------------------------------------------------------------------

    \12\ See Nicholas P. Roussis, M.D., 86 FR 59190, 59194 (2021) 
(explaining ``remorse and acceptance of responsibility are not the 
same thing'' in that a respondent's remorse is primarily concerned 
with his unpleasant feelings whereas a full acceptance of 
responsibility acknowledges the harm his actions posed to the 
public); Ibrahim Al-Qawaqneh, D.D.S., 86 FR 10354, 10357 (2021) 
(finding that regret did not amount to acceptance of 
responsibility).
---------------------------------------------------------------------------

    When specifically asked whether he accepted responsibility, he 
testified that he ``accept[s] full responsibility for the mistakes that 
occurred.'' RD, at 28; Tr. 335. However, that acceptance of 
responsibility was far from unequivocal as Respondent repeatedly blamed 
his decision to give up possession of the token on CES. RD, at 28. 
Respondent testified that in trusting CES with his hard token, he had 
``the wool pulled over [his] eyes.'' Id.; Tr. 238. He testified that 
CES created an impression of being compliant with state and federal 
law. RD, at 13-17. Specifically, he testified about receiving a 
memorandum from the company's CEO detailing the effects of the Drug 
Addiction Treatment Act (DATA) of 2000 on the company's prescribing 
practices, RD, at 16; Tr. 199-204; RX 4, and how this memorandum gave 
him assurance that CES was taking regulatory compliance seriously. RD, 
at 16; Tr. 209-10. He also testified about a July 2021 audit report 
written by the company's compliance officer, a former DEA DI, which 
memorialized the policy that the company and its agents were authorized 
to issue controlled substance prescriptions on behalf of the provider. 
RD, at 13-16; Tr. 219-27, 314; RX 2, at 18. Respondent testified that 
he was ``impressed that [CES] took the trouble and had retained a 
retired DEA investigator as their chief compliance officer to ensure 
that the company was following rules and regulations.'' RD, at 12; Tr. 
189-93, 334. He testified that all these assurances led him to believe 
that CES had more expertise than he did regarding regulatory 
compliance. RD, at 13, 31-32; Tr. 230, 283-84, 321.
    Respondent also testified that he read the requirement to retain 
sole possession of the hard token prior to joining CES,\13\ but blamed 
the company for misinterpreting the regulation.\14\ RD, at 28, 31-32; 
Tr. 315-16. Shifting the blame onto the company further undermines his 
attempt to accept responsibility.\15\ Id.
---------------------------------------------------------------------------

    \13\ Respondent testified that he read 21 CFR 1311.102(a) as 
part of his due diligence before joining CES; however, when the 
Government asked whether he was aware of a regulation prohibiting 
the surrender of a hard token to someone else, Respondent stated: 
``No. Not before I joined CES. I was not aware of this.'' Tr. 316. 
The first words of 21 CFR 1311.102(a) are ``[t]he practitioner must 
retain sole possession of the hard token.'' Respondent's testimony 
that he read this regulation, given his claim that he was not aware 
that he had to keep the hard token, causes the Agency to question 
Respondent's credibility. RD, at 31; see also Daniel A. Glick, 
D.D.S., 80 FR 74,800, 74809 (2015) (holding ignorance of the CSA or 
DEA's regulations are no defense to proven violations).
    \14\ He acknowledged that nowhere in the company's protocols or 
manuals was there an assurance from the company that surrendering 
his hard token complied with DEA regulations. RD, at 18; Tr. 318-19.
    \15\ He testified that he ``understand[s] the gravity of my--the 
mistakes that have occurred.'' RD, at 28; Tr. 244. Rather than take 
ownership by calling them ``my mistakes,'' he referred to mistakes 
in a passive and general sense. See also Tr. 335 (referring broadly 
to ``mistakes that occurred''). Indeed, the majority of his 
testimony reveals that Respondent understands the ``mistakes'' to 
mean the mistakes that CES made and the mistake that he made in 
trusting CES. RD, at 28; see Sualeh Ashraf, M.D., 88 FR at 1098 
(discrediting respondent's acceptance of responsibility due to him 
blaming someone else for being the ``criminal mind'' behind the 
misconduct); Michael A. White, M.D., 79 FR 62957, 62967-68 (2014) 
(finding that the standard for accepting responsibility was not met 
where respondent blamed others for his misconduct); Robert Raymond 
Reppy, D.O., 76 FR 61,154, 61,180 (2011) (finding that respondent 
failed to fully and credibly accept responsibility where most of his 
testimony shifted blame to others and focused on how he was 
``duped'' into violating the CSA). Furthermore, although Respondent 
acknowledged at the hearing that protecting his registration is 
``solely'' his responsibility, this after-the-fact realization 
conflicts with other parts of his testimony where he blamed CES for 
his failure to protect his DEA registration. Tr. 335.
---------------------------------------------------------------------------

    Furthermore, Respondent testified that when he gave up physical 
possession of his hard token, he believed CES would only use the token 
and his credentials to issue controlled substance prescriptions for 
patients with whom Respondent had established a doctor-patient 
relationship. RD, at 16, 32; Tr. 222-23, 230, 284. Even if this was his 
intention, relinquishing control of the token in-and-of-itself was a 
clear violation of 21 CFR 1311.102(a) that allowed diversion to occur. 
Respondent's attempt to downplay his misconduct further undermines his 
acceptance of responsibility and calls into question whether he truly 
understands the gravity of his misconduct. RD, at 30-32. In sum, the 
Agency agrees with the RD that Respondent failed to unequivocally 
accept responsibility for the proven violations. RD, at 27-29.
    The Agency is only required to consider remedial measures where a 
respondent has tendered a full and credible acceptance of 
responsibility. Ajay S. Ahuja, M.D., 84 FR 5479, 5498 n.33 (2019); 
Daniel A. Glick, D.D.S., 80 FR at 74810. Here, the Agency need not 
consider remedial measures given the lack of acceptance of 
responsibility. RD, at 29. Nevertheless, even if Respondent had 
accepted responsibility, his proposed remedial measures would not 
change the outcome of this case.\16\ Id.
---------------------------------------------------------------------------

    \16\ Respondent's proposed remedial measures included 
deactivating all tokens that he was no longer using; hiring a third-
party to conduct a regulatory compliance audit of his practice; 
searching the PMP for prescriptions issued under his COR; and 
writing a controlled substances protocol for other practitioners. 
Tr. 238-43. Although these measures are not without merit, the 
proposed remediation fails to convince the Agency that he can be 
trusted with a registration. John Qian, M.D., 89 FR 59934, 59937-38 
(2024). In this regard, even if these measures were enacted, 
Respondent's insufficient acceptance of responsibility demonstrated 
that he believes it was CES, not himself, who bore ultimate 
responsibility for the proven misconduct. RD, at 27-28. In this 
sense, Respondent's proposed measures are not backed up by his 
willingness to take personal responsibility for his actions, and 
therefore, their remedial efficacy rings hollow. Jeffrey Pollock, 
P.A., 89 FR 54052, 54058 n.38 (2024). Additionally, the proposed 
measures are misplaced. Deactivating unused tokens and auditing his 
practice have no relevance to the proven violation of failing to 
maintain sole possession of his hard token and not sharing his 
authentication credentials. Likewise, checking the PMP and 
instructing other practitioners on their responsibilities have no 
bearing on the misconduct, especially given the fact that he 
believes the misconduct was primarily CES's fault for misleading 
him. RD, at 27-28. Furthermore, in light of the egregiousness of the 
misconduct and the need for deterrence, his proposed remedial 
measures are insufficient. Id. at 29.
---------------------------------------------------------------------------

    In addition to acceptance of responsibility, the Agency looks to 
the egregiousness and extent of the misconduct. Garrett Howard Smith, 
M.D., 83 FR at 18910 (collecting cases), and considers both specific 
and general deterrence when determining an appropriate sanction. Daniel 
A. Glick, D.D.S., 80 FR at 74810.
    Here, the Agency agrees with the ALJ that Respondent's misconduct 
was egregious. RD, at 29-30. The CSA establishes a ``closed system for 
regulating the distribution'' of controlled substances ``to prevent the 
diversion of these substances to those who would either abuse them or 
sell them to those who do.'' Holiday CVS, L.L.C., d/b/a CVS/Pharmacy 
Nos. 219 and 5195, 77 FR at 62317 (citing Gonzales, 546 U.S. at 250). 
DEA regulations contain a clear mandate to ``retain sole possession of 
the hard token'' for a reason: to keep the closed system of 
distribution closed.\17\ Gonzales, 546 U.S. at 250-51.

[[Page 84199]]

In this case, Respondent enabled unregistered individuals at an 
unregistered location to issue multiple controlled substance 
prescriptions, including at least a year's worth of controlled 
substance prescriptions for patient J.O. whom Respondent had never 
evaluated. RD, at 4-5, 16, 18, 26, 29-30; Tr. 42-43, 50, 225-26. 
Therefore, by giving away his hard token and two-factor authentication 
data to unauthorized persons, Respondent committed egregious violations 
of DEA's regulations that created a risk of diversion and threatened 
public safety. RD, at 29-31.
---------------------------------------------------------------------------

    \17\ In a Notice of Proposed Rulemaking, the Agency explained 
that by requiring registrants to retain sole possession of the hard 
token, ``the practitioner can eliminate the risk of fraudulent 
prescriptions and, if the token is lost, stolen, or compromised, he 
will be immediately alerted to the threat and have the 
authentication protocol revoked.'' See Electronic Prescriptions for 
Controlled Substances, 73 FR 36722, 36737 (June 27, 2008). The 
Agency further explained that the requirement for the practitioner 
to retain sole possession of the hard token serves to protect the 
practitioner as well as the pharmacy from forged or fraudulent 
prescriptions, and to provide ``assurance that only a legitimate 
practitioner issued the prescription.'' Id.
---------------------------------------------------------------------------

    The Agency also concludes that revocation of Respondent's 
registration is necessary to deter the registrant community from 
engaging in similar misconduct. RD, at 30-31. There is simply no 
conceivable world in which it is acceptable for a practitioner to give 
away his or her prescribing credentials to anyone else, including a 
telemedicine platform. When a practitioner is awarded the privilege of 
prescribing controlled substances in the form of a registration, that 
privilege belongs to the registrant and the registrant alone--it cannot 
be given away. The Agency agrees with the ALJ that the interests of 
general deterrence support revocation, as a lack of sanction in the 
current matter would send a message to the registrant community that 
giving away a hard token and two-factor authentication credentials can 
be overlooked and excused. RD, at 30; see also Jeffrey Pollock, P.A., 
89 FR at 54058. Revocation is also necessary to impress upon Respondent 
the seriousness of his misconduct and to deter him from committing the 
same misconduct in the future. Id.
    In sum, Respondent has not offered sufficient mitigating evidence 
to establish that he can be trusted with the responsibility of 
maintaining a DEA registration. RD, at 27-33. Accordingly, the Agency 
will order that Respondent's registration be revoked. RD, at 33.

Order

    Pursuant to 28 CFR 0.100(b) and the authority vested in me by 21 
U.S.C. 824(a), I hereby revoke DEA Certificate of Registration No. 
FS2968444 issued to Neeraj B. Shah, M.D. Further, pursuant to 28 CFR 
0.100(b) and the authority vested in me by 21 U.S.C. 823(g)(1), I 
hereby deny any pending applications of Neeraj B. Shah, M.D., to renew 
or modify this registration, as well as any other pending application 
of Neeraj B. Shah, M.D., for additional registration in Texas. This 
Order is effective November 20, 2024.

Signing Authority

    This document of the Drug Enforcement Administration was signed on 
October 10, 2024, by Administrator Anne Milgram. That document with the 
original signature and date is maintained by DEA. For administrative 
purposes only, and in compliance with requirements of the Office of the 
Federal Register, the undersigned DEA Federal Register Liaison Officer 
has been authorized to sign and submit the document in electronic 
format for publication, as an official document of DEA. This 
administrative process in no way alters the legal effect of this 
document upon publication in the Federal Register.

Heather Achbach,
Federal Register Liaison Officer, Drug Enforcement Administration.
[FR Doc. 2024-24189 Filed 10-18-24; 8:45 am]
BILLING CODE 4410-09-P