For such solo practitioners and for many small practices, logical access controls may need to be set only once because they will usually be set or changed only with staff turnover. \13\ Healthcare Information and Management Systems Society. DEA's use of the term EHR in this rule relates to those records maintained by practitioners, as opposed to a PHR maintained by an individual patient, regardless of how those records are maintained. Year-End Reports, Cases Against Doctors However, it is already clear under existing law and regulations that a practitioner who prescribes or otherwise dispenses controlled substances beyond the scope of his registration is committing a violation of the CSA and subject to potential criminal prosecution, civil fine, and loss of registration. The proposed rule would specify the initial criteria an eligible professional and eligible hospital must meet to qualify for the incentive payment; calculation of the incentive payment amounts; and other payment and program participation issues. Within the CSA's system of controls, it is the individual practitioner (e.g., physician, dentist, veterinarian, nurse practitioner) who issues the prescription authorizing the dispensing of the controlled substance. If so, please describe the alternative(s) and indicate how, specifically, it would better encourage adoption of electronic prescriptions for controlled substances without diminishing the safety and security of the system. SCRIPT is a data transmission standard "intended to facilitate the communication of prescription information between prescribers, pharmacies, and payers." The approach proposed for Federal healthcare systems was based, therefore, on the existing Federal systems, which rely on public key infrastructure (PKI) and digital certificates to address basic security issues related to non-repudiation, authentication, and record integrity. From the user's perspective, the experience is similar to using an ATM card. The Recovery Act authorizes incentive payments for eligible professionals and eligible hospitals participating in Medicare or Medicaid if they can demonstrate to the Secretary of HHS that they are "meaningful EHR users" as defined by the Act and its implementing regulations. JUSTICE.GOV    |     ; Decision and Order, Jeffrey M. Wolk, M.D. JUSTICE.GOV    |     Comments. However, at the conclusion of the Congressional review, if the effective date has been changed, the Drug Enforcement Administration will publish a document in the Federal Register to establish the actual effective date or to terminate the rule. Violations of the Act can be civil or criminal in nature, which may result in administrative, civil, or criminal proceedings. All records must be maintained for two years from the date on which they were created or received. Although prescriptions could be altered, added, or deleted during transmission, DEA is not regulating transmission. DEA believes these steps are necessary to ensure that a registrant is involved in the process of setting logical access controls and that these cannot be set or changed without the concurrence of a registrant. The CCHIT criteria do address security issues, such as access control and audit logs. It is unlawful for any person knowingly or intentionally to use a DEA registration number that is fictitious, revoked, suspended, expired, or issued to another person in the course of dispensing a controlled substance, or for the purpose of acquiring or obtaining a controlled substance (21 U.S.C. As suggested by some commenters, for individual practitioners in private practice (i.e., those practitioners not seeking access to an institutional practitioner's applications), DEA will use existing certification authorities (CAs) and similar credential service providers (CSPs) that have been approved by a Federal authority. DEA Response. Most commenters, however, raised a substantial number of issues about various provisions of the proposed rule; their comments are addressed in detail in section IV of this preamble. must be issued for a legitimate medical purpose and must be issued in the usual course of professional practice. For remote identity proofing, Level 3 requires a valid government- issued identification number and a financial account number. DEA will not accept any file formats other than those specifically listed here. Other commenters, including insurance organizations, some practitioner organizations, and some pharmacy organizations, opposed the requirement for identity proofing, stating that it would be burdensome to practitioners and a barrier to adoption of electronic prescribing. There are generally three to five intermediaries that route prescriptions between practitioners and pharmacies. The vast majority of Schedule II, III, IV, and V controlled substances are available only pursuant to a prescription issued by a practitioner licensed by the State and registered with DEA to dispense the substances. Some large healthcare systems and chain pharmacies, however, may develop and maintain the applications themselves, serving as both the practitioner or pharmacy and the application provider. The DEA- registered pharmacy does not order the dispensing. The prescription records must be reliable enough to be used in legal actions (enforcing laws relating to controlled substances) without diminishing the ability to establish the relevant facts and without requiring the calling of excessive numbers of witnesses to verify records. It is unlawful for any person to knowingly or intentionally acquire or obtain possession of a controlled substance by misrepresentation, fraud, forgery, deception, or subterfuge (21 U.S.C. DEA will accept attachments to electronic comments in Microsoft Word, WordPerfect, Adobe PDF, or Excel file formats only. The method used to authenticate a practitioner to the electronic prescribing system must ensure to the greatest extent possible that the practitioner cannot repudiate the prescription. will be familiar with any issues related to the status of a DEA registration. In the case of at least some existing electronic prescription application service providers, individuals are allowed to enroll online. AGENCY: Drug Enforcement Administration (DEA), Department of Justice.