DEA e-Prescribing Rules Present Challenges

As if psychiatrists didn’t have enough to worry about with regard to complying with upcoming Medicare e-Prescribing dictates, there is now a second layer of complication . . . the interim final rule (IFR) from the Drug Enforcement Administration (DEA), which prescribes requirements for physicians who want to use electronic prescribing for controlled substances. Overall, controlled substances constitute between 10% and 11% of all prescriptions written in this country, according to the DEA. Psychiatrists are thought to do a disproportionate amount of that prescribing. They are, as a class, heavy prescribers of buprenorphine for the treatment of opiate dependence, for example-the only controlled substance the FDA has approved to be office-administered as part of opiate withdrawal treatment.

The DEA’s IFR that was published in March 2010 does include some accommodations requested by the American Psychiatric Association after a proposed rule was published in June 2008. But the IFR’s technology requirements otherwise make it impossible for any physician to comply in the short term. That’s because the standards and the software are not available, and they won’t be for at least a few years, according to Peter Kaufman, MD, chief medical officer of DrFirst-a company that sells e-prescribing systems to physicians. Kaufman said comments from industry and physician groups in the af-termath of the IFR will ask the DEA to “ease some of the requirements temporarily until standards are put in place.”

The DEA’s IFR is subject to congressional review. Barbara Carreno, a DEA spokesperson, explained that Congress has 60 legislative days from June 1, 2010, to pass a joint resolution of disapproval. If it does so, the DEA would have to start the rulemaking over again. But resolutions of disapproval are rare, she said.

Apart from any additional DEA mandates, physicians already face an impending requirement from the Centers for Medicare & Medicaid Services (CMS) to purchase elec-tronic health records (EHRs) software and hardware to qualify for Medicare fee bonuses in calendar year 2011. Those bonuses were established in the American Recovery and Reinvestment Act, otherwise known as the stimulus bill that Congress passed in February 2009. The bonuses will be paid in each of 5 successive years. To qualify for those bonuses, a physician must meet a multifaceted “meaningful use” definition pertaining to his or her use of EHRs. That definition is now being finalized by the CMS. One aspect of that definition covers e-prescribing. The DEA requirements in the IFR might make it impossible for psychiatrists to meet the meaningful use requirement. Medicare penalties come into play in 2016 if physicians do not meet the meaningful use EHR standard by then.

Psychiatrists have been reluctant to take the plunge into e-prescribing as long as the DEA prohibits prescriptions for controlled substances to be sent electronically. Psychiatrist hesitancy to implement practice-wide e-prescribing will undoubtedly continue unless the DEA modifies its IFR to make compliance possible.

The DEA requirements, as they stand, mandate an indication that the prescription was signed with appropriate 2-factor authentication and sent according to a standard set by the National Council for Prescription Drug Programs (NCPDP). That standard is called SCRIPT, a data transmission standard. The SCRIPT standard is still evolving; the most recent is Version 10 Release 6. It does not support 2-factor authentication “messaging,” nor does it allow direct, electronic communication between a physician and a pharmacy. The prescription is sent through an intermediary, such as SureScripts/RxHub, which in essence “reads” the SCRIPT and determines whether the pharmacy software can open it; it often cannot. The interoperability issues that require intermediaries generally relate to pharmacy and practitioner applications using different versions of the standard as well as varying approaches to providing opening and reading instructions.

Kaufman explained that the NCPDP is working to add a new authentication field to its messaging SCRIPT that will have to be approved by the CMS and its parent Department of Health and Human Services. “NCPDP is currently working to determine whether there is a field in SCRIPT that is not actually used, which could be used, at least temporarily, for this indicator sooner.”

The DEA did make some apparent concessions by allowing physicians, for example, to use biometrics as one of the options in a 2-factor authentication system. This would allow biometrics to be used with a password, for example. The APA had opposed a requirement in the proposed rule that physicians use what is called a “hard token” as 1 of the 2 factors. A hard token is something like a thumb drive: it must be plugged into the computer every time a prescription is written and therefore has to be carried around by the physician for security purposes. A hard token remains an option; the addition of the biometric factor was applauded by Jennifer Tassler, JD, deputy director, regulatory affairs, APA.

In addition to allowing biometric authentication, the DEA also moved off its proposed requirement that physicians present themselves physically to some federally approved credential service provider or certification authority to obtain authentication credentials or digital certificates. This is called “identity proofing.” In the IFR, the DEA agreed to allow “remote” identity proofing.