The DEA Has Given the Green Light for Electronically Prescribing Controlled Substances

The prohibition against electronically prescribing opioid medications and other controlled substances has long been a major barrier to wider adoption of electronic prescribing. However, in response to mounting demand from the health care and health IT communities, the Drug Enforcement Agency (www.dea.gov) finally changed its policy a little more than a year ago and issued an interim rule revising DEA regulations to provide practitioners with the option of writing prescriptions for controlled substances electronically. The change was welcomed by many physicians, but the new rule also erected some formidable thresholds in the name of security that have made many practitioners hold on to their prescription pads.

“The new rule has taken effect, but there hasn’t been much activity in the marketplace,” says Mihir Patel, PharmD, practice leader for medication management with the Newark, NJ-based consulting firm Point of Care Partners (www.pocp.com). For one thing, many states still prohibit electronic prescribing of controlled substances (see sidebar). And then there’s the issue of physicians, pharmacies, intermediaries, and e-prescribing software applications not being ready to comply with DEA requirements. “There’s work to do at the software level,” says Patel, who spoke on the topic of e-prescribing for controlled substances (EPCS) at the 2011 Healthcare Information and Management Systems Society (HIMSS) (www.himss.org) conference.

Nearly one year after legalization of EPCS, little has changed, and may not for a little while longer. Upon publication of its interim EPCS final rule (www.deadiversion. usdoj.gov/fed_regs/rules/2010/fr0331.pdf ) on March 31, 2010, DEA sent a notice to anyone with a DEA registration number that authorizes them to prescribe controlled substances, informing them that EPCS would soon be legal. “But there’s no way to do it,” says Peter Kaufman, MD, chief medical officer of e-prescribing vendor DrFirst (www.drfirst.com), Rockville, Md.

E-prescribing network Surescripts (www. surescripts.com) reported that e-prescribing volume grew by nearly 72% in 2010, to 326 million prescriptions nationwide. By the end of the year, the company said, physicians and other licensed prescribers were sending about a quarter of all “eligible prescriptions” electronically. For the most part, controlled substances were not among eligible prescriptions.

Two-factor authentication

The DEA rules for e-prescribing of controlled substances are tough (see sidebar). To transmit an electronic prescription for a controlled drug, prescribers must use an e-prescribing system that will only grant access if a prescriber has two security credentials from among the following three factors: something you know, something you have, and something you are. A standard encrypted password is adequate for the first factor (“something you know”), but the second factor has to be either biometric data (such as a fingerprint or retinal scan; ie, “something you are”)or a hard token or a one-time password generated by a device other than the computer used for prescribing (“something you have”). “It’s not easy [to e-prescribe controlled substances] because of the things you have to do,” says Cynthia L. Dunn, RN, principal consultant for the Medical Group Management Association (www.mgma.com). “It’s onerous.”

“Are physicians going to want to go through two-factor authentication?” asks Patel. He says some doctors who e-prescribe write prescriptions on paper and then have a staff member enter the order electronically. That will not work with controlled drugs since the actual licensed prescriber must authenticate his or her identity.

David W. Bragg, MD, senior vice president for medical informatics at HealthTexas Provider Network (www.healthtexas.com) and Baylor Health Care System (www. baylorhealth.com) in Dallas, TX, also is concerned that two-factor authentication is a difficult step for most prescribers to take. “Almost no practices have those kinds of biometrics present now,” Bragg says. “I don’t see that happening routinely until sometime in 2012.”

The DEA is accepting additional comments on the two-factor requirement, signaling that the agency is open to modifying this in the final rule. There is no word on when a final rule might come out.

Is anyone actually doing this?

Beyond identity verification, prescribers and pharmacies alike must use an application certified to meet DEA requirements. Intermediaries must be able to communicate with e-prescribing and pharmacy information systems, and state law has to permit e-prescribing of controlled substances.

Surescripts spokesman Rob Cronin says he is unaware of anyone currently processing controlled e-prescriptions, with the exception of a federally funded pilot project in Berkshire County, Mass., that has been underway since September 2009, thanks to a DEA waiver (www.hcplive.com/publications/ mdng-PainManagement/2010/March2010/ controlled_substances_and_e-prescribing).

There are some signs of progress, though. DrFirst, the software supplier for the Massachusetts pilot, says its EPCS Gold application is the first e-prescribing system to meet the DEA’s security requirements. Kaufman says participating prescribers were issued “crypto-keys,” encrypted USB drives that contain personal authentication details.

According to Kaufman and Patel, Surescripts is planning a trial of EPCS technology in three states, possibly starting in late July. The prescribing network declined to provide specifics, but Cronin says in an e-mail: “Surescripts is readying its network operations to support e-prescribing of controlled substances and that more details would be forthcoming in the second half of this year.”

Meanwhile, the deadline to comply with the National Council for Prescription Drug Programs (www.ncpdp.org) version D.0 standards for pharmacy claims is January 1, 2012, so pharmacies, pharmacy benefit managers, e-prescribing software vendors, and intermediaries all have been updating (or need to update and test) their systems. “We don’t think [EPCS] is going to really take off until next year,” says Patel, agreeing with Bragg’s assessment. “You’re going to have to talk to your vendor if you believe your workflow can take it,” says Dunn.

The effect on day-to-day practice

Ah, workflow. That may be the most challenging piece of the whole puzzle. According to Bragg, a fingerprint reader costs context of an electronic health record (EHR) purchase. “It’s more about establishing the workflows,” Bragg says.

The DEA Office of Diversion Control has estimated that about 11% of all prescriptions in the US are for controlled substances and that 90% of licensed prescribers write prescriptions for controlled drugs. The American Medical Association (www.ama-assn.org) pegs the prescription rate at closer to 20%. That means, on average, physicians who e-prescribe now have to have separate processes for as many as one-fifth of their scripts.

“If you’ve got a patient who’s on 12 different medications and three of them are controlled, then you’ve got to go through different workflows,” Bragg points out. Bragg has used an EHR for 13 years and has been e-prescribing for three years. “I’d love to be able to e-prescribe controlled drugs. All in all, we’re very eager to start using the controlledmed e-prescribing,” Bragg says. “It’s helpful to the patient, too. It’s more patient-centric to be able to do it this way.” Dunn says that she has been seeing another workaround at practices that have already adopted e-prescribing technology, and that “a lot of people are putting [scripts for controlled substances] in the system and then just printing it out.”

Physicians are not penalized in the Medicare e-prescribing incentive program or under the rules for “meaningful use” of EHRs if they don’t write electronic scripts for controlled medications (see sidebar). That doesn’t always alleviate the frustration, though. “Those who are e-prescribing are saying, ‘I want to e-prescribe controlled substances as well,’” reports Joseph H. Schneider, MD, MBA, chair of the Texas Medical Association’s (www.texmed. org) ad hoc Committee on Health Information Technology, chief medical information officer at Baylor Health Care System, and a practicing pediatrician at Parkland Memorial Hospital (www.parklandhospital.com) in Dallas. “Those of us who have dug into the [EPCS] rules are saying, ‘Wow, could you make the rules any more complicated?’”

In Dallas, several health IT leaders are working with the Health Information Trust Alliance (HITRUST) (www.hitrustalliance. net), developer of a health IT security framework that attempts to harmonize various data and security standards, to create a badge that will work as an authentication token at multiple hospitals. “Let’s all have a common key that works everywhere you practice,” Schneider says. “Make my cell phone work as a security tag.” (Schneider suggests that the DEA may have to clarify the interim final rule to allow such a form of authentication.)

From the workflow perspective, Schneider would like to see e-prescribing software—or e-prescribing modules in EHRs—let the doctor write all the scripts for a given patient, then ask for a security key at the end if the batch contains any controlled drugs, rather than stopping the physician after each script. “At certain times, the costs outweigh the incentives,” Schneider says.

Looking ahead

It took years for the DEA interim rule to come to fruition, and it may take years to refine the processes. In the short term, Dunn believes other technologies carry more upside for physicians, such as EHRs and mobile/wireless patient monitoring, particularly for those following the patientcentered medical home model. Most of the practices she talks to these days are simply struggling with EHR implementations, so EPCS is on the back burner. They also have to contend with the switch to ANSI X12 version 5010 transactions by January 2012 and ICD- 10 coding by October 2013.

Dunn sees more opportunities for providers to leverage IT for revenue-cycle management and real-time claims adjudication, both of which can improve cash flow. “You will have to start looking at the service mix of payers,” she says. It’s wise to treat patients with highdeductible health plans like self-pays and start asking for payment at the time of service.

Neil Versel is a freelance writer and journalist who covers a wide range of topics in health IT. Check out his blog Meaningful Health IT News (www. meaningfulhitnews.com) and follow him on Twitter @nversel.