[Federal Register Volume 74, Number 64 (Monday, April 6, 2009)]
[Rules and Regulations]
[Pages 15596-15625]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E9-7698]



[[Page 15595]]

-----------------------------------------------------------------------

Part II





Department of Justice





-----------------------------------------------------------------------



Drug Enforcement Administration



-----------------------------------------------------------------------



21 CFR Part 1300, 1301, 1304, et al.



Implementation of the Ryan Haight Online Pharmacy Consumer Protection 
Act of 2008; Final Rule

  Federal Register / Vol. 74, No. 64 / Monday, April 6, 2009 / Rules 
and Regulations  

[[Page 15596]]


-----------------------------------------------------------------------

DEPARTMENT OF JUSTICE

Drug Enforcement Administration

21 CFR Parts 1300, 1301, 1304, 1306

[Docket No. DEA-322I]
RIN 1117-AB20


Implementation of the Ryan Haight Online Pharmacy Consumer 
Protection Act of 2008

AGENCY: Drug Enforcement Administration (DEA), Department of Justice.

ACTION: Interim final rule with request for comments.

-----------------------------------------------------------------------

SUMMARY: The Ryan Haight Online Pharmacy Consumer Protection Act, which 
was enacted on October 15, 2008, amended the Controlled Substances Act 
and Controlled Substances Import and Export Act by adding several new 
provisions to prevent the illegal distribution and dispensing of 
controlled substances by means of the Internet. DEA is hereby issuing 
an interim rule to amend its regulations to implement the legislation 
and is requesting comments on the interim rule.

DATES: This interim rule is effective April 13, 2009, except Sec. Sec.  
1300.04, 1301.19, and 1304.40, which are effective April 6, 2009. 
Section 1300.04(i) (the definition of ``practice of telemedicine'') has 
an implementation date of January 15, 2010, unless such date is 
superseded by future regulatory actions as explained in the 
SUPPLEMENTARY INFORMATION section.
    Written comments must be postmarked on or before June 5, 2009, and 
electronic comments must be sent on or before midnight Eastern time 
June 5, 2009.

ADDRESSES: To ensure proper handling of comments, please reference 
``Docket No. DEA-322'' on all written and electronic correspondence. 
Written comments being sent via regular or express mail should be sent 
to the Drug Enforcement Administration, Attention: DEA Federal Register 
Representative/ODL, 8701 Morrissette Drive, Springfield, VA 22152. 
Comments may be sent to DEA by sending an electronic message to 
[email protected]. Comments may also be sent 
electronically through http://www.regulations.gov using the electronic 
comment form provided on that site. An electronic copy of this document 
is also available at the http://www.regulations.gov Web site. DEA will 
accept attachments to electronic comments in Microsoft Word, 
WordPerfect, Adobe PDF, or Excel file formats only. DEA will not accept 
any file formats other than those specifically listed here.
    Please note that DEA is requesting that electronic comments be 
submitted before midnight Eastern time on the day the comment period 
closes because http://www.regulations.gov terminates the public's 
ability to submit comments at midnight Eastern time on the day the 
comment period closes. Commenters in time zones other than Eastern time 
may want to consider this so that their electronic comments are 
received. All comments sent via regular or express mail will be 
considered timely if postmarked on the day the comment period closes.

FOR FURTHER INFORMATION CONTACT: Mark W. Caverly, Chief, Liaison and 
Policy Section, Office of Diversion Control, Drug Enforcement 
Administration, 8701 Morrissette Drive, Springfield, VA 22152; 
Telephone: (202) 307-7297.

SUPPLEMENTARY INFORMATION: Posting of Public Comments: Please note that 
all comments received are considered part of the public record and made 
available for public inspection online at http://www.regulations.gov 
and in the DEA's public docket. Such information includes personal 
identifying information (such as your name, address, etc.) voluntarily 
submitted by the commenter.
    If you want to submit personal identifying information (such as 
your name, address, etc.) as part of your comment, but do not want it 
to be posted online or made available in the public docket, you must 
include the phrase ``PERSONAL IDENTIFYING INFORMATION'' in the first 
paragraph of your comment. You must also place all the personal 
identifying information you do not want posted online or made available 
in the public docket in the first paragraph of your comment and 
identify what information you want redacted.
    If you want to submit confidential business information as part of 
your comment, but do not want it to be posted online or made available 
in the public docket, you must include the phrase ``CONFIDENTIAL 
BUSINESS INFORMATION'' in the first paragraph of your comment. You must 
also prominently identify confidential business information to be 
redacted within the comment. If a comment has so much confidential 
business information that it cannot be effectively redacted, all or 
part of that comment may not be posted online or made available in the 
public docket.
    Personal identifying information and confidential business 
information identified and located as set forth above will be redacted 
and the comment, in redacted form, will be posted online and placed in 
the DEA's public docket file. Please note that the Freedom of 
Information Act applies to all comments received. If you wish to 
inspect the agency's public docket file in person by appointment, 
please see the ``For Further Information'' paragraph.

Preamble

I. Legislation Upon Which These Regulations Are Based

    The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 
(Pub. L. 110-425) (hereafter, the ``Ryan Haight Act'' or the ``Act'') 
was enacted on October 15, 2008. The Act amended the Controlled 
Substances Act (CSA) and Controlled Substances Import and Export Act 
(CSIEA) by adding various provisions to prevent the illegal 
distribution and dispensing of controlled substances by means of the 
Internet.\1\ The law becomes effective April 13, 2009 (except for one 
provision relating to telemedicine discussed below). Thus, as of April 
13, 2009, it will be illegal under federal law to ``deliver, 
distribute, or dispense a controlled substance by means of the 
Internet, except as authorized by [the CSA]'' or to aid or abet such 
activity. 21 U.S.C. 841(h)(1). The Act applies to all controlled 
substances in all schedules.
---------------------------------------------------------------------------

    \1\ Consistent with the CSA itself, the Ryan Haight Act relates 
solely to controlled substances. Controlled substances are those 
psychoactive drugs and other substances--including narcotics, 
stimulants, depressants, hallucinogens, and anabolic steroids--that 
are placed in one of the five schedules of the CSA due to their 
potential for abuse and likelihood that they may cause psychological 
or physical dependence when abused.
    Controlled substances constitute only a small percentage of all 
pharmaceutical drugs. Approximately 10 percent of all drug 
prescriptions written in the United States are for controlled 
substances, with the remaining approximately 90 percent of 
prescriptions being written for noncontrolled substances. The 
amendments to the CSA made by the Ryan Haight Act, as well as the 
regulations being issued here, do not apply to noncontrolled 
substances.
---------------------------------------------------------------------------

    This document serves three purposes: (1) To explain the new 
legislation; (2) to announce the amendments to the DEA regulations that 
implement the new legislation; and (3) to request comments on the 
amendments to the regulations, which are being issued as an interim 
rule as contemplated in the legislation.

II. Authority in Ryan Haight Act To Issue Regulations

    The Ryan Haight Act contains various provisions that call upon the 
Attorney

[[Page 15597]]

General to issue regulations to implement the Act. Among these is the 
following general grant of authority:

    The Attorney General may promulgate and enforce any rules, 
regulations, and procedures which may be necessary and appropriate 
for the efficient execution of functions under this Act or the 
amendments made by this Act, and, with the concurrence of the 
Secretary of Health and Human Services where this Act or the 
amendments made by this Act so provide, promulgate any interim rules 
necessary for the implementation of this Act or the amendments made 
by this Act, prior to its effective date.\2\
---------------------------------------------------------------------------

    \2\ Public Law 110-425, sec. 3(k)(1).

    This regulatory authority of the Attorney General has been 
delegated to the Administrator of DEA.\3\ It is evident from the 
foregoing provision of the Act that Congress contemplated it would be 
necessary for DEA to issue regulations on an interim basis in order to 
implement the Act within the relatively short time period between the 
passage of the Act (October 15, 2008) and its effective date (April 13, 
2009). Indeed, Congress envisioned that DEA would need to issue interim 
rules ``prior to its effective date'' (i.e., before April 13, 2009) to 
effectively implement the new requirements of the Act.\4\ Accordingly, 
the rules published here are effective immediately while at the same 
time the agency is seeking public comment on them. Following the 
comment period, DEA will review the comments and make any modifications 
to the interim rule that are appropriate. Also, as explained below, the 
Act contemplates that DEA will, with the concurrence of the Secretary 
of Health and Human Services, promulgate regulations governing the 
issuance to practitioners of a special registration relating to the 
practice of telemedicine. Those regulations will be issued separately 
at a later date.
---------------------------------------------------------------------------

    \3\ Functions vested in the Attorney General under the CSA have 
been delegated to the Administrator of DEA. 28 CFR 0.100. 
Accordingly, in this document, ``DEA Administrator'' will be used in 
place of all statutory references to the Attorney General.
    \4\ Congress's express grant of authority under the Ryan Haight 
Act to issue interim rules as the DEA Administrator finds necessary 
to implement the Act prior to its effective date forms the basis for 
the DEA Administrator's conclusion, as is set forth in Section X 
below, that ``good cause'' exists under the Administrative Procedure 
Act (APA) for the issuance of interim rules (those which take effect 
immediately on an interim basis prior to the public comment period) 
because ``notice and public procedure thereon are impracticable, * * 
*[and] contrary to the public interest.'' See 5 U.S.C. 553(b)(B).
---------------------------------------------------------------------------

III. Overview of the Legislation

A. Reasons for the Legislation

    The unlawful use of pharmaceutical controlled substances has 
reached alarming levels in the United States in recent years, causing a 
substantial detrimental effect on the public health and safety. 
According to the most recently published National Survey on Drug Use 
and Health (2007),\5\ 6.9 million Americans reported using 
psychotherapeutic drugs \6\ nonmedically during the prior month.\7\ 
With specific regard to pain relievers, 5.2 million respondents 
reported abusing these drugs,\8\ which is an 18 percent increase from 
2004.\9\ This study further indicates that, in the United States, the 
abuse of prescription drugs is second only to that of marijuana and is 
higher than the abuse of cocaine, heroin and hallucinogens 
combined.\10\ Among persons aged 12 and older who reported using 
illicit drugs for the first time in 2007, abuse of pain relievers was 
the most common category of first-time illicit drug use.\11\
---------------------------------------------------------------------------

    \5\ Available at http://www.oas.samhsa.gov/nsduh/2k7nsduh/2k7Results.pdf.
    \6\ The study states: ``Psychotherapeutics include the 
nonmedical use of any prescription-type pain relievers, 
tranquilizers, stimulants, or sedatives. Over-the-counter substances 
are not included.'' Id. at 55.
    \7\ Id. at 1.
    \8\ Id.
    \9\ Compare 2004 National Survey on Drug Use and Health at 1, 
available at http://www.oas.samhsa.gov/nsduh/2k4nsduh/2k4results.pdf.
    \10\ See id. at 73.
    \11\ Id. at 4.
---------------------------------------------------------------------------

    The false sense of security that some associate with the abuse of 
these substances is also alarming. Many mistakenly believe that if a 
drug may be prescribed for medical use, abusing that drug cannot be as 
harmful as abusing more conventional ``street'' drugs, such as heroin 
or cocaine. According to the 2005 Partnership Attitude Tracking Study 
\12\, 40 percent of teens surveyed believe that prescription medicines 
are ``much safer'' to use than illegal drugs. Furthermore, the same 
study concluded that 31 percent believe there is ``nothing wrong'' with 
using prescription medicines without a prescription ``once in awhile.'' 
\13\
---------------------------------------------------------------------------

    \12\ Partnership for a Drug-Free America; Partnership Attitude 
Tracking Study, Teens in grades 7 through 12, 2005; http://www.drugfree.org/Files/Full_Teen_Report (page 21).
    \13\ Id. at 20-21.
---------------------------------------------------------------------------

    One of the main factors contributing to the nationwide increase in 
the diversion of pharmaceutical controlled substances has been the rise 
in the number of Internet sites that sell or facilitate the sale of 
these drugs for other than legitimate medical purposes. While in-person 
``prescription mills'' (practitioners' offices that readily supply drug 
seekers with prescriptions for controlled substances without 
establishing a legitimate medical basis for doing so) have always been, 
and remain, a significant source of diversion, the advent of rogue Web 
sites that cater to those who abuse pharmaceutical controlled 
substances has allowed the criminal operators of these sites to exploit 
the anonymity of the Internet to generate illicit sales of controlled 
substances (and/or prescriptions therefor) that far exceed those of any 
in-person prescription mill. This is particularly evident when 
examining the data relating to the sales of hydrocodone, which is the 
most widely abused pharmaceutical controlled substance in the United 
States. According to data registered distributors of controlled 
substances provided to DEA \14\ in 2006, 34 pharmacies in the United 
States that were supplying rogue Internet sites dispensed a total of 
more than 98 million dosage units of hydrocodone. Hence, these 
pharmacies each dispensed an average of approximately 2.9 million 
dosage units of hydrocodone per pharmacy in a single year. By means of 
comparison, the average pharmacy in the United States dispenses 
approximately 88,000 dosage units of hydrocodone per year.
---------------------------------------------------------------------------

    \14\ Distributors are required to submit certain reports to 
DEA's ARCOS unit, as provided in 21 CFR 1304.33.
---------------------------------------------------------------------------

    Congress passed the Ryan Haight Act precisely because of ``the 
increasing use of prescription controlled substances by adolescents and 
others for nonmedical purposes, which has been exacerbated by drug 
trafficking on the Internet.'' \15\ The person for whom the Act was 
named, Ryan Haight, was ``a California high school honors student and 
athlete who died in 2001 from an overdose of controlled substances that 
he had purchased from a rogue online pharmacy.'' \16\ According to the 
Senate Report accompanying the legislation, ``Ease of access to the 
Internet, combined with lack of medical supervision, has led to tragic 
consequences in the online purchase of prescription controlled 
substances.'' \17\ The Senate Report then cited a list of examples of 
persons in the United States who had died from overdoses of controlled 
substances obtained via the Internet.\18\
---------------------------------------------------------------------------

    \15\ S. Rep. No. 110-521, at 1 (2008).
    \16\ Id. at 12.
    \17\ Id. at 5.
    \18\ Id. at 5-6.

---------------------------------------------------------------------------

[[Page 15598]]

B. Common Methods Employed by Operators of Rogue Web Sites That Sell 
Pharmaceutical Controlled Substances

    The rogue Web sites that the Ryan Haight Act seeks to eliminate 
take on a variety of appearances and use a variety of methods. One 
common factor is that all these Web sites are marketed toward drug 
seekers who are willing to pay a premium to obtain pharmaceutical 
controlled substances without having a legitimate medical need for 
them. While the ``business models'' that the operators of these sites 
employ to evade detection by law enforcement and/or to create the 
facade of compliance with the law have evolved significantly over time, 
there tend to be three categories of participants in these schemes: the 
prescribing practitioner; the pharmacy that fills the prescriptions; 
and the criminal facilitator (a non-DEA registrant) who runs the 
operation.\19\
---------------------------------------------------------------------------

    \19\ The ``business models'' described here are not the only 
ones employed by operators of rogue sites; methods other than those 
described above have been utilized by those who divert controlled 
substances by means of the Internet.
---------------------------------------------------------------------------

    While it has always been illegal to dispense a controlled substance 
without a legitimate medical purpose, prior to the Act, a rogue 
operator could design a site that would make it clear to drug seekers 
that pharmaceutical controlled substances could be obtained through the 
site without a legitimate medical purpose. For example, a typical rogue 
site would display prominently on its homepage a list of the 
pharmaceutical controlled substances that it sold and prompt customers 
to click on their desired drugs. These Web sites could easily be found 
by using any of various Internet search engines and entering search 
terms such as ``hydrocodone no prescription.'' Unsolicited e-mails or 
other forms of online advertising and marketing often steered potential 
customers to these Web sites; the advertisements announced that 
controlled substances could be readily obtained through the Web site 
without an in-person medical evaluation and sometimes without even a 
prescription--thus insuring a drug seeking customer could obtain the 
controlled substance without a legitimate medical need.
    Thus, prior to passage of the Act, attracting customers was 
relatively easy for these rogue Web sites. However, to deliver the 
goods that the customers were seeking (pharmaceutical controlled 
substances and/or prescriptions for such), the operator of the rogue 
Web site usually had to enlist the services of two types of DEA 
registrants: a practitioner and pharmacy. Thus, the typical criminal 
facilitator had to recruit an unscrupulous practitioner willing to 
prescribe controlled substances without a legitimate medical evaluation 
obtained through a bona fide doctor-patient relationship. While the 
overwhelming majority of practitioners would want no part of this type 
of improper arrangement, criminal facilitators were able to find some 
unscrupulous practitioners willing to participate. Investigations have 
revealed that these facilitators often target practitioners who carry 
significant debt, such as those recently graduated from medical school, 
or those who have retired and are looking for some ``extra income.'' 
Regardless of the motivations of the participating practitioners, the 
facilitator would persuade them to enter into an agreement whereby they 
would agree to write prescriptions for controlled substances without 
adhering to the standard professional practices employed by 
practitioners when evaluating the medical condition of patients and 
determining the appropriate treatment in return for payment from the 
facilitator based on the number of prescriptions they would write. 
These arrangements operated in several ways. In some instances, the 
facilitator would arrange for a practitioner to issue prescriptions for 
controlled substances based solely on reviewing online questionnaires 
the customers submitted to the Web site. Other schemes involved 
facilitators requiring the customers of the Web site to fax some 
documentation that purported to be the customers' ``medical records'' 
and then having an unscrupulous practitioner issue prescriptions for 
controlled substances based on a ``review'' of these faxed documents. A 
third type of scheme involved the facilitator having customers of the 
Web site call a telephone number staffed by employees of the site, 
answer a series of questions purporting to create a ``medical 
history,'' and then have unscrupulous practitioners write the 
prescriptions based on these answers. Whatever the methods employed, 
these rogue Web site operations were merely a sham, as every step in 
the process was designed to sell customers controlled substances and/or 
prescriptions for controlled substances without regard to actual 
medical need.
    Some criminal facilitators have been content to take in the profits 
associated with selling the prescriptions for controlled substances. 
(Some rogue Web sites charge customers a separate fee for arranging the 
issuance of prescriptions.) Others have sought to increase their 
profits by also having customers fill the prescriptions through a 
pharmacy affiliated with the Web site. To achieve the latter, the 
criminal facilitator needed to enter into an agreement with an 
unscrupulous pharmacy that was willing--for a fee--to fill 
prescriptions for controlled substances with essentially no questions 
asked and for as many prescriptions as the Web site could steer toward 
the pharmacy.\20\ In addition to paying the pharmacy for the cost of 
the drugs, the criminal facilitator would also typically pay the 
pharmacy an agreed upon amount that, in some instances, amounted to 
millions of dollars. Given the amount of money to be made from these 
arrangements, DEA has seen pharmacies close their doors completely to 
walk-in customers and convert their entire business to filling orders 
generated from rogue Web sites. In some instances, criminal 
facilitators have used multiple brick and mortar pharmacies to service 
their list of drug seeking customers. In other cases, a single pharmacy 
has supplied multiple rogue Web sites.
---------------------------------------------------------------------------

    \20\ The small percentage of pharmacies who have so participated 
in these rogue Web site schemes have, in many cases, filled 
extraordinary numbers of prescriptions for controlled substances 
that dwarf the sales figures of walk-in pharmacies.
---------------------------------------------------------------------------

    These rogue Web sites generally provide the customer with a wide 
variety of quick and easy payment methods, such as cash-on-delivery, 
lines of credit, and credit ``gift'' cards. They also typically 
structure the various steps of the ordering process so as to link and 
shift the buyer to different Web sites, making it difficult for 
investigators to connect payments, products, and Web providers 
together. Rarely do such rogue Web sites contain any identifying 
information about where the online pharmacy is located or who owns or 
operates the Web site. On the contrary, these Web sites frequently 
fluctuate in name and number minute by minute. Finally, the typical 
rogue Web site fails to provide any information on how a patient may 
contact the prescribing practitioner or the pharmacist to consult with 
them about the drug(s) ordered, including drug interactions and adverse 
reactions.
    Recognizing that these rogue Web sites fuel the abuse of 
prescription controlled substances and thereby increase the number of 
resulting overdoses and other harmful consequences, Congress passed the 
Ryan Haight Act to prevent the Internet from being exploited to 
facilitate such unlawful drug activity.

[[Page 15599]]

IV. Brief Summary of Some of the Key Provisions of the Legislation

    Before examining the legislation in detail, the following is a 
brief recitation of two of the most important new statutory 
requirements: the in-person medical evaluation requirement for 
prescribing practitioners and the modified registration requirement for 
online pharmacies.
    A. In-person medical evaluation requirement--One of the primary 
ways in which the Ryan Haight Act combats the use of the Internet to 
facilitate illegal sales of pharmaceutical controlled substances is by 
mandating, with limited exceptions, that the dispensing of controlled 
substances by means of the Internet be predicated on a valid 
prescription involving at least one in-person medical evaluation. While 
the lack of an in-person medical evaluation has always been viewed as a 
``red flag'' indicating that diversion might be occurring, the Ryan 
Haight Act makes it unambiguous that it is a per se violation of the 
CSA for a practitioner to issue a prescription for a controlled 
substance by means of the Internet without having conducted at least 
one in-person medical evaluation, except in certain specified 
circumstances. At the same time, it is crucial to bear in mind that, as 
Congress expressly stated under the Act, the mere fact that the 
prescribing practitioner conducted one in-person medical evaluation 
does not demonstrate that the prescription was issued for a legitimate 
medical purpose within the usual course of professional practice. Even 
where the prescribing practitioner has complied with the requirement of 
at least one in-person medical evaluation, a prescription for a 
controlled substance must still satisfy the additional, fundamental 
prerequisite that has been legally mandated for more than 90 years: it 
must be issued for a legitimate medical purpose by a practitioner 
acting in the usual course of professional practice.\21\
---------------------------------------------------------------------------

    \21\ 21 CFR 1306.04(a); United States v. Moore, 423 U.S. 122 
(1975). This requirement has been a part of federal law since the 
Harrison Narcotic Act of 1914. Id. at 131. For a detailed 
explanation of the ``legitimate medical purpose requirement,'' see 
71 FR 52716, 52717 (2006 DEA policy statement).
---------------------------------------------------------------------------

    B. Requirement of modified registration for online pharmacies--
Another of the core provisions of the Act is the requirement that any 
person who operates a Web site that fits within the definition of an 
``online pharmacy'' must obtain from DEA a modification of its DEA 
pharmacy registration that expressly authorizes such online activity. 
Only DEA-registered pharmacies are eligible under the Act to obtain 
such a modification of registration. One of the ramifications of this 
requirement is that those who are not DEA-registered pharmacies (for 
example, those nonregistrants who have heretofore facilitated unlawful 
Internet controlled substance sales by enlisting the services of 
unscrupulous pharmacies and/or prescribing practitioners) are 
prohibited from operating online pharmacies.
    The Act's definition of ``online pharmacy'' encompasses more than 
merely legitimate pharmacies that may obtain a modification of their 
DEA registrations allowing them to dispense controlled substances by 
means of the Internet. As explained below, the definition of ``online 
pharmacy'' includes, among others, those persons who operate the types 
of rogue Web sites that the Act was designed to eliminate. Consistent 
with the longstanding structure of the CSA (since it was enacted in 
1970), the Ryan Haight Act prohibits all controlled substance 
activities by ``online pharmacies'' except those expressly authorized 
by the Act. Again, only DEA-registered pharmacies may obtain a 
modification of their registration authorizing them to operate as 
online pharmacies. In addition, a pharmacy that has obtained such a 
modification of its registration may not operate as an online pharmacy 
unless it has notified DEA of its intent to do so and its Web site 
contains certain declarations designed to provide clear assurance that 
it is operating legitimately and in conformity with the Act. (These 
requirements are discussed at length below.)

V. Detailed Explanation of the Legislation

    Consistent with the structure of the CSA, the Ryan Haight Act sets 
out numerous regulatory requirements and other substantive provisions 
and makes it unlawful to ``knowingly or intentionally * * * deliver, 
distribute, or dispense a controlled substance by means of the 
Internet, except as authorized by [the Act].'' \22\ Thus, this 
explanation of the Act will be divided into two main parts: (1) 
Explaining the Act's regulatory requirements and other substantive 
provisions and (2) explaining what it means to ``knowingly or 
intentionally * * * deliver, distribute, or dispense a controlled 
substance by means of the Internet.''
---------------------------------------------------------------------------

    \22\ 21 U.S.C. 841(h)(1)(A).
---------------------------------------------------------------------------

A. New definitions under the Act

    The Act adds several new definitions to the CSA. These new 
statutory definitions are being added to the DEA regulations as part of 
this Interim Rule. While many of the new definitions are self-
explanatory, some are discussed in this preamble to assist in 
understanding the Act.
    The following are two of the key definitions in the Act, which are 
set forth in 21 U.S.C. 802:

    (51) The term ``deliver, distribute, or dispense by means of the 
Internet'' refers, respectively, to any delivery, distribution, or 
dispensing of a controlled substance that is caused or facilitated 
by means of the Internet.

This definition is plainly broad in scope, encompassing any activity 
utilizing the Internet that causes or facilitates the delivery, 
distribution, or dispensing of a controlled substance. This definition 
is incorporated into the Act's definition of an ``online pharmacy'':

    (52) The term ``online pharmacy'' * * * means [with certain 
exceptions discussed below] a person, entity, or Internet site, 
whether in the United States or abroad, that knowingly or 
intentionally delivers, distributes, or dispenses, or offers or 
attempts to deliver, distribute, or dispense, a controlled substance 
by means of the Internet.

The definition of ``online pharmacy'' is also broad in scope. First, it 
includes not only a ``person'' \23\ but also any other ``entity'' or 
``Internet site''--``whether in the United States or abroad''--that 
otherwise meets the definition of an ``online pharmacy.'' Second, it 
also includes not only any such person, entity or Internet site ``that 
knowingly or intentionally delivers, distributes, or dispenses * * * a 
controlled substance by means of the Internet,'' but also any such one 
who ``offers or attempts'' to do so.
---------------------------------------------------------------------------

    \23\ As set forth in 1 U.S.C. 7, the word ``person'' includes 
``corporations, companies, associations, firms, partnerships, 
societies, and joint stock companies, as well as individuals.'' 
Consistent therewith, the DEA regulations define ``person'' to 
include ``any individual, corporation, government or governmental 
subdivision or agency, business trust, partnership, association, or 
other legal entity.'' 21 CFR 1300.01(b)(34).
---------------------------------------------------------------------------

    Hence, the term ``online pharmacy'' includes, among other things: 
(i) Any Web site that sells, or offers to sell, any controlled 
substance or a prescription therefor to a person in the United States; 
(ii) any person who operates such a Web site; \24\ (iii) any person who 
pays a practitioner to write prescriptions for controlled substances 
for customers of such a Web site; (iv) any person who pays a pharmacy 
to fill prescriptions for controlled substances that were issued

[[Page 15600]]

to customers of such a Web site; (v) any pharmacy that knowingly or 
intentionally fills prescriptions for controlled substances that were 
issued to customers of such a Web site; and (vi) any person who sends 
an e-mail that: Offers to sell a controlled substance or a prescription 
for a controlled substance in a manner not authorized by the Act; 
directs buyers to a Web site operating in violation of the Act; or 
otherwise causes or facilitates the delivery, distribution, or 
dispensing of a controlled substance in a manner not authorized by the 
Act.
---------------------------------------------------------------------------

    \24\ The Act exempts certain categories of persons from the 
application of 21 U.S.C. 841(h)(1), such as Internet service 
providers and Web hosting services, so long as such persons do not 
act in concert with others who violate the Act.
---------------------------------------------------------------------------

    While the general scope of the definition of an ``online pharmacy'' 
is broad, the definition expressly excludes the following categories:

    (i) Manufacturers or distributors registered under subsection 
(a), (b), (d), or (e) of [21 U.S.C. 823] who do not dispense 
controlled substances to an unregistered individual or entity;
    (ii) Nonpharmacy practitioners who are registered under [21 
U.S.C. 823(f)] and whose activities are authorized by that 
registration;
    (iii) Any hospital or other medical facility that is operated by 
an agency of the United States (including the Armed Forces), 
provided such hospital or other facility is registered under [21 
U.S.C. 823(f)];
    (iv) A health care facility owned or operated by an Indian tribe 
or tribal organization, only to the extent such facility is carrying 
out a contract or compact under the Indian Self-Determination and 
Education Assistance Act;
    (v) Any agent or employee of any hospital or facility referred 
to in clause (iii) or (iv), provided such agent or employee is 
lawfully acting in the usual course of business or employment, and 
within the scope of the official duties of such agent or employee, 
with such hospital or facility, and, with respect to agents or 
employees of health care facilities specified in clause (iv), only 
to the extent such individuals are furnishing services pursuant to 
the contracts or compacts described in such clause;
    (vi) Mere advertisements that do not attempt to facilitate an 
actual transaction involving a controlled substance;
    (vii) A person, entity, or Internet site that is not in the 
United States and does not facilitate the delivery, distribution, or 
dispensing of a controlled substance by means of the Internet to any 
person in the United States;
    (viii) A pharmacy registered under [21 U.S.C. 823(f)] whose 
dispensing of controlled substances via the Internet consists solely 
of--
    (I) Refilling prescriptions for controlled substances in 
schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(55)]; 
or
    (II) Filling new prescriptions for controlled substances in 
schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(56)]; 
or
    (ix) Any other persons for whom the [DEA Administrator] and the 
Secretary [of Health and Human Services] have jointly, by 
regulation, found it to be consistent with effective controls 
against diversion and otherwise consistent with the public health 
and safety to exempt from the definition of an ``online pharmacy''.

21 U.S.C. 802(52)(B).
    To elaborate briefly on these exceptions, under exception (i), a 
DEA-registered manufacturer or distributor \25\ that uses the Internet 
to facilitate activities permitted by its DEA registration does not 
constitute an online pharmacy. Under exception (ii), a DEA-registered 
nonpharmacy practitioner (e.g., physician, dentist, veterinarian, 
scientific investigator, hospital, or other person authorized by his 
registration to dispense controlled substances) may do so by means of 
the Internet without being an online pharmacy. Under exceptions (iii) 
through (v), certain hospitals and other health care facilities 
associated with the United States government, as well as agents and 
employees acting in the course of their duties for such institutions, 
are not online pharmacies. Under exception (vi), an advertisement is 
not an online pharmacy, provided the advertisement does not ``attempt 
to facilitate an actual transaction involving a controlled substance.''
---------------------------------------------------------------------------

    \25\ Under the CSA, a DEA-registered ``distributor'' delivers 
controlled substances to other DEA registrants; it may not 
administer, dispense, or otherwise deliver controlled substances to 
patients. See 21 U.S.C. 802(11), 822(a), 822(b), 828(a).
---------------------------------------------------------------------------

    Under exception (vii), a person, entity, or Internet site located 
outside the United States is only excepted from the definition of an 
online pharmacy if it ``does not facilitate the delivery, distribution, 
or dispensing of a controlled substance by means of the Internet to any 
person in the United States.'' (Emphasis added.) Thus, Web sites 
operated by persons located abroad, along with persons who operate the 
sites, do fall within the definition of an online pharmacy if they sell 
or offer to sell controlled substances to persons in the United States 
or otherwise ``facilitate the delivery, distribution, or dispensing of 
a controlled substance by means of the Internet to any person in the 
United States.''
    Under exception (viii), a DEA-registered pharmacy is excepted from 
the definition of an online pharmacy if it dispenses controlled 
substances via the Internet solely by ``refilling prescriptions for 
controlled substances in schedule III, IV, or V'' and ``filling new 
prescriptions for controlled substances in schedule III, IV, or V'' (as 
those terms are defined in the Act). Finally, under exception (ix), the 
DEA Administrator and the Secretary of Health and Human Services have 
the authority to jointly decide to issue regulations making further 
exceptions to the definition of an online pharmacy, where they 
determine that doing so is ``consistent with effective controls against 
diversion and otherwise consistent with the public health and safety.'' 
Pursuant to this clause, the regulations being issued here contain two 
exceptions to the definition of an online pharmacy: One relating to 
electronic prescribing of controlled substances and the other to the 
use of automated dispensing systems. These exceptions are explained 
below.

B. In-Person Medical Evaluation Requirement

    To directly prohibit what had been the practice of many rogue Web 
sites--allowing customers to buy controlled substances and/or 
prescriptions for controlled substances via the Internet without ever 
seeing the prescribing practitioner in person--the Ryan Haight Act 
includes as one of its central features the ``valid prescription'' 
requirement. This requirement is set forth in 21 U.S.C. 829(e)(1): ``No 
controlled substance that is a prescription drug as determined under 
the Federal Food, Drug, and Cosmetic Act \26\ may be delivered, 
distributed, or dispensed by means of the Internet without a valid 
prescription.''
---------------------------------------------------------------------------

    \26\ Nearly every pharmaceutical controlled substance is a 
prescription drug under the Federal Food, Drug, and Cosmetic Act 
(FDCA). In the very rare instance where a drug contains a controlled 
substance but may be dispensed under the FDCA without a 
prescription, the DEA regulations specify the procedures a 
pharmacist must follow to dispense such a drug lawfully to a 
purchaser. 21 CFR 1306.26.
---------------------------------------------------------------------------

    The Act further defines the meaning of ``valid prescription'' in 21 
U.S.C. 829(e)(2)(A): ``The term `valid prescription' means a 
prescription that is issued for a legitimate medical purpose in the 
usual course of professional practice by--(i) a practitioner who has 
conducted at least 1 in-person medical evaluation of the patient; or 
(ii) a covering practitioner.'' The Act explains the meaning of ``in-
person medical evaluation'' in 21 U.S.C. 829(e)(2)(B):

    (i) The term ``in-person medical evaluation'' means a medical 
evaluation that is conducted with the patient in the physical 
presence of the practitioner, without regard to whether portions of 
the evaluation are conducted by other health professionals.
    (ii) Nothing in clause (i) shall be construed to imply that 1 
in-person medical evaluation demonstrates that a prescription has 
been issued for a legitimate medical purpose within the usual course 
of professional practice.

    Thus, for every controlled substance that is delivered, 
distributed, or dispensed by means of the Internet,

[[Page 15601]]

there must be a ``valid prescription,'' which means not only that the 
prescription must comply with the longstanding requirement of being 
issued for a legitimate medical purpose by a practitioner acting in the 
usual course of professional practice, but also that the prescribing 
practitioner must either (i) have conducted at least one in-person 
medical evaluation of the patient or (ii) meet the definition of a 
``covering practitioner'' (explained below). Any practitioner who 
writes a prescription for a controlled substance that fails to comply 
with this provision of the Act, as well as any pharmacy that knowingly 
or intentionally fills such a prescription, violates 21 U.S.C. 
841(h)(1).
    Hence, the Act makes it unambiguous that, except in limited and 
specified circumstances, it is a per se violation of the CSA for a 
practitioner to issue a prescription for a controlled substance by 
means of the Internet without having conducted at least one in-person 
medical evaluation. However, the Act also expressly provides that a 
prescribing practitioner does not automatically meet the requirement of 
issuing a prescription for a legitimate medical purpose while acting in 
the usual course of professional practice merely by having conducted a 
single in-person medical evaluation of the patient. Rather, as with all 
situations in which a prescription for a controlled substance is 
issued, all the facts and circumstances surrounding the issuance of the 
prescription must be evaluated in determining whether it was issued for 
a legitimate medical purpose by a practitioner acting in the usual 
course of professional practice.\27\ A rogue Internet operation cannot, 
for example, defeat the purpose of the Act by establishing a method of 
operation in which a practitioner conducts a perfunctory in-person 
``evaluation'' of each ``patient'' simply for the purpose of selling 
prescriptions for controlled substances to the patient in perpetuity 
with no follow-up visits. This topic is addressed further below in 
Section VII, which provides additional information for practitioners.
---------------------------------------------------------------------------

    \27\ For a detailed explanation of the ``legitimate medical 
purpose requirement,'' see 71 FR 52716, 52717 (2006 DEA policy 
statement). See also, 21 CFR 1306.04(a); United States v. Moore, 423 
U.S. 122 (1975).
---------------------------------------------------------------------------

    With respect to the term ``covering practitioner,'' the Act states 
(21 U.S.C. 829(e)(2)(C)):

    The term ``covering practitioner'' means, with respect to a 
patient, a practitioner who conducts a medical evaluation (other 
than an in-person medical evaluation) at the request of a 
practitioner who--(i) has conducted at least 1 in-person medical 
evaluation of the patient or an evaluation of the patient through 
the practice of telemedicine, within the previous 24 months; and 
(ii) is temporarily unavailable to conduct the evaluation of the 
patient.

Thus, a prescribing practitioner who falls within the above definition 
of a ``covering practitioner'' need not conduct an in-person medical 
evaluation as a prerequisite to prescribing a controlled substance to a 
given patient, provided that the practitioner for whom the covering 
practitioner is covering has conducted an in-person medical evaluation 
of that patient and provided further that this covering arrangement is 
taking place on only a temporary basis. Moreover, just as with the 
primary practitioner, the requirement that the prescription must be 
issued in the usual course of professional practice for a legitimate 
medical purpose applies with equal force to a ``covering 
practitioner.''
    The Act also provides for an exception to the requirement of an in-
person medical evaluation for practitioners who are engaged in the 
``practice of telemedicine'' within the meaning of the Act. 21 U.S.C. 
829(e)(3)(A). Of course, a practitioner engaged in the ``practice of 
telemedicine'' remains subject to the requirement that every 
prescription for a controlled substance be issued for a legitimate 
medical purpose by a practitioner acting in the usual course of 
professional practice. The Act provides a temporary definition of the 
``practice of telemedicine'' pending issuance of new regulations 
addressing ``telemedicine.'' The topic of ``telemedicine'' is further 
addressed in paragraph D below.

C. Requirements for Online Pharmacies

    Modified Registration Requirement--The Act imposes various 
requirements for those persons and other entities that fit within the 
Act's definition of an online pharmacy. To begin with, an online 
pharmacy may only operate lawfully as an online pharmacy if it is a 
DEA-registered pharmacy that has obtained from DEA a modification of 
its registration authorizing it to engage in such activity. 21 U.S.C. 
823(f), 841(h)(1). An online pharmacy that is not validly registered 
with a modification authorizing it to operate as an online pharmacy as 
required by 21 U.S.C. 823(f) will violate 21 U.S.C. 841(h)(1) if it 
knowingly or intentionally delivers, distributes, or dispenses a 
controlled substance by means of the Internet. Moreover, under the Act, 
the only type of online pharmacy that is eligible to apply to DEA for 
such modification of registration is a DEA-registered pharmacy. 21 
U.S.C. 823(f). Thus, any person, entity, or Internet site that falls 
within the definition of an online pharmacy--and is not a DEA-
registered pharmacy that has obtained a modification of its 
registration authorizing it to operate as an online pharmacy--is 
necessarily violating the Act if it knowingly or intentionally 
delivers, distributes, or dispenses a controlled substance by means of 
the Internet.
    The regulations being issued here set forth the process by which a 
DEA-registered pharmacy may apply online for a modification of its 
registration authorizing it to operate as an online pharmacy. Under the 
Act, DEA must base its decision on whether to grant or deny such an 
application for a modification of registration on the same statutory 
criteria that it must consider in evaluating an application for 
registration submitted by a pharmacy or other practitioner. 21 U.S.C. 
823(f).
    Reporting Requirement--A pharmacy that has obtained a modification 
of its registration authorizing it to dispense controlled substances by 
means of the Internet must report to DEA, on a monthly basis, the total 
amount of each controlled substance it dispenses. 21 U.S.C. 827(d)(2). 
For pharmacies that are subject to this requirement, the monthly report 
must include all controlled substances dispensed by any means--not just 
controlled substances dispensed by means of the Internet. Id. However, 
if a pharmacy with such a modified registration dispenses an amount 
that falls below the threshold in a given month, it is not required to 
submit a report for that month. Id. The monthly threshold is either (A) 
100 or more prescriptions for controlled substances filled by the 
pharmacy or (B) 5,000 or more total dosage units of controlled 
substances dispensed. Id. Again, these threshold amounts include all 
controlled substances dispensed by the pharmacy by any means (through 
walk-in business, by mail, by means of the Internet, or otherwise). Id. 
If the pharmacy meets or exceeds either of the foregoing amounts in a 
given month, it must report to DEA the total amount of controlled 
substances it dispensed by any means during that month. Id. The 
regulations being issued here specify the time and manner in which such 
reports must be filed.
    Statements that must appear on an online pharmacy's Web site--Every 
online pharmacy is required under the Act to ``display in a visible and 
clear manner on its homepage a statement that it complies with the 
requirements of [21 U.S.C. 831] with respect to the delivery or sale or 
offer for sale of

[[Page 15602]]

controlled substances and shall at all times display on the homepage of 
its Internet site a declaration of compliance in accordance with this 
section.'' 21 U.S.C. 831(a).
    In addition, the Act requires every online pharmacy to satisfy the 
following requirement relating to what the Act refers to as the 
``Internet Pharmacy Site Disclosure Information.'' As set forth in 21 
U.S.C. 831(c), each online pharmacy shall post in a visible and clear 
manner on the homepage of each Internet site it operates, or on a page 
directly linked thereto in which the hyperlink is also visible and 
clear on the homepage, the following information for each pharmacy that 
delivers, distributes, or dispenses controlled substances pursuant to 
orders made on, through, or on behalf of, that Web site:
     The name and address of the pharmacy as it appears on the 
pharmacy's Drug Enforcement Administration Certificate of Registration.
     The pharmacy's telephone number and e-mail address.
     The name, professional degree, and States of licensure of 
the pharmacist-in-charge, and a telephone number at which the 
pharmacist-in-charge can be contacted.
     A list of the States in which the pharmacy is licensed to 
dispense controlled substances.
     A certification that the pharmacy is registered under this 
part to deliver, distribute, or dispense by means of the Internet 
controlled substances.
     The name, address, telephone number, professional degree, 
and States of licensure of any practitioner who has a contractual 
relationship to provide medical evaluations or issue prescriptions for 
controlled substances, through referrals from the Web site or at the 
request of the owner or operator of the Web site, or any employee or 
agent thereof.
     The following statement, unless revised by the [DEA 
Administrator] by regulation: ``This online pharmacy will only dispense 
a controlled substance to a person who has a valid prescription issued 
for a legitimate medical purpose based upon a medical relationship with 
a prescribing practitioner. This includes at least one prior in-person 
medical evaluation or medical evaluation via telemedicine in accordance 
with applicable requirements of section 309.''
    While the foregoing requirements are largely self-explanatory, some 
aspects warrant special emphasis. The requirement that an online 
pharmacy post the foregoing information ``in a visible and clear manner 
on the homepage of each Internet site it operates, or on a page 
directly linked thereto in which the hyperlink is also visible and 
clear on the homepage'' is intended to ensure that members of the 
public who visit such Web sites are informed about the Ryan Haight 
Act's core requirements and to ensure that the DEA-registered 
pharmacies and prescribing practitioners affiliated with the site, if 
any, are clearly identified. Any effort by an online pharmacy to hide 
or reduce the visibility on the Web site of this required information 
will subject those responsible to potential criminal and civil 
liability and, in the case of DEA registrants, potential loss of 
registration. The required information must be displayed ``for each 
pharmacy that delivers, distributes, or dispenses controlled substances 
pursuant to orders made on, through, or on behalf of, that Web site.'' 
Thus, if multiple pharmacies dispense controlled substances pursuant to 
orders made on, through, or on behalf of, that Web site, each required 
category of information must be displayed for each such pharmacy.
    The requirement (under paragraph (4)) that an online pharmacy list 
the States in which it is licensed to dispense controlled substances is 
designed to ensure that an online pharmacy only dispenses controlled 
substances to patients in States in which it is authorized to practice 
pharmacy. Dispensing beyond the scope of State licensure is one of the 
recurring transgressions of some rogue online pharmacies and generally 
violates State law.\28\
---------------------------------------------------------------------------

    \28\ A State may bring a civil action in federal court to enjoin 
any violation of the Ryan Haight Act--not merely those violations of 
State law--and to obtain other appropriate legal or equitable 
relief. 21 U.S.C. 882(c).
---------------------------------------------------------------------------

    State licensure requirement--The Act also requires that online 
pharmacies comply with State licensure requirements. Specifically, the 
Act requires that:

    Each online pharmacy shall comply with the requirements of State 
law concerning the licensure of pharmacies in each State from which 
it, and in each State to which it, delivers, distributes, or 
dispenses or offers to deliver, distribute, or dispense controlled 
substances by means of the Internet, pursuant to applicable 
licensure requirements, as determined by each such State.

21 U.S.C. 831(b).
    Required notification to DEA--The Act contains a provision that is 
designed to ensure that DEA, and the applicable State boards of 
pharmacy, are aware of the existence of an online pharmacy before it 
commences operation. The Act's notification requirements are set forth 
in 21 U.S.C. 831(d)(1):

    Thirty days prior to offering a controlled substance for sale, 
delivery, distribution, or dispensing, the online pharmacy shall 
notify the [DEA Administrator], in such form and manner as the 
[Administrator] shall determine, and the State boards of pharmacy in 
any States in which the online pharmacy offers to sell, deliver, 
distribute, or dispense controlled substances.

Pursuant to this provision, the regulations being issued here provide 
that such notification to DEA shall be made by the pharmacy as part of 
the process by which it applies to DEA for a modification of its 
registration authorizing it to operate as an online pharmacy. The Act 
specifies that the foregoing notification must include the following 
information:

    (A) The information required to be posted on the online 
pharmacy's Internet site under [21 U.S.C. 831(c)] and shall notify 
the [DEA Administrator] and the applicable State boards of pharmacy, 
under penalty of perjury, that the information disclosed on its 
Internet site under [21 U.S.C. 831(c)] is true and accurate;
    (B) The online pharmacy's Internet site address and a 
certification that the online pharmacy shall notify the 
[Administrator] of any change in the address at least 30 days in 
advance; and
    (C) the Drug Enforcement Administration registration numbers of 
any pharmacies and practitioners referred to in [21 U.S.C. 831(c)], 
as applicable.

21 U.S.C. 831(d)(2).
    Thus, the information that an online pharmacy is required to post 
on its Web site must also be provided to DEA as part of the application 
for a modification of its DEA registration in order to satisfy part of 
the notification requirement.
    Declaration of compliance--Beginning on the date on which the 
online pharmacy makes the notification to DEA required by 21 U.S.C. 
831(d), and continuing thereafter, it must ``display on the homepage of 
its Internet site, in such form as the [DEA Administrator] shall by 
regulation require, a declaration that it has made such notification to 
the [Administrator].'' 21 U.S.C. 831(e). The regulations being issued 
here specify precisely the form in which this declaration must be made.
    Additional considerations regarding statements, declarations, 
notifications, and disclosures required under the Act--As stated in 21 
U.S.C. 831(f): ``Any statement, declaration, notification, or 
disclosure required under [21 U.S.C. 831] shall be considered a report 
required to be kept under [the CSA].'' One important effect of this 
provision is that, in conjunction with 21 U.S.C. 843(a)(4), it is a 
felony violation of the CSA to furnish false or fraudulent

[[Page 15603]]

material information in, or omit any material information from, any 
statement, declaration, notification, or disclosure required under 21 
U.S.C. 831.\29\
---------------------------------------------------------------------------

    \29\ In addition, the Act lists the following as an example of a 
violation of 21 U.S.C. 841(h)(1): ``making a material false, 
fictitious, or fraudulent statement or representation in a 
notification or declaration under [21 U.S.C. 831(d) or (e)].'' 21 
U.S.C. 841(h)(2)(E). Such conduct might also subject the offender to 
liability under 18 U.S.C. 1001(a).
---------------------------------------------------------------------------

D. Telemedicine

    As indicated above, ``a practitioner engaged in the practice of 
telemedicine'' within the meaning of the Act is exempt from the 
requirement of an in-person medical evaluation as a prerequisite to 
prescribing or otherwise dispensing controlled substances by means of 
the Internet. Before explaining the meaning of the ``practice of 
telemedicine,'' it bears repeated emphasis that all practitioners who 
prescribe controlled substances--even those engaged in the practice of 
telemedicine--remain subject to the requirement that the prescription 
be issued for a legitimate medical purpose by a practitioner acting in 
the usual course of professional practice. Prescribing a controlled 
substance without conducting an in-person medical evaluation has always 
been, and remains under the Act, a strong indication (or ``red flag'') 
of likely diversion.\30\ The Act simply made the failure to perform an 
in-person medical evaluation in certain circumstances \31\ an automatic 
violation of the CSA, while leaving it as a factor indicative of 
possible diversion in all other circumstances.
---------------------------------------------------------------------------

    \30\ See, e.g., United States v. Rosen, 582 F.2d 1032, 1036 (5th 
Cir. 1978).
    \31\ These circumstances are specified in 21 U.S.C. 829(e) and 
discussed above.
---------------------------------------------------------------------------

    The definition of the ``practice of telemedicine'' includes seven 
distinct categories that involve circumstances in which the prescribing 
practitioner might be unable to satisfy the Act's in-person medical 
evaluation requirement, yet nonetheless has sufficient medical 
information to prescribe a controlled substance for a legitimate 
medical purpose in the usual course of professional practice. In these 
circumstances, provided certain safeguards are in place to ensure that 
the practitioner who is engaged in the practice of telemedicine is able 
to conduct a bona fide medical evaluation of the patient at the remote 
location, and is otherwise acting in the usual course of professional 
practice, the Act contemplates that the practitioner will be permitted 
to prescribe controlled substances by means of the Internet despite not 
having conducted an in-person medical evaluation. The Act defines these 
categories, through the definition of ``practice of telemedicine,'' 
which is set forth in 21 U.S.C. 802(54).
    The Act specifies that the definition of the ``practice of 
telemedicine'' found in 21 U.S.C. 802(54) does not take effect at the 
same time the rest of the Act takes effect (April 13, 2009). Rather, 
the Act provides for a temporary definition of the ``practice of 
telemedicine'' that will apply beginning April 13, 2009, and continuing 
until the earlier of two dates: (i) three months after the date on 
which regulations are promulgated to carry out 21 U.S.C. 831(h) 
[relating to the issuance of a special registration to practice 
telemedicine] or (ii) January 15, 2010.\32\ Until the first of the 
foregoing two dates is reached, the Act states that the following 
definition applies:
---------------------------------------------------------------------------

    \32\ Public Law 110-425, section 3(j).

    [T]he term ``practice of telemedicine'' means the practice of 
medicine in accordance with applicable Federal and State laws by a 
practitioner (as that term is defined in section 102 of the 
Controlled Substances Act (21 U.S.C. 802)) (other than a pharmacist) 
who is at a location remote from the patient and is communicating 
with the patient, or health care professional who is treating the 
patient, using a telecommunications system referred to in section 
1834(m) of the Social Security Act (42 U.S.C. 1395m(m)), if the 
practitioner is using an interactive telecommunications system that 
satisfies the requirements of section 410.78(a)(3) of title 42, Code 
---------------------------------------------------------------------------
of Federal Regulations.

The rule being issued today contains both definitions of the practice 
of telemedicine (temporary and permanent), with the respective 
effective dates indicated.
    Special registration for telemedicine--A practitioner who is 
engaged in the practice of telemedicine within the meaning of the Act 
is not subject to the mandatory in-person medical evaluation 
requirement of 21 U.S.C. 829(e) (although such practitioner remains 
subject to the requirement that all prescriptions for controlled 
substances be issued for a legitimate medical purpose). The Act's 
permanent definition of the ``practice of telemedicine'' includes, as 
an example, ``a practitioner who has obtained from the [DEA 
Administrator] a special registration under [21 U.S.C. 831(h)].'' 21 
U.S.C. 802(54)(E). The Act specifies certain criteria that DEA must 
consider when evaluating an application for such a registration. 
However, the Act contemplates that DEA must issue certain regulations 
to effectuate this special registration provision. Specifically, the 
Act states: ``The [DEA Administrator] shall, with the concurrence of 
the Secretary [of Health and Human Services], promulgate regulations 
specifying the limited circumstances in which a special registration 
under [21 U.S.C. 831(h)] may be issued and the procedures for obtaining 
such a special registration.'' DEA will issue a separate rule 
promulgating regulations consistent with this directive. As explained 
above, until such regulations are promulgated, or until January 15, 
2010 (whichever comes first), the temporary definition of the practice 
of telemedicine recited above remains in effect.

E. Exemptions for Electronic Prescribing of Controlled Substances and 
Automated Dispensing Systems

    Electronic prescribing of controlled substances--On June 27, 2008, 
DEA published in the Federal Register a Notice of Proposed Rulemaking 
that would amend the DEA regulations to allow practitioners to 
electronically prescribe controlled substances (73 FR 36722). DEA is 
currently developing a final rule on electronic prescribing of 
controlled substances that takes into account the numerous public 
comments that were submitted in response to the proposed rule. Once the 
rule is finalized and published in the Federal Register, practitioners 
will be permitted to electronically prescribe controlled substances in 
accordance with the requirements in the regulations. In most cases, 
electronic prescribing of controlled substances will occur by means of 
the Internet. Given the Act's definitions, a pharmacy that knowingly or 
intentionally fills an electronic prescription for a controlled 
substance would (in the likely event that such an electronic 
prescription were transmitted via the Internet) fall within the Act's 
definition of an online pharmacy.
    As indicated above, the Act gives the DEA Administrator, acting 
jointly with the Secretary of Health and Human Services, authority to 
exempt by regulation certain persons from the definition of an ``online 
pharmacy,'' where the Administrator and the Secretary have found that 
doing so is ``consistent with effective controls against diversion and 
otherwise consistent with the public health and safety.'' 21 U.S.C. 
802(52)(B)(ix). Pursuant to this authority, the regulations being 
issued here today contain a provision that exempts from the definition 
of an online pharmacy any DEA-registered pharmacy ``whose delivery, 
distribution, or dispensing of controlled substances by means of the 
Internet consists solely of * * * filling prescriptions that were 
electronically prescribed in a manner authorized by

[[Page 15604]]

this chapter and otherwise in compliance with the Act.'' 21 CFR 
1300.04(h)(9). To eliminate any possible confusion as to how this 
exception applies, this provision of the regulations further states: 
``A registered pharmacy will be deemed to meet this exception if, in 
view of all of its activities other than [the acceptance of electronic 
prescriptions for controlled substances transmitted in accordance with 
the requirements of this chapter], it would fall outside the definition 
of an online pharmacy.'' A DEA-registered pharmacy that is so exempted 
from the definition of an online pharmacy is not required to obtain a 
modified registration and is not subject to the reporting requirement 
of 21 U.S.C. 827(d)(2) or the additional requirements relating to 
online pharmacies set forth in 21 U.S.C. 831.
    It should be understood that the exception provided in 21 CFR 
1300.04(h)(9) cannot take effect until DEA issues regulations allowing 
for the electronic prescribing of controlled substances. Until then, 
electronic prescribing of controlled substances is not permitted by the 
DEA regulations and thus cannot form the basis for any exception to the 
requirement of a modified registration for DEA-registered pharmacies.
    It should also be clear from the language of 21 CFR 1300.04(h)(9) 
that this exception provides no loophole for operators of rogue 
Internet Web sites or unscrupulous pharmacies that fill prescriptions 
generated through such sites. The mere fact that a pharmacy accepts 
electronic prescriptions does not, in any way, immunize the pharmacy 
from the requirements of the Act. Likewise, a rogue Web site that 
operates in violation of the Act cannot escape liability simply by 
having either (i) unscrupulous practitioners who have a contract to 
write prescriptions on behalf of the site issue such prescriptions 
electronically or (ii) unscrupulous pharmacies that have a contract to 
fill such prescriptions do so through the acceptance of electronic 
prescriptions. To the contrary, the regulation is written so that the 
exception cannot possibly be utilized by a rogue Web site; only a DEA-
registered pharmacy is eligible for the exception and only to the 
extent it is otherwise acting in conformity with the CSA and the DEA 
regulations.
    Exemption for automated dispensing systems--Under current DEA 
regulations, a DEA-registered retail pharmacy may install and operate 
an automated dispensing system at a long term care facility under 
certain specified conditions. 21 CFR 1301.27. Among other requirements, 
any retail pharmacy that installs and operates an automated dispensing 
system at a long term care facility must maintain a separate 
registration at each long term care facility in which its automated 
dispensing systems are located. Id. Prescription information may be 
transmitted by the retail pharmacy to the automated dispensing system 
via the Internet. Therefore, a pharmacy that operates an automated 
dispensing system at a long term care facility could potentially fall 
within the Act's definition of an online pharmacy. Pursuant to 21 
U.S.C. 802(52)(B)(ix), the DEA Administrator and the Secretary have 
jointly concluded that it would be consistent with effective controls 
against diversion and otherwise consistent with the public health and 
safety to issue the following exemption. As set forth in 21 CFR 
1300.04(h)(10), if a DEA-registered retail pharmacy does not deliver, 
distribute, or dispense, or offer to deliver, distribute, or dispense, 
controlled substances by means of the Internet, other than to 
communicate prescription information to an automated dispensing system 
for which it holds a separate registration at a long term care 
facility, that retail pharmacy is exempted from the definition of an 
online pharmacy. As a result, such a pharmacy is not required to obtain 
a modified registration and is not subject to the reporting requirement 
of 21 U.S.C. 827(d)(2) or the additional requirements relating to 
online pharmacies set forth in 21 U.S.C. 831.

VI. Criminal Provisions of the Ryan Haight Act

    The Ryan Haight Act adds two new criminal offenses to the CSA. The 
first new offense is set forth in 21 U.S.C. 841(h)(1), which states:

    It shall be unlawful for any person to knowingly or 
intentionally-
    (A) Deliver, distribute, or dispense a controlled substance by 
means of the Internet, except as authorized by [the CSA]; or
    (B) Aid or abet (as such terms are used in section 2 of title 
18, United States Code) any activity described in subparagraph (A) 
that is not authorized by [the CSA].

The Act contains specific examples of conduct which would violate 21 
U.S.C. 841(h)(1). These examples in the Act, however, are not an 
exclusive list of the types of conduct that constitute violations of 21 
U.S.C. 841(h)(1). With this proviso made clear, 21 U.S.C. 841(h)(2) 
lists the following as examples of violations:

    (A) Delivering, distributing, or dispensing a controlled 
substance by means of the Internet by an online pharmacy that is not 
validly registered with a modification authorizing such activity as 
required by [21 U.S.C. 823(f)] (unless exempt from such 
registration);
    (B) Writing a prescription for a controlled substance for the 
purpose of delivery, distribution, or dispensation by means of the 
Internet in violation of [21 U.S.C. 829(e)];
    (C) Serving as an agent, intermediary, or other entity that 
causes the Internet to be used to bring together a buyer and seller 
to engage in the dispensing of a controlled substance in a manner 
not authorized by [21 U.S.C. 823(f) or 829(e)];
    (D) Offering to fill a prescription for a controlled substance 
based solely on a consumer's completion of an online medical 
questionnaire; and
    (E) Making a material false, fictitious, or fraudulent statement 
or representation in a notification or declaration under [21 U.S.C. 
831(d) or (e)].

As these examples are largely self-illuminating, and some have already 
been addressed in this preamble, only limited further amplification is 
provided here. Paragraph (C), in particular, reflects that the Act was 
intended not only to prohibit DEA registrants from using the Internet 
to facilitate the unlawful dispensing of controlled substances, but to 
also prohibit non-DEA registrants from doing so. Most notably, 
paragraph (C) is aimed squarely at the criminal facilitator whose 
``business plan'' for operating a rogue online pharmacy is to recruit 
an unscrupulous practitioner to write prescriptions based on 
insufficient or nonexistent medical evaluations and/or an unscrupulous 
pharmacist to fill such prescriptions.
    The Act contains certain categories of conduct that do not result 
in the participants falling within the Act's definition of an online 
pharmacy. Specifically, 21 U.S.C. 841(h)(3) states:
    (A) This subsection [21 U.S.C. 841(h)(1)] does not apply to:

    (i) The delivery, distribution, or dispensation of controlled 
substances by nonpractitioners to the extent authorized by their 
registration under [the CSA];
    (ii) The placement on the Internet of material that merely 
advocates the use of a controlled substance or includes pricing 
information without attempting to propose or facilitate an actual 
transaction involving a controlled substance; or
    (iii) except as provided in subparagraph (B), any activity that 
is limited to--
    (I) the provision of a telecommunications service, or of an 
Internet access service or Internet information location tool (as 
those terms are defined in section 231 of the Communications Act of 
1934) [47 U.S.C. 231]; or
    (II) the transmission, storage, retrieval, hosting, formatting, 
or translation (or any combination thereof) of a communication, 
without selection or alteration of the content of the communication, 
except that deletion of a particular communication or material made

[[Page 15605]]

by another person in a manner consistent with section 230(c) of the 
Communications Act of 1934 [47 U.S.C. 230(c)] shall not constitute 
such selection or alteration of the content of the communication.
    (B) The exceptions under subclauses (I) and (II) of subparagraph 
(A)(iii) shall not apply to a person acting in concert with a person 
who violates paragraph (1).

Thus, paragraph (A)(i) allows DEA-registered nonpractitioners (such as 
manufacturers and distributors) to utilize the Internet in carrying out 
activities authorized by their DEA registrations (and otherwise in 
conformity with the CSA) without being subject to liability under 21 
U.S.C. 841(h)(1). Paragraph (A)(ii) allows for Web sites that advocate 
the use of controlled substances or contain pricing information 
``without attempting to propose or facilitate an actual transaction 
involving a controlled substance.'' Paragraph (A)(iii) exempts from 
application of 21 U.S.C. 841(h)(1) Internet service providers, Web 
hosting services, and certain other specified entities that do not 
alter content of Internet transmissions. However, it is crucial to bear 
in mind that the exception of paragraph (A)(iii) does not apply to ``a 
person acting in concert with a person who violates [21 U.S.C. 
841(h)(1)].'' Thus, any person whose conduct would be sufficient to 
prove that he conspired to violate 21 U.S.C. 841(h)(1), or aided and 
abetted such violation, is not immune from prosecution under paragraph 
(A)(iii).
    The second new criminal offense added by the Act is 21 U.S.C. 
843(c)(2)(A). This provision expressly prohibits using the Internet to 
advertise illegal transactions in controlled substances. Specifically, 
this provision states:

    It shall be unlawful for any person to knowingly or 
intentionally use the Internet, or cause the Internet to be used, to 
advertise the sale of, or to offer to sell, distribute, or dispense, 
a controlled substance where such sale, distribution, or dispensing 
is not authorized by [the CSA] or by the Controlled Substances 
Import and Export Act.

The Act further states:

    Examples of activities that violate [21 U.S.C. 843(c)(2)(A)] 
include, but are not limited to, knowingly or intentionally causing 
the placement on the Internet of an advertisement that refers to or 
directs prospective buyers to Internet sellers of controlled 
substances who are not registered with a modification under [21 
U.S.C. 823(f)].

Thus, for example, it is unlawful under the Act to knowingly or 
intentionally place an advertisement on the Internet that directs 
persons to a Web site that sells prescriptions for controlled 
substances where the operator of the Web site is not a DEA-registered 
pharmacy with a modification authorizing it to operate as an online 
pharmacy. As another example, it is unlawful under the Act to knowingly 
or intentionally place an advertisement on the Internet that offers to 
sell a controlled substance without a prescription or that directs 
persons to a Web site through which a controlled substance may be 
purchased without a prescription.
    Two important points should be noted with respect to 21 U.S.C. 
843(c)(2)(A). First, to establish a violation of this felony provision, 
it is not necessary that the person placing the advertisement actually 
engage in a transaction involving a controlled substance. Rather, 
merely placing on the Internet an advertisement that is designed to 
facilitate, or offers to facilitate, an illegal sale of a controlled 
substance is sufficient to violate 21 U.S.C. 843(c)(2)(A). Second, the 
Act applies to advertisements relating to violations not only of the 
CSA, but also of the Controlled Substances Import and Export Act 
(CSIEA, which is found in 21 U.S.C. 951 through 971). Thus, it is a 
violation of 21 U.S.C. 843(c)(2)(A) to place an advertisement on the 
Internet that offers, for example, to ship controlled substances into 
the United States for personal medical use, since doing so would 
violate the CSIEA.\33\ What It Means to ``Knowingly or intentionally 
deliver, distribute, or dispense a controlled substance by means of the 
Internet.''
---------------------------------------------------------------------------

    \33\ Under the CSIEA, the importation of controlled substances 
into the United States is prohibited except by persons registered 
with DEA to do so or persons exempted from such requirement. 21 
U.S.C. 952, 957, 960. In accordance with the CSIEA, DEA has issued a 
regulation authorizing a person to import certain controlled 
substances for personal medical use, provided the person has the 
drugs in his possession upon entering the United States, makes the 
required declaration to the U.S. Customs and Border Protection, and 
otherwise complies fully with the requirements of the regulation. 21 
CFR 1301.26; 69 FR 55343 (2004). Under no circumstances is it 
permissible under the CSIEA or the regulations for a person to have 
controlled substances shipped into the United States for personal 
medical use.
---------------------------------------------------------------------------

    The Ryan Haight Act is structured around the phrase ``knowingly or 
intentionally deliver, distribute, or dispense a controlled substance 
by means of the Internet.'' The meaning of this phrase is therefore 
essential to the meaning of the Act. To explain its meaning, it is 
helpful to divide the phrase into two parts, starting with the latter 
half (``deliver, distribute, or dispense a controlled substance by 
means of the Internet''). The Act itself contains the following 
definition:

    The term ``deliver, distribute, or dispense by means of the 
Internet'' refers, respectively, to any delivery, distribution, or 
dispensing of a controlled substance that is caused or facilitated 
by means of the Internet.

21 U.S.C. 802(51) (emphasis added). Given that the phrase ``deliver, 
distribute, or dispense by means of the Internet'' has the foregoing 
definition, the next question is: What does it mean to ``knowingly or 
intentionally'' deliver, distribute, or dispense a controlled substance 
by means of the Internet?
    The phrase ``knowingly or intentionally'' has been a part of the 
CSA since its enactment in 1970. Among other provisions, 21 U.S.C. 
841(a)(1) (the most widely utilized criminal provision of the CSA) 
makes it an offense to ``knowingly or intentionally * * * manufacture, 
distribute, or dispense, or possess with intent to manufacture, 
distribute, or dispense, a controlled substance'' except as authorized 
by the CSA. There are numerous reported federal cases, some of which 
are discussed below, in which practitioners and pharmacists have been 
convicted of violating 21 U.S.C. 841(a)(1). These cases establish clear 
precedent for interpreting the phrase ``knowingly or intentionally'' in 
the context of practitioners who unlawfully prescribe controlled 
substances and pharmacists who unlawfully fill prescriptions for 
controlled substances. Specifically, a practitioner may be convicted of 
knowingly or intentionally dispensing controlled substances in 
violation of the CSA where the practitioner either (i) had actual 
knowledge of the illegal activity or (ii) was presented with facts that 
put him on notice that criminal activity was particularly likely and 
yet intentionally failed to investigate those facts.\34\ The following 
statement by one federal court of appeals exemplifies the standard 
under which pharmacists may be held liable for knowingly or 
intentionally dispensing controlled substances in violation of the CSA:
---------------------------------------------------------------------------

    \34\ United States v. Katz, 445 F.3d 1023, 1031 (8th Cir. 2006), 
cert. denied, 127 S.Ct. 421 (2006).

    The question, then, in any case where a pharmacist is charged 
with illegal distribution of controlled substances, is whether he 
knew that the purported prescription was not issued for a legitimate 
medical purpose or in the usual course of medical practice. The key 
element of knowledge may be shown by proof that the defendant 
deliberately closed his eyes to the true nature of the 
prescription.\35\
---------------------------------------------------------------------------

    \35\ United States v. Lawson, 682 F.2d 480, 482 (4th Cir. 1982) 
(citations omitted), cert. denied, 459 U.S. 991 (1982).

    Another federal court has similarly stated that a pharmacist may be

[[Page 15606]]

convicted of unlawfully dispensing controlled substances where the 
evidence establishes that the pharmacist ``deliberately closed his eyes 
to wrongdoing that should have been obvious to him.''\36\ Courts have 
referred to such conduct as ``willful blindness'' or ``deliberate 
ignorance.'' As one court has stated:
---------------------------------------------------------------------------

    \36\ United States v. Veal, 23 F.3d 985, 988 (6th Cir. 1994).

    Ignorance is deliberate if the defendant was presented with 
facts that put her on notice that criminal activity was particularly 
likely and yet she intentionally failed to investigate those facts.* 
* * If, in light of certain obvious facts, reasonable inferences 
support a finding that a defendant's failure to investigate is 
equivalent to `burying one's head in the sand,' the jury may 
consider willful blindness as a basis for knowledge.\37\
---------------------------------------------------------------------------

    \37\ Katz, 445 F.3d at 1031.

    Thus, a pharmacist who fills a prescription that was issued in 
violation of any provision of the Act may be held criminally liable 
under 21 U.S.C. 841(h)(1) if he did so knowingly or intentionally--that 
is, if he either (i) had actual knowledge of the violation or (ii) 
deliberately disregarded facts that would have led a reasonable 
pharmacist to be highly suspicious about the likelihood of such a 
violation. Likewise, a practitioner who writes a prescription in 
violation of the Act may be held criminally liable under 21 U.S.C. 
841(h)(1) if he did so knowingly or intentionally--which can be proven 
by showing that either (i) the practitioner had actual knowledge of the 
violation or (ii) the practitioner deliberately disregarded facts that 
would have led a reasonable practitioner to be highly suspicious about 
the likelihood of such a violation.

VII. Additional Information About the Ryan Haight Act for Pharmacists, 
Practitioners, Other Registrants, and Members of the Public

    This section provides additional information specifically tailored 
to various categories of persons who are likely to be affected by, or 
otherwise have an interest in, the Ryan Haight Act. This information 
must be read in conjunction with the general information explaining the 
Act provided above. For example, the definitions of the terminology 
used in the Act will not be repeated in this section (due to their 
length) and should be reviewed as necessary by returning to the 
appropriate sections of the preamble.

A. Additional Specific Information for Pharmacists

    If you are a pharmacist, and your DEA-registered pharmacy falls 
within the definition of an ``online pharmacy,'' your pharmacy must, 
beginning on April 13, 2009, obtain from DEA a modification of its 
registration authorizing it to operate as an online pharmacy. (DEA will 
issue to the pharmacy a Certificate of Registration indicating the 
modification of registration.) The Ryan Haight Act contains several 
exceptions to the definition of an online pharmacy, so you should 
review carefully these exceptions before submitting an application for 
such modification of registration. Among other things, particular 
consideration should be given to the exception set forth in 21 U.S.C. 
802(52)(B)(viii) that excludes from the definition of an online 
pharmacy those DEA-registered pharmacies ``whose dispensing of 
controlled substances via the Internet consists solely of * * * (I) 
refilling prescriptions for controlled substances in schedule III, IV, 
or V, as defined in paragraph [21 U.S.C. 802(55)] or (II) filling new 
prescriptions for controlled substances in schedule III, IV, or V, as 
defined in paragraph [21 U.S.C. 802(56)].''
    Also, the regulations being issued here exempt from the definition 
of online pharmacy any registered pharmacy ``whose delivery, 
distribution, or dispensing of controlled substances by means of the 
Internet consists solely of * * * filling prescriptions that were 
electronically prescribed in a manner authorized by this chapter and 
otherwise in compliance with the Act.'' Given these exceptions to the 
definition of an online pharmacy, DEA anticipates that the overwhelming 
majority of pharmacies in the United States, if they follow their 
current practices, will not, as of April 13, 2009, fall within the 
definition of an online pharmacy. However, as of April 13, 2009, if a 
pharmacist knowingly or intentionally dispenses a controlled substance 
by means of the Internet, and the pharmacy fits within the definition 
of an online pharmacy, but does not hold a modified DEA registration 
authorizing it to operate as an online pharmacy, the pharmacy and the 
pharmacist are violating 21 U.S.C. 841(h)(1) and subject to potential 
criminal prosecution and loss of the pharmacy's DEA registration. 
Accordingly, if the anticipated activities of your pharmacy will render 
it an online pharmacy within the meaning of the Act, you should submit 
to DEA your application for a modified registration as early as 
possible, since you will not be permitted to engage in the activities 
of an online pharmacy until DEA has approved such application. To 
expedite matters, DEA has established an online application process for 
registrants to apply for such modification of registration.
    In addition, as explained earlier in this preamble, any pharmacy 
that fits within the Act's definition of an online pharmacy must 
display certain information on its Web site and make certain 
notifications to DEA, as required by the Act and the regulations being 
issued here. Also, if a pharmacy has applied for and been granted a 
modification of its registration authorizing it to operate as an online 
pharmacy, it is obligated to submit monthly reports of all controlled 
substances dispensed by any means (walk-in business, dispensing by 
mail, or any other type of dispensing--whether by means of the Internet 
or not), provided such dispensing meets or exceeds the threshold 
amounts.
    A pharmacist has always had a corresponding responsibility to 
ensure that any dispensing of controlled substances conforms with the 
CSA and DEA regulations.\38\ That same corresponding responsibility now 
applies with respect to the new requirements of the Ryan Haight Act and 
the implementing regulations. That is, a pharmacist's corresponding 
responsibility now includes ensuring that controlled substances are 
dispensed in conformity with the Ryan Haight Act. For example, under 
the Act, a pharmacist may not knowingly or intentionally fill a 
prescription for a controlled substance that was issued in violation of 
the inperson medical evaluation requirement of 21 U.S.C. 829(e).
---------------------------------------------------------------------------

    \38\ See 21 CFR 1306.04(a).
---------------------------------------------------------------------------

    How does a pharmacist, when presented with a prescription (whether 
it is a written prescription presented in person, an oral prescription, 
a faxed prescription, or otherwise) know whether the prescription was 
``dispensed by means of the Internet,'' and thus subject to the 
requirements of the Act? Again, under the law, a pharmacist has a 
corresponding responsibility to ensure that any prescription filled was 
issued in conformity with the law and regulations. The same legal 
standard that has always applied in determining whether a pharmacist 
met this responsibility will also apply in determining whether the 
pharmacist acted properly in filling a prescription subject to the 
requirements of the Ryan Haight Act. If the pharmacist either (i) had 
actual knowledge that the prescription was issued by means of the 
Internet and that the requirements of the Act were not met or (ii) in 
view of all

[[Page 15607]]

the circumstances surrounding a particular prescription, and, in the 
exercise of proper professional practice, should have known of such 
violation, or deliberately closed his eyes to circumstances indicative 
of a possible violation, or otherwise failed to take appropriate steps 
that a professional pharmacist should take to investigate suspicious 
circumstances, the pharmacy and pharmacist may be deemed to have 
knowingly or intentionally violated 21 U.S.C. 841(h)(1).
    Depending on the circumstances, the relevant factors for this 
inquiry might include: the number of prescriptions received from a 
practitioner; the practitioner's pattern of prescribing; the address of 
the patient in relation to that of the practitioner; and the distance 
from the practitioner to the pharmacy. If, taking factors such as these 
into account, the pharmacist either (a) actually knows that the patient 
to whom a prescription for a controlled substance was issued was 
steered to the practitioner through a Web site or (b) should reasonably 
suspect so and fails to verify, the pharmacist who fills such a 
prescription will have knowingly or intentionally dispensed a 
controlled substance by means of the Internet. If such dispensing 
occurs, both the pharmacy and the pharmacist fall within the definition 
of an online pharmacy, and both will automatically violate 21 U.S.C. 
841(h)(1) if the pharmacy does not have a modified DEA registration 
authorizing it to operate as an online pharmacy. Again, such a 
violation, or any other transgression by a pharmacist of the 
corresponding responsibility as it pertains to the requirements of the 
Act may result in criminal prosecution of the pharmacist and/or 
administrative proceedings to revoke the pharmacy's registration.
    Pharmacists should also note that the new requirements of the Act 
are in addition to, and not in lieu of, the longstanding requirement 
that all prescriptions for controlled substances be issued by a 
practitioner acting in the usual course of professional practice and 
otherwise in conformity with the CSA and DEA regulations. Thus, when a 
prescription for a controlled substance has been issued by means of the 
Internet, even if the pharmacy that fills the prescription has obtained 
from DEA a modification of its registration, and even if the pharmacist 
has confirmed that the prescribing practitioner has conducted at least 
one in-person medical evaluation of the patient, the pharmacist still 
has the corresponding responsibility to ensure that the prescription 
was issued for a legitimate medical purpose in the usual course of 
professional practice. For example, if the pharmacist knows that a 
prescription for a controlled substance was issued by a practitioner 
who works for a Web site that sends its customers to practitioners for 
a one-time sham medical evaluation with the intent to sell 
prescriptions to the customers repeatedly thereafter with no in-person 
follow-up evaluations, the fact that the practitioner conducted an in-
person ``evaluation'' purporting to comply with the Act does not excuse 
the pharmacist from fulfilling his corresponding responsibility to fill 
only those prescriptions for controlled substances that were issued for 
a legitimate medical purpose in the usual course of professional 
practice.
    To list another common practice of rogue Internet site operators, 
if you are an owner of a pharmacy and you are approached by an 
``entrepreneur'' who offers to funnel to you large quantities of 
prescriptions for filling in exchange for a fee, there is a strong 
possibility that you are being asked to serve as the supplier to a 
rogue Web site. This is especially so if such ``entrepreneur'' is not 
affiliated with a legitimate health care organization. Again, the rogue 
Web sites that the Act was designed to eliminate often depend on the 
assistance of DEA-registered pharmacies. If you as a pharmacy owner or 
pharmacist are asked to participate in a scheme that raises suspicions 
about compliance with the Act, you are risking potential criminal 
liability and loss of DEA registration if you agree to participate 
without taking reasonable steps to rule out the possibility that the 
scheme will violate the Act.
    A pharmacist is not, however, obligated to know what cannot be 
known through the exercise of sound professional pharmacy practice. For 
example, it is conceivable that a customer could walk into a pharmacy 
with a prescription that was issued by means of the Internet (or such a 
prescription could be faxed to a pharmacy) with the pharmacist having 
no reasonable basis to know or suspect that it was issued by means of 
the Internet. As long as the pharmacist meets his corresponding 
responsibility to take reasonable steps under the circumstances to 
ensure that the prescription was issued in accordance with the 
requirements of the Ryan Haight Act (as well as all other applicable 
requirements of the CSA and DEA regulations), the pharmacist will not 
be held strictly liable for filling a prescription that he could not 
reasonably have known was issued by means of the Internet. Thus, it is 
absolutely unnecessary for a pharmacy to apply for a modification of 
its DEA registration authorizing it to operate as an online pharmacy 
for the sole purpose of ensuring that it does not--despite the exercise 
of sound professional judgment--inadvertently fill a prescription that 
was issued by means of the Internet.

B. Additional Specific Information for Practitioners

    If you are a physician, dentist, veterinarian, mid-level 
practitioner, or other practitioner registered with DEA to prescribe, 
administer, or dispense controlled substances, and your activities 
involving controlled substances are limited to those authorized by your 
registration, you are exempted under the Ryan Haight Act from the 
definition of an ``online pharmacy.'' As a result, you are not subject 
to the requirement of obtaining a modified DEA registration that 
applies to pharmacies that dispense controlled substances by means of 
the Internet. Nonetheless, there are other requirements of the Act and 
the implementing regulations that, depending on the nature of your 
practice, might apply to you.
    DEA believes that the overwhelming majority of practitioners in the 
United States, based on their current practices, do not engage in 
activities that constitute delivering, distributing, or dispensing 
controlled substances by means of the Internet.\39\ Accordingly, the 
overwhelming majority of practitioners need not change their practices 
because of the enactment of the Ryan Haight Act. However, if you are a 
DEA-registered practitioner who prescribes or otherwise dispenses a 
controlled substance by means of the Internet, you must comply with the 
provisions of the Act that apply to you.
---------------------------------------------------------------------------

    \39\ As discussed above, the electronic prescribing of 
controlled substances is not currently permitted under the DEA 
regulations, but DEA has proposed regulations that, once finalized, 
will allow such practice. The electronic prescribing of controlled 
substances through use of the Internet does, as explained above, 
constitute delivering, distributing, or dispensing controlled 
substances by means of the Internet. Nonetheless, since the 
overwhelming majority of practitioners only prescribe controlled 
substances to patients for whom they have conducted an in-person 
medical evaluation, and only for a legitimate medical purpose in the 
usual course of professional practice, it is anticipated that the 
overwhelming majority of practitioners will continue this practice 
once electronic prescribing of controlled substances becomes 
permissible under the DEA regulations. If so, such practitioners 
would satisfy the ``valid prescription'' requirement of the Ryan 
Haight Act.
---------------------------------------------------------------------------

    First, if you are a DEA-registered practitioner who prescribes or 
otherwise dispenses a controlled substance by means of the Internet, 
you must comply

[[Page 15608]]

with the provision of the Act relating to the in-person medical 
evaluation requirement, which is set forth in 21 U.S.C. 829(e). Certain 
exceptions apply to this requirement, as are discussed above in this 
preamble. Note, however, that the Act expressly states that compliance 
by a practitioner with the in-person medical evaluation requirement 
does not, by itself, satisfy the requirement that every prescription be 
issued for a legitimate medical purpose in the usual course of 
professional practice. Whether a prescription was issued for a 
legitimate medical purpose in the usual course of professional practice 
must, as always, be determined based on the totality of the 
circumstances under which a particular prescription was issued to a 
particular patient. As DEA has previously stated, ``DEA recognizes that 
the overwhelming majority of American physicians who prescribe 
controlled substances do so for legitimate medical purposes [and] 
exercise the appropriate degree of medical supervision--as part of 
their routine practice during office visits.''\40\ However, this 
favorable characterization cannot be applied to the very small 
percentage of practitioners who write prescriptions on behalf of rogue 
Internet Web sites. Indeed, the main reason Congress enacted the Ryan 
Haight Act was to bring an end to the rogue Web sites that hire 
unscrupulous practitioners to write prescriptions without a legitimate 
medical purpose and outside the usual course of professional practice.
---------------------------------------------------------------------------

    \40\ 71 FR 52716, 52719 & 52723 (2006 DEA policy statement).
---------------------------------------------------------------------------

    If you are a practitioner who knowingly or intentionally prescribes 
or otherwise dispenses controlled substances on behalf of a particular 
Web site, and if that Web site is not compliant with the requirements 
of the Act and the implementing regulations, you are dispensing 
controlled substances by means of the Internet in a manner not 
authorized by the Act. Doing so constitutes a violation of 21 U.S.C. 
841(h)(1) and may result in criminal prosecution and/or administrative 
proceedings to revoke your DEA registration.
    If you are a practitioner who writes prescriptions on behalf of a 
particular Web site, your name must appear prominently on that Web 
site. (This requirement helps to distinguish those Web sites that are 
compliant with the Act and the implementing regulations from those that 
are not compliant.) If such Web site is operated on behalf of a group 
medical practice in which you participate, it is sufficient that your 
name (along with the names of your fellow practitioners who write 
prescriptions on behalf of the site) are posted in a visible and clear 
manner on the homepage of the Web site, or on a page directly linked 
thereto in which the hyperlink is also visible and clear on the 
homepage.\41\ It is anticipated that most every medical office in the 
United States that currently has a Web site is already in compliance 
with this provision as it is common practice for such Web sites to post 
in such manner the names of the practitioners. If, however, you are one 
of what is anticipated to be a very small number of practitioners who, 
beginning on or after April 13, 2009 (the effective date of the Ryan 
Haight Act), writes prescriptions on behalf of a Web site of a DEA-
registered pharmacy, the Act requires the Web site to post additional 
information identifying you. Specifically, the Web site must post the 
following information in a visible and clear manner on the homepage of 
each Internet site it operates, or on a page directly linked thereto in 
which the hyperlink is also visible and clear on the homepage: ``The 
name, address, telephone number, professional degree, and States of 
licensure of any practitioner who has a contractual relationship to 
provide medical evaluations or issue prescriptions for controlled 
substances, through referrals from the Web site or at the request of 
the owner or operator of the Web site, or any employee or agent 
thereof.'' \42\
---------------------------------------------------------------------------

    \41\ As stated in 21 CFR 1304.50: ``For a Web site to identify 
itself as being exempt from the definition of an online pharmacy by 
virtue of section 102(52)(B)(ii) of the Act (21 U.S.C. 
802(52)(B)(ii)), the Web site shall post in a visible and clear 
manner on its homepage, or on a page directly linked thereto in 
which the hyperlink is also visible and clear on the homepage, a 
list of the DEA-registered nonpharmacy practitioners who are 
affiliated with the Web site. Any nonpharmacy practitioner 
affiliated with such a Web site is responsible for compliance with 
this section. An institutional practitioner that otherwise complies 
with the requirements of the Act and this chapter will be deemed to 
meet the requirements of this section if, in lieu of posting the 
names of each affiliated individual practitioner, it posts its name 
(as it appears on its Certificate of Registration) in a visible and 
clear manner on its homepage and in a manner that identifies itself 
as being responsible for the operation of the Web site.''
    \42\ 21 U.S.C. 831(c)(6).
---------------------------------------------------------------------------

    How does a practitioner know whether he is writing prescriptions 
that are issued through, or on behalf of, a Web site? In some cases, 
this will be obvious to the practitioner. For example, if a 
practitioner is approached by a person who offers to pay the 
practitioner to write prescriptions for ``patients'' who will be routed 
to the practitioner through the Web site, the practitioner has actual 
knowledge that he is being asked to dispense controlled substances by 
means of the Internet within the meaning of the Act. (As most 
practitioners would immediately recognize, such a proposal is 
inherently suspect, since the legitimate practice of medicine is not 
structured around writing prescriptions for controlled substances and 
being compensated primarily or exclusively on that basis.) \43\ The 
profitability of rogue Internet Web sites typically depends on the 
ability of the criminal facilitator who operates the site to recruit 
unscrupulous practitioners to enter into such types of contractual 
arrangements.
---------------------------------------------------------------------------

    \43\ Such an arrangement whereby compensation is based primarily 
or exclusively on the number of prescriptions for controlled 
substances issued is a ``red flag'' indicating that diversion of 
controlled substances into illicit channels might be occurring--
regardless of whether the Internet is involved.
---------------------------------------------------------------------------

    In response to the enactment of the Ryan Haight Act, some rogue Web 
sites have come up with the following approach in an effort to 
circumvent the new law. Drug-seeking customers who visit the rogue Web 
site are told that they should arrange a visit with one of the 
practitioners affiliated with the site to satisfy the Act's requirement 
of an in-person medical evaluation. Once the practitioner has gone 
through the motions of conducting what purports to be a medical 
evaluation, the ``patient'' will be permitted to purchase controlled 
substances (or prescriptions therefor) through the Web site in 
perpetuity, without having to see the practitioner in person again. A 
practitioner who might be inclined to consider entering into a contract 
with the operator of such a rogue Web site should consider that, in all 
likelihood, such an operation violates the Act--despite its purported 
compliance with the in-person medical evaluation requirement. For one, 
under the Act, the only persons who may operate Web sites through which 
controlled substances are prescribed or otherwise dispensed are DEA-
registered practitioners (pharmacies and nonpharmacy 
practitioners).\44\ Thus, a non-DEA registrant may not operate a Web 
site that constitutes an ``online pharmacy'' within the meaning of the 
Act (which includes, for example, a Web site that sells prescriptions 
for controlled substances or fills such prescriptions). Second, even in 
the unlikely event that the person who is offering the practitioner the 
opportunity to participate in such a Web site is a DEA registrant with 
the appropriate registration allowing it to dispense controlled 
substances by means of the

[[Page 15609]]

Internet, the prescribing practitioner must ensure that the Web site 
properly displays his name and the other required information in the 
manner required by the Act and the implementing regulations.
---------------------------------------------------------------------------

    \44\ See 21 U.S.C. 802(51), 802(52), 823(f), & 841(h)(1).
---------------------------------------------------------------------------

    Further, even if the Web site has the required registration and 
posts the required information, it is difficult to envision how a 
conscientious practitioner could enter into a contract to provide 
medical evaluations and/or issue prescriptions through referrals from a 
Web site that is designed primarily to attract and supply persons 
seeking to obtain controlled substances for other than legitimate 
medical purposes (rather than to provide legitimate medical care to 
patients without a predetermined goal of selling drugs or 
prescriptions). Indeed, a Web site that operates in such a manner--such 
as by offering to arrange in-person ``medical evaluations'' for the 
purpose of allowing customers to obtain controlled substances through 
the Web site indefinitely thereafter--should be viewed by a 
practitioner as a ``red flag'' indicating that diversion of controlled 
substances to illicit channels might be occurring.
    The same considerations apply if you, as a practitioner, are 
offered a contract or otherwise presented with a proposal to write 
prescriptions to customers of a Web site based on reviewing online 
questionnaires or faxed ``medical records'' or by answering telephone 
calls through a phone number affiliated with the Web site. If these 
customers are being referred to you through the Web site or at the 
request of the owner or operator of the Web site, any prescriptions for 
controlled substances you write for the customers constitute 
``dispensing by means of the Internet'' within the meaning of the Act. 
As explained above, a practitioner who dispenses a controlled substance 
by means of the Internet in violation of the Act may be held criminally 
liable under 21 U.S.C. 841(h)(1) if he did so knowingly or 
intentionally--which can be proven by showing that either (i) the 
practitioner had actual knowledge of the violation or (ii) the 
practitioner deliberately disregarded facts that would have led a 
reasonable practitioner to be highly suspicious about the likelihood of 
such a violation. In addition, any transgression of the Act may result 
in administrative action to revoke the practitioner's DEA registration.
    With the foregoing considerations in mind, DEA again emphasizes 
that the current practices of the overwhelming majority of 
practitioners in the United States do not involve delivering, 
distributing, or dispensing controlled substances by means of the 
Internet. This means that the vast majority of practitioners need not 
alter their current practices to conform to the requirements of the 
Ryan Haight Act.

C. Additional Specific Information for DEA-Registered Distributors

    The ability of rogue Internet sites to supply controlled substances 
to persons who seek them for other than legitimate medical purposes 
depends largely on the existence of DEA-registered pharmacies that are 
willing to supply the customers of these Web sites. As the data 
provided at the beginning of this preamble illustrates, it takes only a 
relatively small number of unscrupulous pharmacies, working in 
conjunction with rogue Internet sites, to supply enormous quantities of 
hydrocodone and other controlled substances, causing a substantial 
detrimental effect on the public health and welfare. Accordingly, if 
you are a DEA-registered distributor, it is critical that you are 
vigilant in taking appropriate steps to avoid supplying the pharmacies 
that service the customers of rogue Web sites.
    In a September 27, 2006, letter to all DEA-registered distributors, 
DEA specified a number of pharmacy practices that might be indicative 
of diversion. While all the considerations set forth in that letter 
remain valid today, the enactment of the Ryan Haight Act should further 
assist distributors in avoiding distributing controlled substances to 
pharmacies that are supplying customers of rogue Web sites. For 
example, if you are a distributor and you know that a pharmacy is 
soliciting buyers of controlled substances via the Internet, or is 
associated with an Internet site that solicits orders for controlled 
substances,\45\ you are on notice that the pharmacy is an ``online 
pharmacy'' under the Act. If so, it is unlawful, per se, for the 
pharmacy to be operating without a modified DEA registration 
authorizing it to operate as an online pharmacy. Under such 
circumstances, if the pharmacy does not have such a modified 
registration, it would be unlawful for you as a distributor to supply 
the pharmacy with controlled substances. (The pharmacy's Certificate of 
Registration will reflect its status as an online pharmacy in its 
business activity designation.) \46\
---------------------------------------------------------------------------

    \45\ As explained earlier in this preamble, the Ryan Haight Act 
contains an exception from the definition of ``online pharmacy'' for 
any pharmacy registered under 21 U.S.C. 823(f) whose dispensing of 
controlled substances via the Internet consists solely of 
``refilling prescriptions for controlled substances in schedule III, 
IV, or V'' or ``filling new prescriptions for controlled substances 
in schedule III, IV, or V'' (as those terms are defined in 21 U.S.C. 
802(55) and (56)). 21 U.S.C. 802(52)(B)(viii). Given these and other 
exceptions in the Act, it is anticipated that most pharmacies, if 
they continue their current practices, will not fall within the 
definition of an online pharmacy. However, a pharmacy that actively 
solicits buyers of controlled substances via the Internet or is 
associated with a Web site that does so cannot fall within the 
foregoing exception and, therefore, does constitute an online 
pharmacy.
    \46\ DEA provides a ``Registration Validation'' tool on its Web 
site, through which DEA registrants may query DEA's registration 
database regarding another DEA registrant to gather specific 
information about that registrant. Information available includes: 
The registrant's name, address, and DEA registration number; the 
date of expiration of the registration; business activity; and the 
schedules of controlled substances the registrant is authorized to 
handle.
---------------------------------------------------------------------------

    Even if you do not have actual knowledge that the pharmacy is 
operating through a Web site, if the pharmacy's buying patterns are of 
a volume or otherwise of a nature indicating a reasonable likelihood 
that the pharmacy is supplying customers of a Web site or otherwise 
engaging in practices that render it an online pharmacy within the 
meaning of the Ryan Haight Act, the sound course of action for the 
distributor would be to confirm that the pharmacy is complying with the 
Act prior to supplying the pharmacy with controlled substances.\47\
---------------------------------------------------------------------------

    \47\ As with all DEA registrants, distributors have a duty to 
maintain effective controls against diversion of controlled 
substances. 21 U.S.C. 823(b)(1), 823(e)(1); 21 CFR 1301.71(a). As 
part of this responsibility, all distributors must design and 
operate a system to disclose to the registrant suspicious orders of 
controlled substances and must report to DEA any such suspicious 
orders of controlled substances in accordance with 21 CFR 
1301.74(b). Failure to comply with these or any other applicable 
regulatory requirements may, depending on the circumstances, result 
in civil monetary penalties and/or administrative revocation 
proceedings, among other things.
---------------------------------------------------------------------------

D. Additional Specific Information for Consumers

    The full title of the Ryan Haight Act is ``The Ryan Haight Online 
Pharmacy Consumer Protection Act of 2008.'' As this title implies, a 
primary purpose of the Act is to protect consumers by ensuring that 
only legitimate, law-abiding Web sites dispense controlled substances 
via the Internet. One of the ways the Act achieves this goal is by 
allowing only pharmacies who are properly registered with DEA to 
operate Web sites through which prescriptions for controlled substances 
are filled. In addition, the Act and the implementing regulations 
require such Web sites to fully disclose to consumers certain basic 
information, such as the name and telephone number of the pharmacist-
in-charge, a list of the states in which the pharmacy is authorized to 
dispense controlled substances, the names of any

[[Page 15610]]

practitioners who have a contractual relationship to issue 
prescriptions for controlled substances through referrals from the Web 
site, and a certification that the Web site is acting in compliance 
with the Act. Accordingly, the Act should make it easier for consumers 
to differentiate between legitimate and illegitimate Web sites that 
sell controlled substances.
    One strong indicator of an unlawful Web site is that it lets you as 
a customer pick the controlled substance and then charges you a fee to 
arrange for a practitioner to prescribe that controlled substance to 
you. An unlawful Web site might further offer to refund all or part of 
your fee if you are not sold the prescription for your drug of choice. 
A Web site that engages in such practices is virtually certain to be a 
rogue Web site that is not operating in compliance with the Ryan Haight 
Act.
    Consumers should also be aware that the Act also prohibits certain 
advertising practices relating to the types of criminal activities the 
Act is designed to eliminate. Specifically, the Act makes it a crime to 
place an advertisement on the Internet that offers to sell a controlled 
substance or a prescription for a controlled substance in a manner that 
would be illegal (in violation of the CSA or the CSIEA).\48\ For 
example, the Act makes it unlawful to place an advertisement on the 
Internet stating: ``Hydrocodone! No Prescription Needed!'' (or words to 
the same effect). This provision of the Act also makes it illegal to 
place an advertisement on the Internet that refers consumers to a Web 
site that is operating in violation of the Act (such as one that sells 
controlled substances but is not properly registered with DEA). This 
ban on illegal Internet advertising also applies to unsolicited 
commercial e-mail, which is sometimes referred to as ``spam'' or ``junk 
e-mail.'' Consequently, beginning on April 13, 2009, if you as a 
consumer receive an unsolicited commercial e-mail with the subject 
line: ``Hydrocodone! No Prescription Needed!,'' the sender of that e-
mail has violated the law. Likewise, if you receive spam directing you 
to a Web site that is operating in violation of the Act, the spammer 
has also violated the Act.
---------------------------------------------------------------------------

    \48\ The exact wording of this provision is found in 21 U.S.C. 
843(c)(2) and is recited above in this preamble.
---------------------------------------------------------------------------

    Consumers should also be wary of rogue Web sites falsely claiming 
that they are allowed to sell controlled substances without complying 
with the Ryan Haight Act because they are located outside the United 
States. Any such claim is flatly wrong. In fact, as explained earlier 
in this preamble, it has always been unlawful under the Controlled 
Substances Import and Export Act (CSIEA) (even prior to the Ryan Haight 
Act) to ship controlled substances into the United States for personal 
medical use. Any person who ships controlled substances from abroad 
into the United States illegally, along with the person in the United 
States who places the order for such a shipment and thereby causes the 
controlled substances to be illegally shipped into the United States, 
violates the CSIEA and is subject to criminal prosecution.\49\
---------------------------------------------------------------------------

    \49\ 21 U.S.C. 952, 957, 960(a)(1).
---------------------------------------------------------------------------

VIII. Regulatory Changes To Implement the Ryan Haight Act

    This section summarizes the regulations contained in this Interim 
Rule, which are being issued to implement the Ryan Haight Act. This 
section should be viewed as merely a summary provided for the 
convenience of the reader, and any registrant subject to the Ryan 
Haight Act should read carefully the entire preamble along with the 
text of the regulations being issued here.

A. Notification and Registration

    As provided in 21 CFR 1304.40, all online pharmacies that intend to 
dispense controlled substances by means of the Internet must provide 
DEA with a thirty-day notice of such intent. To do this, they must 
apply for a modified registration via the online application process. 
The Administrator must approve the application for a modified 
registration and issue a Certificate of Registration indicating the 
modification before the online pharmacy may engage in any activity of 
an online pharmacy. As discussed previously in the preamble, the only 
entities that may apply for a modified registration are registrants 
with a valid Certificate of Registration (DEA Form 223) as a pharmacy. 
If you are not registered with DEA as a pharmacy and you intend to 
dispense controlled substances by means of the Internet, you must first 
apply for registration as a pharmacy in accordance with 21 CFR 1301.13. 
Upon receipt of the Certificate of Registration as a pharmacy from the 
Administrator, you may then apply for a modification to your 
registration to operate as an online pharmacy.
    The Administrator may deny an application for such registration or 
such modification of registration if the Administrator determines that 
the issuance of such registration or modification would be inconsistent 
with the public interest. 21 CFR 1301.19. The same statutory criteria 
used in determining the public interest for purposes of evaluating an 
application for registration--those found in 21 U.S.C. 823(f)--will be 
used in evaluating an application for a modification of registration to 
operate as an online pharmacy.
    An online pharmacy must make a separate thirty-day advance notice 
to the State boards of pharmacy in each State in which it intends to 
offer to sell, deliver, distribute, or dispense controlled substances.
    In accordance with 21 U.S.C. 831, the following information must be 
included in the notification to DEA that must be submitted as part of 
the Application for Modification of Registration:
     All Internet pharmacy site disclosure information as 
listed below.
     A certification, under penalty of perjury, that the 
Internet pharmacy site disclosure information that is posted on the 
online pharmacy's Web site is true and accurate.
     A listing of all Internet Web site addresses (also known 
as the uniform resource locator or URL) owned by the online pharmacy to 
conduct its online business activities.
     A certification that the online pharmacy will notify DEA 
of any changes to any of its Internet Web site addresses (URLs) at 
least 30 days in advance.
     The name, address, telephone number, professional degree, 
DEA registration numbers and States of licensure of any practitioner 
who has a contractual relationship to provide medical evaluations or 
issue prescriptions for controlled substances, through referrals from 
the Web site or at the request of the owner or operator of the Web 
site, or any employee or agent thereof.
     The DEA registration numbers of each pharmacy that 
delivers, distributes, or dispenses controlled substances pursuant to 
orders made on, through, or on behalf of the online pharmacy.
    Pharmacies that intend to dispense controlled substances by means 
of the Internet must apply for the modified registration using the 
online registration process by going to the DEA Office of Diversion 
Control Web site at http://www.deadiversion.usdoj.gov. Registrants must 
positively acknowledge and agree to several statements during the 
application process. These acknowledgements will be printed on the 
registrant's receipt of registration for future reference. The 
following is a list of the acknowledgments with which a

[[Page 15611]]

registrant must agree as part of the online pharmacy application 
process:

    1. Pursuant to section 309(e) of the Controlled Substances Act 
(21 U.S.C. 829(e)), you, as an online pharmacy, acknowledge and 
agree that no controlled substance that is a prescription drug may 
be delivered, distributed, or dispensed by means of the Internet 
without a valid prescription.
    2. Pursuant to 21 CFR 1306.09, you, as an online pharmacy, 
acknowledge and agree that a prescription for a controlled substance 
may only be dispensed by means of the Internet by a pharmacist, 
acting in the usual course of his professional practice, and 
employed in a pharmacy whose registration has been modified to 
authorize it to operate as an online pharmacy.
    3. You, as an online pharmacy, acknowledge and understand that 
you may not engage in any activity of an online pharmacy, as defined 
in 21 CFR 1300.04(h), until your application for modified 
registration to operate as an online pharmacy is granted and a 
Certificate of Registration indicating the modification is issued by 
the Administrator (DEA Form 223).
    4. You, as an online pharmacy, understand that the Administrator 
may deny an application for a modification of registration if the 
Administrator determines that the issuance of such modification 
would be inconsistent with the public interest. In determining the 
public interest, the Administrator considers the factors listed in 
21 U.S.C. 823(f).
    5. Pursuant to section 303(f) of the Controlled Substances Act 
(21 U.S.C. 823(f)), you, as an online pharmacy, certify that you are 
authorized by the appropriate state authority(ies) to modify your 
existing DEA registration to authorize you to dispense schedule II-V 
controlled substances by means of the Internet.
    6. Pursuant to 21 CFR 1301.19, if you, as an online pharmacy, 
cease to dispense controlled substances by means of the Internet, 
you acknowledge and agree that you shall promptly notify the 
Administrator by modifying your registration to reflect the 
appropriate business activity.
    7. Pursuant to section 307(d) of the Controlled Substances Act 
(21 U.S.C. 827(d)), you, as an online pharmacy, understand you are 
required to report the dispensing of controlled substances by means 
of the Internet to the Administrator in the manner set forth in 21 
CFR 1304.55. This report will include the total quantity of each 
controlled substance that the pharmacy dispenses each calendar 
month. The report must be submitted to DEA electronically via online 
reporting, electronic file upload, or other means as approved by 
DEA. The monthly report shall include the date range of the 
reporting period, the NDC, and total quantity of each controlled 
substance dispensed. Reporting shall include all controlled 
substances dispensed via Internet transactions, mail-order, face-to-
face transactions, or any other means. The report shall be submitted 
to DEA by the 15th day of the following month. (For threshold 
amounts refer to DEA Web site: http://www.deadiversion.usdoj.gov.)
    8. Pursuant to section 311(a) of the Controlled Substances Act 
(21 U.S.C. 831(a)), you, as an online pharmacy, agree to display at 
all times on your homepage, in a visible and clear manner, a 
statement that your online pharmacy complies with the requirements 
of section 311 of the Act (21 U.S.C. 831) with respect to the 
delivery or sale or offer for sale of controlled substances.
    9. Pursuant to section 311(b) of the Controlled Substances Act 
(21 U.S.C. 831(b)), you, as an online pharmacy, acknowledge and 
agree to comply with the requirements of State law concerning the 
licensure of pharmacies in each State from which and to which you, 
deliver, distribute, or dispense, or offer to deliver, distribute, 
or dispense controlled substances by means of the Internet.
    10. Pursuant to section 311(c) of the Controlled Substances Act 
(21 U.S.C. 831(c)), you, as an online pharmacy, acknowledge and 
agree to post the following Internet Pharmacy Site Disclosure 
information in a visible and clear manner on the homepage of each 
Internet site you operate, or on a page directly linked thereto in 
which the hyperlink is also visible and clear on the homepage:
    (A) The name and address of the pharmacy as it appears on the 
pharmacy's DEA Certificate of Registration.
    (B) The pharmacy's telephone number and e-mail address.
    (C) Name of pharmacist-in charge, professional degree, States of 
licensure, and telephone number.
    (D) List of States in which the pharmacy is licensed to dispense 
controlled substances.
    (E) Certification that the pharmacy is registered to deliver, 
distribute, or dispense by means of the Internet, controlled 
substances.
    (F) Practitioner's name, address, telephone number, professional 
degree, and States of licensure of any practitioner who has a 
contractual relationship to provide medical evaluations or issue 
prescriptions for controlled substances, through referrals from the 
Web site or at the request of the owner or operator of the Web site, 
or any employee or agent thereof.
    (G) The following statement: ``This online pharmacy is obligated 
to comply fully with the Controlled Substances Act and DEA 
regulations. As part of this obligation, this online pharmacy has 
obtained a modified DEA registration authorizing it to operate as an 
online pharmacy. In addition, this online pharmacy will only 
dispense a controlled substance to a person who has a valid 
prescription issued for a legitimate medical purpose based upon a 
medical relationship with a prescribing practitioner. This includes 
at least one prior in-person medical evaluation in accordance with 
section 309 of the Controlled Substances Act (21 U.S.C. 829), or a 
medical evaluation via telemedicine in accordance with section 
102(54) of the Controlled Substances Act (21 U.S.C. 802(54)).''
    11. Pursuant to section 311(d)(2)(A) of the Controlled 
Substances Act (21 U.S.C. 831(d)(2)(A)), you, as an online pharmacy, 
certify that the Internet Pharmacy Site Disclosure information 
disclosed on your Web site, under penalty of perjury, is true and 
accurate.
    12. Pursuant to section 311(d) of the Controlled Substances Act 
(21 U.S.C. 831(d)), you, as an online pharmacy, acknowledge and 
agree that, thirty days prior to offering a controlled substance for 
sale, delivery, distribution, or dispensing, you must notify the 
Administrator and the State boards of pharmacy in any States in 
which you offer to sell, deliver, distribute, or dispense controlled 
substances. By fully completing and submitting this application, you 
will satisfy this requirement with respect to notifying the 
Administrator. However, you must separately notify the State boards 
of pharmacy as required by the Act. You understand that subsequent 
online pharmacy registration renewals will be accomplished by the 
online process and the appropriate renewal fee will apply.
    13. You understand that in accordance with section 401(h) of the 
Act (21 U.S.C. 841(h)), as of April 13, 2009, it is unlawful for any 
online pharmacy to deliver, distribute, or dispense a controlled 
substance by means of the Internet unless such online pharmacy is 
validly registered with a modification of DEA registration 
authorizing the dispensing of controlled substances by means of the 
internet.
    14. Pursuant to section 311(e) of the Controlled Substances Act 
(21 U.S.C. 831(e)), you, as an online pharmacy, understand and agree 
that on and after the date you apply for a modified registration, 
you will display on your homepage, in the manner described in 21 CFR 
1304.40(d), a declaration that you have made the required 
notifications to the DEA Administrator.

    There is no fee to apply for modification of an existing DEA 
registration. When a pharmacy makes application for a modified 
registration to conduct business as an online pharmacy, and the 
Administrator issues a Certificate of Registration for the modification 
to that pharmacy, the registration period continues from the date of 
the pharmacy's prior registration. When, however, an online pharmacy 
makes application to renew the modified registration, it will incur the 
appropriate application fee and, if approved, a new three-year 
registration period will begin.
    An online pharmacy that seeks to discontinue its modification of 
registration authorizing it to dispense controlled substances by means 
of the Internet, but continue its business activity as a pharmacy, must 
so notify the Administrator through the online application process for 
modification of registration. The Administrator will issue a new 
Certificate of Registration to the pharmacy based on the changes made 
to its registration. Once the registration has been changed back to its 
previous status (retail pharmacy), the pharmacy is no longer authorized 
to dispense controlled substances by means of the Internet.

[[Page 15612]]

B. Licensure

    An online pharmacy must comply with the requirements of State law 
concerning the licensure of pharmacies in each State from which it, and 
in each State to which it, delivers, distributes, or dispenses or 
offers to deliver, distribute, or dispense controlled substances by 
means of the Internet. 21 U.S.C. 831(b).

C. Online Pharmacy Internet Site Disclosure

    Online pharmacies have a continual obligation under the Ryan Haight 
Act to make certain disclosures on their Web sites required by the Act. 
Consequently, an online pharmacy must maintain an active Web site to 
post the required information, statements, and other disclosures 
required by the Act and update the information as necessary.

D. Statement of Compliance

    The Act requires that each online pharmacy shall display, at all 
times and in a visible and clear manner, on its homepage a statement 
that it complies with the requirements of section 311(a) of the Act (21 
U.S.C. 831(a)) with respect to the delivery or sale or offer for sale 
of controlled substances. This requirement is reiterated in the 
regulations being issued here in 21 CFR 1304.45(a). This regulation 
does not require specific language to be used for this statement, but 
the statement must include the name of the pharmacy as displayed on its 
DEA Certificate of Registration and clearly state that the pharmacy is 
in compliance with 21 U.S.C. 831(a). The following is an example of a 
statement a pharmacy may post on its Web site that would meet the 
requirements of this provision:

    XYZ Pharmacy is in full compliance with the requirements of 
section 311(a) of the Controlled Substances Act (21 U.S.C. 831(a)) 
with respect to the delivery or sale or offer for sale of controlled 
substances.

E. Internet Pharmacy Site Disclosure Information

    The Act \50\ and the regulations being issued here (21 CFR 
1304.45(b)) require that each online pharmacy shall post in a visible 
and clear manner on the homepage of each Internet Web site it operates, 
or on a page directly linked thereto in which the hyperlink is also 
visible and clear on the homepage, the following information for each 
pharmacy that delivers, distributes, or dispenses controlled substances 
pursuant to orders made on, through, or on behalf of, that Web site:
---------------------------------------------------------------------------

    \50\ 21 U.S.C. 831(c).
---------------------------------------------------------------------------

     The name and address of the pharmacy as it appears on the 
pharmacy's DEA Certificate of Registration.
     The pharmacy's telephone number and active business e-mail 
address.
     The name, professional degree, and States of licensure of 
the pharmacist-in-charge, and a telephone number at which the 
pharmacist-in-charge can be contacted.
     A list of the States in which the pharmacy is licensed to 
dispense controlled substances.
     A certification that the pharmacy is registered under 21 
CFR Part 1301 to deliver, distribute, or dispense controlled substances 
by means of the Internet.
     The name, address, telephone number, professional degree, 
and States of licensure with State license number of any practitioner 
who has a contractual relationship to provide medical evaluations or 
issue prescriptions for controlled substances, through referrals from 
the Web site or at the request of the owner or operator of the Web 
site, or any employee or agent thereof.
     The following statement: ``This online pharmacy is 
obligated to comply fully with the Controlled Substances Act and DEA 
regulations. As part of this obligation, this online pharmacy has 
obtained a modified DEA registration authorizing it to operate as an 
online pharmacy. In addition, this online pharmacy will only dispense a 
controlled substance to a person who has a valid prescription issued 
for a legitimate medical purpose based upon a medical relationship with 
a prescribing practitioner. This includes at least one prior in-person 
medical evaluation in accordance with section 309 of the Controlled 
Substances Act (21 U.S.C. 829) or a medical evaluation via telemedicine 
in accordance with section 102(54) of the Controlled Substances Act (21 
U.S.C. 802(54)).''
    The following is a hypothetical example of a statement that would 
comply with all of the requirements of 21 CFR 1304.45(b) (assuming the 
assertions were true):

XYZ Pharmacy,
1 Main Street,
[City, State, zip code],
[Area code and telephone number],
[email protected].
John H. Smith, R.Ph., Pharmacist-in-Charge, licensed in State.

    The XYZ Pharmacy is in full compliance with the requirements of 
section 311(a) of the Controlled Substances Act (21 U.S.C. 831(a)). 
XYZ Pharmacy is licensed in [State(s)] to dispense controlled 
substances. The pharmacist-in-charge may be contacted at the above 
telephone number. XYZ Pharmacy does not have any contractual 
relationships with any practitioner to provide medical evaluations 
or issue prescriptions for controlled substances through referrals 
from this Web site or at the request of the owner or operator of 
this Web site, or any employee or agent thereof. This online 
pharmacy is obligated to comply fully with the Controlled Substances 
Act and DEA regulations. As part of this obligation, this online 
pharmacy has obtained a modified DEA registration authorizing it to 
operate as an online pharmacy. In addition, this online pharmacy 
will only dispense a controlled substance to a person who has a 
valid prescription issued for a legitimate medical purpose based 
upon a medical relationship with a prescribing practitioner. This 
includes at least one prior in-person medical evaluation in 
accordance with section 309 of the Controlled Substances Act (21 
U.S.C. 829) or a medical evaluation via telemedicine in accordance 
with section 102(54) of the Controlled Substances Act (21 U.S.C. 
802(54)).

F. Declaration of Compliance

    On and after the date on which an online pharmacy makes the 
notification and applies for a modified registration, it must display, 
on the homepage of its Web site, a declaration that it has made such 
notification/application to the Administrator.

G. Reporting

    The Act requires,\51\ and 21 CFR 1304.55 reiterates, that each 
online pharmacy must submit a monthly report to the Administrator of 
the total quantity of each controlled substance it has dispensed the 
previous calendar month. This report will be due on or before the 15th 
day of the following month. The report must include the total amount of 
such dispensing by any means, including all controlled substances 
dispensed via Internet transactions, mail-order transactions, face-to-
face transactions, or any other means. It is not required that the 
online pharmacy identify the means of the dispensing in its report. The 
report is required for every month in which the total amount of 
dispensing of controlled substances by the pharmacy is either (i) over 
100 prescriptions filled or (ii) 5,000 or more dosage units dispensed 
of all controlled substances combined.
---------------------------------------------------------------------------

    \51\ 21 U.S.C. 827(d)(2).
---------------------------------------------------------------------------

    Each online pharmacy shall report a negative response to the 
Administrator if, during a given calendar month, its total quantity of 
dispensing of controlled substances falls below both of the thresholds 
listed above.
    The reporting required by online pharmacies under 21 CFR 1304.55 
must

[[Page 15613]]

be submitted to the Administrator electronically via online reporting, 
electronic file upload, or other means as approved by DEA. The report 
shall identify controlled substances by National Drug Code (NDC) number 
assigned to the product under the National Drug Code System of the Food 
and Drug Administration.
    Online pharmacies must maintain these records for at least two 
years. The information must be easily accessible and available for 
inspection by authorized DEA employees.
    A pharmacy that has changed its registration status from that of an 
online pharmacy back to a retail pharmacy remains responsible for 
submitting reports in accordance with Sec.  1304.55 of this chapter 
with respect to any controlled substances that it dispensed while it 
was registered with a modification authorizing it to operate as an 
online pharmacy.

IX. Section-by-Section Discussion of the Interim Final Rule

    In part 1300, new Sec.  1300.04, containing definitions relating to 
the dispensing of controlled substances by means of the Internet, is 
added. These definitions are from the definitions contained in the Ryan 
Haight Act. This includes definitions of the terms ``covering 
practitioner,'' ``deliver, distribute or dispense by means of the 
Internet,'' ``filling new prescriptions for controlled substances in 
Schedule III, IV, or V,'' ``homepage,'' ``in-person medical 
evaluation,'' ``Internet,'' ``online pharmacy,'' ``practice of 
telemedicine,'' ``refilling prescriptions for controlled substances in 
Schedule III, IV, or V,'' ``valid prescription,'' and the temporary 
definition of ``practice of telemedicine.'' However, please note that 
the regulations being issued here expand upon the exceptions to the 
definition of an online pharmacy contained in the Act. Specifically, as 
discussed above, the regulations add two exceptions to the definition 
of ``online pharmacy'': One relating to electronic prescriptions for 
controlled substances issued in a manner permitted by the DEA 
regulations and another relating to the utilization by retail 
pharmacies of automated dispensing systems at long term care facilities 
in a manner permitted by the DEA regulations.
    In part 1301 (registration of manufacturers, distributors, and 
dispensers of controlled substances), new Sec.  1301.11(b) restates the 
requirements of the Act that any person falling within the definition 
of an online pharmacy must be validly registered with a modification 
authorizing it to operate as an online pharmacy and that only 
pharmacies registered under 21 U.S.C. 823(f) may apply for such 
modification.
    To address the modification of registration as an online pharmacy, 
the table in Sec.  1301.13(e)(1) is amended in ``(iv) Dispensing or 
instructing'' to specify the application for an online pharmacy. A 
comment has been added in the ``Coincident activities allowed'' column 
to explain that an online pharmacy may perform the activities of both a 
retail and online pharmacy.
    New Sec.  1301.19 (special requirements for online pharmacies) 
provides in paragraphs (a), (c), and (f) that a pharmacy must request a 
modification of its registration authorizing it to operate as an online 
pharmacy by completing the online application process. This section 
also provides, consistent with the Ryan Haight Act, that a pharmacy 
registrant may not operate as an online pharmacy until the DEA 
Administrator grants the modified registration. Paragraph (b) requires, 
consistent with the Ryan Haight Act, that an online pharmacy must 
comply with the pharmacy license requirements of not only the State 
where it is located, but also of any State to which it delivers, 
distributes, or dispenses controlled substances. Paragraph (d) requires 
a pharmacy that seeks to discontinue its authorization to operate as an 
online pharmacy to modify its registration to reflect this change in 
its business activity.
    Section 1301.52, which addresses termination of registrations, is 
revised to include modification of registration within the meaning of 
the Act.
    Four new sections are added to 21 CFR part 1304 (records and 
reports of registrants) to implement the reporting requirements of the 
Ryan Haight Act for online pharmacies, and to specify the information 
the Act requires to be posted on an online pharmacy's Web site. New 
Sec.  1304.40(a) requires online pharmacies to notify the Administrator 
and State boards of pharmacy 30 days before offering to fill 
prescriptions for controlled substances. Notification to the DEA 
Administrator will be made by applying for a modification of DEA 
registration. Paragraph (b) of Sec.  1304.40 contains a list of items 
that must be included in the notification. Paragraph (c) requires 
online pharmacies in operation at the time the Ryan Haight Act becomes 
effective (April 13, 2009) to make this notification by May 13, 2009, 
but this paragraph also makes clear that, as of April 13, 2009, it is 
unlawful for any person to operate as an online pharmacy unless it has 
obtained from DEA a modification of its registration authorizing it to 
do so. In addition, paragraph (d) requires that on and after an online 
pharmacy makes notification under this section, it shall display a 
declaration that it has done so. Under Sec.  1304.40(e), an online 
pharmacy must notify the Administrator of any changes to the 
information submitted in its notification thirty days prior to the 
change.
    New section 1304.45 specifies the data elements required to be 
posted on the Web site of online pharmacies in a visible and clear 
manner, as provided in the Act.
    To identify Web sites that are operating solely on behalf of DEA-
registered nonpharmacy practitioners who are acting within the scope of 
their registrations (and thereby exempt from the definition of an 
online pharmacy), new Sec.  1304.50 requires such Web sites that 
dispense controlled substances by means of the Internet to display in a 
visible and clear manner a list of those DEA-registered nonpharmacy 
practitioners affiliated with the Web site.
    New Sec.  1304.55 implements the requirement of the Act that each 
online pharmacy make a monthly report to DEA stating the total quantity 
of each controlled substance the pharmacy has dispensed the previous 
calendar month. This report must include not only the transactions made 
through the online pharmacy, but also any that the pharmacy made 
through mail order, face-to-face, or any other transaction when the 
pharmacy's total dispensing of controlled substances meets or exceeds 
the monthly threshold of either 100 prescriptions filled or 5,000 or 
more dosage units dispensed. Online pharmacies that do not meet this 
threshold in a given month are required to so notify DEA.
    In part 1306 (prescriptions), new Sec.  1306.09 includes 
requirements for prescriptions that track the requirements of the Act. 
Paragraph (a) specifies that no controlled substance may be delivered, 
distributed, or dispensed by means of the Internet without a valid 
prescription (using the definition of a valid prescription contained in 
the Act). Also consistent with the Act, paragraph (b) provides that a 
prescription may only be filled by a pharmacy whose registration has 
been modified as specified in the Act. Finally, paragraph (c) applies 
to online pharmacies the requirements of sections 1306.15 and 1306.25 
regarding transfers of prescriptions between pharmacies.

[[Page 15614]]

X. Regulatory Certifications

A. Administrative Procedure Act

    The Administrative Procedure Act (APA) generally requires agencies 
to publish a notice of proposed rulemaking and allow for a period of 
public comment prior to implementing new rules. The APA also provides, 
however, that agencies can be excepted from these requirements ``when 
the agency for good cause finds (and incorporates the finding and a 
brief statement of reasons therefor in the rules issued) that notice 
and public procedure thereon are impracticable, unnecessary, or 
contrary to the public interest.'' 5 U.S.C. 553(b)(B). DEA has 
concluded that ``good cause'' exists to promulgate this rule as an 
Interim Final Rule rather than a proposed rule for the following 
reasons.
    As explained above, the Ryan Haight Act contains the following 
provision specifically addressing the issuance of interim rules to 
implement the Act:

    The [DEA Administrator] may promulgate and enforce any rules, 
regulations, and procedures which may be necessary and appropriate 
for the efficient execution of functions under this Act or the 
amendments made by this Act, and, with the concurrence of the 
Secretary of Health and Human Services where this Act or the 
amendments made by this Act so provide, promulgate any interim rules 
necessary for the implementation of this Act or the amendments made 
by this Act, prior to its effective date.\52\
---------------------------------------------------------------------------

    \52\ Public Law 110-425, sec. 3(k)(1).

    It is evident from the foregoing provision that Congress envisioned 
that DEA might need to issue regulations on an interim basis to 
implement the Ryan Haight Act prior to the Act's effective date (April 
13, 2009). This provision indicates that, given the 180 days between 
enactment of the Act and its effective date, Congress recognized it 
could be impracticable for DEA to complete notice-and-comment 
rulemaking within a time frame that would have allowed for regulations 
to become effective prior to the effective date of the Act. Similarly, 
this provision indicates that Congress believed it would be contrary to 
the public interest to delay the promulgation of regulations in a 
manner that would prevent implementation of the Act upon its effective 
date. Delaying the effective date of the regulations past the effective 
date of the Act would also be confusing to the public and would 
frustrate the intent of Congress to have the new provisions of the Act 
take effect on April 13, 2009. Accordingly, the rules published here 
are effective immediately while at the same time the agency is seeking 
public comment on them.
    Under the APA, 5 U.S.C. 553(d), agencies must generally provide a 
30-day delayed effective date for final rules. An agency may dispense 
with the 30-day delayed effective date requirement ``for good cause 
found and published with the rule.'' 5 U.S.C. 553(d)(3). For the 
reasons just discussed, DEA concludes that such good cause exists to 
justify an immediate effective date. In addition to the reasons 
provided above, DEA had to make this rule effective immediately to have 
in place regulatory procedures that will allow legitimate pharmacies 
that wish to conduct activity as an ``online pharmacy'' to do so upon 
the effective date of the Act. With the immediate effective date of 
these regulations, pharmacies may, sufficiently in advance of the 
effective date of the Act, submit applications to modify their 
registrations as required by the Act.

B. Executive Order 12866

    The Deputy Administrator certifies that this rulemaking has been 
drafted in accordance with the principles in Executive Order 12866 
Section 1(b). It has been determined that this is ``a significant 
regulatory action.'' Therefore, this action has been reviewed by the 
Office of Management and Budget. As discussed above, this action is 
largely codifying statutory provisions and involves limited agency 
discretion.
    Costs. It should be noted that the costs identified here are costs 
associated with activities that online pharmacies are obligated to 
carry out to comply with the statutory requirements of the Ryan Haight 
Act. The regulatory provisions listed here are those which carry 
forward the statutory requirements mandated by the Act.
    Pharmacies with existing online operations and those that wish to 
begin dispensing controlled substances by means of the Internet must 
apply to DEA to modify their registrations. Section 1304.40 requires 
notification to DEA. The application for modification of registration 
includes the notifications required by the Act; application to DEA is 
made with an online form. The information required is straightforward: 
Names, addresses, telephone numbers, the name, professional degree, and 
telephone number of the pharmacist-in-charge, and required 
certifications.
    Assembly of this information and putting it in the online form in 
the proper manner can be accomplished by a pharmacist (Standard 
Occupational Code (SOC) 29-1051). The information required for the 
online pharmacy Web site is largely the same as that required for the 
notification, so the pharmacist's work will also provide the 
information needed for the Web site.
    Since an online pharmacy must have a Web site to operate, the 
initial cost of setting up the Web site is not a cost of the rule. (In 
fact, it is now commonplace for even small retail establishments to 
have Web sites.) The only cost is that of entering the required 
information and certifications on the site. Given that the site is 
already, or must be, in place, DEA estimates that such revisions will 
be relatively minor in nature. Modification of the Web site to include 
the required information will, however, require additional work--work 
that requires some technical expertise with computer systems and 
programs, including Web sites. DEA expects that a computer support 
specialist (SOC 15-1041) will be required for this work.
    Completion of the online application for modification of 
registration will require fifteen minutes of the pharmacist's time and 
half an hour of the computer support specialist's time to update the 
Web site with the required information. The Web site will require 
ongoing maintenance as information changes. This will require one hour 
per year of the computer-support specialist's time.
    Section 1304.55 requires online pharmacies to report to DEA the 
total quantity of each controlled substance that the pharmacy has 
dispensed each calendar month. The report must include the total 
quantity of such dispensing by any means, regardless of whether the 
controlled substances are dispensed by means of the Internet. Such 
reporting is required for every calendar month in which the total 
quantity of controlled substances dispensed by the pharmacy meets or 
exceeds one of the following thresholds: 100 or more prescriptions for 
controlled substances filled; or 5,000 or more dosage units dispensed 
of all controlled substances combined.
    Such reporting is not required now from pharmacies of any kind. 
Based upon common industry practice, DEA believes that virtually all 
pharmacies will have internal electronic recordkeeping systems which 
will include the necessary data. A computer programmer (SOC 15-1021) 
will be required to set up a system that will extract the required data 
from existing records and put it in a form that meets the rule and is 
suitable for transmission to DEA. DEA estimates that the initial set-up 
will take two hours of the programmer's time. DEA expects that 
maintenance of the reporting system will not entail any increment in 
cost

[[Page 15615]]

beyond the initial work of setting up the system. DEA further assumes 
that a pharmacist will require ten minutes per month to transmit the 
monthly report to DEA.
    Table 1 presents initial unit costs.

                                           Table 1--Initial Unit Costs
----------------------------------------------------------------------------------------------------------------
                                                                   Unit time (in   Hourly wage,
                           Requirement                                hours)       fully loaded      Unit cost
----------------------------------------------------------------------------------------------------------------
Application for Modification of Registration (pharmacist).......            0.25         $104.40          $26.10
Revision of pharmacy Web site (computer support specialist).....            0.5            47.79           23.89
Establishing reporting system (programmer)......................            2.0            75.96          151.93
                                                                 -----------------------------------------------
    Total.......................................................  ..............  ..............          201.92
----------------------------------------------------------------------------------------------------------------

    Annual ongoing costs for online pharmacies comprise the cost of 
filing monthly reports with DEA and revising the pharmacy Web site as 
needed to comply with the requirements of the Act. As noted previously, 
DEA assumes that Web site modifications can be handled by a computer 
support specialist. DEA assumes one hour per year of a computer support 
specialist's time for those modifications and two hours a year for the 
pharmacist to file the reports. Table 2 presents annual ongoing costs 
for online pharmacies.

                                          Table 2--Annual Ongoing Costs
----------------------------------------------------------------------------------------------------------------
                                                                   Unit time (in   Hourly wage,
                           Requirement                                hours)       fully loaded      Unit cost
----------------------------------------------------------------------------------------------------------------
Pharmacy Web site modification (computer support specialist)....             1.0          $47.79          $47.79
Sending monthly report to DEA (pharmacist)......................             2.0          104.40          208.80
                                                                 -----------------------------------------------
    Total.......................................................  ..............  ..............          256.59
----------------------------------------------------------------------------------------------------------------

    Total costs. To estimate total costs, it is necessary to estimate 
the number of firms that will seek to modify their registration to that 
of online pharmacies. DEA estimates that 250 pharmacies will initially 
apply for such modification of registration. It is also necessary to 
estimate the number of pharmacies that will apply for such modification 
of registration in the future. DEA estimates that there would be a 
moderate number of registrants applying to modify their registrations 
in the two years after the first year as some other pharmacies find 
advantage in an online presence. After that, DEA estimates the number 
of pharmacies applying to modify their registrations will decline 
steadily, as few pharmacies will find benefit. Each year it is expected 
that a number of registrants applying to modify their registrations may 
drop out for various reasons. The total number of pharmacies in the 
United States has been declining. Data from the Economic Census 
indicate that the number of retail pharmacies fell at an annual rate of 
1.7 percent from 1998 through 2006.\53\ DEA estimates that the number 
of online pharmacy registrants will decline at a slightly faster rate, 
because some pharmacies will drop their online pharmacy registrations 
but stay in business as retail pharmacies. DEA estimates an annual 
attrition rate of 2.0 percent for online pharmacies. The table below 
shows the estimated number of online pharmacy registrations and 
registrants in operation, year by year.
---------------------------------------------------------------------------

    \53\ Economic Census, Statistics of U.S. Businesses, 2006, 
available at http://www.census.gov/epcd/susb/latest/us/US44.HTM#N446.

                  Table 3--Online Pharmacy Registrants
------------------------------------------------------------------------
                                                          Registrants in
                                         Registrations      operation
------------------------------------------------------------------------
Year 1................................              250              250
Year 2................................               30              275
Year 3................................               25              295
Year 4................................               20              309
Year 5................................               20              322
Year 6................................               10              326
Year 7................................               10              329
Year 8................................               10              333
Year 9................................                9              335
Year 10...............................                8              337
Year 11...............................                7              337
Year 12...............................                6              336
Year 13...............................                5              334
Year 14...............................                5              333
Year 15...............................                5              331
------------------------------------------------------------------------

    To obtain undiscounted costs, year by year, the unit cost 
estimates--$201.92 for initial start-up, $256.59 for ongoing costs--are 
applied, respectively, to the number of online pharmacy registrations 
and the number of operating registrants in each year. The results are 
shown in the following table.

                    Table 4--Undiscounted Total Costs
------------------------------------------------------------------------
                                           Initial   Ongoing     Total
------------------------------------------------------------------------
Year 1..................................   $50,480   $64,147    $114,628
Year 2..................................     6,058    70,562      76,620
Year 3..................................     5,048    75,566      80,614
Year 4..................................     4,038    79,186      83,225
Year 5..................................     4,038    82,734      86,773
Year 6..................................     2,019    83,646      85,665
Year 7..................................     2,019    84,538      86,558
Year 8..................................     2,019    85,414      87,433
Year 9..................................     1,817    86,015      87,832
Year 10.................................     1,615    86,347      87,962
Year 11.................................     1,413    86,416      87,830
Year 12.................................     1,212    86,227      87,439
Year 13.................................     1,010    85,786      86,795
Year 14.................................     1,010    85,353      86,363
Year 15.................................     1,010    84,929      85,939
------------------------------------------------------------------------

    Table 5 shows the present value and annualized cost at 7.0 percent 
and 3.0 percent discount rates, over fifteen years.

               Table 5--Present Value and Annualized Costs
------------------------------------------------------------------------
                                                       7.0        3.0
                                                     Percent    Percent
------------------------------------------------------------------------
Year 1............................................   $114,628   $114,628
Year 2............................................     71,607     74,388
Year 3............................................     70,411     75,986
Year 4............................................     67,936     76,162
Year 5............................................     66,198     77,096
Year 6............................................     61,078     73,895
Year 7............................................     57,677     72,491
Year 8............................................     54,449     71,091

[[Page 15616]]

 
Year 9............................................     51,119     69,335
Year 10...........................................     47,846     67,416
Year 11...........................................     44,648     65,354
Year 12...........................................     41,542     63,168
Year 13...........................................     38,538     60,877
Year 14...........................................     35,837     58,809
Year 15...........................................     33,328     56,816
                                                   ---------------------
    Total.........................................    856,843  1,077,511
                                                   =====================
    Annualized....................................     94,077     90,259
------------------------------------------------------------------------

    The costs are relatively modest; the annualized sum of the present 
values is less than $100,000 at both discount rates. Further, Table 4 
shows that the undiscounted annual cost never exceeds $100,000 after 
the first year with its relatively large number of registrations.
    Benefits. The Ryan Haight Online Pharmacy Consumer Protection Act 
is designed to save lives by reducing deaths from drug overdoses and 
otherwise lessen the detrimental consequences of pharmaceutical 
controlled substance abuse by restricting the ability of rogue Internet 
pharmacies to illegally divert dangerous controlled substance 
prescription drugs to millions of people, including teens, without 
valid prescriptions issued under a legitimate physician's care.\54\ The 
regulations promulgated based on this legislation will address the 
``wide-open channel of distribution'' that currently exists for 
prescription controlled substances sold over the Internet, which 
represents an ``easy availability [that] has enormous implications for 
public health, particularly the health of our children.\55\ A key 
provision of this law, the requirement for practitioners to conduct at 
least one in-person medical evaluation of the patient before they 
prescribe a prescription for a controlled substance, is a major step 
toward combating the use of the Internet to facilitate illegal sales of 
pharmaceutical controlled substances. Also, requiring online pharmacies 
to post the required site disclosure information, certifications, and 
other information on their homepage provides consumers with enhanced 
tools to determine the legitimacy of the online pharmacy.
---------------------------------------------------------------------------

    \54\ Office of National Drug Control Policy, Press Release, 
March 1, 2008, available at http://www.ondcp.gov/pda/030108.html.
    \55\ S. Rep. No. 110-521, at 68 (2008).
---------------------------------------------------------------------------

C. Regulatory Flexibility Act

    The Deputy Administrator hereby certifies that this rulemaking has 
been drafted in accordance with the Regulatory Flexibility Act (RFA) (5 
U.S.C. 601-612). The RFA applies to a rule that is published by the 
agency as a notice of proposed rulemaking. As explained above, the Ryan 
Haight Act expressly contemplates that DEA will issue interim rules 
under the ``good cause'' provision of the APA as the agency deems 
necessary to implement the Act prior to its effective date (April 13, 
2009). Thus, Congress has expressly granted DEA authority to issue 
regulations to implement the Act that become effective immediately 
without the requirement of first seeking public comment through a 
notice of proposed rulemaking. Consequently, the requirements of the 
RFA do not apply to this rule.
    It also should be noted that only a limited portion of the 
regulatory text being issued here is subject to modification following 
the comment period as the bulk of the regulatory text is taken verbatim 
from, and mandated by, the Ryan Haight Act. DEA is seeking public 
comment with respect to those parts of the regulatory text about which 
the agency has discretion.
    Although the RFA does not apply to this Interim Final Rule, DEA has 
reviewed the potential impacts. The rule is likely to affect a 
substantial number of small entities, but DEA does not believe that it 
will have a significant economic impact on small entities.
    DEA is uncertain which pharmacies will apply to modify their 
registrations to that of online pharmacies. While it is possible that 
such applicants will be a mixture of independent pharmacies and chains, 
DEA believes it unlikely that many chain pharmacies will fall within 
the definition of an online pharmacy and thereby need to apply for the 
modified registration. As discussed previously, the Ryan Haight Act 
contains several exceptions to the definition of ``online pharmacy'' 
including the exception set forth in 21 U.S.C. 802(52)(B)(viii) that 
excludes from the definition of an online pharmacy those DEA-registered 
pharmacies ``whose dispensing of controlled substances via the Internet 
consists solely of * * * (I) refilling prescriptions for controlled 
substances in schedule III, IV, or V, as defined in paragraph [21 
U.S.C. 802(55)] or (II) filling new prescriptions for controlled 
substances in schedule III, IV, or V, as defined in paragraph [21 
U.S.C. 802(56)].'' Also, the regulations being issued here exempt from 
the definition of online pharmacy any registered pharmacy ``whose 
delivery, distribution, or dispensing of controlled substances by means 
of the Internet consists solely of * * * filling prescriptions that 
were electronically prescribed in a manner authorized by this chapter 
and otherwise in compliance with the Act.'' Given these exceptions to 
the definition of an online pharmacy, DEA anticipates that the 
overwhelming majority of pharmacies in the United States, if they 
follow their current practices, will not, as of April 13, 2009, fall 
within the definition of an online pharmacy.
    Further, as DEA stated previously, as long as the pharmacist meets 
his corresponding responsibility to take reasonable steps under the 
circumstances of the dispensing of any particular prescription to 
ensure that the prescription was issued in accordance with the 
requirements of the Ryan Haight Act (as well as all other applicable 
requirements of the CSA and DEA regulations), the pharmacist will not 
be held strictly liable for filling a prescription that he could not 
reasonably have known was issued by means of the Internet. Thus, it is 
absolutely unnecessary for a pharmacy to apply for a modification of 
its DEA registration authorizing it to operate as an online pharmacy 
for the sole purpose of ensuring that it does not--despite the exercise 
of sound professional judgment--inadvertently fill a prescription that 
was issued by means of the Internet.
    The small-business size standard for retail pharmacies is annual 
revenue of $7.0 million.\56\ From the 2002 Economic Census, there are 
data on revenue of pharmacies by revenue class. The class with the 
lowest average revenue is pharmacies with sales of less than $250,000 
per year. Average revenue for this group is $132,000. Table 6 shows 
Small Business Administration standards for these and larger firms that 
dispense controlled substances.
---------------------------------------------------------------------------

    \56\ Small Business Administration, Table of Small Business Size 
Standards, August 22, 2008.

[[Page 15617]]



               Table 6--SBA Definitions of Small Entities
------------------------------------------------------------------------
                                                               Small
                                                             business
          Industry description              NAICS code      definition
                                                           (sales in $)
------------------------------------------------------------------------
Pharmacies and Drug Stores..............          446110       7,000,000
Supermarkets and Other Grocery Stores...          445110      27,000,000
Discount Department Stores..............          452112      27,000,000
Warehouse Clubs and Supercenters........          452910      25,000,000
Mail Order Houses.......................          454113      25,000,000
------------------------------------------------------------------------

    DEA estimates the annual cost of compliance with the Interim Final 
Rule for an individual pharmacy is the annualized sum of the present 
value of a 15-year stream of ongoing costs and the initial start-up 
cost. Table 7 shows these values for 7.0 percent and 3.0 percent 
discount rates. The result is annualized cost of about $275. Even for 
the smallest pharmacies, that is not a significant economic impact.\57\
---------------------------------------------------------------------------

    \57\ Economic Census, Establishment and Firm Size, 2002, Table 
4.

             Table 7--Annualized Cost for an Online Pharmacy
------------------------------------------------------------------------
                                            7.0 Percent     3.0 Percent
------------------------------------------------------------------------
Annual Ongoing Cost.....................         $256.59         $256.59
PV of Ongoing Cost......................        2,337.00        3,063.15
Initial Cost............................          201.92          201.92
Sum of PV and Initial Cost..............        2,538.92        3,265.07
Annualized Cost.........................          278.76          273.50
------------------------------------------------------------------------

D. Paperwork Reduction Act

    The Ryan Haight Act requires pharmacies that dispense controlled 
substances by means of the Internet to obtain a modification of their 
existing DEA registration to that of an online pharmacy (21 U.S.C. 
823(f), 21 CFR 1301.11). To address this, DEA is revising its existing 
information collection, ``Application for Registration (DEA Form 224), 
Application for Registration Renewal (DEA Form 224a), Affidavit for 
Chain Renewal (DEA Form 224b)'' [information collection 1117-0014] to 
add an Application for Modification of Registration for Online 
Pharmacies (DEA Form 224c). This form will be completed online by 
pharmacies requesting to modify their registrations to that of an 
online pharmacy.
    Application for modification of registration--The application for 
modification of registration will require an online pharmacy applicant 
to provide to DEA certain information, as discussed above. For purposes 
of this reporting, DEA believes that the Internet Pharmacy Site 
Disclosure information that applicants must supply will be immediately 
obtainable with minimal effort. Information such as the pharmacy's 
name, registration number, and contact information will be populated by 
DEA on the online form completed by the pharmacy applicant. Contact 
information for the pharmacist-in-charge should be readily available. 
State licensure information should be readily available as well.
    DEA believes that very few legitimate pharmacies (i.e., those that 
comply with the law) will be affiliated with more than one Web site. 
Nor does it seem likely that such pharmacies will have contractual 
relationships with practitioners to issue prescriptions for controlled 
substances through referrals from the Web site or at the request of the 
owner or operator of the Web site, or any employee or agent thereof. 
Thus, DEA believes that the reporting of this type of information 
should be minimal, if at all, and will not be burdensome for the vast 
majority of the limited number of pharmacies likely to apply to modify 
their registrations.
    DEA believes that the certifications required of the online 
pharmacies are straightforward and can easily be included on 
pharmacies' Web sites and reported to DEA. DEA has provided examples of 
those certifications for potential use by pharmacies applying to modify 
their registrations.
    While the new reporting and application requirements will request 
information not previously requested by DEA (as the Ryan Haight Act 
mandates), DEA believes that much of the information required to be 
provided as part of the applications is readily available and 
retrievable, thus limiting the impact of the burden for completion of 
this application.
    DEA estimates that 250 pharmacies will apply to modify their 
registrations to that of online pharmacies. DEA estimates that it will 
take a pharmacy 15 minutes (0.25 hours) to complete an Application for 
Modification of Registration for Online Pharmacies (DEA Form 224c), and 
that it will take an online pharmacy 15 minutes (0.25 hours) to renew 
its online pharmacy registration. DEA notes that the Application for 
Modification of Registration for Online Pharmacies (DEA Form 224c) is 
completed and submitted online through the DEA Office of Diversion 
Control Web site. Because those applying for a modification of 
registration must already be registered with DEA, the overall number of 
respondents will not change. To account for the new requirement, the 
number of respondents using DEA-224a has been reduced by the 250 
respondents DEA estimates will apply for a modification using DEA-224c. 
As a result, the total burden for DEA-224a has been reduced by 16.7 
hours. DEA estimates that DEA-224c will have a total of 62.5 burden 
hours for an overall increase of 46.2 burden hours.
    Reports of dispensing of controlled substances by online 
pharmacies--The Ryan Haight Act requires those pharmacies with modified 
registrations to report certain information regarding their dispensing 
of controlled

[[Page 15618]]

substances to DEA. Specifically, online pharmacies are required to 
report to DEA the total quantity of controlled substances that the 
pharmacy has dispensed during each calendar month by any means, 
regardless of whether the controlled substances are dispensed by means 
of the Internet. Reports are required to be filed by every pharmacy 
that, at any time during a calendar month, holds a modified 
registration authorizing it to operate as an online pharmacy, 
regardless of whether the online pharmacy dispenses any controlled 
substances by means of the Internet during the month. Reports are 
required when the total quantity of controlled substances dispensed 
meets or exceeds either 100 or more prescriptions for controlled 
substances filled, or 5,000 or more dosage units dispensed of all 
controlled substances combined, in the calendar month for which 
reporting is required. If a pharmacy fills fewer than 100 prescriptions 
for controlled substances, and dispenses fewer than 5,000 dosage units 
of all controlled substances combined, in the calendar month for which 
reporting is required, a negative response indicating that reporting is 
not required must be received by DEA. Thus, each online pharmacy will 
report every month to DEA, either by providing actual dispensing 
information or by providing a negative response.
    DEA believes that, of the limited number of pharmacies expected to 
be subject to the reporting requirement of the Act, few are likely to 
submit negative responses. It is reasonable to assume that online 
pharmacies subject to the reporting requirement will either fill 100 or 
more prescriptions for controlled substances, or 5,000 or more dosage 
units of all controlled substances combined, in any calendar month. 
Therefore, DEA has assumed for purposes of these estimates that all 
online pharmacies will report dispensing information to DEA.
    DEA estimates that 250 online pharmacies will file monthly reports 
with DEA regarding their dispensing of controlled substances. DEA 
estimates that it will take each pharmacy 10 minutes to file this 
report.
    The Department of Justice, Drug Enforcement Administration, has 
submitted the following information collection requests to the Office 
of Management and Budget (OMB) for review and clearance in accordance 
with the review procedures of the Paperwork Reduction Act of 1995. The 
information collections are published to obtain comments from the 
public and affected agencies.
    All comments and suggestions, or questions regarding additional 
information, to include obtaining a copy of the proposed information 
collection instrument with instructions, should be directed to Mark W. 
Caverly, Chief, Liaison and Policy Section, Office of Diversion 
Control, Drug Enforcement Administration, 8701 Morrissette Drive, 
Springfield, VA 22152, Telephone (202) 307-7297.
    Written comments and suggestions from the public and affected 
agencies concerning the required collections of information are 
encouraged. Your comments on the information collection-related aspects 
of this rule should address one or more of the following four points:
     Evaluate whether the collection of information is 
necessary for the proper performance of the functions of the agency, 
including whether the information will have practical utility.
     Evaluate the accuracy of the agency's estimate of the 
burden of the proposed collection of information, including the 
validity of the methodology and assumptions used.
     Recommendations to enhance the quality, utility, and 
clarity of the information to be collected.
     Recommendations to minimize the burden of the collection 
of information on those who are to respond, including through the use 
of appropriate automated, electronic, mechanical, or other 
technological collection techniques or other forms of information 
technology, e.g., permitting electronic submission of responses.
    Overview of information collection 1117-0014:
    (1) Type of Information Collection: Revision of a currently 
approved collection.
    (2) Title of the Form/Collection:
    Application for Registration (DEA Form 224);
    Application for Registration Renewal (DEA Form 224a);
    Affidavit for Chain Renewal (DEA Form 224b);
    Application for Modification of Registration for Online Pharmacies 
(DEA Form 224c)
    (3) Agency form number, if any, and the applicable component of the 
Department of Justice sponsoring the collection:
    Form Number: DEA Form 224, 224a, 224b, 224c;
    Component: Office of Diversion Control, Drug Enforcement 
Administration, U.S. Department of Justice.
    (4) Affected public who will be asked or required to respond, as 
well as a brief abstract:
    Primary: Business or other for-profit.
    Other: Not-for-Profit Institutions; State, Local or Tribal 
Government.
    Abstract: All firms and individuals who distribute or dispense 
controlled substances must register with the DEA under the Controlled 
Substances Act. Pharmacies wishing to be online pharmacies must apply 
to modify their registrations. Such registration is mandatory under the 
law and needed for control measures over legal handlers of controlled 
substances and to monitor their activities.
    (5) An estimate of the total number of respondents and the amount 
of time estimated for an average respondent to respond is provided in 
the table below. Please note that the number of respondents using DEA-
224a has been reduced by the 250 respondents that DEA estimates will 
apply for a modification using DEA-224c. Because those applying for a 
modification of registration must be currently registered with DEA, the 
overall number of respondents will not increase. The total response 
time has increased by 46.2 hours as a result of the 11 additional 
minutes it is estimated it will take each respondent to complete DEA-
224c as compared to DEA-224a.

----------------------------------------------------------------------------------------------------------------
                                                              Number of                             Total  (in
               Form                       Completed          respondents     Time per response        hours)
----------------------------------------------------------------------------------------------------------------
Application for Registration (DEA-  Paper................          12,094  0.2 hours (12                 2,418.8
 224).                                                                      minutes).
Application for Registration (DEA-  Electronic...........          59,283  0.13 hours (8                 7,904.4
 224).                                                                      minutes).
Application for Registration        Paper................         159,678  0.2 hours (12                31,935.6
 Renewal (DEA-224a).                                                        minutes).
Application for Registration        Electronic...........         209,285  0.06 hours (4                13,952.3
 Renewal (DEA-224a).                                                        minutes).
Affidavit for Chain Renewals (DEA-  Electronic...........              16  5 hours.............             80
 224b).
Application for Modification of     Electronic...........             250  0.25 hours (15                   62.5
 Registration for Online                                                    minutes).
 Pharmacies (DEA-224c).
                                   -----------------------------------------------------------------------------

[[Page 15619]]

 
    Total.........................  .....................         440,606  ....................         56,354
----------------------------------------------------------------------------------------------------------------

     (6) An estimate of the total public burden (in hours) associated 
with the collection: It is estimated that this collection will create a 
burden of 56,354 annual burden hours.
    Overview of new information collection:
    (1) Type of Information Collection: New collection.
    (2) Title of the Form/Collection: Reports of dispensing of 
controlled substances by online pharmacies.
    (3) Agency form number, if any, and the applicable component of the 
Department of Justice sponsoring the collection:
    Form Number: DEA Form 332.
    Component: Office of Diversion Control, Drug Enforcement 
Administration, U.S. Department of Justice.
    (4) Affected public who will be asked or required to respond, as 
well as a brief abstract:
    Primary: Business or other for-profit.
    Other: Not-for-Profit Institutions; State, Local or Tribal 
Government.
    Abstract: The Controlled Substances Act (21 U.S.C. 827(d)(2)) 
requires online pharmacies to report to DEA the total quantity of 
controlled substances that the pharmacy has dispensed during each 
calendar month by any means, regardless of whether the controlled 
substances are dispensed by means of the Internet. Reports are required 
to be filed by every pharmacy that, at any time during a calendar 
month, holds a modified registration authorizing it to operate as an 
online pharmacy, regardless of whether the online pharmacy dispenses 
any controlled substances by means of the Internet during the month. 
Such reporting is mandated by the Ryan Haight Act and permits DEA to 
monitor the dispensing of controlled substances by online pharmacies.
    (5) An estimate of the total number of respondents and the amount 
of time estimated for an average respondent to respond: It is estimated 
that 250 persons respond to this collection at 0.25 hours per person 
per month, for a total of 750 hours per year.
    (6) An estimate of the total public burden (in hours) associated 
with the collection: 750 annual burden hours.
    If additional information is required contact: Lynn Bryant, 
Department Clearance Officer, Information Management and Security 
Staff, Justice Management Division, Department of Justice, Patrick 
Henry Building, Suite 1600, 601 D Street, NW., Washington, DC 20530.

E. Executive Order 12988

    This regulation meets the applicable standards set forth in 
sections 3(a) and 3(b)(2) of Executive Order 12988, Civil Justice 
Reform.

F. Executive Order 13132

    This rulemaking does not impose enforcement responsibilities on any 
State; nor does it diminish the power of any State to enforce its own 
laws. Accordingly, this rulemaking does not have federalism 
implications warranting the application of Executive Order 13132.

G. Unfunded Mandates Reform Act of 1995

    This rule will not result in the expenditure by State, local, and 
tribal governments, in the aggregate, or by the private sector, of 
$120,000,000 or more (adjusted for inflation) in any one year, and will 
not significantly or uniquely affect small governments. Therefore, no 
actions were deemed necessary under the provisions of the Unfunded 
Mandates Reform Act of 1995.

H. Congressional Review Act

    This rule is not a major rule as defined by section 804 of the 
Small Business Regulatory Enforcement Fairness Act of 1996 
(Congressional Review Act). This rule will not result in an annual 
effect on the economy of $100,000,000 or more; a major increase in 
costs or prices; or significant adverse effects on competition, 
employment, investment, productivity, innovation, or on the ability of 
United States-based companies to compete with foreign-based companies 
in domestic and export markets. Further, as noted above in the 
Administrative Procedure Act certification, DEA has concluded that 
``good cause'' exists to promulgate this rule as an Interim Final Rule 
effective as set forth in the DATES section of the preamble pursuant to 
5 U.S.C. 553(b)(B) and 5 U.S.C. 553(d)(3).

List of Subjects

21 CFR Part 1300

    Chemicals, Drug traffic control.

21 CFR Part 1301

    Administrative practice and procedure, Drug traffic control, 
Security measures.

21 CFR Part 1304

    Drug traffic control, Reporting and recordkeeping requirements.

21 CFR Part 1306

    Drug traffic control, Prescription drugs.


0
For the reasons set out above, 21 CFR parts 1300, 1301, 1304, and 1306 
are amended as follows:

PART 1300--DEFINITIONS

0
1. The authority citation for part 1300 is revised to read as follows:

    Authority:  21 U.S.C. 802, 821, 829, 871(b), 951, 958(f).


0
2. Section 1300.04 is added to read as follows:


Sec.  1300.04  Definitions relating to the dispensing of controlled 
substances by means of the Internet.

    (a) Any term not defined in this part or elsewhere in this chapter 
shall have the definition set forth in sections 102 and 309 of the Act 
(21 U.S.C. 802, 829).
    (b) The term covering practitioner means, with respect to a 
patient, a practitioner who conducts a medical evaluation (other than 
an in-person medical evaluation) at the request of a practitioner who:
    (1) Has conducted at least one in-person medical evaluation of the 
patient or an evaluation of the patient through the practice of 
telemedicine, within the previous 24 months; and
    (2) Is temporarily unavailable to conduct the evaluation of the 
patient.
    (c) The term deliver, distribute, or dispense by means of the 
Internet refers, respectively, to any delivery, distribution, or 
dispensing of a controlled substance that is caused or facilitated by 
means of the Internet.
    (d) The term filling new prescriptions for controlled substances in 
Schedule III, IV, or V means filling a prescription for an individual 
for a controlled substance in Schedule III, IV, or V, if:
    (1) The pharmacy dispensing that prescription has previously 
dispensed to the patient a controlled substance other than by means of 
the Internet and pursuant to the valid prescription of a practitioner 
that meets the applicable

[[Page 15620]]

requirements of subsections (b) and (c) of section 309 of the Act (21 
U.S.C. 829) and Sec. Sec.  1306.21 and 1306.22 of this chapter (for 
purposes of this definition, such a prescription shall be referred to 
as the ``original prescription'');
    (2) The pharmacy contacts the practitioner who issued the original 
prescription at the request of that individual to determine whether the 
practitioner will authorize the issuance of a new prescription for that 
individual for the controlled substance described in paragraph (d)(1) 
of this section (i.e., the same controlled substance as described in 
paragraph (d)(1)); and
    (3) The practitioner, acting in the usual course of professional 
practice, determines there is a legitimate medical purpose for the 
issuance of the new prescription.
    (e) The term homepage means the opening or main page or screen of 
the Web site of an online pharmacy that is viewable on the Internet.
    (f) The term in-person medical evaluation means a medical 
evaluation that is conducted with the patient in the physical presence 
of the practitioner, without regard to whether portions of the 
evaluation are conducted by other health professionals. Nothing in this 
paragraph shall be construed to imply that one in-person medical 
evaluation demonstrates that a prescription has been issued for a 
legitimate medical purpose within the usual course of professional 
practice.
    (g) The term Internet means collectively the myriad of computer and 
telecommunications facilities, including equipment and operating 
software, which comprise the interconnected worldwide network of 
networks that employ the Transmission Control Protocol/Internet 
Protocol, or any predecessor or successor protocol to such protocol, to 
communicate information of all kinds by wire or radio.
    (h) The term online pharmacy means a person, entity, or Internet 
site, whether in the United States or abroad, that knowingly or 
intentionally delivers, distributes, or dispenses, or offers or 
attempts to deliver, distribute, or dispense, a controlled substance by 
means of the Internet. The term includes, but is not limited to, a 
pharmacy that has obtained a modification of its registration pursuant 
to Sec. Sec.  1301.13 and 1301.19 of this chapter that currently 
authorizes it to dispense controlled substances by means of the 
Internet, regardless of whether the pharmacy is currently dispensing 
controlled substances by means of the Internet. The term does not 
include:
    (1) Manufacturers or distributors registered under subsection (a), 
(b), (d), or (e) of section 303 of the Act (21 U.S.C. 823(a), (b), (d), 
or (e)) (Sec.  1301.13 of this chapter) who do not dispense controlled 
substances to an unregistered individual or entity;
    (2) Nonpharmacy practitioners who are registered under section 
303(f) of the Act (21 U.S.C. 823(f)) (Sec.  1301.13 of this chapter) 
and whose activities are authorized by that registration;
    (3) Any hospital or other medical facility that is operated by an 
agency of the United States (including the Armed Forces), provided such 
hospital or other facility is registered under section 303(f) of the 
Act (21 U.S.C. 823(f)) (Sec.  1301.13 of this chapter);
    (4) A health care facility owned or operated by an Indian tribe or 
tribal organization, only to the extent such facility is carrying out a 
contract or compact under the Indian Self-Determination and Education 
Assistance Act;
    (5) Any agent or employee of any hospital or facility referred to 
in paragraph (h)(3) or (h)(4) of this section, provided such agent or 
employee is lawfully acting in the usual course of business or 
employment, and within the scope of the official duties of such agent 
or employee, with such hospital or facility, and, with respect to 
agents or employees of health care facilities specified in paragraph 
(h)(4) of this section, only to the extent such individuals are 
furnishing services pursuant to the contracts or compacts described in 
such paragraph;
    (6) Mere advertisements that do not attempt to facilitate an actual 
transaction involving a controlled substance;
    (7) A person, entity, or Internet site that is not in the United 
States and does not facilitate the delivery, distribution, or 
dispensing of a controlled substance by means of the Internet to any 
person in the United States;
    (8) A pharmacy registered under section 303(f) of the Act (21 
U.S.C. 823(f)) (Sec.  1301.13 of this chapter) whose dispensing of 
controlled substances via the Internet consists solely of:
    (i) Refilling prescriptions for controlled substances in Schedule 
III, IV, or V, as defined in paragraph (k) of this section; or
    (ii) Filling new prescriptions for controlled substances in 
Schedule III, IV, or V, as defined in paragraph (d) of this section;
    (9)(i) Any registered pharmacy whose delivery, distribution, or 
dispensing of controlled substances by means of the Internet consists 
solely of filling prescriptions that were electronically prescribed in 
a manner authorized by this chapter and otherwise in compliance with 
the Act.
    (ii) A registered pharmacy will be deemed to meet this exception 
if, in view of all of its activities other than those referred to in 
paragraph (h)(9)(i) of this section, it would fall outside the 
definition of an online pharmacy; or
    (10)(i) Any registered pharmacy whose delivery, distribution, or 
dispensing of controlled substances by means of the Internet consists 
solely of the transmission of prescription information between a 
pharmacy and an automated dispensing system located in a long term care 
facility when the registration of the automated dispensing system is 
held by that pharmacy as described in Sec. Sec.  1301.17 and 1301.27 
and the pharmacy is otherwise complying with this chapter.
    (ii) A registered pharmacy will be deemed to meet this exception 
if, in view of all of its activities other than those referred to in 
paragraph (h)(10)(i) of this section, it would fall outside the 
definition of an online pharmacy.
    (i) Effective January 15, 2010, the term practice of telemedicine 
means the practice of medicine in accordance with applicable Federal 
and State laws by a practitioner (other than a pharmacist) who is at a 
location remote from the patient and is communicating with the patient, 
or health care professional who is treating the patient, using a 
telecommunications system referred to in section 1834(m) of the Social 
Security Act (42 U.S.C. 1395m(m)), which practice falls within a 
category listed in the following paragraphs (i)(1) through (7):
    (1) Treatment in a hospital or clinic. The practice of telemedicine 
is being conducted while the patient is being treated by, and 
physically located in, a hospital or clinic registered under section 
303(f) of the Act (21 U.S.C. 823(f)) by a practitioner acting in the 
usual course of professional practice, who is acting in accordance with 
applicable State law, and who is registered under section 303(f) of the 
Act (21 U.S.C. 823(f)) in the State in which the patient is located, 
unless the practitioner:
    (i) Is exempted from such registration in all States under section 
302(d) of the Act (21 U.S.C. 822(d); or
    (ii) Is an employee or contractor of the Department of Veterans 
Affairs who is acting in the scope of such employment or contract, and 
registered under section 303(f) of the Act (21 U.S.C. 823(f)) in any 
State or is utilizing the registration of a hospital or clinic operated 
by the Department of Veterans Affairs registered under section 303(f);

[[Page 15621]]

    (2) Treatment in the physical presence of a practitioner. The 
practice of telemedicine is being conducted while the patient is being 
treated by, and in the physical presence of, a practitioner acting in 
the usual course of professional practice, who is acting in accordance 
with applicable State law, and who is registered under section 303(f) 
of the Act (21 U.S.C. 823(f)) in the State in which the patient is 
located, unless the practitioner:
    (i) Is exempted from such registration in all States under section 
302(d) of the Act (21 U.S.C. 822(d)); or
    (ii) Is an employee or contractor of the Department of Veterans 
Affairs who is acting in the scope of such employment or contract, and 
registered under section 303(f) of the Act (21 U.S.C. 823(f)) in any 
State or is using the registration of a hospital or clinic operated by 
the Department of Veterans Affairs registered under section 303(f);
    (3) Indian Health Service or tribal organization. The practice of 
telemedicine is being conducted by a practitioner who is an employee or 
contractor of the Indian Health Service, or is working for an Indian 
tribe or tribal organization under its contract or compact with the 
Indian Health Service under the Indian Self-Determination and Education 
Assistance Act; who is acting within the scope of the employment, 
contract, or compact; and who is designated as an Internet Eligible 
Controlled Substances Provider by the Secretary of Health and Human 
Services under section 311(g)(2) of the Act (21 U.S.C. 831(g)(2));
    (4) Public health emergency declared by the Secretary of Health and 
Human Services. The practice of telemedicine is being conducted during 
a public health emergency declared by the Secretary of Health and Human 
Services under section 319 of the Public Health Service Act (42 U.S.C. 
247d), and involves patients located in such areas, and such controlled 
substances, as the Secretary of Health and Human Services, with the 
concurrence of the Administrator, designates, provided that such 
designation shall not be subject to the procedures prescribed by the 
Administrative Procedure Act (5 U.S.C. 551-559 and 701-706);
    (5) Special registration. The practice of telemedicine is being 
conducted by a practitioner who has obtained from the Administrator a 
special registration under section 311(h) of the Act (21 U.S.C. 
831(h));
    (6) Department of Veterans Affairs medical emergency. The practice 
of telemedicine is being conducted:
    (i) In a medical emergency situation:
    (A) That prevents the patient from being in the physical presence 
of a practitioner registered under section 303(f) of the Act (21 U.S.C. 
823(f)) who is an employee or contractor of the Veterans Health 
Administration acting in the usual course of business and employment 
and within the scope of the official duties or contract of that 
employee or contractor;
    (B) That prevents the patient from being physically present at a 
hospital or clinic operated by the Department of Veterans Affairs 
registered under section 303(f) of the Act (21 U.S.C. 823(f));
    (C) During which the primary care practitioner of the patient or a 
practitioner otherwise practicing telemedicine within the meaning of 
this paragraph is unable to provide care or consultation; and
    (D) That requires immediate intervention by a health care 
practitioner using controlled substances to prevent what the 
practitioner reasonably believes in good faith will be imminent and 
serious clinical consequences, such as further injury or death; and
    (ii) By a practitioner that:
    (A) Is an employee or contractor of the Veterans Health 
Administration acting within the scope of that employment or contract;
    (B) Is registered under section 303(f) of the Act (21 U.S.C. 
823(f)) in any State or is utilizing the registration of a hospital or 
clinic operated by the Department of Veterans Affairs registered under 
section 303(f); and
    (C) Issues a controlled substance prescription in this emergency 
context that is limited to a maximum of a five-day supply which may not 
be extended or refilled; or
    (7) Other circumstances specified by regulation. The practice of 
telemedicine is being conducted under any other circumstances that the 
Administrator and the Secretary of Health and Human Services have 
jointly, by regulation, determined to be consistent with effective 
controls against diversion and otherwise consistent with the public 
health and safety.
    (j) Temporary definition of practice of telemedicine. Prior to 
January 15, 2010, or as otherwise specified by regulation prior to that 
date, instead of the definition in paragraph (i), the term practice of 
telemedicine means the practice of medicine in accordance with 
applicable Federal and State laws by a practitioner (as that term is 
defined in section 102 of the Act (21 U.S.C. 802)) (other than a 
pharmacist) who is at a location remote from the patient and is 
communicating with the patient, or health care professional who is 
treating the patient, using a telecommunications system referred to in 
section 1834(m) of the Social Security Act (42 U.S.C. 1395m(m)), if the 
practitioner is using an interactive telecommunications system that 
satisfies the requirements of section 410.78(a)(3) of title 42, Code of 
Federal Regulations.
    (k) The term refilling prescriptions for controlled substances in 
Schedule III, IV, or V:
    (1) Means the dispensing of a controlled substance in Schedule III, 
IV, or V in accordance with refill instructions issued by a 
practitioner as part of a valid prescription that meets the 
requirements of subsections (b) and (c) of section 309 of the Act (21 
U.S.C. 829) and Sec. Sec.  1306.21 and 1306.22 of this chapter, as 
appropriate; and
    (2) Does not include the issuance of a new prescription to an 
individual for a controlled substance that individual was previously 
prescribed.
    (l)(1) The term valid prescription means a prescription that is 
issued for a legitimate medical purpose in the usual course of 
professional practice by:
    (i) A practitioner who has conducted at least one in-person medical 
evaluation of the patient; or
    (ii) A covering practitioner.
    (2) Nothing in this paragraph (l) shall be construed to imply that 
one in-person medical evaluation demonstrates that a prescription has 
been issued for a legitimate medical purpose within the usual course of 
professional practice.

PART 1301--REGISTRATION OF MANUFACTURERS, DISTRIBUTORS, AND 
DISPENSERS OF CONTROLLED SUBSTANCES

0
3. The authority citation for part 1301 is revised to read as follows:

    Authority: 21 U.S.C. 821, 822, 823, 824, 831, 871(b), 875, 877, 
886a, 951, 952, 953, 956, 957, 958.


0
4. Section 1301.11 is revised to read as follows:


Sec.  1301.11  Persons required to register; requirement of 
modification of registration authorizing activity as an online 
pharmacy.

    (a) Every person who manufactures, distributes, dispenses, imports, 
or exports any controlled substance or who proposes to engage in the 
manufacture, distribution, dispensing, importation or exportation of 
any controlled substance shall obtain a registration unless exempted by 
law or pursuant to Sec. Sec.  1301.22 through 1301.26. Except as 
provided in paragraph (b) of this section, only persons actually 
engaged in such activities are required to obtain a registration; 
related or affiliated

[[Page 15622]]

persons who are not engaged in such activities are not required to be 
registered. (For example, a stockholder or parent corporation of a 
corporation manufacturing controlled substances is not required to 
obtain a registration.)
    (b) As provided in sections 303(f) and 401(h) of the Act (21 U.S.C. 
823(f) and 841(h)), it is unlawful for any person who falls within the 
definition of ``online pharmacy'' (as set forth in section 102(52) of 
the Act (21 U.S.C. 802(52)) and Sec.  1300.04(h) of this chapter) to 
deliver, distribute, or dispense a controlled substance by means of the 
Internet if such person is not validly registered with a modification 
of such registration authorizing such activity (unless such person is 
exempt from such modified registration requirement under the Act or 
this chapter). The Act further provides that the Administrator may only 
issue such modification of registration to a person who is registered 
as a pharmacy under section 303(f) of the Act (21 U.S.C. 823(f)). 
Accordingly, any pharmacy registered pursuant to Sec.  1301.13 of this 
part that falls within the definition of an online pharmacy and 
proposes to dispense controlled substances by means of the Internet 
must obtain a modification of its registration authorizing such 
activity following the submission of an application in accordance with 
Sec.  1301.19 of this part. This requirement does not apply to a 
registered pharmacy that does not fall within the definition of an 
online pharmacy set forth in Sec.  1300.04(h). Under the Act, persons 
other than registered pharmacies are not eligible to obtain such a 
modification of registration but remain liable under section 401(h) of 
the Act (21 U.S.C. 841(h)) if they deliver, distribute, or dispense a 
controlled substance while acting as an online pharmacy without being 
validly registered with a modification authorizing such activity.

0
5. Section 1301.13 is amended by revising paragraph (e)(1)(iv) and 
(e)(3) to read as follows:


Sec.  1301.13  Application for registration; time for application; 
expiration date; registration for independent activities; application 
forms, fees, contents and signature; coincident activities.

* * * * *
    (e) * * *
    (1) * * *

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                            Application      Registration       Coincident activities
          Business activity              Controlled substances    DEA application forms    fee  (dollars)  period  (years)             allowed
--------------------------------------------------------------------------------------------------------------------------------------------------------
 
                                                                      * * * * * * *
(iv) Dispensing or instructing         Schedules II-V..........  New--224...............              551                3  May conduct research and
 (includes Practitioner, Hospital/                               Renewal--224a Online                 551                    instructional activities
 Clinic, Retail Pharmacy, Online                                  Pharmacy--224c.                                            with those substances for
 Pharmacy, Central fill pharmacy,                                                                                            which registration was
 Teaching Institution).                                                                                                      granted, except that a mid-
                                                                                                                             level practitioner may
                                                                                                                             conduct such research only
                                                                                                                             to the extent expressly
                                                                                                                             authorized under State
                                                                                                                             statute. A pharmacist may
                                                                                                                             manufacture an aqueous or
                                                                                                                             oleaginous solution or
                                                                                                                             solid dosage form
                                                                                                                             containing a narcotic
                                                                                                                             controlled substance in
                                                                                                                             Schedule II-V in a
                                                                                                                             proportion not exceeding
                                                                                                                             20% of the complete
                                                                                                                             solution, compound or
                                                                                                                             mixture. A retail pharmacy
                                                                                                                             may perform central fill
                                                                                                                             pharmacy activities. An
                                                                                                                             online pharmacy may perform
                                                                                                                             activities of retail
                                                                                                                             pharmacy as well as online
                                                                                                                             pharmacy activities.
 
                                                                      * * * * * * *
--------------------------------------------------------------------------------------------------------------------------------------------------------

* * * * *
    (3) Registrants will receive renewal notifications approximately 60 
days prior to the registration expiration date. DEA Forms 224a, 225a, 
and 363a may be mailed, as applicable, to registrants; if any 
registered person does not receive such notification within 45 days 
before the registration expiration date, the registrant must promptly 
give notice of such fact and may request such forms by writing to the 
Registration Section, Drug Enforcement Administration.
* * * * *
0
6. Section 1301.19 is added to read as follows:


Sec.  1301.19  Special requirements for online pharmacies.

    (a) A pharmacy that has been issued a registration under Sec.  
1301.13 may request that the Administrator modify its registration to 
authorize the pharmacy to dispense controlled substances by means of 
the Internet as an online pharmacy. The Administrator may deny an 
application for a modification of registration if the Administrator 
determines that the issuance of a modification would be inconsistent 
with the public interest. In determining the public interest, the 
Administrator will consider the factors listed in section 303(f) of the 
Act (21 U.S.C. 823(f)).
    (b) Each online pharmacy shall comply with the requirements of 
State law concerning licensure of pharmacies in each State from which 
it, and in each State to which it, delivers, distributes, or dispenses, 
or offers to deliver, distribute, or dispense controlled substances by 
means of the Internet.
    (c) Application for a modified registration authorizing the 
dispensing of controlled substances by means of the Internet will be 
made by an online application process as specified in Sec.  1301.13 of 
this part. Subsequent online pharmacy registration renewals

[[Page 15623]]

will be accomplished by an online process.
    (d) A pharmacy that seeks to discontinue its modification of 
registration authorizing it to dispense controlled substances by means 
of the Internet as an online pharmacy (but continue its business 
activity as a non-online pharmacy) shall so notify the Administrator by 
requesting to modify its registration to reflect the appropriate 
business activity. Once the registration has been so changed, the 
pharmacy may no longer dispense controlled substances by means of the 
Internet. A pharmacy that has so changed its registration status back 
to that of a non-online pharmacy remains responsible for submitting 
reports in accordance with Sec.  1304.55 of this chapter with respect 
to any controlled substances that it dispensed while it was registered 
with a modification authorizing it to operate as an online pharmacy.
    (e) Registrants applying for modified registrations under this 
section must comply with notification and reporting requirements set 
forth in Sec. Sec.  1304.40, 1304.45, 1304.50, and 1304.55 of this 
chapter.
    (f) No person (including a registrant) required to obtain a 
modification of a registration under Sec. Sec.  1301.11(b) and 1301.13 
of this part authorizing it to operate as an online pharmacy may engage 
in any activity for which such modification of registration is required 
until the application for such modified registration is granted and an 
active Certificate of Registration indicating the modification of the 
registration has been issued by the Administrator to such person.


0
7. Section 1301.52 is amended by revising paragraph (a) to read as 
follows:


Sec.  1301.52  Termination of registration; transfer of registration; 
distribution upon discontinuance of business.

    (a) Except as provided in paragraph (b) of this section, the 
registration of any person, and any modifications of that registration, 
shall terminate if and when such person dies, ceases legal existence, 
or discontinues business or professional practice. Any registrant who 
ceases legal existence or discontinues business or professional 
practice shall notify the Administrator promptly of such fact.
* * * * *

PART 1304--RECORDS AND REPORTS OF REGISTRANTS

0
8. The authority citation for part 1304 is revised to read as follows:

    Authority:  21 U.S.C. 821, 827, 831, 871(b), 958(e), 965, unless 
otherwise noted.


0
9. Section 1304.01 is revised to read as follows:


Sec.  1304.01  Scope of part 1304.

    Inventory and other records and reports required under section 307, 
section 311, or section 1008(e) of the Act (21 U.S.C. 827, 831, and 
958(e)) shall be in accordance with, and contain the information 
required by, those sections and by the sections of this part.

0
10. An undesignated heading and Sec. Sec.  1304.40, 1304.45, 1304.50 
and 1304.55 are added to read as follows:

Online Pharmacies

1304.40 Notification by online pharmacies.
1304.45 Internet Web site disclosure requirements.
1304.50 Disclosure requirements for Web sites of nonpharmacy 
practitioners that dispense controlled substances by means of the 
Internet.
1304.55 Reports by online pharmacies.

Online Pharmacies


Sec.  1304.40  Notification by online pharmacies.

    (a) Thirty days prior to offering a controlled substance for sale, 
delivery, distribution, or dispensing by means of the Internet, an 
online pharmacy shall:
    (1) Notify the Administrator of its intent to do so by submitting 
an application for a modified registration in accordance with 
Sec. Sec.  1301.13 and 1301.19 of this chapter, with such application 
containing the information required by this section; and
    (2) Notify the State boards of pharmacy in any States in which the 
online pharmacy offers to sell, deliver, distribute, or dispense 
controlled substances.
    (b) The following information must be included in the notification 
submitted under paragraph (a) of this section:
    (1) The pharmacy's Internet Pharmacy Site Disclosure information 
required to be posted on the homepage of the online pharmacy's Internet 
site under section 311(c) of the Act (21 U.S.C. 831(c)) and Sec.  
1304.45 of this part.
    (2) Certification that the information disclosed on its Internet 
site under the Internet Pharmacy Site Disclosure is true and accurate. 
The statement shall be in a form similar to the following: ``The above-
named pharmacy, a DEA registrant, certifies, under penalty of perjury, 
that the information contained in this statement is true and 
accurate.''
    (3) Each Internet site address utilized by the online pharmacy and 
a certification that the online pharmacy shall notify the Administrator 
of any change in any such Internet address at least 30 days in advance. 
In the event that a pharmacy delivers, distributes, or dispenses 
controlled substances pursuant to orders made on, through, or on behalf 
of, more than one Web site, the pharmacy shall provide, for purposes of 
complying with this paragraph, the Internet site address of each such 
site.
    (4) The DEA registration numbers of:
    (i) Every pharmacy that delivers, distributes, or dispenses 
controlled substances pursuant to orders made on, through, or on behalf 
of, each Web site referred to in paragraph (b)(3) of this section; and
    (ii) Every practitioner who has a contractual relationship to 
provide medical evaluations or issue prescriptions for controlled 
substances, through referrals from the Web site or at the request of 
the owner or operator of the Web site, or any employee or agent 
thereof.
    (c) An online pharmacy that is in operation at the time Public Law 
110-425 becomes effective (April 13, 2009) must make the notifications 
required in this section on or before May 13, 2009. However, in 
accordance with section 401(h) of the Act (21 U.S.C. 841(h)), as of 
April 13, 2009, it is unlawful for any online pharmacy to deliver, 
distribute, or dispense a controlled substance by means of the Internet 
unless such online pharmacy is validly registered with a modification 
of such registration authorizing such activity.
    (d) On and after the date an online pharmacy makes the 
notifications required under this section, each online pharmacy shall 
display on the homepage of its Internet site, a declaration that it has 
made such notifications to the Administrator in the following form: 
``In accordance with the Controlled Substances Act and the DEA 
regulations, this online pharmacy has made the notifications to the DEA 
Administrator required by 21 U.S.C. 831 and 21 CFR 1304.40.''
    (e)(1) Except as provided in paragraphs (e)(2) and (e)(3) of this 
section, if any of the information required to be submitted under this 
section changes after the online pharmacy submits the notification to 
the Administrator, the online pharmacy shall notify the Administrator 
of the updated information no later than 30 days before the change 
becomes effective via the online process.
    (2) If a pharmacy referred to in paragraph (b)(4)(i) of this 
section ceases to deliver, distribute, or dispense controlled 
substances pursuant to orders made on, through, or on behalf of, each 
Web site referred to in paragraph (b)(3) of this section, the online 
pharmacy shall notify the Administrator no later than 30 days after the 
change becomes effective via the online process.

[[Page 15624]]

    (3) If a practitioner referred to in paragraph (b)(4)(ii) of this 
section ceases to have a contractual relationship with the online 
pharmacy, the online pharmacy shall notify the Administrator no later 
than 30 days after the change becomes effective via the online process.


Sec.  1304.45  Internet Web site disclosure requirements.

    (a) Each online pharmacy shall display, at all times and in a 
visible and clear manner, on its homepage a statement that it complies 
with the requirements of section 311 of the Act (21 U.S.C. 831) with 
respect to the delivery or sale or offer for sale of controlled 
substances. This statement must include the name of the pharmacy as it 
appears on the DEA Certificate of Registration.
    (b) Each online pharmacy shall clearly display the following 
information on the homepage of each Internet site it operates, or on a 
page directly linked to the homepage. If the information is displayed 
on a page directly linked to the homepage, that link on the homepage 
must be visible and clear. The information must be displayed for each 
pharmacy that delivers, distributes, or dispenses controlled substances 
pursuant to orders made on, through, or on behalf of that Web site.
    (1) The name and address of the pharmacy as it appears on the 
pharmacy's DEA Certificate of Registration.
    (2) The pharmacy's telephone number and e-mail address.
    (3) The name, professional degree, and States of licensure of the 
pharmacist-in-charge, and a telephone number at which the pharmacist-
in-charge can be contacted.
    (4) A list of the States in which the pharmacy is licensed to 
dispense controlled substances.
    (5) A certification that the pharmacy is registered under part 1301 
of this chapter with a modification of its registration authorizing it 
to deliver, distribute, or dispense controlled substances by means of 
the Internet.
    (6) The name, address, telephone number, professional degree, and 
States of licensure with State license number of any practitioner who 
has a contractual relationship to provide medical evaluations or issue 
prescriptions for controlled substances, through referrals from the Web 
site or at the request of the owner or operator of the Web site, or any 
employee or agent thereof.
    (7) The following statement: ``This online pharmacy is obligated to 
comply fully with the Controlled Substances Act and DEA regulations. As 
part of this obligation, this online pharmacy has obtained a modified 
DEA registration authorizing it to operate as an online pharmacy. In 
addition, this online pharmacy will only dispense a controlled 
substance to a person who has a valid prescription issued for a 
legitimate medical purpose based upon a medical relationship with a 
prescribing practitioner. This includes at least one prior in-person 
medical evaluation in accordance with section 309 of the Controlled 
Substances Act (21 U.S.C. 829) or a medical evaluation via telemedicine 
in accordance with section 102(54) of the Controlled Substances Act (21 
U.S.C. 802(54)).''


Sec.  1304.50  Disclosure requirements for Web sites of nonpharmacy 
practitioners that dispense controlled substances by means of the 
Internet.

    For a Web site to identify itself as being exempt from the 
definition of an online pharmacy by virtue of section 102(52)(B)(ii) of 
the Act (21 U.S.C. 802(52)(B)(ii)) and Sec.  1300.04(h)(2) of this 
chapter, the Web site shall post in a visible and clear manner on its 
homepage, or on a page directly linked thereto in which the hyperlink 
is also visible and clear on the homepage, a list of the DEA-registered 
nonpharmacy practitioners who are affiliated with the Web site. Any 
nonpharmacy practitioner affiliated with such a Web site is responsible 
for compliance with this section. An institutional practitioner that 
otherwise complies with the requirements of the Act and this chapter 
will be deemed to meet the requirements of this section if, in lieu of 
posting the names of each affiliated individual practitioner, it posts 
its name (as it appears on its Certificate of Registration) in a 
visible and clear manner on its homepage and in a manner that 
identifies itself as being responsible for the operation of the Web 
site.


Sec.  1304.55  Reports by online pharmacies.

    (a) Each online pharmacy shall report to the Administrator the 
total quantity of each controlled substance that the pharmacy has 
dispensed each calendar month. The report must include the total 
quantity of such dispensing by any means, regardless of whether the 
controlled substances are dispensed by means of the Internet. Thus, 
such reporting shall include all controlled substances dispensed via 
Internet transactions, mail-order transactions, face-to-face 
transactions, or any other means. However, the pharmacy is not required 
to describe in its report to the Administrator such means of 
dispensing. Such reporting is required for every calendar month in 
which the total quantity of controlled substances dispensed by the 
pharmacy meets or exceeds one of the following thresholds:
    (1) 100 or more prescriptions for controlled substances filled; or
    (2) 5,000 or more dosage units dispensed of all controlled 
substances combined.
    (b) Each online pharmacy shall report a negative response if, 
during a given calendar month, its total dispensing of controlled 
substances falls below both of the thresholds in paragraph (a) of this 
section.
    (c) The reporting requirements of this section apply to every 
pharmacy that, at any time during a calendar month, holds a modified 
registration authorizing it to operate as an online pharmacy, 
regardless of whether the online pharmacy dispenses any controlled 
substances by means of the Internet during the month.
    (d) Reports will be submitted to DEA electronically via online 
reporting, electronic file upload, or other means as approved by DEA.
    (e) Reports shall be filed every month not later than the fifteenth 
day of the month succeeding the month for which they are submitted.
    (f) An online pharmacy filing a report under paragraph (a) of this 
section shall utilize the National Drug Code number assigned to the 
product under the National Drug Code System of the Food and Drug 
Administration, and indicate the total number of dosage units dispensed 
for each such National Drug Code number.
    (g) Records required to be kept under this section must be kept by 
the registrant for at least two years from the date of such records. 
The information shall be readily retrievable from the ordinary business 
records of the registrant and available for inspection and copying by 
authorized employees of the Administration.

PART 1306--PRESCRIPTIONS

0
11. The authority citation for part 1306 is revised to read as follows:

    Authority:  21 U.S.C. 821, 829, 831, 871(b), unless otherwise 
noted.


0
12. Section 1306.09 is added to read as follows:


Sec.  1306.09  Prescription requirements for online pharmacies.

    (a) No controlled substance that is a prescription drug may be 
delivered, distributed, or dispensed by means of the Internet without a 
valid prescription.

[[Page 15625]]

    (b) In accordance with the Act, it is unlawful for any person to 
knowingly or intentionally fill a prescription for a controlled 
substance that was issued in a manner that constitutes dispensing by 
means of the Internet unless such person is a pharmacist who is acting 
in the usual course of his professional practice and is acting on 
behalf of a pharmacy whose registration has been modified under 
sections 1301.13 and 1301.19 of this chapter to authorize it to operate 
as an online pharmacy.
    (c) Any online pharmacy that participates in the transfer between 
pharmacies of prescription information must do so in accordance with 
the requirements of Sec. Sec.  1306.15 and 1306.25 of this part.

    Dated: April 1, 2009.
Michele M. Leonhart,
Deputy Administrator.
 [FR Doc. E9-7698 Filed 4-3-09; 8:45 am]
BILLING CODE 4410-09-P