[Federal Register Volume 85, Number 190 (Wednesday, September 30, 2020)]
[Rules and Regulations]
[Pages 61594-61601]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-21310]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF JUSTICE
Drug Enforcement Administration
21 CFR Parts 1300, 1301, 1304, and 1306
[Docket No. DEA-322]
RIN 1117-AB20
Implementation of the Ryan Haight Online Pharmacy Consumer
Protection Act of 2008
AGENCY: Drug Enforcement Administration, Department of Justice.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: On April 6, 2009, the Drug Enforcement Administration
published the interim final rule titled ``Implementation of the Ryan
Haight Online Pharmacy Consumer Protection Act of 2008,'' which amended
DEA's regulations by adding several new provisions to prevent the
illegal distribution and dispensing of controlled substances by means
of the internet. This action adopts the interim final rule as a final
rule without change, apart from a minor technical amendment and certain
changes to DEA regulations already made by intervening rules. This
action also reinstates amendments that were inadvertently removed by
the Controlled Substances and List I Chemical Registration and
Reregistration Fees final rule published on March 15, 2012.
DATES: This final rule is effective October 30, 2020.
FOR FURTHER INFORMATION CONTACT: Scott A. Brinks, Diversion Control
Division, Drug Enforcement Administration; Mailing Address: 8701
Morrissette Drive, Springfield, VA 22152; Telephone: (571) 362-3261.
SUPPLEMENTARY INFORMATION:
Outline
I. Purpose of Regulatory Action
II. Summary of Key Provisions of the Ryan Haight Act
A. In-Person Medical Evaluation
B. Requirement of Modified Registration
C. Criminal Offenses
III. The Interim Final Rule and Subsequent Changes to DEA
Regulations
IV. Discussion of Comments
A. Distributors' Responsibilities
B. Pharmacies' Responsibilities
C. Exceptions to the Definition of ``Online Pharmacy''
D. Access to Medication
E. Verification of Registration
V. Section-by-Section Summary of the Final Rule
VI. Regulatory Analyses
I. Purpose of Regulatory Action
The Ryan Haight Online Pharmacy Consumer Protection Act of 2008
(Pub. L. 110-425) (hereafter, the ``Ryan Haight Act'' or the ``Act'')
was enacted on October 15, 2008. The Act amended the Controlled
Substances Act (CSA) by adding various provisions to prevent the
illegal distribution and dispensing of controlled substances by means
of the internet. The Ryan Haight Act makes it illegal under Federal law
to ``deliver, distribute, or dispense a controlled substance by means
of the internet, except as authorized by [the CSA]'' or to aid or abet
such activity. 21 U.S.C. 841(h)(1).
On April 6, 2009, the Drug Enforcement Administration (DEA)
published an interim final rule that served (1) to explain the Ryan
Haight Act, (2) to announce amendments to DEA regulations that
implemented the Act, and (3) to request comments on these amendments to
the regulations. See 74 FR 15596.
Through this final rule, DEA is responding to the comments it
received on the April 6, 2009, interim final rule and adopting the
interim final rule as final without change (aside from a minor
technical amendment and certain minor changes, discussed below, that
were already made by intervening rules).
II. Summary of Some of the Key Provisions of the Ryan Haight Act
Congress passed the Ryan Haight Act because of ``the increasing use
of prescription controlled substances by adolescents and others for
non-medical purposes, which [had] been exacerbated by drug trafficking
on the internet.'' \1\ Recognizing that rogue websites fueled the abuse
of prescription controlled substances and thereby increased the number
of resulting overdoses and other harmful consequences, Congress passed
the Ryan Haight Act to prevent the internet from being exploited to
facilitate such unlawful drug activity.
---------------------------------------------------------------------------
\1\ S. Rep. No. 110-521, at 1 (2008).
---------------------------------------------------------------------------
Consistent with the CSA, the Ryan Haight Act set out numerous
regulatory requirements and other substantive provisions. These
provisions and other aspects of the Act are explained in detail in the
interim final rule. See 74 FR 15597-15610. For this final rule, a
summary of three key provisions of the Act will suffice: The in-person
medical evaluation requirement for prescribing practitioners, the
modified registration requirement for online pharmacies, and the
criminal offenses the Act added to the CSA.
[[Page 61595]]
A. In-Person Medical Evaluation Requirement
One of the primary ways in which the Act combats the use of the
internet to facilitate illegal sales of pharmaceutical controlled
substances is by mandating, with limited exceptions, that the
dispensing of controlled substances by means of the internet be
predicated on a valid prescription issued by a practitioner who has
conducted at least one in-person medical evaluation of the patient.
While the lack of an in-person medical evaluation has always been
viewed as highly probative evidence that a prescription has been issued
outside of the usual course of professional practice and for other than
a legitimate medical purpose, the Act makes it unambiguous that it is a
per se violation of the CSA for a practitioner to issue a prescription
for a controlled substance by means of the internet without having
conducted at least one in-person medical evaluation, except in certain
specified circumstances. However, as Congress expressly stated under
the Act, the mere fact that the prescribing practitioner conducted one
in-person medical evaluation does not demonstrate that the prescription
was issued for a legitimate medical purpose within the usual course of
professional practice. Even where the prescribing practitioner has
complied with the requirement of at least one in-person medical
evaluation, a prescription for a controlled substance must still
satisfy the longstanding requirement of federal law that it must be
issued for a legitimate medical purpose by a practitioner acting in the
usual course of professional practice.\2\
---------------------------------------------------------------------------
\2\ 21 CFR 1306.04(a); United States v. Moore, 423 U.S. 122
(1975). This requirement has been a part of federal law since the
Harrison Narcotic Act of 1914. Id. at 131. For a detailed
explanation of the ``legitimate medical purpose requirement,'' see
71 FR 52716, 52717 (2006 DEA policy statement).
---------------------------------------------------------------------------
B. Requirement of Modified Registration for Online Pharmacies
Another one of the core provisions of the Act is the requirement
that any person who operates a website that fits within the definition
of an ``online pharmacy'' must obtain from DEA a modification of its
DEA pharmacy registration that expressly authorizes such online
activity. Only DEA-registered pharmacies are eligible under the Act to
obtain such a modification of registration. One of the ramifications of
this requirement is that those who are not DEA-registered pharmacies
(for example, those non-registrants who have previously facilitated
unlawful internet controlled substance sales by enlisting the services
of illegitimate pharmacies and/or prescribing practitioners) are
prohibited from operating online pharmacies.
The Act's definition of ``online pharmacy'' encompasses more than
merely legitimate pharmacies that may obtain a modification of their
DEA registrations allowing them to dispense controlled substances by
means of the internet. As explained below, the definition of ``online
pharmacy'' includes, among others, those persons who operate the types
of rogue websites that the Act was designed to eliminate. Consistent
with the longstanding structure of the CSA (since it was enacted in
1970), the Act prohibits all controlled substance activities by
``online pharmacies'' except those expressly authorized by the Act.
Again, only DEA-registered pharmacies may obtain a modification of
their registration authorizing them to operate as online pharmacies. In
addition, a pharmacy that has obtained such a modification of its
registration may not operate as an online pharmacy unless it has
notified DEA of its intent to do so and its website contains certain
declarations designed to provide clear assurance that it is operating
legitimately and in conformity with the Act.
C. Criminal Offenses
The Act also adds two new criminal offenses to the CSA. The first
new criminal offense makes it explicitly unlawful for any person to
knowingly or intentionally dispense, distribute, or deliver a
controlled substance by means of the internet or to aid and abet such
actions, except as authorized by the CSA, as stated in 21 U.S.C.
841(h)(1). The second new criminal offense added by the Act prohibits
using the internet to knowingly or intentionally advertise illegal
transactions of controlled substances that are not authorized by the
CSA, as stated in 21 U.S.C. 841(h)(2). The Act contains specific
examples of such conduct, as discussed in the interim final rule;
however, it is important to note that the examples provided are not an
exhaustive list of the types of conduct that constitute violations of
21 U.S.C. 841(h)(1) and 21 U.S.C. 841(h)(2).
III. The Interim Final Rule and Subsequent Changes to DEA Regulations
DEA published its interim final rule implementing the Ryan Haight
Act at 74 FR 15596 on April 6, 2009. The interim final rule amended
DEA's regulations at 21 CFR parts 1300, 1301, 1304, and 1306 to carry
out the Act. The specific regulatory changes made by the interim final
rule and herein adopted as a final rule are discussed in greater detail
in Section V below.
While this final rule is not making any changes to the provisions
of the interim final rule aside from a minor technical amendment
discussed below, there have been two amendments to DEA's regulations
since the interim final rule was published that have further altered
regulatory language that had been amended by the interim final rule.
The first change occurred in 2011, when 21 CFR 1301.52(a) was
amended to provide for immediate termination of a registration, and all
modifications of that registration, upon surrender by the registrant.
76 FR 61563. This final rule does not disturb that intervening 2011
amendment.
The second change occurred in 2012, when registration fees were
increased for all business activities by amending DEA regulatory
provisions including 21 CFR 1301.13(e)(1). 77 FR 15234. The change in
2012 increased the three-year registration fee for dispensers (which
includes pharmacies) from $551 to $731, but it did not impose any
additional fee to apply for the online pharmacy modification.
Unfortunately, however, this amendment--though solely intended to
adjust fees--also inadvertently removed the interim final rule's
changes to Sec. 1301.13(e)(1). In particular, the interim final rule
had amended Sec. 1301.13(e)(1)(iv) to list ``Online Pharmacy'' as part
of the business activity ``[d]ispensing or instructing''; to list the
online pharmacy application form, 224c; and to indicate, under
``[c]oincident activities allowed'' that ``[a]n online pharmacy may
perform activities of retail pharmacy as well as online pharmacy
activities.'' The revised version of Sec. 1301.13(e)(1) placed in the
Code of Federal Regulations by the 2012 amendment not only changed the
fees in Sec. 1301.13(e)(1), as intended, but also used an earlier
version of the text of Sec. 1301.13(e)(1)(iv) that did not contain the
interim final rule's additions, causing them to be inadvertently
removed from Sec. 1301.13(e)(1).
Thus, the current text of Sec. Sec. 1301.13(e)(1) and 1301.52(a)
differs from that contained in the interim final rule as published on
April 6, 2009, because of these intervening amendments. This final
rule, while otherwise adopting the regulatory revisions of the interim
final rule, does not disturb these intervening amendments, except to
reinstate the interim final rule's changes to Sec. 1301.13(e)(1) that
were inadvertently undone by the 2012 registration fee
[[Page 61596]]
amendment. In particular, through this action, Sec. 1301.13(e)(1)(iv)
will be updated to: (1) Include online pharmacy as a type of
``dispensing or instructing'' business activity; (2) add Form DEA-224c
to DEA application forms column; and (3) include a statement that
online pharmacies are allowed to perform activities of a retail
pharmacy and online pharmacy as a coincident activity.
Thus, the publication of this final rule does not alter the text of
the Code of Federal Regulations except to reinstate the interim final
rule's Sec. 1301.13(e)(1) amendments and to make one purely technical
amendment to Sec. 1304.40(c) to remove outdated information that is
further discussed below.
IV. Discussion of Comments
DEA received nine comments on the interim final rule. Six
commenters generally supported the rule while also raising issues of
concern, and three commenters expressed opposition to the rule. The
comments are summarized below, along with DEA's responses.
A. Distributors' Responsibilities
Some commenters expressed concerns that the precise scope of
distributors' obligations described in the interim final rule were
unclear--in particular, distributors' duty to avoid supplying
pharmacies that service the customers of rogue websites. Another
commenter sought clarification of whether, when a pharmacy's buying
patterns indicate a reasonable likelihood that it is supplying
customers of a website, distributors are required to confirm only that
the pharmacy has obtained a modified pharmacy registration under the
Act, or must confirm that the pharmacy is in compliance with all
requirements of the CSA. The same commenter argued that the language in
the interim final rule suggested that distributors would be required to
have knowledge of a pharmacy's buying patterns before any transactions
occurred with the pharmacy.
Some commenters stated that it is not feasible for distributors to
know more about a pharmacy's online activities than what would be
discovered by verifying the pharmacy's DEA registration status and
conducting a routine due diligence investigation. The same commenters
requested that DEA confirm whether it was the distributor's
responsibility, when faced with a pharmacy whose buying patterns
indicate a reasonable likelihood that it is supplying customers of a
website, to either confirm that the pharmacy has a modified DEA
registration, or to obtain a plausible alternative explanation to
justify the buying pattern.
DEA Response. With respect to the obligation to confirm a
pharmacy's compliance with the requirements of the CSA, distributors,
like all DEA registrants, have a duty to maintain effective controls
against the diversion of controlled substances. 21 U.S.C. 823(b)(1),
823(e)(1); 21 CFR 1301.71(a). Failure to comply with this or any other
applicable regulatory requirements may, depending on the circumstances,
result in civil monetary penalties and/or administrative revocation
proceedings. In addition, a distributor that knowingly or intentionally
distributes controlled substances to a pharmacy that is dispensing
controlled substances in violation of the Ryan Haight Act is subject to
criminal prosecution under 21 U.S.C. 841(h)(1).
The Act introduces new requirements to ensure a pharmacy's
compliance with the registration modification provisions. This final
rule does not, however, relieve distributors of their existing duty to
maintain effective controls against diversion, including the obligation
to conduct adequate due diligence, not only prior to distributing
controlled substances to a new customer but also throughout the course
of a distributor's relationship with a customer.\3\
---------------------------------------------------------------------------
\3\ See Masters Pharmaceuticals, Inc., 80 FR 55418, 55477
(2015). See also 21 CFR 1301.71(a) (``All applicants and registrants
shall provide effective controls to guard against theft and
diversion of controlled substances.''); Southwood Pharmaceuticals,
Inc., 72 FR 36487, 36498-36500 (2007) (discussing inadequacy of
distributor's due diligence efforts with respect to rogue internet
pharmacies); 21 U.S.C. 823(b)(1) (directing the Attorney General to
consider an applicant's/registrant's ``maintenance of effective
controls against diversion of particular controlled substances into
other than legitimate medical, scientific, and industrial channels''
when making the public interest determination with respect to the
granting or revocation of a registration to distribute schedule I
and II drugs); id. 823(e)(1) (same with respect to registration to
distribute schedule III through V drugs).
---------------------------------------------------------------------------
There are several ways for a distributor to determine whether a
pharmacy is properly registered to dispense controlled substances by
means of the internet. A pharmacy's certificate of registration will
state that it has obtained the requisite modification of its
registration. A distributor can also verify the pharmacy's status using
DEA's registration validation web tool. However, as DEA explained in
both Southwood and Masters, ``doing `nothing more than verifying a
pharmacy's DEA registration and state license' is not enough'' to
comply with a distributor's ``duty to perform due diligence.'' \4\ In
Masters, DEA further held that ``a distributor must conduct a
reasonable investigation `to determine the nature of a potential
customer's business before it' sells to the customer, and the
distributor cannot ignore ``information which raise[s] serious doubt as
to the legality of [a potential . . . customer's] business practices.''
\5\
---------------------------------------------------------------------------
\4\ Masters, 80 FR at 55477 (quoting Southwood, 72 FR at 36498).
\5\ Id.
---------------------------------------------------------------------------
Continuing in Masters, DEA explained that where ``a customer
provides information regarding its dispensing practices that is
inconsistent with other information the distributor has obtained about
or from the customer, or is inconsistent with information about
pharmacies' dispensing practices generally, the distributor must
conduct `additional investigation to determine whether [its customer
is] filling legitimate prescriptions.' '' \6\ Finally, Masters
explained that ``the obligation to perform due diligence is ongoing
throughout the course of a distributor's relationship with its
customer.'' \7\ Id.
---------------------------------------------------------------------------
\6\ Id. (quoting 72 FR at 55477).
\7\ Id.
---------------------------------------------------------------------------
Thus, where a pharmacy's buying patterns suggest that the pharmacy
is filling prescriptions for a rogue website, it is not enough for a
distributor to confirm only that the pharmacy has a modified pharmacy
registration under the Ryan Haight Act.\8\ Rather, the distributor must
confirm that the pharmacy is in compliance with the CSA's requirement
that it is filling only those prescriptions which have been issued by a
practitioner acting in the usual course of professional practice for a
legitimate medical purpose in accordance with 21 CFR 1306.04(a).
Moreover, this requirement is not undermined by any contention that a
pharmacy's buying patterns may not be known at the time of its first
transaction with a specific distributor: Pursuant to section 3273(a) of
the Substance Use-Disorder Prevention that Promotes Opioid Recovery and
Treatment for Patients and Communities Act (SUPPORT Act), Public Law
115-271, 132 Stat. 3894, DEA has created an online tool which allows
distributors to obtain data as to the number of distributors that have
sold to a prospective customer and the total quantity and type of
opioids distributed to the prospective customer during the
[[Page 61597]]
last six months.\9\ The SUPPORT Act further provides that ``[a]ll
registered manufacturers and distributors shall be responsible for
reviewing this information'' and that, in determining whether to
initiate proceedings to suspend or revoke a manufacturer's/
distributor's registration, DEA ``may take into account that this
information . . . was available to the registrant.'' \10\ It should
also be noted that federal law now provides that the failure to review
this information is unlawful and is punishable by civil and criminal
penalties.\11\
---------------------------------------------------------------------------
\8\ Indeed, as of the date of this rule, no person or entity
holds a modified registration authorizing the dispensing of
controlled substances by means of the internet.
\9\ Press Release, Drug Enforcement Administration, DEA
announces enhanced tool for registered drug manufacturers and
distributors to combat opioid crisis (Feb. 26, 2019).
\10\ 21 U.S.C. 827(f).
\11\ 21 U.S.C. 842(a)(17), (c)(1)(B), (c)(2)(D).
---------------------------------------------------------------------------
In addition, nearly all pharmacies now use dispensing software
which allows for the creation of a utilization/dispensing report. As
Masters explains, a distributor, as part of its due diligence, should
evaluate a customer's dispensing ratio of controlled to non-controlled
drugs as well as such other relevant data, including the types of
controlled substances, the dosage forms, and quantities dispensed, and
base this evaluation on the most accurate information available.\12\
Thus, a distributor should be obtaining and reviewing utilization/
dispensing reports both upon taking on a new customer and periodically
throughout the course of its relationship with its customer. As Masters
makes amply clear, the failure to obtain and review this information
may constitute strong evidence that a distributor has failed to
maintain effective controls against diversion and support a finding
that its registration is inconsistent with the public interest.
---------------------------------------------------------------------------
\12\ 80 FR at 55480-55481.
---------------------------------------------------------------------------
Accordingly, while it is true that information as to a pharmacy's
buying patterns and/or dispensing activities may not point conclusively
to a finding that the pharmacy is dispensing controlled substances in
violation of the Ryan Haight Act, DEA's experience has been that rogue
online pharmacies present many of the same indicia of illegal
dispensing activity as do brick and mortar pharmacies engaged in drug
trafficking. Thus, even if a distributor does not have actual knowledge
that the pharmacy is operating through a rogue website, if the
pharmacy's buying patterns or other circumstances surrounding an order
create a reasonable suspicion that it is supplying customers of a
website or otherwise engaging in practices that render it an online
pharmacy within the meaning of the Act, the distributor should, prior
to filling any order for controlled substances, confirm whether the
pharmacy has a modified registration. The distributor should also
assess the likelihood that the pharmacy is filling only controlled
substance prescriptions that comply with 21 CFR 1306.04(a).
In sum, if a pharmacy's buying patterns or the other circumstances
of an order create a reasonable suspicion that it is supplying
customers of a website or otherwise engaging in practices that render
it an online pharmacy within the meaning of the Act, but nothing else
about the order appears suspect or unlawful, a distributor will not be
held liable for supplying the pharmacy controlled substances if the
distributor has confirmed that the pharmacy holds a modified
registration. However, merely confirming that the pharmacy holds a
modified registration will not relieve the distributor of liability if
the pharmacy's order raised grounds for suspicion that it was filling
otherwise unlawful controlled substance prescriptions and the
distributor did not properly resolve the grounds. Conversely, if a
pharmacy's order initially indicates that it may be supplying customers
of a website, but the distributor is able to confirm an alternative
justification for the suspect features of the order, it may lawfully
fill the order and supply the pharmacy with controlled substances. To
be clear, however, the distributor must actually confirm the
alternative justification; it cannot simply conceive of some
theoretical set of circumstances under which the pharmacy's suspect
order would be justified. As such, the commenters are correct that an
alternative explanation can justify an otherwise suspect order, but as
discussed above, distributors must conduct reasonable investigations to
confirm the explanation.
B. Pharmacies' Responsibilities
One commenter raised concerns regarding the variety of factors
listed in the interim final rule as relevant to determining whether a
prescription was issued by means of the internet. In particular, the
commenter suggested that these factors are subjective. The same
commenter requested that DEA define a reasonable distance between the
pharmacy and a practitioner. This comment relates to DEA's statement in
the interim final rule that, in some circumstances, the distance
between a pharmacy and a practitioner may be a relevant factor in
assessing the likelihood that a prescription has been issued by means
of the internet in violation of the Ryan Haight Act. See 74 FR 15607.
Another commenter urged DEA to enforce the pharmacy requirements in the
manner outlined in the interim final rule, and not apply a more
stringent standard than the ones discussed there.
DEA Response. DEA appreciates the commenter's concerns regarding
the factors to be considered when determining whether a pharmacist
should reasonably suspect that a prescription was issued by means of
the internet. Pharmacists have always had a responsibility to ensure
the dispensing of controlled substances conforms with DEA's regulations
and the CSA and to exercise professional judgment in determining
whether a controlled substance prescription has been lawfully issued in
accordance with all provisions of the CSA.\13\ While a pharmacist is
not obligated to know what cannot be known through the exercise of
sound professional pharmacy practice, the relevant factors set forth in
the interim final rule for determining whether a pharmacist should
reasonably know that a prescription was issued by means of the internet
have been based on numerous decisions of both the federal courts and
this Agency involving rogue internet pharmacies and the physicians who
wrote the prescriptions that were filled by them.\14\ Indeed, an
examination of these and other cases reveals that the factual
circumstances surrounding the issuance of the controlled substance
prescriptions was so obviously outside the usual course of professional
practice and for other than a legitimate medical purpose that no
reasonable pharmacist could claim ignorance of the unlawfulness of the
prescriptions.\15\
---------------------------------------------------------------------------
\13\ See 21 CFR 1306.04(a); JM Pharmacy Group, Inc., 80 FR
28667, 28670 (2015) (quoting Ralph J. Bertolino, 55 FR 4729, 4730
(1990) (``a pharmacist must exercise professional judgment [and
common sense] when filling a prescription''); id. (quoting Medic-Aid
Pharmacy, 55 FR 30043, 30044 (1990) (``The administrative law judge
concluded that it is not necessary to find that [the pharmacist] in
fact knew that many prescriptions were presented to him that were
not written for a legitimate medical purpose, for there is no
question that a conscientious pharmacists would have been suspicious
of these prescriptions and refused to fill them.'').
\14\ See United States v. Smith, 573 F.3d 639, 657-658 (8th Cir.
2009); United States v. Nelson, 383 F.3d 1227, 1231-1232 (10th Cir.
2004); Nirmal Saran, M.D., & Nisha Saran, D.O., 73 FR 78827 (2008);
Kamir Garces-Mejias, M.D., 72 FR 54931 (2007); William R. Lockridge,
M.D., 73 FR 78827 (2006); Mario Alberto Diaz, 71 FR 70780 (2006);
United Prescription Services, Inc., 72 FR 50397 (2007); Trinity
Health Care Corp., d/b/a Oviedo Discount Pharmacy, 72 FR 30849
(2007). See also Robert Raymond Reppy, 76 FR 61154 (2011); Sun &
Lake Pharmacy, Inc., 76 FR 24523 (2011).
\15\ Under 21 CFR 1306.04(a), a pharmacist who knowingly fills a
controlled substance prescription which has been issued outside of
the usual course of professional practice has engaged in an unlawful
distribution of a controlled substance in violation of 21 U.S.C.
841(a). So too, a pharmacist who knowingly or intentionally fills a
controlled substance prescription issued in violation of the Ryan
Haight Act commits a violation of 21 U.S.C. 841(h)(1).
While the scienter for criminal violations of section 841
requires proof that a pharmacist acted with intent, knowledge, or
willful blindness, it should be noted that under the public interest
standard applicable in revocation proceedings brought under 21
U.S.C. 824(a), DEA is not necessarily required to show that a
pharmacist violated either section 841 or 21 CFR 1306.04(a) to
establish liability. Rather, DEA can establish that a pharmacy has
committed acts which render its registration inconsistent with the
public interest by showing that a pharmacist engaged in the reckless
or negligent dispensing of a controlled substance by failing to
resolve the suspicious circumstances presented by a prescription.
Cf. Paul J. Caragine, Jr., 63 FR 51592, 51601 (1998).
---------------------------------------------------------------------------
[[Page 61598]]
DEA's obligations under the Ryan Haight Act do not require it to
establish a particular distance between a practitioner and pharmacy
beyond which a prescription should be presumed to have been issued by
means of the internet. As DEA stated in the interim final rule, the
distance between a prescribing practitioner and the pharmacy is just
one factor potentially relevant to assessing whether a prescription was
issued by means of the internet. The Act and this rule rely on
pharmacists to consider all of the circumstances surrounding a
controlled substance prescription and exercise their professional
judgment in determining whether to dispense the prescription. To
address the other commenter's concerns about how these provisions of
the Act will be enforced, the commenter should look to the standards
outlined in the interim final rule, which set out the basis for DEA's
enforcement of the Act's pharmacy requirements. These standards are
being adopted as a final rule in this rulemaking.
C. Exceptions to the Definition of ``Online Pharmacy''
The interim final rule contains ten exceptions to its definition of
``online pharmacy,'' eight taken directly from the Ryan Haight Act. See
21 CFR 1300.04(h)(1)-(10); 21 U.S.C. 802(52)(B). Some commenters
supported three particular exceptions: Pharmacies whose dispensing of
controlled substances by means of the internet consists solely of (1)
filling or refilling prescriptions for controlled substances in
schedules III-V, as defined in the Act, 21 CFR 1300.04(h)(8); (2)
filling prescriptions that were electronically prescribed in a manner
otherwise consistent with the CSA, id. 1300.04(h)(9); or (3)
transmitting prescription information between a pharmacy and an
automated dispensing system located in a long term care facility, when
the registration of the automated dispensing system is held by the
pharmacy, id. Sec. 1300.04(h)(10).
One commenter encouraged DEA to consistently emphasize this first
exception in communications regarding the Act and its requirements.
Another commenter expressed concern that the precise wording of the
first and second exceptions is such that a pharmacy engaging in both
filling or refilling prescriptions for controlled substances in
schedules III-V, as defined in the Act, and filling prescriptions that
were electronically prescribed in a manner otherwise consistent with
the CSA would be considered an online pharmacy. Other commenters argued
that additional exceptions to the definition of online pharmacy were
required to properly exclude other activities conducted by means of the
internet, such as central fill and processing and telepharmacy.
DEA Response. DEA thanks the commenters for their support of the
exceptions to the definition of online pharmacy.
With respect to the concern that a pharmacy engaging in activity
under each of the two separate exceptions (21 CFR 1300.04(h)(8), (9))
would be considered an online pharmacy, 21 CFR 1300.04(h)(9)(ii)
already allows a registrant to engage in both categories of activity
without being deemed an online pharmacy: ``A registered pharmacy will
be deemed to meet this exception if, in view of all of its activities
other than those referred to in paragraph (h)(9)(i) . . . it would fall
outside the definition of an online pharmacy.'' Consistent with this
section, if a pharmacy fills or refills prescriptions for controlled
substances in schedules III-V and also fills prescriptions that were
electronically prescribed, it could still qualify for the exception in
paragraph (h)(9)(i) if, considering all the activity it engages in
besides filling electronic prescriptions, including filling and
refilling prescriptions for controlled substances in schedules III-V,
it would not meet the definition of an online pharmacy.
DEA does not believe that further limitations on the definition of
an online pharmacy are necessary at this time. This rule already
includes ten separate exceptions to the definition of an online
pharmacy, covering a broad range of activities; a majority of
pharmacies fit within one or more of these existing exceptions.
D. Access to Medication
One commenter objected to the rule on the grounds that people with
disabilities and people confined to their homes who do not have a care
provider to pick up medications from a pharmacy will be unable to
receive the medications they need. Another commenter opposed the rule,
stating that some patients need more medication than one doctor is
permitted to prescribe. This commenter argued that it was neither cheap
nor easy to get controlled substances from reputable online pharmacies
in the United States, and that imposing additional requirements would
drive patients to foreign online pharmacies or ``street'' dealers. A
third commenter objected to the rule on the basis that it would reduce
access to phentermine.
DEA Response. The ability of a patient or care provider to pick up
medications from a pharmacy is outside of the scope of this rule. The
amount of medication a doctor is permitted to prescribe and the costs
of medication are outside of the scope of this rule. The Act provides
that, subject to certain exceptions, controlled substances that are
prescription drugs may not be dispensed by means of the internet
without a valid prescription. In order to issue a valid prescription,
the prescribing practitioner must have conducted at least one in-person
medical evaluation of the patient, or else be a covering practitioner
operating in a narrow set of circumstances. These requirements do not
apply to the dispensing of controlled substances by practitioners
engaged in the practice of telemedicine, but the Act did not modify the
existing requirement that all controlled substance prescriptions, to be
valid, must be issued for a legitimate medical purpose in the usual
course of professional practice.
Patients who previously filled valid prescriptions by mail can
continue to do so. Patients will need to visit a practitioner's office
for an initial in-person medical evaluation or take part in a
telemedicine encounter before being issued a prescription, but the vast
majority of patients were likely already doing this before the
enactment of the Act. This final rule does not decrease access to
specific prescriptions of controlled substances as this rule ensures
that only legitimate law abiding websites dispense controlled
substances via the internet. Phentermine is a schedule IV controlled
substance and all the requirements specified for schedule IV controlled
substances are applicable because the new requirements do not exclude
or include specific controlled substances. Furthermore, under the CSA,
it is unlawful to ship controlled substances from abroad into the
United States for personal medical use, and
[[Page 61599]]
individuals who place an order for such a shipment are in violation of
the CSA and subject to criminal prosecution. 21 U.S.C. 952, 957,
960(a)(1).
E. Verification of Registration
One commenter recommended that DEA create a ``list serve'' email
system to provide distributors real-time notifications of changes in
registrants' registration statuses, or to update the registration
validation tool to allow registrants to check multiple DEA
registrations automatically. The same commenter suggested DEA allow
information obtained from the registration validation tool to be used
as a suitable method of documenting verification of a customer's
registration during DEA inspections. Finally, the commenter suggested
DEA conduct a number of outreach efforts to increase awareness of and
engagement with the new requirements of the rule among members of the
public and non-registrant companies.
DEA Response. DEA thanks the commenter for these suggestions. DEA
strives to provide tools and resources to registrants and the public to
discontinue the diversion and abuse of controlled substances, and
always appreciates receiving additional ideas for how these goals can
be achieved. The commenter's suggestions, however, are beyond the scope
of this rule, are not necessary for DEA to implement the Ryan Haight
Act, and would require additional DEA resources to realize. Thus, DEA
is not acting on these suggestions as part of this final rule, but will
consider them as appropriate as DEA continues to provide additional
tools and resources to registrants and the public in the future.
V. Section-by-Section Discussion of the Final Rule
As discussed above, DEA is adopting the interim final rule as a
final rule without change, except for a technical amendment further
explained below and certain minor changes already made by intervening
rules. Thus, the interim final rule's more detailed discussion of its
provisions generally remains valid. See 74 FR 15610-15613. In brief,
however, the final rule consists of the following provisions, all of
which were already added to the Code of Federal Regulations by the
interim final rule.
In part 1300 (definitions), Sec. 1300.04, containing definitions
relating to the dispensing of controlled substances by means of the
internet, was added by the interim final rule and remains unchanged.
These definitions are from the definitions contained in the Act and
include definitions of the following terms: ``covering practitioner,''
``deliver, distribute or dispense by means of the internet,'' ``filling
new prescriptions for controlled substances in Schedule III, IV, or
V,'' ``homepage,'' ``in-person medical evaluation,'' ``internet,''
``online pharmacy,'' ``practice of telemedicine,'' ``refilling
prescriptions for controlled substances in Schedule III, IV, or V,''
``valid prescription,'' and the temporary definition of ``practice of
telemedicine.'' \16\ As discussed in the interim final rule and as
authorized by the Act, Sec. 1300.04 adds two exceptions to the
definition of an online pharmacy beyond the eight exceptions provided
for in the Act. See 21 CFR 1300.04(h); 21 U.S.C. 802(52)(B).
---------------------------------------------------------------------------
\16\ As explained in the interim final rule, the Ryan Haight Act
provided two definitions of the ``practice of telemedicine,'' a
temporary definition and a permanent definition. See 74 FR 15603;
Public Law 110-425, sec. 3(j). The interim final rule incorporated
both of these definitions, with the permanent definition, 21 CFR
1300.04(i), becoming effective on January 15, 2010, and the
temporary definition, 21 CFR 1300.04(j), effective before that date.
The permanent definition of the ``practice of telemedicine''
includes practice ``conducted by a practitioner who has obtained
from the Administrator a special registration under section 311(h)
of the Act (21 U.S.C. 831(h)).'' 21 CFR 1300.04(i)(5); 21 U.S.C.
802(54)(B). The Act, as amended, contemplates that DEA will issue
regulations effectuating this telemedicine special registration
provision by October 24, 2019. 21 U.S.C. 831(h)(2). DEA will further
address the definition and requirements of telemedicine in future
rulemaking.
---------------------------------------------------------------------------
In part 1301 (registration of manufacturers, distributors, and
dispensers of controlled substances), Sec. 1301.11(b) restates the
requirements of the Act that any person falling within the definition
of an online pharmacy must be validly registered with a modification
authorizing it to operate as an online pharmacy, and that only
pharmacies registered under 21 U.S.C. 823(f) may apply for such
modification.
To address the modification of registration as an online pharmacy,
the table in Sec. 1301.13(e)(1) was amended by the interim final rule.
``Online Pharmacy'' was listed as a business activity falling under
``(iv) Dispensing or instructing.'' The online pharmacy application
form, 224c, was noted. And a comment was added in the ``Coincident
activities allowed'' column to explain that an online pharmacy may
perform the activities of both a retail and online pharmacy. As
explained above, the table in Sec. 1301.13(e)(1) was again amended in
2012 to increase registration fees. See 77 FR 15234. The revised
version of the Sec. 1301.13(e)(1) table placed in the Code of Federal
Regulations by the 2012 amendment, however, not only changed fees in
Sec. 1301.13(e)(1) but also inadvertently removed the interim final
rule's additions to Sec. 1301.13(e)(1). This final rule reinstates
them.
As added by the interim final rule, Sec. 1301.19 (special
requirements for online pharmacies) provides in paragraphs (a), (c),
and (f) that a pharmacy must request a modification of its registration
authorizing it to operate as an online pharmacy by completing the
online application process. This section also provides, consistent with
the Act, that a pharmacy registrant may not operate as an online
pharmacy until DEA Administrator grants the modified registration.
Paragraph (b) requires, consistent with the Act, that an online
pharmacy must comply with the pharmacy license requirements of not only
the State where it is located, but also of any State to which it
delivers, distributes, or dispenses controlled substances. Paragraph
(d) requires a pharmacy that seeks to discontinue its authorization to
operate as an online pharmacy to modify its registration to reflect
this change in its business activity.
Section 1301.52, which addresses termination of registrations, was
revised by the interim final rule to include modification of
registration within the meaning of the Act. As explained above, Sec.
1301.52 was amended by another rule in 2011. See 76 FR 61563. This 2011
revision did not disturb the interim final rule's changes, and thus the
final rule requires no additional changes to Sec. 1301.52.
Four new sections were added to 21 CFR part 1304 (records and
reports of registrants) by the interim final rule to implement the
reporting requirements of the Act for online pharmacies, and to specify
the information the Act requires to be posted on an online pharmacy's
website. This final rule leaves three of these sections unchanged, but
makes a minor technical amendment to a paragraph of one of these
sections, Sec. 1304.40(c).
Section 1304.40(a) requires online pharmacies to notify the
Administrator and State boards of pharmacy 30 days before offering to
fill prescriptions for controlled substances by means of the internet.
Notification to the Administrator is made by applying for a
modification of DEA registration. Paragraph (b) of Sec. 1304.40
contains a list of items that must be included in the notification.
In the interim final rule, Sec. 1304.40(c) required online
pharmacies in operation of the time the Act became effective (April 13,
2009) to make this notification by May 13, 2009, and stated that, since
April 13, 2009, it has been unlawful for any person to operate as an
online pharmacy unless it has obtained
[[Page 61600]]
from DEA a modification of its registration authorizing it to do so.
Given the passage of time since the publication of the interim final
rule, the first portion of paragraph (c) is no longer relevant,
specifically the text stating that an online pharmacy in operation at
the time the Act became effective must make the required notification
on or before May 13, 2009. As such, in this final rule, DEA is making a
technical amendment to Sec. 1304.40(c) to remove this outdated text.
The revised Sec. 1304.40(c) retains the rest of the interim final
rule's paragraph (c), stating that it is unlawful for any person to
operate as an online pharmacy unless it has obtained from DEA a
modification of its registration authorizing it to do so.
The remainder of Sec. 1304.40 remains unchanged. As in the interim
final rule, Sec. 1304.40(d) requires that on and after an online
pharmacy makes notification under this section, it shall display a
declaration that it has done so. Under Sec. 1304.40(e), an online
pharmacy must notify the Administrator of any changes to the
information submitted in its notification thirty days prior to the
change.
Section 1304.45 specifies the data elements required to be posted
on the website of online pharmacies in a visible and clear manner, as
provided in the Act.
To identify websites that are operating solely on behalf of DEA-
registered non-pharmacy practitioners who are acting within the scope
of their registrations (and are thereby exempt from the definition of
an online pharmacy), Sec. 1304.50 requires such websites that dispense
controlled substances by means of the internet to display in a visible
and clear manner a list of those DEA-registered non-pharmacy
practitioners affiliated with the website.
Section 1304.55 implements the requirement of the Act that each
online pharmacy make a monthly report to DEA stating the total quantity
of each controlled substance the pharmacy has dispensed the previous
calendar month. This report must include not only the transactions made
through the online pharmacy, but also any that the pharmacy made
through mail order, face-to-face, or any other transaction when the
pharmacy's total dispensing of controlled substances meets or exceeds
the monthly threshold of either 100 prescriptions filled or 5,000 or
more dosage units dispensed. Online pharmacies that do not meet this
threshold in a given month are required to notify DEA.
In part 1306 (prescriptions), Sec. 1306.09 includes requirements
for prescriptions that track the requirements of the Act. Paragraph (a)
specifies that no controlled substance may be delivered, distributed,
or dispensed by means of the internet without a valid prescription
(using the definition of a valid prescription contained in the Act).
Also consistent with the Act, paragraph (b) provides that such
prescriptions may only be filled by a pharmacy whose registration has
been modified as specified in the Act. Finally, paragraph (c) applies
to online pharmacies the requirements of Sec. Sec. 1306.15 and 1306.25
regarding transfers of prescriptions between pharmacies.
VI. Regulatory Analyses
Executive Orders 12866, 13563, and 13771
This rule was developed in accordance with the principles of
Executive Orders (EOs) 12866 and 13563. E.O. 12866 directs agencies to
assess all costs and benefits of available regulatory alternatives and
when regulation is necessary, to select regulatory approaches that
maximize net benefits (including potential economic, public health and
safety, and environmental advantages; distributive impacts; and
equity). E.O. 13563 is supplemental to and reaffirms the principles,
structures, and definitions governing regulatory review as established
in E.O. 12866. It defines a ``significant regulatory action'' requiring
review by the Office of Management and Budget (OMB) as any regulatory
action that is likely to result in a rule that may: (1) Have an annual
effect on the economy of $100 million or more, or adversely affect in a
material way the economy, a sector of the economy, productivity,
competition, jobs, environment, public health or safety, or State,
local, or tribal governments or communities; (2) create a serious
inconsistency or otherwise interfere with an action taken or planned by
another agency; (3) materially alter the budgetary impact of
entitlements, grants, user fees, or loan programs or the rights and
obligations of recipients thereof; or (4) raise novel legal or policy
issues arising out of legal mandates, the President's priorities, or
the principles set forth in the Executive order.
As discussed above, this final rule adopts the interim final rule
without change, apart from certain changes to DEA regulations already
made by intervening rules and a minor technical amendment. Therefore,
this final rule imposes no costs beyond the costs already imposed by
the interim final rule and those intervening rules. OMB has determined
that this final rule is not a ``significant regulatory action'' under
E.O. 12866, section 3(f), Regulatory Planning and Review, and
accordingly this rule has not been reviewed by OMB.
This final rule is not a significant regulatory action under E.O.
12866, and it does not impose a cost greater than zero. Therefore, this
final rule is not an E.O. 13771 regulatory action.
Regulatory Flexibility Act
The interim final rule was drafted in accordance with the
Regulatory Flexibility Act (RFA), 5 U.S.C. 601-612. The RFA applies to
rules for which an agency publishes a general notice of proposed
rulemaking. As was explained in the interim final rule, the Ryan Haight
Act expressly contemplated that DEA would issue interim rules under the
``good cause'' provision of the APA as the agency deemed necessary to
implement the Act prior to its effective date of April 13, 2009. Thus,
Congress expressly granted DEA authority to issue regulations to
implement the Act that become effective immediately, without the
requirement of first seeking public comment through a notice of
proposed rulemaking. Consequently, the requirements of the RFA did not
apply to the interim final rule. Nonetheless, DEA did review the
potential impacts, and determined that the rule was likely to affect a
substantial number of small entities, but not likely to have a
significant economic impact on those small entities. Furthermore, DEA
sought comments in the interim final rule with respect to those parts
of the regulatory text about which the agency has discretion. DEA
received no comments regarding economic impacts. It seems unlikely,
therefore, that small entities have been significantly impacted by this
rule.
Paperwork Reduction Act
This final rule does not create or modify a collection of
information or impose recordkeeping or reporting requirements under the
Paperwork Reduction Act of 1995 beyond those modified by the interim
final rule. 44 U.S.C. 3501-3521. That information collection
requirement was previously approved by OMB under the assigned OMB
Control Number 1117-0014. An agency may not conduct or sponsor, and a
person is not required to respond to, a collection of information
unless it displays a currently valid OMB control number.
Executive Order 12988, Civil Justice Reform
This final rule meets the applicable standards set forth in
sections 3(a) and 3(b)(2) of Executive Order 12988, Civil
[[Page 61601]]
Justice Reform, to eliminate ambiguity, minimize litigation, establish
clear legal standards, and reduce burden.
Executive Order 13132, Federalism
This rulemaking does not have federalism implications warranting
the application of Executive Order 13132. The final rule does not have
substantial direct effects on the States, on the relationship between
the National Government and the States, or the distribution of power
and responsibilities among the various levels of government.
Executive Order 13175, Consultation and Coordination With Indian Tribal
Governments
This rule does not have substantial direct effects on the States,
on the relationship between the National Government and the States, or
the distribution of power and responsibilities between the Federal
Government and Indian tribes.
Unfunded Mandates Reform Act of 1995
This rule will not result in the expenditure by State, local, and
tribal governments, in the aggregate, or by the private sector, of
$100,000,000 or more (adjusted for inflation) in any one year, and will
not significantly or uniquely affect small governments. Therefore, no
actions were deemed necessary under the provisions of the Unfunded
Mandates Reform Act of 1995, 2 U.S.C. 1532.
Congressional Review Act
This rule is not a major rule as defined by the Congressional
Review Act. 5 U.S.C. 804. This rule will not result in an annual effect
on the economy of $100,000,000 or more; a major increase in costs or
prices; or significant adverse effects on competition, employment,
investment, productivity, innovation, or on the ability of United
States-based companies to compete with foreign-based companies in
domestic and export markets.
List of Subjects
21 CFR Part 1300
Chemicals, Drug traffic control.
21 CFR Part 1301
Administrative practice and procedure, Drug traffic control,
Security measures.
21 CFR Part 1304
Drug traffic control, Reporting and recordkeeping requirements.
21 CFR Part 1306
Drug traffic control, Prescription drugs.
For the reasons set out above, the interim final rule amending 21
CFR parts 1300, 1301, 1304, and 1306, which was published at 74 FR
15596 on April 6, 2009, and as subsequently amended at 76 FR 61563 and
77 FR 15234, is adopted as final with the following changes to 21 CFR
parts 1301 and 1304:
PART 1301--REGISTRATION OF MANUFACTURERS, DISTRIBUTORS, AND
DISPENSERS OF CONTROLLED SUBSTANCES
0
1. The authority citation for part 1301 continues to read as follows:
Authority: 21 U.S.C. 821, 822, 823, 824, 831, 871(b), 875, 877,
886a, 951, 952, 956, 957, 958, 965 unless otherwise noted.
0
2. In Sec. 1301.13, revise paragraph (e)(1)(iv) to read as follows:
Sec. 1301.13 Application for registration; time for application;
expiration date; registration for independent activities; application
forms, fees, contents and signature; coincident activities.
(e) * * *
(1) * * *
--------------------------------------------------------------------------------------------------------------------------------------------------------
Registration
Business activity Controlled substances DEA application Application period Coincident activities allowed
forms fee ($) (years)
--------------------------------------------------------------------------------------------------------------------------------------------------------
* * * * * * *
(iv) Dispensing or instructing Schedules II-V............... New--224 Renewal-- 731 3 May conduct research and
(includes Practitioner, Hospital/ 224a Online instructional activities with
Clinic, Retail Pharmacy, Online Pharmacy--224c. those controlled substances for
Pharmacy, Central Fill Pharmacy, which registration was granted,
Teaching Institution). except that a mid-level
practitioner may conduct such
research only to the extent
expressly authorized under State
statute. A pharmacist may
manufacturer an aqueous or
oleaginous solution solid dosage
form containing a narcotic
controlled substance in Schedule
II-V in a proportion not exceeding
20% of the complete solution,
compound or mixture. A retail
pharmacy may perform central fill
pharmacy activities. An online
pharmacy may perform activities of
retail pharmacy, as well as online
pharmacy activities.
* * * * * * *
--------------------------------------------------------------------------------------------------------------------------------------------------------
* * * * *
PART 1304--RECORDS AND REPORTS OF REGISTRANTS
0
3. The authority for citation for part 1304 continues to read as
follows:
Authority: 21 U.S.C. 821, 827, 831, 871(b), 958(e)-(g), and
965, unless otherwise noted.
0
4. In Sec. 1304.40, revise paragraph (c) to read as follows:
Sec. 1304.40 Notification by online pharmacies.
* * * * *
(c) It is unlawful for any online pharmacy to deliver, distribute,
or dispense a controlled substance by means of the internet unless such
online pharmacy is validly registered with a modification of such
registration authorizing such activity.
* * * * *
Timothy J. Shea,
Acting Administrator.
[FR Doc. 2020-21310 Filed 9-29-20; 8:45 am]
BILLING CODE 4410-09-P