Commerce

Professional Licensing

Rule 37f: Controlled Substance Database Act Rule

Effective Date: 12/09/2021

Admin. Code Reference: R156-37f

Rule Type: Current Rule

R156. Commerce, Occupational and Professional Licensing.

R156-37f. Controlled Substance Database Act Rule.

R156-37f-101. Title.

This rule shall be known as the "Controlled Substance Database Act Rule."

R156-37f-102. Definitions.

In addition to the definitions in Sections 58-17b-102, 58-37-2 and 58-37f-102, as used in this Rule R156-37f:

(1) "ASAP" means the American Society for Automation in Pharmacy system.

(2) "DEA" means Drug Enforcement Administration.

(3) "EDS" means "electronic data system" as defined in Subsection 58-37f-303(1)(c).

(4) "EHR" means electronic health record.

(5) "HIE" means health information exchange.

(6) "High risk prescription" means the same as defined in Subsection 58-37-6(11)(a).

(7) "NABP" means the National Association of Boards of Pharmacy.

(8) "NCPDP" means National Council for Prescription Drug Programs.

(9) "NDC" means National Drug Code.

(10) "Null report" means the same as zero report.

(11) "ORI" means Originating Agency Identifier Number.

(12)(a) "Point of sale date," "POS date," or "Date Sold" mean the date the prescription drug left the pharmacy, and do not include the date the prescription drug was filled, if the dates differ.

(b) ASAP Version 4.2 uses the "DSP17" field to identify the point of sale date.

(13) "Positive identification" means:

(a) one of the following photo identifications issued by a foreign or domestic government:

(i) driver's license;

(ii) non-driver identification card;

(iii) passport;

(iv) military identification; or

(v) concealed weapons permit; or

(b) if the individual does not have government-issued identification, alternative evidence of the individual's identity as determined appropriate by the pharmacist, if the pharmacist documents in a prescription record a description of how the individual was positively identified.

(14) "Research facility" means a facility in which research takes place that has policies and procedures describing the research.

(15) "Rx" means a prescription.

(16) "Zero report" means a report containing the data fields required by Subsection R156-37f-203(5), indicating that no controlled substance required to be reported has been dispensed since the previous submission of data.

R156-37f-103. Authority - Purpose.

This rule is adopted by the Division under the authority of Subsection 58-1-106(1)(a) to enable the Division to administer Title 58, Chapter 37f, Controlled Substance Database Act.

R156-37f-104. Organization - Relationship to Rule R156-1.

The organization of this rule and its relationship to Rule R156-1, General Rule of the Division of Occupational and Professional Licensing, is as described in Section R156-1-107.

R156-37f-203. Submission, Collection, and Maintenance of Data.

(1) Under Subsection 58-37f-203(1), each pharmacy or pharmacy group shall submit the data required in this section on a daily basis, either in real time or daily batch file reporting. The submitted data shall be from the point of sale date.

(a) If the data is submitted by a single pharmacy entity, the data shall be submitted in chronological order according to the date each prescription was sold.

(b) If the data is submitted by a pharmacy group, the data shall be sorted by individual pharmacy within the group, and the data of each individual pharmacy within the group shall be submitted in chronological order according to the date each prescription was sold.

(2) Under Subsections 58-37f-203(2), (3), and (6), the data required by this section shall be submitted to the Database through one of the following methods:

(a) electronic data sent via a secured internet transfer method, including sFTP site transfer;

(b) secure web base service; or

(3) Under Subsections 58-37f-203(2), (3), and (6), the format for submission to the Database shall be Version 4.2 of the ASAP Format for Controlled Substances. The Division may approve alternative formats substantially similar to this standard.

(4) Under Subsection 58-37f-203(6), the pharmacist-in-charge and the pharmacist identified in Subsections 58-37f-203(2) and (3) shall provide the following data fields to the Division:

(a) version of ASAP used to send transaction (ASAP 4.2 code TH01);

(b) transaction control number (TH02);

(d) time transaction created (TH06);

(e) file type (production or test) (TH07);

(f) segment terminator character (TH09);

(g) information source identification number (IS01);

(h) information source entity name (IS02);

(i) reporting pharmacy's:

(i) National Provider Identifier (PHA01); and

(ii) identifier assigned by NCPDP or NABP (PHA02), or if none, then DEA registration number (PHA03);

(j) patient last name (PAT07);

(k) patient first name (PAT08);

(l) patient address (PAT12);

(m) patient city of residence (PAT14);

(n) patient zip code (PAT 16);

(o) patient date of birth (PAT18);

(p) dispensing status - new, revised, or void (DSP01);

(q) prescription number (DSP02);

(r) date prescription written by prescriber (DSP03);

(s) number of refills authorized by prescriber (DSP04);

(t) date prescription filled at dispensing pharmacy (DSP05);

(u) if current dispensed prescription is a refill, the number of the refill being dispensed (DSP06);

(v) product identification qualifier (DSP07);

(w) NDC 11-digit drug identification number (DSP08);

(x) quantity of drug dispensed in metric units (DSP09);

(y) days supply dispensed (DSP10);

(z) date drug left the pharmacy, meaning date sold (DSP17);

(aa) DEA registration number of prescribing practitioner (PRE02);

(bb) state that issued identification of individual picking up dispensed drug (AIR03);

(cc) type of identification used by individual picking up dispensed drug (AIR04);

(dd) identification number of individual picking up dispensed drug (AIR05);

(ee) last name of individual picking up dispensed drug (AIR07);

(ff) first name of individual picking up dispensed drug (AIR08);

(gg) dispensing pharmacist last name or initial (AIR09);

(hh) dispensing pharmacist first name (AIR10);

(ii) number of detail segments included for the pharmacy (TP01);

(jj) transaction control number (TT01); and

(kk) total number of segments included in the transaction (TT02).

(5) Under Subsection 58-37f-203(6), if no controlled substance required to be reported has been dispensed since the previous submission of data, then the pharmacist-in-charge and the pharmacist shall submit a zero report to the Division, which shall include the following data fields:

(a) version of ASAP used to send transaction (TH01);

(b) transaction control number (TH02);

(d) time transaction created (TH06);

(e) file type (production or test) (TH07);

(f) segment terminator (TH09);

(g) information source identification number (IS01);

(h) information source entity name (IS02);

(i) date range (IS03);

(j) reporting pharmacy's:

(i) National Provider Identifier (PHA01); and

(ii) identifier assigned by NCPDB or NABP (PHA02), or if none, then DEA registration number (PHA03);

(k) patient last name = "Report" (PAT07);

(l) patient first name = "Zero" (PAT08);

(m) date prescription dispensed at dispensing pharmacy (DSP05);

(n) number of detail segments included for the pharmacy (TP01);

(o) transaction control number (TT01); and

(p) total number of segments included in the transaction (TT02).

(6) Under Subsection 58-37f-203(2), a Class A, B, D, or E pharmacy or pharmacy group that has a controlled substance license but is not dispensing controlled substances and does not anticipate doing so in the immediate future may request a waiver or submit a certification, in a form preapproved by the Division, in lieu of daily zero reports:

(a) The pharmacy or pharmacy group shall renew its waiver or certification at the end of each calendar year.

(b) If a pharmacy or pharmacy group with a current waiver or certification dispenses a controlled substance:

(i) the waiver or certification shall immediately and automatically terminate;

(ii) the Database reporting requirements of Subsections 58-37f-203(1) and R156-37f-203(1) shall apply to the pharmacy or pharmacy group immediately upon the dispensing of the controlled substance; and

(iii) the pharmacy or pharmacy group shall notify the Division in writing of the waiver or certification termination within 24 hours or the next business day of the dispensing of the controlled substance, whichever is later.

(7) The Database shall collect information regarding the prescription noncontrolled substance 1-(Aminomethyl)-cyclohexaneacetic acid (Gabapentin), in accordance with Subsection 58-37f-203(8).

(8) The Database shall collect information regarding "any substance which contains any quantity of a derivative of barbituric acid or any salt of any of them" (Butalbital), in accordance with Subsection 58-37-4(2)(c)(ii) which designates this as a Schedule III controlled substance.

R156-37f-301. Access to Database Information.

Under Subsections 58-37f-301(1)(a) and (b):

(1) The Division Director may designate the Database staff individuals employed by the Division who may have access to the Database.

(2)(a) An applicant to become a Database registered user may apply for an online account and user name only under the specific subparagraph in Subsection 58-37f-301(2) under which the applicant qualifies.

(b) A registered user may not permit another person to have knowledge of or use the registered user's assigned password or personal identification number (PIN).

(3)(a) A request for information from the Database may be made:

(i) directly to the Database by electronic submission, if the requester is registered to use the Database; or

(ii) by written request to the Database staff in accordance with this section, if the requester is not registered to use the Database.

(b) A written request may be submitted by facsimile, email, regular mail, or in person except as otherwise provided in this section.

(4) The following Database information may be disseminated to a verified requester who is permitted to obtain the information:

(a) dispensing and reporting pharmacy ID number and name;

(b) subject's birth date;

(d) prescription (Rx) number;

(e) metric quantity;

(f) days supply;

(g) NDC code and drug name;

(h) prescriber ID and name;

(i) subject's last name;

(j) subject's first name; and

(k) subject's street address;

(5)(a) Under Subsection 58-37f-301(2)(l), federal, state, and local law enforcement authorities and state and local prosecutors requesting information from the Database pursuant to a valid search warrant or DEA administrative subpoena, may submit the search warrant or subpoena to the Database as follows:

(i) in person;

(ii) by email to csd@utah.gov;

(iii) by facsimile; or

(iv) by U.S. Mail.

(b) The search warrant or DEA administrative subpoena may include the following information to assist in the search:

(i) for an individual for whom a controlled substance or noncontrolled substance has been prescribed or dispensed, the subject's name and birth date;

(ii) for a prescriber who is the subject of the investigation, the prescriber's full name; and

(iii) the date range to be searched.

(c) The Database information provided as a result of the search warrant or DEA administrative subpoena shall be in accordance with Subsection (4) unless otherwise specified in the search warrant or subpoena.

(6) Under Subsections 58-37f-301(2) and (7), a probation or parole officer employed by the Department of Corrections or a political subdivision may have access to the Database without a search warrant, for supervision of a specific probationer or parolee under the officer's direct supervision, if the following conditions have been met:

(a) a security agreement signed by the officer is submitted to the Division for access, which contains:

(i) the agency's:

(A) name;

(B) complete address, including city and zip code; and

(ii) a copy of the officer's driver's license;

(iii) the officer's:

(A) full name;

(B) contact phone number; and

(b) the online database account includes the officer's:

(i) full name;

(ii) agency email address;

(iii) complete home address, including city and zip code;

(iv) work title;

(v) contact phone number;

(vi) complete work address including city and zip code;

(vii) work phone number; and

(viii) driver's license number.

(7) Under Subsections 58-37f-301(2)(p) and (q):

(a) An individual may:

(i) obtain the individual's own information and records contained within the Database; and

(ii) unless the individual's record is subject to a pending or current investigation authorized under Subsection 58-37f-301(2)(q), receive an accounting of persons or entities that have requested or received Database information about the individual, to include:

(A) the role of the person that accessed the information;

(B) the date range of the information that was accessed, if available;

(D) the name of the practitioner on behalf of whom the request was made, if applicable.

(b) The individual may request the information by submitting an original signed and notarized request as furnished by the Division that includes:

(i) the individual's:

(A) full name, including aliases;

(B) complete home address;

(D) date of birth;

(ii) a clearly legible copy of government-issued picture identification confirming the individual's identity; and

(iii) requested date range for the information.

(c) A third party may request information from the Database on behalf of an individual as provided in Subsection (7)(a), by submitting:

(i) an original signed and notarized request as furnished by the Division;

(ii) a clearly legible copy of government-issued picture identification confirming the requester's identity; and

(iii) an original, or certified copy, of properly executed legal documentation acceptable to the Database staff that the requester:

(A) is the individual's current agent under a power of attorney that:

(I) authorizes the agent to make health are decisions for the individual;

(II) allows the agent to have access to the patient's protected health information (PHI) under HIPAA; or

(III) otherwise grants the agent specific authority to obtain Database information on behalf of the individual;

(B) is the parent or court-appointed legal guardian of a minor individual;

(D) has an original, signed, and notarized form for release of records from the individual in a format acceptable to the Database staff, that identifies the purpose of the release with respect to the Database.

(8) Under Subsection 58-37f-301(2)(i), an employee of a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information if prior to making the request:

(a) the licensed practitioner has provided to the Division a written designation furnished by the Division that includes:

(i) the practitioner's:

(A) DEA number; and

(B) email address account registered with the Database, that is not a shared or group account; and

(ii) the designated employee's:

(A) full name;

(B) complete home address;

(D) date of birth;

(E) driver license number or state identification card number; and

(F) professional license number, if any; and

(iii) signatures from both the practitioner and designated employee;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification;

(d) the Database has issued the designated employee a user (PIN) and activated the employee's Database account.

(9) Under Subsection 58-37f-301(2)(j), an employee of the same business that employs a licensed practitioner who is authorized to prescribe controlled substances may obtain Database information if prior to making the request:

(a) the licensed practitioner and employing business have provided to the Division a written designation that includes:

(i) the practitioner's:

(A) DEA number; and

(B) email address account registered with the Database, that is not a shared or group account;

(ii) the name of the employing business; and

(iii) the designated employee's:

(A) full name;

(B) complete home address;

(D) date of birth;

(E) driver license number or state identification card number; and

(F) professional license number, if any;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(d) the Database has issued the designated employee a user (PIN) and activated the employee's Database account.

(10) Under Subsection 58-37f-301(4)(a), an individual who is employed in the emergency department of a hospital may obtain Database information if prior to making the request:

(a) the practitioner and the hospital operating the emergency department have provided to the Division a written designation that includes:

(i) the practitioner's:

(A) DEA number; and

(B) email address account registered with the Database, that is not a shared or group account;

(ii) the name of the hospital; and

(iii) the designated employee's:

(A) full name;

(B) complete home address;

(D) date of birth;

(E) driver license number or state identification card number; and

(F) professional license number, if any;

(b) the designated employee has registered for an account for access to the Database and provided a unique user identification and password;

(d) the Database has issued the designated employee a user (PIN) and activated the employee's Database account.

(11) Under Subsection 58-37f-301(5), an individual's requests to the Division regarding third party notice when a controlled substance or noncontrolled substance prescription is dispensed to that individual, shall be made as follows:

(a) To request that the Division begin providing notice to a third party, or to request that the Division discontinue providing notice to a third party, the individual shall submit an original signed and notarized request form as furnished by the Division, that includes:

(i) the individual's:

(A) full name, including aliases;

(B) birth date;

(D) email address; and

(E) contact phone number;

(ii) a clearly legible copy of government-issued picture identification confirming the individual's identity; and

(iii) the designated third party's:

(A) full name;

(B) complete home address, including city and zip code;

(D) contact phone number.

(b) After receiving a request to discontinue third party notice, the Division shall:

(i) provide notice to the requesting individual that the discontinuation notice was received; and

(ii) provide notice to the designated third party that the notification has been rescinded.

(12) Under Subsections 58-37f-301(2)(e)(i) and (2)(f), the Utah Department of Health may access Database information for purposes of scientific study regarding public health. To access information, the scientific investigator shall:

(a) demonstrate to the satisfaction of the Division that the research is part of an approved project of the Utah Department of Health;

(b) provide a description of the research to be conducted, including:

(i) a research protocol for the project; and

(ii) a description of the data needed from the Database to conduct that research;

(c) provide assurances and a plan that demonstrates all Database information will be maintained securely, with access being strictly restricted to the requesting scientific investigator;

(d) provide for electronic data to be stored on a secure database computer system with access being strictly restricted to the requesting scientific investigator; and

(e) pay all relevant expenses for data transfer and manipulation.

(13) Under Subsection 58-37f-301(2)(v), an employee of the Utah Medicaid Fraud Control Unit (MFCU) of the Attorney General's Office may have access to the Database if the following conditions have been met:

(a) a security agreement signed by the employee is submitted to the Division for access, which contains:

(i) the MFCU's:

(A) complete address, including city and zip code; and

(B) ORI number;

(ii) a copy of the employee's driver's license;

(iii) the employee's:

(A) full name;

(B) contact phone number; and

(b) the online database account includes the employee's:

(i) full name;

(ii) MFCU email address;

(iii) complete home address, including city and zip code;

(iv) work title;

(v) contact phone number;

(vi) complete work address including city and zip code;

(vii) work phone number; and

(viii) driver's license number.

(14) Database information that may be disseminated under Section 58-37f-301 may be disseminated by the Database staff either:

(a) verbally;

(b) by facsimile;

(d) by U.S. mail; or

(e) by electronic access, where adequate technology is in place to ensure that a record will not be compromised, intercepted, or misdirected.

(15)(a) A designating practitioner or other person that employs a designee authorized to obtain Database information, shall submit to the Division a notice of disassociation of designee as soon as practicable after that designee ceases employment or is otherwise no longer designated.

(b) The notice of disassociation of designee shall be on a form provided by the Division, and include:

(i) the designee's full name;

(ii) the designee's email address;

(iii) the designating practitioner's:

(A) name;

(B) DEA number;

(D) email address;

(iv) the establishment's:

(A) name;

(B) phone number, and fax number if any; and

(v) the reason for disassociation; and

(vi) the signature of the designating practitioner or person authorized to sign on their behalf.

R156-37f-302. Other Restrictions on Access to Database.

Subsection 58-37f-302(2), which prohibits any individual or organization with lawful access to the data from being compelled to testify with regard to the data, includes deposition testimony.

R156-37f-303. Access to Opioid Prescription Information Via an Electronic Data System.

(1) Under Subsection 58-37f-303(4)(a)(i), to access opioid prescription information in the Database, an electronic data system shall:

(a) interface with the Database through the Division-approved Prescription Monitoring Program (PMP) Hub system; and

(b) comply with the restrictions on Database access and use of Database information in Title 58, Chapter 37f, Controlled Substance Database Act and this Rule R156-37f.

(2) Pursuant to Subsection 58-37f-303(4)(a)(ii), to access opioid prescription information in the Database via an electronic data system (EDS), an EDS user shall:

(a) register to use the Database by creating an approved account established by the Division pursuant to a memorandum of understanding with the Division;

(b) use the unique user name and password associated with the account created for the EDS user to access Database information through the original internet access system;

(c) comply with the restrictions on Database access and uses of Database information in Title 58, Chapter 37f, Controlled Substance Database Act and this Rule R156-37f.

(3)(a) The Division may immediately suspend, without notice or opportunity to be heard, an electronic data system's or an EDS user's access to the Database, if the Division determines by audit or other means that the access may lead to a violation of Section 58-37f-601 or may otherwise compromise the integrity, privacy, or security of the Database's opioid prescription information.

(b) This remedy shall be in addition to the criminal and civil penalties imposed by Section 58-37f-601 for unlawful release or use of Database information, and the Division's obligation under Subsections 58-37f-303(5) and (6) to immediately suspend or revoke Database access and pursue appropriate corrective or disciplinary action against a non-compliant electronic data system or EDS user.

KEY: controlled substance database, licensing

Date of Last Change: December 9, 2021

Notice of Continuation: July 19, 2022

Authorizing, and Implemented or Interpreted Law: 58-1-106(1)(a); 58-37f-301(1)