A proposed amendment to Rule 64F-12.012, F.A.C., requires an inventory of drugs at each wholesaler establishment, of drugs it has on hand as of June 30, 2006, so as to give the Department information useful to determining compliance as the drug ...

DEPARTMENT OF HEALTH
Division of Family Health Services

RULE NO: RULE TITLE
64F-12.012: Records of Drugs, Cosmetics and Devices
64F-12.025: Certification Authority and Digital Signatures For Self-Authenticating Pedigree
PURPOSE AND EFFECT: A proposed amendment to Rule 64F-12.012, F.A.C., requires an inventory of drugs at each wholesaler establishment, of drugs it has on hand as of June 30, 2006, so as to give the Department information useful to determining compliance as the drug pedigree law transitions effective July 1, 2006 from the requirements of Section 499.0121(6)(d) and (e), F.S., to Section 499.0121(6)(f), F.S. An additional proposed amendment to this rule would allow adjustments to the pedigree requirements for an emergency distribution, where a pharmacy or health care practitioner certifies to the wholesaler a need to treat a life threatening medical condition, or medical condition that will result in serious bodily harm, even if a drug pedigree compliant with Section 499.0121(6)(f), F.S. is not available.
Rule 64F-12.025, F.A.C., is proposed to establish standards for a certification authority to issue a digital certificate to an employee of a wholesale establishment, where the establishment employs this person to certify the accuracy and completeness of a pedigree paper. Through this rule the Department seeks to facilitate a self authenticating drug pedigree.
SUMMARY: A proposed amendment to Rule 64F-12.012, F.A.C., would require an inventory of drugs on hand as of June 30, 2006. An additional amendment to this rule also allows adjustments to the pedigree requirement in certain emergency situations.
Proposed Rule 64F-12.025, F.A.C., would facilitate the use of a self-authenticating electronic drug pedigree. Self authentication is facilitated when the digital signature of the person authenticating the information that person provides on the pedigree is certified by an independent Certification Authority.
SUMMARY OF ESTIMATED REGULATORY COSTS: No Statement of Estimated Regulatory Cost was prepared.
Any person who wishes to provide information regarding a statement of estimated regulatory costs, or provide a proposal for a lower cost regulatory alternative must do so in writing within 21 days of this notice.
SPECIFIC AUTHORITY: 499.05, 499.0121, 499.0122, 499.013, 499.014, 499.052 FS.
LAW IMPLEMENTED: 499.012, 499.0121, 499.0122, 499.013, 499.014, 499.051, 499.052 FS.
A HEARING WILL BE HELD AT THE TIME, DATE AND PLACE SHOWN BELOW:
TIME AND DATE: May 15, 2006, 1:00 p.m. eastern daylight savings time.
PLACE: Ramada Inn Conference Center, 2900 North Monroe Street, Tallahassee, Florida.
Pursuant to the provisions of the Americans with Disabilities Act, any person requiring special accommodations to participate in this workshop/meeting is asked to advise the agency at least days before the workshop/meeting by contacting: Maxine Wenzinger at [phone]. If you are hearing or speech impaired, please contact the agency using the Florida Relay Service, 1(800)955-8771 (TDD) or 1(800)955-8770 (Voice).
THE PERSON TO BE CONTACTED REGARDING THE PROPOSED RULE IS: Rebecca Poston, R. Ph., Executive Director, Board of Pharmacy-Drugs Devices and Cosmetics, 4052 Bald Cypress Way, Mail Bin C-04, Tallahassee, Florida 32399, [phone].

THE FULL TEXT OF THE PROPOSED RULE IS:

64F-12.012 Records of Drugs, Cosmetics and Devices.

(1)(a) through (b) No change.

(2) Any person engaged in the manufacture of preion drugs, the wholesale distribution of preion drugs, or otherwise receiving or distributing preion drugs must maintain records as follows:

(a) through (d) No change.

(e) Inventory. A complete and accurate record of all stock of preion drugs on hand must be made annually available by establishments permitted under Chapter 499, F.S. A physical inventory must be conducted at least annually unless perpetual inventory records are maintained, in which case the physical inventory may be conducted on a biennial basis. Significant inventory discrepancies must be investigated and handled in accordance with the written policies and procedures of the establishment. In addition, no later than July 17, 2006, each wholesale distributor shall submit to the department an inventory of drugs it has on hand as of June 30, 2006.

(3) Pedigree papers.

(a) through (j) No change.

(k) Emergency Distributions. A wholesale distributor may distribute and a purchasing pharmacy or health care practitioner authorized by law to purchase preion drugs may accept a preion drug for which a pedigree that complies with Section 499.0121(6)(f), F.S., is not available, when the preion drug is required immediately to treat a specific patient with a life-threatening medical condition or a medical condition that will result in serious bodily harm. A pharmacist for the purchasing pharmacy or the health care practitioner shall supply the wholesale distributor with a coded reference to the specific patient and a statement that the emergency meets this section’s requirements. Such coded reference shall allow agents for the department to identify the specific patient in the pharmacy’s or health care practitioner’s records and confirm the stated emergency. The wholesale distributor that distributes a preion drug under this provision must maintain the coded patient reference and the pharmacist’s or the health care practitioner’s emergency statement to demonstrate compliance with this section. The supplying wholesale distributor must otherwise comply fully with all other applicable provisions of Sections 499.001 through 499.081, F.S., with respect to the distribution of such a drug. The wholesale distributor must maintain the confidentiality of the coded patient reference and the emergency statement in its possession, but may provide that information to the department or to FDLE pursuant to Section 499.051, F.S.

Specific Authority 499.05, 499.0121, 499.0122, 499.013, 499.014, 499.052 FS. Law Implemented 499.012, 499.0121, 499.0122, 499.013, 499.014, 499.051, 499.052 FS. History–New 1-1-77, Amended 12-12-82, 7-8-84, 1-30-85, Formerly 10D-45.53, Amended 11-26-86, 2-4-93,7-1-96, Formerly 10D-45.053, Amended 1-26-99, 4-17-01, 10-7-03,________.

64F-12.025 Certification Authority and Digital Signatures for Self-Authenticating Electronic Pedigree.

(1) As used in this rule chapter the terms “certificate” and “Certification Authority” are as defined by Section 668.003, F.S. (2005). The department will list on its website one or more companies authorized to serve as a Certification Authority to issue digital certificates to persons for purposes of certifying via a digital signature the accuracy and completeness of a pedigree paper for authentication purposes under sub-subparagraph 64F-12.013(5)(d)1.f., F.A.C. The department recognizes that a Certification Authority listed on the department’s website may revoke any digital certificate it has issued. In addition, the department recognizes that the certificate holder and the employer of the certificate holder may also seek revocation of a certificate, for example because of termination of the holder’s employment or change of the holder’s authority to sign a pedigree for the employing establishment.

(2) The department will list on its website a Certification Authority that requests in writing to the bureau that it be so listed, if the request demonstrates:

(a) The Certification Authority meets the requirements set forth in the Federal Government Bridge Certification Authority Certificate Policy (FBCA CP), of the federal General Services Administration for “medium assurance” certificates, or comparable requirements,

(b) The Certification Authority requires at a minimum the following written documentation prior to granting a digital certificate to the person requesting a digital signature to sign an electronic pedigree:

1. Authorization from the establishment for whom the person is requesting a digital certificate that person may sign pedigree papers on the establishment’s behalf,

2. A valid, unexpired identification document which bears a photograph of the person requesting a digital certificate such as:

a. A passport issued by the United States, an immigration document issued by the Federal Government, or any document issued by an agency of the Federal Government or the Armed Services of the United States,

b. A passport issued by a foreign government if the passport includes or is accompanied by a document proving that the alien is lawfully in the United States, or

c. A document issued by a state or political subdivision if the issuing state or political subdivision prohibits the issuance of the identification document to an alien who is unlawfully in the United States, and the state or political subdivision requires independent verification of the records offered by the person to prove identity when applying for the identification document;

3. The valid permit of the establishment for whom the person requesting a digital certificate is employed, which authorizes that establishment to possess and to wholesale preion drugs consistent with the transactions it documents on a drug pedigree paper,

(c) The Certification Authority shall submit to the department a statement from an independent auditor confirming that the Certification Authority complies with the requirements of this rule and the applicable provisions of sub-subparagraph 64F-12.013(5)(d)1.f., F.A.C., so that a recipient of a pedigree signed with a digital signature issued by the Certification Authority can rely on the integrity of the digital signature.

(3) To remain listed as a Certification Authority on the department’s website, the Certification Authority must submit a signed statement certifying to the department on an annual basis that it operates in accordance with the requirements of this section and has been audited by a qualified independent (from the operator of the Certification Authority) auditor on at least an annual basis. The Certification Authority must also submit a signed statement from an independent auditor that the Certification Authority complies with the requirements of this rule and the applicable provisions of sub-subparagraph  64F-12.013(5)(d)1.f., F.A.C. This documentation must be submitted to the department by June 1 of each year in order to remain listed on the department’s website as a Certification Authority for the next July 1 – June 30 period.

(4) If a Certification Authority proposes comparable requirements to the FBCA CP “medium assurance” certificates, the Certification Authority must provide a detailed crosswalk between the standards set forth for the FBCA CP “medium assurance” certificates and the proposed comparable requirements with a detailed explanation describing how the comparable requirements provide at least the same level of assurance as the FBCA CP standards.

(5) If any of the requirements in the FBCA CP differ from those set forth in this rule, the ones set forth in this rule shall prevail.

(6) If authorized by the affected establishments that lawfully purchase or receive preion drugs to digitally sign their electronic pedigrees, an employee may be issued digital certificates for each such establishment or for multiple permits of a single establishment.

(7) The loss, theft, or compromise of a private key or password must be communicated to the Certification Authority within 24 hours of discovery of the key’s loss, theft, or compromise. Notification should promptly result in a request for revocation of the Certificate holder's digital certificate and must include sufficient information to uniquely identify the certificate holder. Revocation shall be effective upon issuance of the next Certificate Revocation List.

(8) Either the certificate holder or the establishment shall request revocation of a certificate holder's digital certificate upon termination of the certificate holder's authorization to make digital signatures on behalf of the establishment. Notification should promptly request revocation of the certificate holder’s digital certificate and must include sufficient information to uniquely identify the certificate holder. Revocation shall be effective upon issuance of the next Certificate Revocation List.

(9) The establishment is ultimately responsible for electronic pedigrees that have been digitally signed on its behalf.

Specific Authority 499.05, 499.0121, 499.0122, 499.013, 499.014, 499.052 FS. Law Implemented 499.012, 499.0121, 499.0122, 499.013, 499.014, 499.051, 499.052 FS. History–New_________.

NAME OF PERSON ORIGINATING PROPOSED RULE: Rebecca Poston.
NAME OF SUPERVISOR OR PERSON WHO APPROVED THE PROPOSED RULE: Cassandra Pasley.
DATE PROPOSED RULE APPROVED BY AGENCY HEAD: 4/12/2006
DATE NOTICE OF PROPOSED RULE DEVELOPMENT PUBLISHED IN FAW: March 3, 2006