Records of Drugs, Cosmetics and Devices, Certification Authority and Digital Signatures For Self-Authenticating Pedigree

DEPARTMENT OF HEALTH
Division of Family Health Services

RULE NO: RULE TITLE
64F-12.012: Records of Drugs, Cosmetics and Devices
64F-12.025: Certification Authority and Digital Signatures For Self-Authenticating Pedigree

NOTICE OF CHANGE

Notice is hereby given that the following changes have been made to the proposed rule in accordance with subparagraph 120.54(3)(d)1., F.S., published in Vol.32,No.16, April 21, 2006 issue of the Florida Administrative Weekly.

The changes are the result of comments received from the public during a rule hearing held on May 15, 2006, or by facsimile transaction and by email or by mail, within the time frame allowed by the Department at the Rule hearing held on May 15, 2006.

Paragraphs (2) (f) and (3) (k) of Rule 64F-12.012 shall now read as follows:

64F-12.012 Records of Drugs, Cosmetics and Devices

(2)(f) Inventory existing as of June 30, 2006.

A wholesale distributor permitted under Section 499.012, F.S., that has purchased a preion drug on or before close of business June 30, 2006, without the pedigree required by Section 499.0121(6)(f), F.S., may distribute such drug provided the wholesale distributor submits to the department an inventory of such drugs no later than July 17, 2006, conforming to paragraph (2)(e) above and provided further that such drugs are otherwise in compliance with the provisions of Sections 499.001 through 499.081, F.S. Inventories shall be submitted to the Department in written form, email, facsimile, or electronic media excluding a web page. The Department will consider the submittal to be a trade secret as defined by Section 812.081(1)(c), F.S., provided that the sending wholesale distributor complies with the requirements of subsections 64F-12.021(1) and (2), F.A.C.

(3) Pedigree papers.

(k) Emergency Distributions. A wholesale distributor may distribute and a purchasing pharmacy or health care practitioner authorized by law to purchase preion drugs may accept a preion drug for which a pedigree that complies with Section 499.0121(6)(f), F.S., is not available, when the preion drug is required immediately to treat a specific patient with a life-threatening medical condition or a medical condition that will result in serious bodily harm. A pharmacist for the purchasing pharmacy, or the health care practitioner, shall supply a statement to the supplying wholesale distributor(s) that the emergency meets this rule paragraph’s requirements and the supplying wholesale distributor(s) must maintain such statement in compliance with the timeframes in Section 499.0121(6)(b), F.S. The supplying wholesale distributor must otherwise comply fully with all other applicable provisions of Sections 499.001 through 499.081, F.S., with respect to such drug.

 

Specific Authority 499.003, 499.05, 499.0121, 499.0122, 499.013, 499.014, 499.052 FS. Law Implemented 499.01, 499.003, 499.012, 499.0121, 499.0122, 499.013, 499.014, 499.028, 499.04, 499.041, 499.05, 499.051, 499.052, 499.06, 499.063, 499.064, 499.066, 499.067 FS. History–New 1-1-77, Amended 12-12-82, 7-8-84, 1-30-85, Formerly 10D-45.53, Amended 11-26-86, 2-4-93, 7-1-96, Formerly 10D-45.053, Amended 1-26-99, 4-17-01, 10-7-03, 1-1-04, 6-15-04, 8-2-04, 1-19-06,________.

 

Subsections (2) through (10) of Rule 64F-12.025 shall read as follows:

64F-12.025 Certification Authority and Digital Signatures For Self-Authenticating Pedigree.

There are no changes to subsection (1) of this rule as published in the April 21, 2006, edition of the Florida Administrative Weekly.

(2) The department will list on its website a Certification Authority that requests in writing to the bureau that it be so listed, if the request demonstrates:

(a) The Certification Authority meets the requirements set forth in the Federal Government Bridge Certification Authority Certificate Policy (FBCA CP), of the federal General Services Administration for “medium assurance” certificates, or comparable requirements,

(b) The Certificate Authority will issue two types of digital signatures, the status of which is ascertainable within the digital signature. One type of digital signature will indicate that the person to whom the digital signature is issued signs on behalf of a company that is lawfully permitted in Florida to engage in the unrestricted wholesale distribution of a preion drug in or into Florida. The other type of digital signature will indicate that the person to whom the digital signature is issued signs on behalf of a company that is not lawfully permitted in Florida but is lawfully permitted in its resident state to engage in the wholesale distribution of preion drugs, or is licensed in Florida under a restricted distributor permit.

(c) The Certification Authority requires at a minimum the following written documentation prior to granting a digital certificate to the person requesting a digital signature to sign an electronic pedigree:

1. Authorization from the establishment for whom the person is requesting a digital certificate that that person may sign pedigree papers on the establishment’s behalf,

2. A valid, unexpired identification document which bears a photograph of the person requesting a digital certificate such as:

a. A passport issued by the United States, an immigration document issued by the Federal Government, or any document issued by an agency of the Federal Government or the Armed Services of the United States,

b. A passport issued by a foreign government if the passport includes or is accompanied by a document proving that the alien is lawfully in the United States, or

c. A document issued by a state or political subdivision if the issuing state or political subdivision prohibits the issuance of the identification document to an alien who is unlawfully in the United States, and the state or political subdivision requires independent verification of the records offered by the person to prove identity when applying for the identification document;

3.a. A copy of the state issued permit for the company’s name and address for whom the person is requesting a digital certificate demonstrating authorization by the state of Florida to engage in the unrestricted wholesale distribution of preion drugs in or into Florida, or

b. A copy of the state issued permit or license for the company’s name and address for whom the person is requesting a digital certificate demonstrating authorization by the state in which the company resides to engage in the wholesale distribution of preion drugs, or demonstrating authorization by the state of Florida to engage in the wholesale distribution of preion drugs under a restricted distributor permit.

(d) The Certification Authority shall submit to the department a statement from an independent auditor confirming that the Certification Authority complies with the requirements of this rule and the applicable provisions of sub-subparagraph 64F-12.013(5)(d)1.f., F.A.C., so that a recipient of a pedigree signed with a digital signature issued by the Certification Authority can rely on the integrity of the digital signature.

(3) To remain listed as a Certification Authority on the department’s website, the Certification Authority must submit a signed statement certifying to the department on an annual basis that it operates in accordance with the requirements of this section and has been audited by a qualified independent (from the operator of the Certification Authority) auditor on at least an annual basis. The Certification Authority must also submit a signed statement from an independent auditor that the Certification Authority complies with the requirements of this rule and the applicable provisions of sub-subparagraph 64F-12.013(5)(d)1.f., F.A.C., This documentation must be submitted to the department by June 1 of each year in order to remain listed on the department’s website as a Certification Authority for the next July 1 – June 30 period.

(4) If a Certification Authority proposes comparable requirements to the FBCA CP “medium assurance” certificates, the Certification Authority must provide a detailed crosswalk between the standards set forth for the FBCA CP “medium assurance” certificates and the proposed comparable requirements with a detailed explanation describing how the comparable requirements provide at least the same level of assurance as the FBCA CP standards.

(5) If any of the requirements in the FBCA CP differ from those set forth in this rule, the ones set forth in this rule shall prevail.

(6) If authorized by the affected establishments that lawfully purchase or receive preion drugs to digitally sign their electronic pedigrees, an employee may be issued digital certificates for each such establishment or for multiple permits of a single establishment.

(7)(a) The loss, theft, or compromise of a private key or password must be communicated to the Certification Authority within 24 hours of discovery of the key’s loss, theft, or compromise. Notification should promptly result in a request for revocation of the Certificate holder's digital certificate and must include sufficient information to uniquely identify the certificate holder. Revocation shall be effective upon issuance of the next Certificate Revocation List.

(b) During the lifetime of the certificate, the Certificate Authority must for each certificate issued verify the license status has not been suspended, revoked, or otherwise inactivated for the wholesale distribution of preion drugs. The Certificate Authority must perform this check at least weekly. If it is found the license status has been suspended, revoked, or otherwise inactivated, then the Certificate Authority must issue a certificate revocation for all certificates issued effective the date of the license change.

(8) Either the certificate holder or the establishment shall request revocation of a certificate holder's digital certificate upon termination of the certificate holder's authorization to make digital signatures on behalf of the establishment. Notification should promptly request revocation of the certificate holder’s digital certificate and must include sufficient information to uniquely identify the certificate holder. Revocation shall be effective upon issuance of the next Certificate Revocation List.

(9) The establishment is ultimately responsible for electronic pedigrees that have been digitally signed on its behalf.

(10) Until a Certification Authority can submit the audit required in paragraph (2)(d) or June 30, 2007, whichever is earlier, the Department will provisionally list a Certification Authority requesting to be listed on the Department’s website as a Certification Authority, provided that the Certification authority submits the audit required by paragraph (2)(c) by June 15, 2007, and otherwise operates in accordance with the requirements of this rule. A digital certification issued by a provisionally listed Certification Authority must expire and be revoked on or before June 30, 2007. Any provisionally listed Certification Authority that has not submitted the audit required in paragraph (2)(c) by June 15, 2007, will be removed from the provisional list and may not operate as a Certification Authority under this section. Upon submission of the audit required by paragraph (2)(c), the Certification Authority will be listed without the provisional designation. Upon removal of the provisional designation, a Certification Authority must reissue all existing digital certificates.

 

Specific Authority 499.003, 499.05, 499.0121, 499.0122, 499.013, 499.014, 499.052 FS. Law Implemented 499.003, 499.012, 499.0121, 499.0122, 499.013, 499.014, 499.051, 499.052 FS. History– New________.

 

THE PERSON TO BE CONTACTED REGARDING THE PROPOSED RULES IS: Rebecca Poston, R. Ph., Executive Director, Board of Pharmacy-Drugs Devices and Cosmetics, 4052 Bald Cypress Way, Mail Bin C-04 Tallahassee, Florida 32399, [phone].