To strengthen accountability measures for safekeeping of confidential prescription information and to update materials incorporated by reference.

 

DEPARTMENT OF HEALTH

Prescription Drug Monitoring Program

RULE NOS.:RULE TITLES:

64K-1.003Accessing Database

64K-1.004Management and Operation of Database

64K-1.005Privacy of Information

PURPOSE AND EFFECT: To strengthen accountability measures for safekeeping of confidential prescription information and to update materials incorporated by reference.

SUMMARY: The rule is being amended to strengthen accountability measures for safekeeping of confidential prescription information during collection and maintenance as well as after authorized release and to update forms, training and other materials incorporated by reference.

SUMMARY OF STATEMENT OF ESTIMATED REGULATORY COSTS AND LEGISLATIVE RATIFICATION: The Agency has determined that this will not have an adverse impact on small business or likely increase directly or indirectly regulatory costs in excess of $200,000 in the aggregate within one year after the implementation of the rule. A SERC has not been prepared by the Agency.

The Agency has determined that the proposed rule is not expected to require legislative ratification based on the statement of estimated regulatory costs or if no SERC is required, the information expressly relied upon and described herein: Based on the SERC checklist, this rulemaking will not have an adverse impact or regulatory costs in excess of $1 million within five years as established in s.120.541(2)(a), F.S.

Any person who wishes to provide information regarding a statement of estimated regulatory costs, or provide a proposal for a lower cost regulatory alternative must do so in writing within 21 days of this notice.

RULEMAKING AUTHORITY: 893.055 FS.

LAW IMPLEMENTED: 893.055 FS.

IF REQUESTED WITHIN 21 DAYS OF THE DATE OF THIS NOTICE, A HEARING WILL BE SCHEDULED AND ANNOUNCED IN THE FAR.

THE PERSON TO BE CONTACTED REGARDING THE PROPOSED RULE IS: Rebecca Poston, Program Manager, Prescription Drug Monitoring Program, 4052 Bald Cypress Way, Bin #C-16, Tallahassee, Florida 32399 or [e-mail]

 

THE FULL TEXT OF THE PROPOSED RULE IS:

 

64K-1.003 Accessing Database.

(1) Pharmacists, prescribers and dispensers licensed in Florida The following entities have direct access to the information contained in the Program database:

(a) A pharmacist, prescriber, or dispenser if the information relates to a patient of that pharmacy, prescriber, or dispenser for purposes of reviewing the patient’s controlled substance prescription history. Those entities who are authorized to prescribe or dispense controlled substances, Schedules II-IV, and are licensed in the State of Florida may directly access the information in the program database by registering on through the E-FORCSE® secure web portal at https://flpdmp-phreg.hidinc.com. using the temporary user name “newacct” and temporary password “welcome”. to request and receive information electronically, or may submit A a written request may be submitted to the pProgram manager if information must be received by an alternate means.  A pharmacist, prescriber or dispenser must review the “Training Guide for Florida Practitioners and Pharmacists”, DH8009-PDMP, effective 01/2015, which is incorporated herein by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-##### prior to registering. Certification of this review is required before registration can be completed.  A permanent user name and password will be emailed to the successful registrant.  Registration denials, stating the reason for denial, will be emailed to the unsuccessful registrant.

(b) The Program manager and designated Program support staff acting at the direction of or as authorized by the Program manager for purposes of management of the Program database. 

(2) The following Eentities that do not have direct access to the information in the database, but may request information access from the pProgram manager or authorized staff:

(a) The Department or the heath care regulatory boards in Section 893.005(7)(c)1., F.S., when involved in a specific controlled substance investigation involving a designated person for one or more prescribed controlled substances.

(b) The Attorney General or designee for Medicaid Fraud cases involving prescribed controlled substances.

(c) A law enforcement agency during an active investigation regarding potential criminal activity, fraud, or theft relating to prescribed controlled substances by having the agency head or designee execute an “Agency User Agreement”, DH8017-PDMP, effective 07/2015, incorporated herein by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-#####.  If approved, the program will execute and return the agreement to the agency.

(3) Each agency head or designee shall appoint an agency administrator with an “Agency Administrator Appointment Form”, DH8010-PDMP, effective 07/2015, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-#####.  Approved administrators will be notified and provided instructions for appointing authorized users.

(4) Each agency administrator may appoint authorized users to request and receive information on behalf of the agency using an “Agency Authorized User Appointment Form, DH 8017-PDMP, effective 01/2015, incorporated by reference and available athttp://www/flrules.org/Gateway/reference.asp?No=Ref-#####.  Prior to appointment each authorized user must review the “Training Guide for Enforcement and Investigative Agencies”, DH 8011-PDMP, effective 01/2015, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-##### and the “E-FORCSE Information Security and Privacy Training Course, effective 01/2015, incorporated by reference and available at http://www.flrules/.org/Gateway/reference.asp?No=Ref-#####.  Certification of this review is required before registration can be completed.  The authorized user should provide a printed copy of the certification to the agency administrator who shall maintain them for the duration of the appointment and make them available for examination upon request of the program manager,  Approved authorized users will be notified by email and provided with instructions for requesting and receiving information through the secure E-FORCSE web portal.

(5) An authorized user must have actual knowledge of an active investigation as defined by statute prior to submitting a request and is prohibited from requesting information on behalf of another law enforcement agency or entity.

(6) Each agency head or designee shall immediately notify the program manager or support staff of a change in the agency administrator.  The program shall suspend authority to request and receive information from the program database during an agency administrator vacancy.

(7) Each agency administrator shall immediately notify the program manager or support staff by email of authorized user changes and verify the list of authorized users on or immediately prior to June 30 of each year.

(8)(d) A patient or the legal guardian or designated health care surrogate of an incapacitated patient as described in Section 893.0551, F.S., who, for may request information from the program database to verify the purpose of verifying the accuracy of the database information, contacts by contacting the Prescription Drug Monitoring Program by mail at 4052 Bald Cypress Way, Bin C-16, Tallahassee, FL 32399-3254 or by telephone at [phone].  Requesters must complete to request form DH 2143 “Patient Information Request,” effective 12/2010, December, 2010, which is incorporated by reference and available located at http://www.flrules.org/Gateway/reference.asp?No=Ref-00721. To receive the requested information, Tthe patient or other authorized person must make an appointment, appear in person at the pProgram or department field office, and produce a valid government issued identification, which includes a photograph, to review the requested information.

(3) The Program manager or designated staff must ensure that the entity requesting access to information is permitted by law to receive access and must document steps taken to verify the request as authentic.

Rulemaking Authority, 893.055 FS. Law Implemented 893.055 FS. History–New 11-24-1, Amended               .

 

64K-1.004 Management and Operation of Database.

(1) All non-exempt entities that dispense controlled substances, Schedules II-IV, are required to register and report to the pProgram database. These entities include:

(a) Any pharmacy with a permit issued under Chapter 465, F.S., that dispenses controlled substances, whether located in or out of the State of Florida, including mail order or Internet pharmacies.

(b) Any health care practitioner, practicing in Florida, who dispenses any controlled substances, Schedules II-IV, and who is licensed under Chapter 458, 459, 461, 462 or 466, F.S.

(c) Exemptions from reporting are as stated in Section 893.055(5), F.S.

(2) Dispensers must register electronically at https://flpdmp-reporting.hidinc/ using the temporary user name “new acct” and temporary password “welcome”.  A permanent user name and password will be provided electronically to successful registrants.  Certification that the dispenser has reviewed the “Dispenser’s Implementation Guide”, DH8013-PDMP, effective 01/2015, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-##### is required before registration can be completed. 

(3)(2) All dispensers will shall electronically report submit data dispensing information to the pProgram’s database as soon thereafter as possible, but not more than 7 days after the controlled substance is dispensed to an individual. Extensions of the time to within which a dispenser must report the dispensing of a controlled substance may shall be granted for no more than 30 days upon request to the pProgram by any dispenser unable to submit data by electronic means for good cause if the dispenser provides evidence of having suffered a mechanical or electronic failure or cannot report for reasons beyond the control of the dispenser or if the database is unable to receive submissions.

(4)(3) Dispensing information with Data not accepted by the database system due to a substantial number of errors or omissions shall be corrected and resubmitted to the database by the reporting dispenser within ten seven business days of receiving electronic or written notice from the program manager or support staff of the error or omission that the submitted data was unacceptable.

(5)(4) Failure to report the dispensing of Schedules II-IV controlled substances will result in tThe pProgram filing will file a complaint with the Department for investigation and refer a referral to law enforcement any failure to report the dispensing of Schedules II – IV controlled substances.

(6) Pharmacies that do not dispense controlled substances in or into this state must submit a “Notification of Exemption From Reporting”, DH8016-PDMP, effective 07/2015, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-#####.  Exemptions must be renewed on or before September 30 in even years on “Exemption Renewal Form”, DH8018-PDMP, effective 07/2015, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-#####.  Pharmacies seeking to begin dispensing controlled substances must notify the program electronically and be removed from the exempt list prior to registering to report to the program database.

(5) All information from the database disseminated in any form by the Program to any entity is considered protected health information and the use of it is governed by any and all applicable federal and state laws.

(7)(6)(a) A patient, health care provider, prescriber, or dispenser is authorized to may submit to the Program an electronic request to the program for the correction of erroneous information in the database. The request shall include:

1. A statement explaining in detail the error and the basis for the requested correction;

2. The precise change requested;

3. Documentation establishing the error and the correct information;

4. The requester’s name, address, telephone number, and license number if licensed as a health care provider in Florida.

(b) The pProgram manager or support designated staff will review all requests to correct information and will request the dispenser reporting the incorrect information to correct identified errors.  No correction will be made if no error is found in the database and will contact the entity that provided the data under review.  If the reporter of the data concurs that the data should be corrected as requested the reporter will make the correction. If the reporter does not agree, the reporter will not enter the correction. The program will notify Tthe entity or person requesting the correction of the results of the review will be notified of whether the correction has been made.

(8) Information reported will be maintained in the database for a period of two years from the date the prescription was dispensed.

Rulemaking Authority 893.055 FS. Law Implemented 893.055 FS. History–New 11-24-11, Amended             .

 

64K-1.005 Privacy of Controlled Substance Prescription Dispensing Information.

(1) Breaches in database security discovered by the pProgram manager or support designated staff must be reported to the Department’s Department Chief Privacy Officer and to law enforcement within one business day of immediately upon discovery of the breach. Any sSystem user users who suspects or becomes become aware of a breach in security must report the suspected or actual breach to the pProgram manager or support designated staff as soon as possible, but no later than one business day after its discovery.

(2) The program manager or support staff will notify the agency administrator by email each time a request for information is made by an agency authorized user.

(3) Information from the database disseminated in any form by the program to any entity is considered protected health information and the use of it is governed by any and all applicable state and federal laws.  All information accessed or provided to an authorized agency, entity, or individual shall be labeled “CONFIDENTIAL:  This information obtained from E-FORCSE® contains confidential controlled substance prescription dispensing information. Release or disclosure of confidential and exempt information may be a third degree felony.”

(4) Each registered agency shall be accountable for all confidential and exempt information received by authorized users.  The agency shall have an auditable, continuous chain of custody record of the receipt and transfer of confidential and exempt information.  When confidential and exempt information is transferred from one agency to another during the transaction of official business, the receiving agency shall maintain the confidential and exempt information in the same manner.

(5) It is unlawful to access or request information for a prohibited purpose or to disclose or release confidential or exempt information.  Failure to comply with section 893.0551(5), F.S. may result in suspension of access to the database.  The program manager will notify agency administrators of any alleged failure to comply.  Agency administrators must investigate the alleged compliance failure and report its findings to the program manager immediately. Access privileges may be reinstated upon request in writing to the program manager who shall determine if the investigation is complete and reinstatement is appropriate.  Prior to reinstatement the suspended user must submit proof of completion of the “E-FORCSE® Information Security and Privacy Training Course” within the last 30 days to the Program manager.

(6) All information released by an authorized user to a criminal justice agency shall have all information that is not the subject of the active investigation redacted by the authorized user prior to release.

(7) To prevent inadvertent release or disclosure of the confidential and exempt information in the database, pharmacists, prescribers and dispensers should avoid downloading and printing information from the database.

(8) Agency administrators shall provide a quarterly report to the Program with the status of each active investigation case which has required program database access.  The report shall include, at a minimum, whether the case is active or inactive and the disposition, if applicable.

Rulemaking Authority 893.055 FS. Law Implemented 893.055 FS. History–New 11-24-11, Amended               .

 

NAME OF PERSON ORIGINATING PROPOSED RULE: Rebecca Poston

NAME OF AGENCY HEAD WHO APPROVED THE PROPOSED RULE: John H. Armstrong, MD, FACS, Surgeon General and Secretary

DATE PROPOSED RULE APPROVED BY AGENCY HEAD: September 16, 2015

DATE NOTICE OF PROPOSED RULE DEVELOPMENT PUBLISHED IN FAR: August 12, 2015