To update reporting American Society for Automation in Pharmacy (ASAP) standards for dispensing practitioners and pharmacies reporting controlled substance dispensing to newer version; to add definition of “authenticate” ....

 

DEPARTMENT OF HEALTH

Prescription Drug Monitoring Program

RULE NOS.:RULE TITLES:

64K-1.002American Society for Automation in Pharmacy Standards and Formats

64K-1.003Accessing Database

64K-1.004Management and Operation of Database

64K-1.008Electronic Health Recordkeeping System Integration

PURPOSE AND EFFECT: To update reporting American Society for Automation in Pharmacy (ASAP) standards for dispensing practitioners and pharmacies reporting controlled substance dispensing to newer version; to add definition of “authenticate” and clarify access through electronic health recordkeeping and pharmacy management systems; to extend the time to report errors or omissions and outline new waiver process; and to define provider authentication process and describe entity responsibilities.

SUMMARY: This rulemaking establishes the format for submissions to the Prescription Drug Monitoring Database, describes access to the information in the database by prescribers and dispensers outside Florida using electronic health recordkeeping systems, extends the days to report errors or omissions in reports and outlines new waiver request process, and defines the term “provider authentication” and entity responsibilities.

SUMMARY OF STATEMENT OF ESTIMATED REGULATORY COSTS AND LEGISLATIVE RATIFICATION:

The Agency has determined that this will not have an adverse impact on small business or likely increase directly or indirectly regulatory costs in excess of $200,000 in the aggregate within one year after the implementation of the rule. A SERC has not been prepared by the Agency.

The Agency has determined that the proposed rule is not expected to require legislative ratification based on the statement of estimated regulatory costs or if no SERC is required, the information expressly relied upon and described herein: Based on the SERC checklist, this rulemaking will not have an adverse impact on regulatory costs in excess of $1 million within five years as established in s.120.541(2)(a), F.S.

Any person who wishes to provide information regarding a statement of estimated regulatory costs, or provide a proposal for a lower cost regulatory alternative must do so in writing within 21 days of this notice.

RULEMAKING AUTHORITY: 893.055, F.S.

LAW IMPLEMENTED: 893.055, 893.0551, F.S.

IF REQUESTED WITHIN 21 DAYS OF THE DATE OF THIS NOTICE, A HEARING WILL BE SCHEDULED AND ANNOUNCED IN THE FAR.

THE PERSON TO BE CONTACTED REGARDING THE PROPOSED RULE IS: Rebecca Poston, Program Manager, 4052 Bald Cypress Way, Bin C-016, Tallahassee, Florida 32399 or [e-mail].

 

THE FULL TEXT OF THE PROPOSED RULE IS:

 

64K-1.002 American Society for Automation in Pharmacy Standards and Formats.

(1) The format for submission to the E-FORCSE® database shall be in accordance with the electronic reporting standards of the American Society for Automation in Pharmacy (ASAP) contained in the “Implementation Guide ASAP Standard for Prescription Drug Monitoring Programs Version 4, Release 2B 2A” (12/2019 10/2016), incorporated by reference. E-FORCSE® will continue to accept reports in the ASAP Version 4, Release 2A (10/2016) 2011 version 4.2 standard, incorporated by reference, for six months one year from the effective date of this rule (to be determined), after which all reports must be made using the ASAP 2016 Vversion 4, Release 2B (12/2019) 4.2A standard.

(2) The format for submission to the E-FORCSE® database if no controlled substances are dispensed shall be in accordance with the incorporated by reference ASAP Error Report and Zero Report Standards (12/2019 10/2016), which are included in the ASAP Version 4, Release 2B (12/2019) and are incorporated by reference.

(3) The agency has determined that posting the incorporated materials would be a violation of federal copyright law. The materials are available for public inspection at the Department of Health, 4052 Bald Cypress Way, Tallahassee, FL 32399, and the Department of State, R.A. Gray Building, 500 South Bronough Street, Tallahassee, FL 32399. A copy of the electronic reporting Standard for Prescription Drug Monitoring Programs may be obtained from the American Society for Automation in Pharmacy, 492 Norristown Road, Suite 160, Blue Bell, Pennsylvania 19422, Telephone: [phone], Website: www.asapnet.org.

Rulemaking Authority 893.055 FS. Law Implemented 893.055 FS. History–New 2-20-12, Amended 10-21-15, 12-19-18,_.

 

64K-1.003 Accessing Database.

(1)    Definitions:

(a) “Authenticate, Authenticated, or Authentication” means a confirmation of the authorized user’s credentials by the prescription drug monitoring program of a state, district or territory.

(a) through (f) renumbered (b) through (g) No change.

(2) No change.

(3)(a) Pharmacists, prescribers and dispensers licensed in Florida may directly access the information in E‑FORCSE® by registering at https://florida.pmpaware.net/login. A pharmacist, prescriber or dispenser must review the “PMP AWARxE® Requestor User Support Manual, Florida Prescription Drug Monitoring Program, Version 3.0 2.0” DH8009-PDMP, effective 5/2022 12/2018, which is incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-XXXX11365, prior to registering. Certification of this review is required before registration can be completed. Registration denials, stating the reason for denial, will be emailed to the unsuccessful registrant.

(b) A prescriber or dispenser licensed to practice in the state of Florida may request and receive information from E‑FORCSE® using a secure recordkeeping system integration associated with his or her electronic health record. If the user is authenticated, E-FORCSE® will return query results to the authorized user’s electronic health record.

(c) Prescribers and dispensers licensed in states, districts or territories other than Florida, may directly access information in E-FORCSE® using an approved secure recordkeeping system integration associated with his or her electronic health record if:

1. The prescribers and dispensers are practicing in a state, district or territory where the Department has entered into a reciprocal interstate data sharing agreement, and;

2. The prescriber or dispenser, is accessing the information through an approved secure recordkeeping system integration associated with his or her electronic health record or pharmacy management system which authenticates the user’s credentials by the prescription drug monitoring program.

(4)(a) A designee of a prescriber or dispenser may directly access the information in E‑FORCSE® by registering at https://florida.pmpaware.net/login. A designee must review the “PMP AWARxE® Requestor User Support Manual” prior to registration and the “Information Security and Privacy Training Course for Designees,” DH8019-PDMP, effective 7/2016, incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-07629 or http://www.floridahealth.gov/statistics-and-data/e-forcse/health_care_practitioners/index.html, prior to registering and complete the “Designee Certification Form” DH8026-PDMP, effective 5/2019, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11366. The designee must provide a printed copy of the “Designee Certification Form” to the designating prescriber or dispenser. Registration denials, stating the reason for the denial, will be emailed to the unsuccessful registrant.

(b) A registered designee will not have access to E‑FORCSE® until the designating prescriber or dispenser affirmatively accepts responsibility for the designee and links the designee to a pharmacy, prescriber or dispenser E-FORCSE® account as described in the “PMP AWARxE® Requestor User Support Manual.” The linking process will require the prescriber or dispenser to certify that the designee has reviewed the “PMP AWARxE® Requestor User Support Manual” and the “Information Security and Privacy Training Course for Designees.” The designating prescriber or dispenser shall maintain copies of the certification of these reviews and make them available to the program manager upon request.

(c) Registered designees who do not access E-FORCSE® for a period in excess of one year six months will be deactivated. Deactivated designees may request activation by sending a request to [e-mail] reapply for access.

(5) No change.

(6)(a) Law enforcement and other agencies that do not have direct access to E-FORSCE® may request information from the program manager by having the agency head or a person appointed by the agency head for this purpose execute an “Agency User Agreement,” DH8017-PDMP, effective 3/2023 7/2019, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-XXX11367. If approved, the program manager will execute and return the agreement to the agency.

(b) After approval of the “Agency User Agreement,” each agency head or person appointed by the agency head for this purpose shall appoint an agency administrator with an “Agency Administrator Appointment Form,” DH8010-PDMP, effective 5/2019, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11368. The agency administrator may register at https://florida.pmpaware.net/login. Prior to registration, each agency administrator must review the “PMP AWARxETM Law Enforcement and Regulatory User Support Manual,” DH8012-PDMP, effective 7/2021 6/2019, incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-XXXX11369 and the “E-FORCSE® Information Security and Privacy Training Course” (Florida Department of Law Enforcement, 2014) available at http://www.flrules.org/Gateway/reference.asp?No=Ref-XX or https://360.articulate.com/review/content/af6873e1-d7e7-4f35-b68d-ce2f0d834d52/review, and complete the “Authorized User Certification Form”, DH8025-PDMP, effective 7/2019, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11370. The agency administrator shall maintain the “Authorized User Certification Form” for the duration of the appointment and make it available for examination upon request of the program manager. Upon registration, the agency administrator will upload the “Agency User Agreement” and the “Agency Administrator Appointment Form.” Registration denials, stating the reason for the denial, will be emailed to the unsuccessful registrant.

(c) through (g) No change.

(7)(a) Impaired practitioner consultants do not have direct access to E-FORCSE® but may request and review information relating to persons referred to or participating in the approved impaired practitioner programs by having the Medical Director or Executive Director of the impaired practitioner program execute an “Impaired Practitioner Consultant User Agreement,” DH8020-PDMP, effective 3/2023 7/2016, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-XXXX07632. If approved, the program manager will execute and return the agreement to the Medical Director or Executive Director of the impaired practitioner program.

(b) through (c) No change.

(d) The Medical Director or Executive Director of the impaired practitioner consultant shall immediately notify the program manager or support staff by email of authorized user changes and verify the list of authorized users on or immediately prior to June 30 of each year.

(e) through (g) No change.

(8) No change.

Rulemaking Authority, 893.055 FS. Law Implemented 893.055, 893.0551 FS. History–New 11-24-11, Amended 2-17-16, 2-14-17, 12-19-18, 12-11-19,           .

 

64K-1.004 Management and Operation of Database.

(1) No change.

(2) Dispensers must register electronically at https://pmpclearinghouse.net/registrations/new. Prior to registration, a dispenser must review the “PMP AWARxE® Data Submission Guide for Dispensers, Version 3.0 Dispenser Guide, DH8013-PDMP, effective 7/2022 7/2018, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-XXXX11371, before registration can be completed.

(3) All dispensers shall electronically report dispensing information to E-FORCSE® E-FORSE® as soon as possible, but no later than the close of the next business day after the day the controlled substance is dispensed. Extensions of time to report the dispensing of a controlled substance may be granted for no more than 30 days upon request to the program by any dispenser unable to submit data by electronic means if the dispenser provides evidence of having suffered a mechanical or electronic failure or cannot report for reasons beyond the control of the dispenser or if E-FORCSE® is unable to receive submissions. A dispenser that has no dispensing transactions to report for the preceding business day must submit a zero activity report as described in the “PMP AWARxE® Data Submission Guide for Dispensers Dispenser Guide.”

(4) Dispensing information with errors or omissions shall be corrected and resubmitted to E-FORCSE® by the reporting dispenser within seven one business days day of receiving electronic or written notice from the program manager or support staff of the error or omission.

(5) No change.

(6) (a) Pharmacies and registered dispensing practitioners that do not dispense controlled substances in or into this state and meet one of the exemptions in section 893.055(3)(b), Florida Statutes, must submit a “Notification of Exemption From Reporting,” DH8016-PDMP, effective 7/2018, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11372 or https://controlled-substance-reporting-waiver.pmpaware.net/florida/waiver/index.https://forms.office.com/Pages/ResponsePage.aspx?id=gI_NKEQ8J0uBoM0rA6MbjTnNU-2qGcdHpmNOMX7FE7hUNloxQ01PWEkwWUFESEZBNFRWU1FXV1lPNyQlQCN0PWcu. Reporting exemptions include:

(b) Exemption requests Exemptions must be renewed on a biennial basis on or before February 28 in odd years by making the appropriate election on the biennial pharmacy permit renewal form or on “Renewal of Notification of Exemption from Reporting Form,” DH8018-PDMP, effective 7/2018, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11373 or https://controlled-substance-reporting-waiver.pmpaware.net/florida/waiver/index https://forms.office.com/Pages/ResponsePage.aspx?id=gI_NKEQ8J0uBoM0rA6MbjTnNU-2qGcdHpmNOMX7FE7hUNloxQ01PWEkwWUFESEZBNFRWU1FXV1lPNyQlQCN0PWcu.

(c) Pharmacies and registered dispensing practitioners seeking to begin dispensing controlled substances must notify the program electronically at [e-mail], requesting to and be removed from the exempt list.

(7) through (8) No change.

Rulemaking Authority 893.055 FS. Law Implemented 893.055 FS. History–New 11-24-11, Amended 2-17-16, 1-12-17, 12-11-19,       .             

 

64K-1.008 Electronic Health Recordkeeping System Integration.

(1) Definitions.

(a) “Approved entity” means an eligible entity that has been approved by the department to connect an electronic health recordkeeping system directly to E‑FORCSE®, the prescription drug monitoring data system.

(b) No change.

(c) “Electronic health recordkeeping system” is an electronic or computer-based integrated information system used by health care practitioners or providers to create, collect, store, manipulate, exchange, or make available personal health information including, but not limited to, electronic health records, for the delivery of patient care.

(d) through (e) No change.

(f) “Provider authentication” means confirmation of the authorized users’ credentials by the eligible entity through the state prescription drug monitoring program and Drug Enforcement Administration (DEA) Registration number, or National provider Identification (NPI) number prior to the release of information or state license number.

(2) An eligible entity may apply to the department to request and receive information directly from E‑FORCSE® through an electronic health recordkeeping system by completing an “Integration Request Form,” DH8024-PDMP, effective 7/2018, incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-11404 or https://go.bamboohealth.com/ehrrequesthttp://www.floridahealth.gov/statistics-and-data/e-forcse/EHR_Integration/index.html, and submitting the form to the department.

(3) Eligible entities and authorized users may retain patient prescription monitoring information in the electronic health recordkeeping system and must ensure that the confidential and exemption information is not inadvertently released or accessed by unauthorized persons or entities.  Eligible entities shall comply with all of the following:

(a) Ensure the provider is authenticated prior to the release of information.

(b) Log each user’s access to the information.  Access logs shall be retained by the practitioner, health care system, or pharmacy for a minimum of four years from the date of access and shall be provided to the department upon request.

(c) If the user identified in access logs is not the practitioner, the eligible entity shall clearly identify on which practitioner’s behalf the user was accessing information.  A practitioner’s designee using an integrated system is required to maintain an active prescription drug monitoring program registration.

(d) Maintain appropriate administrative, technical, and physical security measures to safeguard against unauthorized access disclosure, or theft of information and shall meet all state and federal requirements for safeguarding protected health information.

(e) Notify the program manager of any breach in the electronic health record system that may have included E-FORCSE® information within 24 hours of making the determination that a breach occurred.  This includes inappropriate access by a prescriber, health care system, or dispenser.

(4) through (6) No change.

Rulemaking Authority 893.055 FS. Law Implemented 893.055(7) FS. History–New 1-7-20,        .

 

NAME OF PERSON ORIGINATING PROPOSED RULE: Rebecca Poston

NAME OF AGENCY HEAD WHO APPROVED THE PROPOSED RULE: Joseph A. Ladapo, MD, PhD, Surgeon General and Secretary

DATE PROPOSED RULE APPROVED BY AGENCY HEAD: April 13, 2023

DATE NOTICE OF PROPOSED RULE DEVELOPMENT PUBLISHED IN FAR: March 21, 2022