64K-1.003. Accessing Database

Prescription Drug Monitoring Program

64K-1.001              Patient Advisory Alerts and Reports (Repealed)

64K-1.002              American Society for Automation in Pharmacy Standards and Formats

64K-1.003              Accessing Database

64K-1.004              Management and Operation of Database

64K-1.005              Privacy of Controlled Substance Prescription Dispensing Information

64K-1.006              Program Evaluation and Other (Repealed)

64K-1.007              Indicators of Controlled Substance Abuse

64K-1.008              Electronic Health Recordkeeping System Integration

64K-1.001 Patient Advisory Alerts and Reports.

Rulemaking Authority 893.055 FS. Law Implemented 893.055 FS. History–New 11-24-11, Repealed 12-11-19.

64K-1.002 American Society for Automation in Pharmacy Standards and Formats.

(1) The format for submission to the E-FORCSE® database shall be in accordance with the electronic reporting standards of the American Society for Automation in Pharmacy (ASAP) contained in the “Implementation Guide ASAP Standard for Prescription Drug Monitoring Programs Version 4, Release 2B” (12/2019), incorporated by reference. E-FORCSE® will continue to accept reports in the ASAP Version 4, Release 2A (10/2016) standard, incorporated by reference, for six months from the effective date of this rule, after which all reports must be made using the ASAP Version 4, Release 2B (12/2019) standard.

(2) The format for submission to the E-FORCSE® database if no controlled substances are dispensed shall be in accordance with the ASAP Error Report and Zero Report Standards (12/2019), which are included in the ASAP Version 4, Release 2B (12/2019) and are incorporated by reference.

(3) The agency has determined that posting the incorporated materials would be a violation of federal copyright law. The materials are available for public inspection at the Department of Health, 4052 Bald Cypress Way, Tallahassee, FL 32399, and the Department of State, R.A. Gray Building, 500 South Bronough Street, Tallahassee, FL 32399. A copy of the electronic reporting Standard for Prescription Drug Monitoring Programs may be obtained from the American Society for Automation in Pharmacy, 492 Norristown Road, Suite 160, Blue Bell, Pennsylvania 19422, Telephone: [phone], Website: www.asapnet.org.

Rulemaking Authority 893.055 FS. Law Implemented 893.055 FS. History–New 2-20-12, Amended 10-21-15, 12-19-18, 8-8-23.

64K-1.003 Accessing Database.

(1) Definitions:

(a) “Authenticate, Authenticated, or Authentication” means a confirmation of the authorized user’s credentials by the prescription drug monitoring program of a state, district or territory.

(b) “Designee” means a person, preferably a licensed or certified health care professional, appointed to act as an agent of a prescriber or dispenser for the purposes of requesting or receiving information from the Prescription Drug Monitoring Program database, E-FORCSE®.

(c) “E‑FORCSE®” is the comprehensive electronic database system established by the Department of Health that has controlled substance prescribing and dispensing information reported to it and that provides the information to persons and entities allowed by law to access, request and receive this information.

(d) “Electronic health record” is an electronic or digital version of a patient’s medical history, maintained over time and may include all of the key administrative clinical data relevant to that person’s medical care under a particular provider, including demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports. The electronic health record uses computer hardware and software for the storage, retrieval, sharing and use of health care information and data.

(e) “Impaired practitioner consultant” means an impaired practitioner program designated by the department through contract with a consultant to evaluate, refer and monitor impaired practitioners. The department has designated the Intervention Project for Nurses (IPN) and Professionals Resource Network (PRN) as the Approved Impaired Practitioner Programs.

(f) “Order” means a written, transmitted or oral direction from a prescriber for a controlled substance to be administered to a patient.

(g) “Prescribe” means the act of a prescriber issuing, writing or transmitting a direction to a pharmacist to dispense a specified controlled substance to a specified patient.

(2) Pharmacists, prescribers and dispensers, or their designees, are required to access and consult E‑FORCSE® to review a patient’s controlled substance dispensing history each time a controlled substance, other than a nonopioid drug listed on Schedule V, is prescribed or dispensed, but not ordered, for a patient age 16 or older unless a statutory exception applies.

(3)(a) Pharmacists, prescribers and dispensers licensed in Florida may directly access the information in E‑FORCSE® by registering at https://florida.pmpaware.net/login. A pharmacist, prescriber or dispenser must review the “PMP AWARxE® Requestor User Support Manual, Florida Prescription Drug Monitoring Program, Version 3.0” DH8009-PDMP, effective 5/2022, which is incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-15670, prior to registering. Registration denials, stating the reason for denial, will be emailed to the unsuccessful registrant.

(b) A prescriber or dispenser licensed to practice in the state of Florida may request and receive information from E‑FORCSE® using a secure recordkeeping system integration associated with his or her electronic health record. If the user is authenticated, E-FORCSE® will return query results to the authorized user’s electronic health record.

(c) Prescribers and dispensers licensed in states, districts or territories other than Florida, may directly access information in E-FORCSE® using an approved secure recordkeeping system integration associated with his or her electronic health record if:

1. The prescribers and dispensers are practicing in a state, district or territory where the Department has entered into a reciprocal interstate data sharing agreement, and;

2. The prescriber or dispenser, is accessing the information through an approved secure recordkeeping system integration associated with his or her electronic health record or pharmacy management system which authenticates the user’s credentials by the prescription drug monitoring program.

(4)(a) A designee of a prescriber or dispenser may directly access the information in E‑FORCSE® by registering at https://florida.pmpaware.net/login. A designee must review the “PMP AWARxE® Requestor User Support Manual” prior to registration.

(b) A registered designee will not have access to E‑FORCSE® until the designating prescriber or dispenser affirmatively accepts responsibility for the designee and links the designee to a pharmacy, prescriber or dispenser E-FORCSE® account as described in the “PMP AWARxE® Requestor User Support Manual.” The linking process will require the prescriber or dispenser to certify that the designee has reviewed the “PMP AWARxE® Requestor User Support Manual”.

(c) Registered designees who do not access E-FORCSE® for a period in excess of one year will be deactivated. Deactivated designees may request activation by sending a request to [e-mail].

(5) Prescribers and dispensers and their designees employed by the United States Department of Veterans Affairs (DVA), United States Department of Defense (DOD), and the Indian Health Service (IHS) who are authorized to prescribe or dispense controlled substance and are not licensed in Florida but provide health care services to patients in this state pursuant to such employment, may directly access E‑FORCSE® by registering at https://florida.pmpaware.net/login. An employee of the DVA, DOD and IHS must review the “PMP AWARxE Requestor User Support Manual” prior to registering. Registration denials, stating the reason for the denial, will be emailed to the unsuccessful registrant.

(a) A registered employee of the DVA, DOD, and IHS will not have access to E‑FORCSE® until his or her employment is verified.

(b) Direct access to the information in E‑FORCSE® is limited to the information that relates to a patient of such employee and may be accessed only for the purpose of reviewing that patient’s controlled substance prescription history.

(c) A prescriber or dispenser or designee employed by the DVA, DOD or IHS that is an authorized E‑FORCSE® user must notify E-FORSCE® within 30 days of termination of employment.

(6)(a) Law enforcement and other agencies that do not have direct access to E-FORSCE® may request information from the program manager by having the agency head or a person appointed by the agency head for this purpose execute an “Agency User Agreement,” DH8017-PDMP, effective 3/2023, incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-15671. If approved, the program manager will execute and return the agreement to the agency.

(b) After approval of the “Agency User Agreement,” each agency head or person appointed by the agency head for this purpose shall appoint an agency administrator with an “Agency Administrator Appointment Form,” DH8010-PDMP, effective 5/2019, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11368. The agency administrator may register at https://florida.pmpaware.net/login. Prior to registration, each agency administrator must review the “PMP AWARxE™ Law Enforcement and Regulatory User Support Manual,” DH8012-PDMP, effective 7/2021, incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-15672 and the “E-FORCSE® Information Security and Privacy Training Course,” (Florida Department of Law Enforcement, 2014) available at https://www.flrules.org/Gateway/reference.asp?No=Ref-15675 or https://360.articulate.com/review/content/af6873e1-d7e7-4f35-b68d-ce2f0d834d52/review, and complete the “Authorized User Certification Form”, DH8025-PDMP, effective 7/2019, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11370. The agency administrator shall maintain the “Authorized User Certification Form” for the duration of the appointment and make it available for examination upon request of the program manager. Upon registration, the agency administrator will upload the “Agency User Agreement” and the “Agency Administrator Appointment Form.” Registration denials, stating the reason for the denial, will be emailed to the unsuccessful registrant.

(c) Each agency head or person appointed by the agency head for this purpose shall immediately notify the program manager or support staff of a change in the agency administrator. Authority to request and receive information from E-FORCSE® shall be suspended during an agency administrator vacancy.

(d) A designee of an agency administrator may register at https://florida.pmpaware.net/login. A registered designee will not have access to E-FORCSE® until the agency administrator affirmatively accepts responsibility for the designee and links the designee to the agency administrator’s account as described in the “PMP AWARxE Law Enforcement and Regulatory User Support Manual.” The linking process will require the agency administrator to certify that the designee has reviewed the “PMP AWARxE Law Enforcement and Regulatory User Support Manual” and the “E-FORCSE® Information Security and Privacy Training Course.” The designee must provide a printed copy of the “Authorized User Certification Form” to the agency administrator who shall maintain it for the duration of the appointment and make it available for examination upon request of the program manager. Registration denials, stating the reason for the denial, will be emailed to the unsuccessful registrant.

(e) An authorized law enforcement user must have actual knowledge of an active investigation as defined by Section 893.055(1)(a), F.S., prior to submitting a request and is prohibited from requesting information on behalf of another law enforcement agency or entity.

(f) Each agency administrator shall immediately update user access permissions upon separation or reassignment of users and immediately update user access permissions upon discovery of negligence, improper or unauthorized use or dissemination of information and promptly notify the program manager or support staff by email.

(g) Prior to the release of information in active investigations or pending civil or criminal litigation involving prescribed controlled substances, the Attorney General or his or her designee must upload evidence of the trial court granting the petition or motion which specifically identifies the active or pending matter leading to the discovery of admissible evidence.

(7)(a) Impaired practitioner consultants do not have direct access to E-FORCSE® but may request and review information relating to persons referred to or participating in the approved impaired practitioner programs by having the Medical Director or Executive Director of the impaired practitioner program execute an “Impaired Practitioner Consultant User Agreement,” DH8020-PDMP, effective 3/2023, incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-15673. If approved, the program manager will execute and return the agreement to the Medical Director or Executive Director of the impaired practitioner program.

(b) The impaired practitioner consultant shall immediately notify the program manager or support staff of a change of Medical Director or Executive Director. Authority to request and receive information from E-FORCSE® shall be suspended while the position of Medical Director or Executive Director is vacant.

(c) Upon approval of the impaired practitioner consultant user agreement, the Medical Director or Executive Director of the approved practitioner program may appoint up to three (3) authorized users who are employees of the impaired practitioner consultant to request and receive information on behalf of the impaired practitioner program using an “Impaired Practitioner Program Authorized User Appointment Form,” DH8022-PDMP, effective 7/2016, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-07633. Prior to appointment, each authorized user must review the “Training Guide for Impaired Practitioner Consultants,” DH8021-PDMP, effective 7/2018, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-10122. Certification of this review is required before registration can be completed. The authorized user must provide a printed copy of this certification to the Medical Director or Executive Director of the impaired practitioner program who shall maintain them for the duration of the appointment and make them available for examination upon request of the program manager. Approved authorized users will be notified by email and provided with instructions for requesting and receiving information from E-FORCSE®. Registration denials, stating the reason for the denial, will be emailed to the Medical Director or Executive Director.

(d) The Medical Director or Executive Director of the impaired practitioner consultant shall immediately notify the program manager or support staff by email of authorized user changes.

(e) The person referred to or participating in the impaired practitioner program must provide written authorization for the impaired practitioner consultant to request and review information from E-FORCSE® relating to that person. The referred or participating person shall use the “Authorization for Impaired Practitioner Consultant Access,” Form DH8023-PDMP, effective 7/2016, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-07635, to provide this authorization. The impaired practitioner consultant or authorized user must upload the executed authorization form with the request for information from E-FORCSE® relating to the referred or participating person. Each access for a referred person requires a new authorization form. Authorizations for impaired practitioner program participants can be in effect no longer than the duration of the monitoring contract with the impaired practitioner program. If approved, the program manager will return the information on the referred or participating person from E-FORCSE® to the impaired practitioner consultant or authorized user. If denied, the program manager will notify the impaired practitioner consultant or authorized user with the reason for the denial.

(f) Impaired practitioner program consultants and authorized users may only query information relating to the referred or participating person who has given authorization to access the information, and not any prescriber or dispenser. An impaired practitioner program consultant may make a notation of the query in the impaired practitioner program file.

(g) Information in E-FORCSE® relating to referred and participating persons accessed by impaired practitioner consultants and authorized users is confidential and exempt and shall not be disclosed or transmitted to any other person, program or entity, including the Department. To prevent inadvertent disclosure, the information should not be included in the referred or participating person’s impaired practitioner program file, downloaded or printed.

(8) A patient or the legal guardian or designated health care surrogate of an incapacitated patient may request information from E-FORCSE® to verify the accuracy of the information by contacting the Prescription Drug Monitoring Program by mail at 4052 Bald Cypress Way, Bin #C-16, Tallahassee, FL 32399-3254, or by telephone at [phone] and submitting form DH 2143, “Patient Information Request,” effective 7/2018, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-10123.

Rulemaking Authority, 893.055 FS. Law Implemented 893.055, 893.0551 FS. History–New 11-24-11, Amended 2-17-16, 2-14-17, 12-19-18, 12-11-19, 8-8-23.

64K-1.004 Management and Operation of Database.

(1) All non-exempt entities that dispense controlled substances as defined in Section 893.055(1)(c), F.S., are required to register and report to the program database. Orders for administration are exempt from reporting.

(2) Dispensers must register electronically at https://pmpclearinghouse.net/registrations/new. Prior to registration, a dispenser must review the “PMP AWARxE® Data Submission Guide for Dispensers, Version 3.0, DH8013-PDMP, effective 7/2022, incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-15674, before registration can be completed.

(3) All dispensers shall electronically report dispensing information to E-FORCSE® as soon as possible, but no later than the close of the next business day after the day the controlled substance is dispensed. Extensions of time to report the dispensing of a controlled substance may be granted for no more than 30 days upon request to the program by any dispenser unable to submit data by electronic means if the dispenser provides evidence of having suffered a mechanical or electronic failure or cannot report for reasons beyond the control of the dispenser or if E-FORCSE® is unable to receive submissions. A dispenser that has no dispensing transactions to report for the preceding business day must submit a zero activity report as described in the “PMP AWARxE® Data Submission Guide for Dispensers.”

(4) Dispensing information with errors or omissions shall be corrected and resubmitted to E-FORCSE® by the reporting dispenser within seven business days of receiving electronic or written notice from the program manager or support staff of the error or omission.

(5) The program will file a complaint with the Department and refer to law enforcement any failure to report the dispensing of controlled substances as defined in Section 893.055(1)(c), F.S.

(6)(a) Pharmacies and registered dispensing practitioners that do not dispense controlled substances in or into this state and meet one of the exemptions in Section 893.055(3)(b), F.S., must submit a “Notification of Exemption From Reporting,” DH8016-PDMP, effective 7/2018, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11372 or https://controlled-substance-reporting-waiver.pmpaware.net/florida/waiver/index.

(b) Exemption requests must be renewed on a biennial basis or before February 28 in odd years on “Renewal of Notification of Exemption from Reporting Form,” DH8018-PDMP, effective 7/2018, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11373 or https://controlled-substance-reporting-waiver.pmpaware.net/florida/waiver/index.

(c) Pharmacies and registered dispensing practitioners seeking to begin dispensing controlled substances must notify the program electronically at [e-mail], requesting to be removed from the exempt list.

(7)(a) A patient, health care provider, prescriber, or dispenser may submit an electronic request to the program manager for the correction of erroneous information in E-FORCSE®. The request shall include:

1. A statement explaining in detail the error and the basis for the requested correction,

2. The precise change requested,

3. Documentation establishing the correct information,

4. The requester’s name, address, telephone number, and license number if licensed as a health care provider in Florida.

(b) The program manager or support staff will review all requests to correct information and will request the reporting dispenser to correct identified errors. No correction will be made if no error is found. The program will notify the entity or person requesting the correction of the results of the review.

(8) Information reported to E-FORCSE® will be available for access for a period of 2 years from the date the prescription was dispensed.

Rulemaking Authority 893.055 FS. Law Implemented 893.055 FS. History–New 11-24-11, Amended 2-17-16, 1-12-17, 12-11-19, 8-8-23.

64K-1.005 Privacy of Controlled Substance Prescription Dispensing Information.

(1) Breaches in database security discovered by the program manager or support staff must be reported to the Department’s Chief Privacy Officer immediately upon discovery of the breach. Any system user who suspects or becomes aware of a breach in security must report the suspected or actual breach to the program manager or support staff as soon as possible, but no later than one business day after discovery.

(2) The program manager or support staff will notify the agency administrator by email each time a request for information is made by an agency authorized user.

(3) Information from the database disseminated in any form by the program to any entity is considered protected health information, and the use of it is governed by any and all applicable state and federal laws. All information accessed or provided to an authorized agency, entity, or individual shall be labeled “CONFIDENTIAL: This information obtained from E-FORCSE® contains confidential controlled substance prescription dispensing information. Release or disclosure of confidential and exempt information may be a third degree felony.”

(4) Each registered agency shall be accountable for all confidential and exempt information received by authorized users. The agency shall have an auditable, continuous chain of custody record of the receipt and transfer of confidential and exempt information. When confidential and exempt information is transferred from one agency to another during the transaction of official business, the receiving agency shall maintain the confidential and exempt information in the same manner.

(5) It is unlawful to access or request information for a prohibited purpose or to disclose or release confidential or exempt information. Failure to comply with Section 893.0551(5), F.S., may result in suspension of access to the database. The program manager will notify agency administrators of any alleged failure to comply. Agency administrators must investigate the alleged compliance failure and report its findings to the program manager immediately. Access privileges may be reinstated upon request in writing to the program manager who shall determine if the investigation is complete and reinstatement is appropriate. Prior to reinstatement the suspended user must submit proof of completion of the “E-FORCSE® Information Security and Privacy Training Course,” effective 1/2015, incorporated by reference and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-06464, within the last 30 days to the program manager.

(6) All information released by an authorized user to a criminal justice agency shall have all information that is not the subject of the active investigation redacted by the authorized user prior to release.

(7) To prevent inadvertent release or disclosure of the confidential and exempt information in the database, pharmacists, prescribers and dispensers should avoid downloading and printing information from the database.

Rulemaking Authority 893.055 FS. Law Implemented 893.055, 893.0551 FS. History–New 11-24-11, Amended 2-17-16, 12-11-19.

64K-1.006 Program Evaluation and Other.

Rulemaking Authority 893.055 FS. Law Implemented 893.055 FS. History–New 11-24-11, Repealed 3-2-14.

64K-1.007 Indicators of Controlled Substance Abuse.

(1) The following behavior indicates controlled substance abuse:

A patient who within a 90-day time period: (1) obtains a prescription for a controlled substance as defined in Section 893.055(1)(c), F.S., from more than one prescriber; and (2) is dispensed a controlled substance as defined in Section 893.055(1)(c), F.S., from five or more pharmacies.

(2) Upon identifying a patient who exhibits or for whom the behavior outlined in subsection (1), has been exhibited, the Program Manager may provide relevant information to the identified health care practitioners who have prescribed or dispensed controlled substances to the identified patient within the 90-day period.

Rulemaking Authority 893.055 FS. Law Implemented 893.055(2) FS. History–New 5-21-12, Amended 12-11-19.

64K-1.008 Electronic Health Recordkeeping System Integration.

(1) Definitions.

(a) “Approved entity” means an eligible entity that has been approved by the department to connect an electronic health recordkeeping system directly to E‑FORCSE®.

(b) “Authorized user” means a health care practitioner as defined in Section 893.055(1)(g), F.S., or his or her designee.

(c) “Electronic health recordkeeping system” is an electronic or computer-based integrated system used by health care practitioners or providers to create, collect, store, manipulate, exchange, or make available personal health information including, but not limited to, electronic health records, for the delivery of patient care.

(d) “Electronic health record” is an electronic or digital version of a patient’s medical history, maintained over time and may include all of the key administrative clinical data relevant to that person’s medical care under a particular provider, including demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports. The electronic health record uses computer hardware and software for the storage, retrieval, sharing and use of health care information and data. The electronic health record must provide audit trail information at the time of the request, including but not limited to facility name; facility identification type; facility identification; facility state; requester first name; requester last name; requester role; requester identification type; requester identification; request date and time; request type; PDMP disclosure identification; patient last name; patient first name; and patient date of birth.

(e) “Eligible entity” means an organization or entity that operates, provides, or makes available an electronic health recordkeeping system to a health care practitioner or a designee of the practitioner.

(f) “Provider authentication” means confirmation of the authorized users’ credentials by the eligible entity through the state prescription drug monitoring program and Drug Enforcement Administration (DEA) Registration number, or National provider Identification (NPI) number prior to the release of information or state license number.

(2) An eligible entity may apply to the department to request and receive information directly from E‑FORCSE® through an electronic health recordkeeping system by completing an “Integration Request Form,” DH8024-PDMP, effective 7/2018, incorporated by reference and available at https://www.flrules.org/Gateway/reference.asp?No=Ref-11404 or https://go.bamboohealth.com/ehrrequest.

(3) Eligible entities and authorized users may retain patient prescription monitoring information in the electronic health recordkeeping system and must ensure that the confidential and exemption information is not inadvertently released or accessed by unauthorized persons or entities. Eligible entities shall comply with all of the following:

(a) Ensure the provider is authenticated prior to the release of information.

(b) Log each user’s access to the information. Access logs shall be retained by the practitioner, health care system, or pharmacy for a minimum of four years from the date of access and shall be provided to the department upon request.

(c) If the user identified in access logs is not the practitioner, the eligible entity shall clearly identify on which practitioner’s behalf the user was accessing information. A practitioner’s designee using an integrated system is required to maintain an active prescription drug monitoring program registration.

(d) Maintain appropriate administrative, technical, and physical security measures to safeguard against unauthorized access disclosure, or theft of information and shall meet all state and federal requirements for safeguarding protected health information.

(e) Notify the program manager of any breach in the electronic health record system that may have included E-FORCSE® information within 24 hours of making the determination that a breach occurred. This includes inappropriate access by a prescriber, health care system, or dispenser.

(4) Only individuals authorized by Sections 893.055 and 893.0551, F.S., who are active registered E‑FORCSE® users are authorized to request and receive information directly from E‑FORCSE® through an electronic health recordkeeping system.

(5) Pursuant to Section 893.055(8), F.S., prescribers and dispensers are required to consult the E-FORCSE® database to review a patient’s controlled substance dispensing history prior to prescribing or dispensing a controlled substance to that patient. Review of summary information provided through an electronic health recordkeeping system integration does not meet this requirement.

(6) The department may suspend or revoke integration approval if an eligible entity or authorized user does not adhere to the department’s terms and conditions, including security and privacy requirements. The department will immediately notify the approved entity or authorized user upon suspension or revocation of approval.

Rulemaking Authority 893.055 FS. Law Implemented 893.055(7) FS. History–New 1-7-20, Amended 8-8-23.