DEA Announces Proposed Expansion of Controlled Substance Monitoring Requirements

Alert
November 9, 2020
9 minutes

On November 2, 2020, the Drug Enforcement Administration (“DEA”) issued a notice of proposed rulemaking expanding the obligations of DEA registrants to monitor and report suspicious orders for controlled substances (the “Proposal”).1 The Proposal sets forth a two-option framework for reviewing and reporting suspicious orders, adds new reporting and recordkeeping requirements, and expands the scope of suspicious order monitoring obligations to cover certain hospitals, practitioners and other dispensers. Notably, the Proposal asserts that those hospitals, practitioners and dispensers should already be in compliance with the purported requirements.

The Proposal would impact all DEA registrants authorized to distribute controlled substances, including distributors, manufacturers, importers, and Narcotic Treatment Programs (“NTPs”), as well as the numerous entities that distribute controlled substances under the “five percent rule.”2 This latter group may include persons and entities not traditionally regulated as distributors under the Controlled Substances Act (“CSA”), including thousands of pharmacies, hospitals, clinics, teaching institutions, practitioners, mid-level practitioners (“MLPs”), MLP-ambulance services, researchers, and analytical labs. All comments to the Proposal are due on or before January 4, 2021.

BACKGROUND

Under the CSA, DEA registrants must maintain “effective controls” against diversion of controlled substances from legitimate channels. DEA registrants that distribute controlled substances must also design and operate a system to identify and disclose suspicious orders of controlled substances that they receive, including those orders of unusual size, pattern, or frequency.3 Over the years, DEA registrants have repeatedly sought guidance from DEA on the scope of these obligations. DEA has been notoriously reluctant to provide meaningful guidance.4

Against that backdrop, in 2015, DEA issued a Decision and Order revoking Masters Pharmaceuticals, Inc.’s DEA registration for failing to report suspicious orders.5 In the Decision and Order, DEA announced its view that once a distributor reported a suspicious order, it must either decline to ship the order or investigate the order before shipping. On appeal, the United States Court of Appeals for the District of Columbia Circuit affirmed DEA’s Decision and Order, holding that based on the deficiencies of Masters’ SOM Program, once the company “reported a suspicious order, it must make one of two choices: decline to ship the order, or conduct some ‘due diligence’” and ship the order “if it is able to determine that the order is not likely to be diverted into illegitimate channels.”6 That process was never codified by regulation.

In 2018, in the wake of the opioid crisis, Donald Trump signed into law the PDDA as part of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (“SUPPORT Act”). In relevant part, the PDDA required DEA to establish a centralized database for suspicious order reports, displacing the practice specified by DEA regulations that registrants report suspicious order to local DEA offices. As detailed below, the PDDA also revised the term of “suspicious order” used in the CSA.

DEA’S PROPOSAL

The Proposal is purportedly the culmination of DEA’s efforts to codify certain aspects of the Masters decision and implement requirements set forth in the PDDA, but it notably expands registrants’ due diligence, reporting, and recordkeeping obligations.

1. Two-Option System for Identifying and Reporting Suspicious Orders

The Proposal establishes a framework for identifying and reporting suspicious orders that largely mirrors the process set forth in the Masters decision. Nevertheless, this marks the first time DEA has formally specified the manner in which registrants should respond to potentially suspicious orders of controlled substances.

Under the Proposal, registrants have two options for handling an “order received under suspicious circumstances” (“ORUSC”). Registrants can file a suspicious order report immediately through the DEA centralized database, decline to ship the ORUSC, and maintain a record of the ORUSC and any related due diligence. Alternatively, registrants may conduct due diligence in order to “dispel each suspicious circumstance surrounding the ORUSC within seven calendar days.” If they are able to do so, they must maintain a record of the due diligence conducted to meet this burden, and then may ship the order. If registrants are unable to “dispel each suspicious circumstance” within seven days, they are required to file a suspicious order report through the DEA centralized database and must not ship the order.

In the Proposal, DEA asserts that “there is no added cost associated” with the new two-option framework because it is a “codification of existing practices.”7 However, the burden and cost associated with identifying and reporting suspicious orders may in fact increase, given the Proposal’s broad language requiring registrants to “dispel each suspicious circumstance surrounding the ORUSC” within seven days and specifically document its due diligence. In addition, the Proposal purports to require registrants to design a system “not only to identify size, pattern, and frequency [of] orders, but also to identify suspicious orders based on facts and circumstances that may be relevant indicators of diversion in determining whether a person . . . is engaged in, or is likely to engage in, the diversion of controlled substances.”8 The Proposal does not, however, provide further clarity regarding what constitutes “facts and circumstances that may be relevant indicators of diversion.”9 It thus provides little help to registrants struggling to determine what information should be reviewed and what, if any, external data it may be required to purchase, collect or analyze to meet its obligations.

2. New Recordkeeping and Reporting Requirements

The Proposal also sets forth a number of material changes to reporting and recordkeeping requirements.

First, the Proposal would require registrants to report any suspicious order within seven calendar days after it is received. The current regulations require that suspicious orders be reported “when discovered,” without specifying a timeframe in which a determination regarding suspicion must be made.10

Second, the Proposal would require registrants to maintain a record of every suspicious order and ORUSC for at least two years, and all records must be prepared within the original seven-day diligence window. These requirements are purportedly designed to enable DEA to review—and, presumably, to second-guess—a registrant’s decision to release ORUSCs. They further seem intended to prevent registrants from relying on due diligence conducted promptly but only documented at a later date.

Third, the Proposal would require registrants to include certain information in all suspicious order and ORUSC records. Specifically, the Proposal would require that these records include (1) the “information and circumstances [that] rendered the order actually or potentially suspicious”; (2) the “steps, if any, [that] the registrant took to conduct due diligence”; (3) the “information [that] it obtained during its investigation, and where the registrant concludes that each suspicious circumstance has been dispelled, the specific basis for each such conclusion”; (4) “[w]hether or not the registrant distributed controlled substances pursuant to this order.”11 While the precise scope of this new recordkeeping provision is unclear, the Proposal specifies that it “would require more than just a ‘check-the-box’ type of documentation.”12

Fourth, the Proposal would require registrants to send suspicious order reports to a centralized DEA database as opposed to local field offices. The Proposal also requires that suspicious order reports include certain information, most notably the “information and circumstances [that] rendered the order actually suspicious.”13

Taken together, the Proposal’s new recordkeeping and reporting requirements mark a significant change from existing regulations. If they are incorporated into the final rule, registrants should consider a fulsome review of their existing suspicious order monitoring program and recordkeeping practices.

3. New Definitions for Suspicious Order Monitoring

The Proposal also sets forth certain definitions in support of the framework outlined above. In particular, it modifies the definition of “suspicious order”—a central term in the existing regulation—and adds definitions for three new terms: “order,” “order received under suspicious circumstances” (“ORSUC”), and “due diligence.”

First, the Proposal incorporates the definition of “suspicious order” set forth in the PDDA. For almost 50 years, the term “suspicious order” was defined to include orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency.14 The new definition expands the current understanding of that term by specifying that a suspicious order “includes, but is not limited to” those three types of orders. The Proposal specifically notes that the new definition clarifies that “an order for controlled substances can be deemed suspicious for reasons other than size, pattern, or frequency (including reasons related to the characteristics of the customer submitting the order.”15

Second, the Proposal includes a definition for the term “order” which would purportedly encompass any communication proposing or requesting a distribution of controlled substances. Although DEA contends that this new definition is “consistent with the current understanding of the term,” it in fact may reflect a far broader understanding of the term than is common in the industry.16

Third, the Proposal includes a definition for the term “order received under suspicious circumstances.”17 As explained above, this new term is central to the Proposal’s two-option review framework for identifying and reporting suspicious orders. The Proposal suggests that this new definition is intended to provide clarity in describing the procedures for identifying suspicious orders, and should capture any circumstances that might be indicative of diversion, including, but not limited to, orders that are “blocked,” “flagged,” “held,” or “pended” by a suspicious order monitoring program.

Finally, the Proposal advances an expansive definition for “due diligence,” which may ultimately raise more questions than answers regarding the scope of a registrant’s duties.18 For example, it is unclear what constitutes an “examination of each suspicious circumstance surrounding an order,” or an “examination of all facts and circumstances that may be relevant indicators of diversion” or likely diversion.

4. Certain Practitioners and Dispensers to Be Subject to Suspicious Order Monitoring Regulations

The Proposal would also amend DEA regulations to require that entities including practitioners, hospitals, and dispensers that distribute pursuant to the “five percent rule”—which allows entities to distribute up to five percent of their controlled substances to other dispensers under certain circumstances—design and operate a suspicious order monitoring system.

DEA asserts that such registrants “already understand” that they must maintain suspicious order monitoring systems under the CSA’s ill-defined “effective controls” requirement.19 But there is no DEA regulation or published guidance to that effect.20 The purported monitoring requirement may therefore come as a surprise to thousands of hospitals, pharmacies, physicians, and other entities that routinely and legally distribute pursuant to the “five percent rule.”

In light of DEA’s position that the Proposal’s requirements may already apply, all practitioners and other entities that distribute pursuant to the “five percent rule” should examine their suspicious order monitoring programs, if they exist, and consult counsel as needed.

CONCLUSION

The Proposal reflects DEA’s continuing focus on suspicious order monitoring involving both opioids and other controlled substances. Thousands of registrants may be affected by the proposed regulation. All should consider the Proposal’s implications carefully and use this occasion to assess their compliance with existing suspicious order monitoring requirements. Some may wish to submit formal comments seeking clarification of the Proposal’s terms or apprising DEA of the practical difficulties associated with it. Comments are due on or before January 4, 2021. Please contact your usual legal advisor at Ropes & Gray with any questions.

  1. Notice of proposed rulemaking to Suspicious Orders of Controlled Substance, 85 Fed. Reg. 69,282 (Nov. 2, 2020).
  2. Under the “five percent rule,” an entity that is registered to dispense controlled substances may distribute them to another practitioner for dispensing to patients, so long as the total amount distributed does not exceed five percent of the number of dosage units of controlled substances dispensed and distributed by the entity during that year. 21 C.F.R. § 1307.11.
  3. 21 C.F.R. § 1301.74(b).
  4. U.S. Gov’t Accountability Off., GAO-15-471, More DEA Information about Registrants’ Controlled Substances Roles Could Improve Their Understanding and Help Ensure Access (2015).
  5. Decision and Order, Masters Pharms., Inc., No. 13-39, 80 Fed. Reg. 55,418 (Sept. 15, 2015).
  6. Masters Pharms., Inc. v. DEA, 861 F.3d 206, 212–213 (D.C. Cir. 2017).
  7. Notice, 85 Fed. Reg. at 69,290.
  8. See Notice, 85 Fed. Reg. at 69, 286 (Proposed amended 1301.74(b)(1)).
  9. Id.
  10. 21 C.F.R. § 1301.74(b).
  11. See Notice, 85 Fed. Reg. at 69,288 (proposed new 21 C.F.R. § 1301.78(c)).
  12. Notice, 85 Fed. Reg. at 69,288.
  13. See id. at 69,292 (proposed new 21 C.F.R. § 1301.78(b)).
  14. 21 C.F.R. § 1301.74(b).
  15. Notice, 85 Fed. Reg. at 69,285 (Suspicious order “includes, but is not limited to, an order of unusual size, an order deviating substantially from a normal pattern, or an order of unusual frequency.”).
  16. Id. (Order “means any communication by a person to a registrant proposing or requesting a distribution of a controlled substance, regardless of how it is labeled by the person or the registrant, and regardless of whether a distribution is made by the registrant, except that simple price/availability inquiries, standing alone, do not constitute an order.”).
  17. Id. (Order received under suspicious circumstances “means an order potentially meeting the definition of suspicious order.”).
  18. Id. (Due diligence “means a reasonable and documented investigation into persons and orders (coupled with other appropriate investigations, including previous investigations into persons and orders) that includes, but is not limited to, verification that a person (or a person submitting an order) holds the appropriate DEA registration, verification that a person (or a person submitting an order) holds all licenses required by the state(s) in which a person (or a person submitting an order) conducts business with respect to controlled substances, examination of each suspicious circumstance surrounding an order, and examination of all facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.”).
  19. Notice, 85 Fed. Reg. at 69,290.
  20. Indeed, the existing regulation requiring registrants to design and operate a suspicious order monitoring program excludes practitioners from its title. See 21 C.F.R. §1301.74 (“Other security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment programs.”) (emphasis added). The Proposal would amend the title of 21 C.F.R. §1301.74 to expressly include practitioners. See Notice, 85 Fed. Reg. at 69,298 (“Other security controls for non-practitioners; non-practitioners and practitioners for orders received under suspicious circumstances; narcotic treatment programs and compounders for narcotic treatment programs) (emphasis added).