Complexity of DEA Rules Hindering E-Rxing of Controlled Substances

eprescribeby Bonnie Darves, iHealthBeat Contributing Reporter, iHealthBeat, Monday, March 23, 2015

The big push toward electronic prescribing of controlled substances hit a bump in the road this month when New York Gov. Andrew Cuomo (D) rolled back the deadline for mandatory e-prescribing in the state by one year, to March 2016.

The state e-prescription mandate, which was set to take effect March 27, was adopted as part of New York’s Internet System for Tracking Over-Prescribing, or I-STOP, Act. The state law served as a jumpstart nationally for entities affected by the Drug Enforcement Administration’s 2010 interim final rule allowing e-prescribing of controlled substances. But doctors and other health care professionals had lobbied lawmakers for the extension, noting that many electronic health record systems lack proper federal certification for e-prescribing of controlled substances.

Adoption of E-Prescribing of Controlled Substances

Adoption of e-prescribing of controlled substances has occurred relatively rapidly on the pharmacy side. According to recent data from Surescripts, which processes the vast majority of e-prescriptions in the U.S., more than 70% of pharmacies are ready for e-prescribing of controlled substance. But only 6% of prescribers have gone through the required hoops to e-prescribe controlled substances. That’s despite the fact that more than 70% of office-based prescribing clinicians e-prescribe “non-controlled” prescription drugs.

EHR vendors have been somewhat slow to come on board, too, likely because of the laborious process involved in getting their products certified to participate and their prescriber users identity proofed and authentication ready. Fewer than 50 EHR vendors have obtained the requisite certification.

What’s holding things up? Several sources say it’s the fact that the DEA requirements are immensely complex and multifaceted.

Sean Kelly — an emergency physician and chief medical officer for Imprivata, a health care IT security company that provides authentication and access management tools — said, “Until recently, most organizations had adopted e-prescribing but not e-prescribing of controlled substances because of the stringent DEA guidelines requiring a stem-to-stern, well-credentialed, authenticated chain of trust — from the prescriber identity and authentication to the EHR software to the pharmacy.

He added, “When you analyze that workflow, it’s pretty complicated — even though the [DEA] requirements are useful.” He cited what he calls “the clear benefits of making [e-prescribing of controlled substances] secure and auditable,” from reducing the public health and patient safety risks in inappropriate opioid prescribing or dispensing, to the potential for significantly reducing the fraud and diversion that have plagued prescribers and pharmacies that deal with controlled substances.

One benefit of DEA’s rule — which permits and provides the required framework for e-prescribing of controlled substances but doesn’t mandate it — is its essentially “tamper-proof” structure. All systems and parties integral to the transaction must be third-party authenticated or certified, and systems must meet strict technology standards.

EHR e-prescribing and pharmacy applications must be certified by a third party as compliant with DEA’s requirements. Prescribers must be identity-proofed, have the appropriate DEA authority to prescribe the controlled drugs and be authenticated via two or three approved authentication methods — a knowledge factor, hard token/cryptographic key and/or biometric information — before they can proceed to write and sign a prescription. Finally, health care organizations and medical practices must put in place access controls so that only DEA-registrant prescribers can sign the prescription, and prescribers must e-sign each individual prescription.

Complexity Deterring Adoption

That daunting complexity is one of the drawbacks of e-prescribing of controlled substances and a presumed reason why prescriber and EHR adoption is lagging.

“There are about 300 EHR companies, and the certifying bodies don’t have the bandwidth to certify us all in a timely manner,” said Neil Simon, COO of Aprima, an EHR vendor in Carrollton, Texas. “That’s been one of the problems with New York — and why I-STOP had to be delayed.”

Aprima, which has approximately 50,000 end users, has just “gotten all of the I’s dotted and T’s crossed,” to obtain its certification for e-prescribing of controlled substances, Simon said. But he and others in the industry wonder if the rule had to be so complicated.

“Some people think the DEA went a little further than it should have, making it so difficult that it’s been hard for some EHR vendors and pharmacies to get e-prescribing of controlled substances adopted and out,” he said. “If they’d made it a little less burdensome, it could still have been secure but could have gotten done quicker.”

The other issue, according to Simon and other sources, is that the DEA rule doesn’t adjust for smaller physician organizations, vendors and pharmacies, which must incur considerable expenses to meet the technology requirements.

“It’s kind of one-size-fits-all,” Simon said. “If you’re a multi-hospital chain, this makes sense. But if you’re a small physician practice … you might be pushed out of the market. The rule was clearly written with security in mind, but an incremental- or volume-based approach might have been better.”

The slow adoption on the prescriber side isn’t all that remarkable in context, according to Tricia Lee Wilkins, pharmacy adviser to the Office of the National Coordinator for Health IT. “We saw a similar trend in 2007 and 2008 with ‘regular’ e-prescribing,” she said. “Prescribers were slow to adopt, compared [with] pharmacies, whose business case prompted them to [implement] more rapidly than providers. This is not a surprising adoption trend.”

Wilkins predicts that when adoption is more widespread, implementation burdens will be outweighed by other gains — namely that controlled-substance prescription reporting and auditing can occur electronically, and that when problems occur, they’ll be “easier to trace.”

The risk reduction is considerable, given that pharmacies and prescribers are subject to hefty fines — up to $25,000 per occurrence — and costly audits should a pharmacy dispense a controlled-substance prescription that shouldn’t have made its way to the pharmacy.

Avoiding a fine might seem small solace for organizations that are trying to find the IT resources to move ahead with e-prescribing of controlled substances. Some technology companies are addressing some of the complexity with targeted products. Imprivata of Lexington, Mass., recently launched Confirm ID, which simplifies two-factor authentication. And Healthcare Data Solutions of Lincoln, Neb., tackles the front-end with a real-time service that verifies prescribers’ DEA credentials.

Managing Implementation

Some organizations that have moved ahead with e-prescribing of controlled substances are already benefitting.

HealthEast in St. Paul, Minn., which operates four hospitals and 14 clinics, took the leap in 2014.

Lou Gallagher, systems director of engineering and architecture for the health system, reported that it went more smoothly than expected. HealthEast deployed a new Epic EHR system at the same time it implemented technology for e-prescribing of controlled substances, incorporating products from Imprivata.

HealthEast used EHR training sessions as the physical venue for enrolling physicians and gathering the biometric ID for the e-prescribing system, which made for “an efficient way to deal with a time-consuming aspect of this,” Gallagher said. “Other organizations could do something like set up enrollment stations in lunchrooms, so that they can have someone attest to the physician’s identity.” That’s one of the DEA requirements.

“Our physicians are ecstatic about this. One physician said to me, ‘Of all the things we’ve gone through, e-prescribing of controlled substances stands out as the biggest value gain,'” Gallagher said.

Source: iHealthBeat, Monday, March 23, 2015