ARC 2905C

ARC 2905C

PHARMACY BOARD[657]

Notice of Intended Action

Twenty-five interested persons, a governmental subdivision, an agency or association of 25 or more persons may demand an oral presentation hereon as provided in Iowa Code section 17A.4(1)"b."

Notice is also given to the public that the Administrative Rules Review Committee may, on its own motion or on written request by any individual or group, review this proposed action under section 17A.8(6) at a regular or special meeting where the public or interested persons may be heard.

Pursuant to the authority of Iowa Code section 124.554, the Board of Pharmacy and the Prescription Monitoring Program Advisory Council hereby give Notice of Intended Action to amend Chapter 37, "Iowa Prescription Monitoring Program," Iowa Administrative Code.

The amendments were approved at the November 2, 2016, regular meeting of the Board of Pharmacy. The amendments were approved by the Prescription Monitoring Program Advisory Council at its meeting held on October 11, 2016.

The proposed amendments are the result of a review of the chapter pursuant to the requirements of Iowa Code subsection 17A.7(2). The proposed amendments also are intended to implement Iowa Code changes passed by the Legislature in 2016 Iowa Acts, chapter 1052 (Senate File 2102).

Proposed amendments include:

●New definitions for "electronic health record system," "electronic pharmacy information system," "electronic system," and "health information exchange" and clarifying amendments to the definitions of "health care professional," "PMP administrator," and "practitioner's agent";

●Clarifications regarding exemption from reporting dispensed prescriptions to the Prescription Monitoring Program (PMP) and the procedures for requesting exemption;

●Clarification of the required data elements and procedures for submission by a pharmacy of records of dispensed prescriptions or of reports which state that no qualifying prescriptions were dispensed during a reporting period;

●Clarifications regarding the PMP records and information that is deemed confidential;

●An increase in the number of agents that a practitioner may authorize to access the PMP on behalf of the practitioner and the procedures for registration of a practitioner's agent, removal of alternate procedures relating to a practitioner without Internet access, and reference to and clarification of the procedures for a patient to obtain a copy of the patient's prescription history;

●Clarifications of the procedures for a regulatory agency or board, a law enforcement agency, and researchers to request information from the Iowa PMP, including provisions regarding charging a fee for the preparation and release of PMP information and reports;

●New provisions relating to the establishment of facility users and the integration of PMP access into electronic health record, health information exchange and e-pharmacy systems, including contract and agreement requirements for such integration; and

●Correction of rule references and the implementation clause.

Requests for waiver or variance of the discretionary provisions of Board rules will be considered pursuant to 657—Chapter 34.

Any interested person may present written comments, data, views, and arguments on the proposed amendments not later than 4:30 p.m. on February 7, 2017. Such written materials may be sent to Terry Witkowski, Executive Officer, Board of Pharmacy, 400 S.W. Eighth Street, Suite E, Des Moines, Iowa 50309-4688; or by e-mail to terry.witkowski@iowa.gov.

After analysis and review of this rule making, no impact on jobs has been found.

These amendments are intended to implement Iowa Code sections 124.550 to 124.558.

The following amendments are proposed.

Item 1. Adopt the following new definitions in rule 657—37.2(124):

"Electronic health record system" or "EHRS" means a real-time, patient-centered health record system that makes patient health information and other health care tools and resources readily and securely available to authorized providers in a digital format capable of being shared with other providers across one or more health care organizations or facilities.

"Electronic pharmacy information system" or "e-pharmacy system" means a real-time electronic patient prescription record system that includes, at a minimum, patient profiles and prescription dispensing information and that may enable shared access to included information by multiple pharmacies, such as a chain of pharmacies using the same e-pharmacy system.

"Electronic system" means an electronic health record system, an electronic pharmacy information system, or a health information exchange. "Electronic systems" refers to a combination of two or more of these types of systems.

"Health information exchange" or "HIE" means a system that allows health care professionals to appropriately access and securely share a patient's vital medical information and records as that electronic information is instantly updated and simultaneously available to each of the health care professionals across organizations, often within a region, community, or health care system.

Item 2. Amend the following definitions in rule 657—37.2(124):

"DEA number" means the registration number issued to an individual or pharmacy by the U.S. Department of Justice, Drug Enforcement Administration (DEA) authorizing the individual or pharmacy to engage in the prescribing, dispensing, distributing, or procuring of a controlled substance.

"Health care professional" means a person who, by education, training, certification, or licensure, is qualified to provide and is engaged in providing health care to patients. "Health care professional" does not include clerical or administrative staff. "Health care professional," other than a licensed prescriber or pharmacist, may include, but is not limited to, a certified pharmacy technician or a registered technician trainee, a nurse, or a certified medical assistant, or supervised trainee such as a pharmacist-intern or student, a medical student, or a nursing student.

"PMP administrator" means the board staff person or persons designated to manage and administer the PMP under the direction and oversight of the board and the council.

"Practitioner's agent" means a health care professional who is employed by or under the direct supervision of a health care PMP-registered practitioner and who is authorized by the practitioner to access PMP information as provided in subrule 37.4(1).

Item 3. Amend rule 657—37.3(124) as follows:

657—37.3(124) Requirements for the PMP. Each dispenser, unless identified as exempt from reporting and who has applied for and been granted an exemption from reporting to the PMP pursuant to subrule 37.3(1), shall submit to the PMP administrator either a record of each reportable prescription dispensed during a reporting period or a zero report pursuant to subrule 37.3(5), as appropriate. A dispenser located outside the state of Iowa, unless identified as exempt from reporting and who has applied for and been granted an exemption from reporting to the PMP pursuant to subrule 37.3(1), shall submit to the PMP administrator either a record of each reportable prescription dispensed during a reporting period to a patient located in Iowa or a zero report pursuant to subrule 37.3(5), as appropriate.

37.3(1) Exemptions. The dispensing of a controlled substance as described in this subrule shall not be considered a reportable prescription. A dispenser engaged in the distribution of controlled substances solely pursuant to one or more of the practices identified in paragraphs paragraph37.3(1)"a," or 37.3(1)"b," shall so notify the PMP administrator and shall be exempt or 37.3(1)"c," or that is not registered to handle controlled substances as described in paragraph 37.3(1)"d," may apply for an exemption from reporting to the PMP. A dispenser claiming exemption pursuant to this subrule shall certify to the board, on a form provided by the board, the basis for exemption from reporting to the PMP. The PMP administrator is hereby authorized to approve or deny the pharmacy's request for exemption from reporting to the PMP.

a. and b. No change.

c. A nonresident pharmacy that does not distribute controlled substances to patients located in Iowa shall not be required to report to the PMP. A nonresident pharmacy claiming exemption from reporting pursuant to this paragraph shall certify to the board that the nonresident pharmacy does not dispense controlled substances to patients located in Iowa.

d. A licensed pharmacy that does not handle controlled substances and that is not registered to handle controlled substances with the federal DEA shall not be required to report to the PMP. A pharmacy claiming exemption from reporting pursuant to this paragraph shall certify to the board that the pharmacy does not dispense controlled substances.

c. e.A prescriber or other authorized person who administers or dispenses a controlled substance, including samples of a controlled substance, for the purposes of outpatient care shall not be required to report such administration or dispensing. A prescriber shall not be required to submit a form or notification claiming exemption from reporting to the PMP. This exception shall not apply to a pharmacist who administers a controlled substance, as directed by the prescriber, pursuant to a prescription.

d. f.A wholesale distributor of a controlled substance shall not be required to report the wholesale distribution of such a substance. A wholesale distributor shall not be required to submit a form or notification claiming exemption from reporting to the PMP.

37.3(2) Data elements. The information submitted for each prescription shall include, at a minimum, the following items:

a. Dispenser DEA number.

b. Date the prescription is filled.

c. Prescription number.

d. Indication as to whether the prescription is new or a refill.

e. NDC number for the drug dispensed.

f. Quantity of the drug dispensed.

g. Number of days of drug therapy provided by the drug as dispensed.

h. Patient name first and last names.

i. Patient address including street address, city, state, and ZIP code.

j. Patient date of birth.

k. Patient gender.

l. Prescriber DEA number.

m. Date the prescription was issued by the prescriber.

n. Method of payment as either third-party payer or patient cash payment.

37.3(3) Reporting periods. A record of each reportable prescription dispensed shall be submitted by each dispenser at least weekly. Records may be submitted with greater frequency than required by this subrule. Records of reportable prescriptions dispensed between Sunday and Saturday each week shall be submitted no later than the following Wednesday. However, a pharmacy that is currently submitting prescription dispensing records to another state's PMP on an alternative weekly reporting schedule may request authority to submit records to the Iowa PMP pursuant to that established schedule. The request shall be submitted in writing via e-mail, fax, or regular mail to the PMP administrator. The request shall identify the pharmacy by name, address, and Iowa pharmacy license number and shall define the alternative reporting period and the reason for the requested alternative reporting period. The PMP administrator is hereby authorized to accept approve or deny the pharmacy's alternative weekly reporting schedule.

37.3(4) Transmission methods. Prescription information shall be transmitted using one of the following methods:

a. Data upload to a reporting Web site via a secure Internet connection or by utilizing the secure FTP procedure. The PMP administrator or designee will provide dispensers with initial secure login and password information. Dispensers will be required to register on the reporting Web site prior to initial data upload.

b. Electronic media including CD-ROM, DVD, or diskette, accompanied by a transmittal form identifying the dispenser submitting the electronic media, the number of prescription records included on the media, and the individual submitting the media as directed by the PMP administrator or designee.

c. If a dispenser does not have an automated record-keeping system capable of producing an electronic report as provided in this rule, the dispenser may submit prescription information on the industry standard universal claim form. The dispenser may complete and submit the claim form on the reporting Web site or, if the dispenser does not have Internet access, the completed paper claim form may be submitted as directed by the PMP administrator or designee.

d. Chain pharmacies and pharmacies under shared ownership may submit combined data transmissions on behalf of all facilities by utilizing the secure FTP procedure. Combined data transmissions shall identify the specific pharmacy that dispensed each individual prescription record included in the combined data transmission.

37.3(5) Zero reports. If a dispenser has not been identified as exempt from reporting to the PMP and the dispenser did not dispense any reportable prescriptions during a reporting period, the dispenser shall submit a zero report via the established reporting Web site or secure FTP procedure. If such a dispenser does not have Internet access, the dispenser shall notify the PMP administrator via mail or facsimile transmission that the dispenser did not dispense any reportable prescriptions during the reporting period. The schedule identified in subrule 37.3(3) shall determine timely submission of zero reports.

Item 4. Amend rule 657—37.4(124) as follows:

657—37.4(124) Access to database information. All information contained in the PMP database, including prescription information submitted for inclusion in the PMP database, communications or notifications to PMP users and dispensers via the database, and records of requests for PMP information, shall be privileged and strictly confidential and not subject to public or open records laws. The board, council, and PMP administrator shall maintain procedures to ensure the privacy and confidentiality of patients, prescribers, dispensers, practitioners, practitioners' agents, and patient information collected, recorded, transmitted, and maintained in the PMP database and to ensure that program information is not disclosed to persons except as provided in this rule.

37.4(1) Prescribers and pharmacists. A health care practitioner authorized to prescribe or dispense controlled substances may obtain PMP information regarding the practitioner's patient, or a patient seeking treatment from the practitioner, for the purpose of providing patient health care. A practitioner may authorize no more than three six health care professionals to act as the practitioner's agents for the purpose of requesting PMP information regarding a practitioner's patients. A practitioner's agent shall be licensed, registered, certified, or otherwise credentialed as a health care professional in a manner that permits verification of the health care professional's credentials.

a. Prior to being granted access to PMP information, a practitioner or a practitioner's agent shall submit an individual request for registration and program access. The PMP administrator shall take reasonable steps to verify the identity of a practitioner or practitioner's agent and to verify a practitioner's or practitioner's agent's credentials prior to providing a practitioner or practitioner's agent with a secure login and initial password.

(1)A practitioner or a practitioner's agent with Internet access may shall register via a secure Web site established by the board for that purpose. A practitioner without Internet access shall submit a written registration request on a form provided by the PMP administrator. A practitioner without Internet access shall not authorize a

(2)A practitioner's agent to shall register for or to access to PMP information on behalf of the supervising practitioner by completing and submitting a hard-copy registration form, provided by the board, that requires the signatures of both the supervising practitioner and the practitioner's agent. The PMP administrator shall take reasonable steps to verify the identity of a practitioner or practitioner's agent and to verify a practitioner's credentials prior to providing a practitioner or practitioner's agent with a secure login and initial password.

b.Each practitioner or practitioner's agent registered to access PMP information shall securely maintain and use the login and password assigned to the individual practitioner or practitioner's agent. Except in an emergency when the patient would be placed in greater jeopardy by restricting PMP information access to the practitioner or practitioner's agent, a registered practitioner shall not share the practitioner's secure login and password information and shall not delegate PMP information access to another health care practitioner or to an unregistered agent. A registered practitioner's agent shall not delegate PMP information access to another individual.

b. c.A practitioner or practitioner's agent with Internet access may submit a request for PMP information via a secure Web site established by the board for that purpose. The requested information shall be provided to the requesting practitioner or practitioner's agent in a format established by the board and shall be delivered via the secure Web site.

c. A practitioner without Internet access may submit to the PMP administrator a written request for PMP information via mail or facsimile transmission. The written request shall be in a format established by the board and shall be signed by the requesting practitioner. Prior to processing a written request for PMP information, the PMP administrator shall take reasonable steps to verify the request, which may include but not be limited to a telephone call to the practitioner at a telephone number known to be the number for the practitioner's practice.

d. No change.

e. A practitioner or practitioner's agent shall not provide the patient with a copy of a report generated by the PMP. A patient may receive a report of the patient's own prescription history pursuant to subrule 37.4(4).

37.4(2) Regulatory agencies and boards. Professional licensing boards and regulatory agencies that supervise or regulate a health care practitioner professional or that provide payment for health care services shall be able to access information from the PMP database only pursuant to an order, subpoena, or other means of legal compulsion relating to a specific investigation of a specific individual and supported by a determination of probable cause. The board may charge a fee for the preparation and release of PMP information and reports as provided in rule 657—37.5(124).

a. Prior to accepting and processing a request for PMP database information from the director or director's designee of a licensing board or other authorized regulatory agency, the director or director's designee shall complete and submit a hard-copy registration form, provided by the board, that requires the signatures of both the director and the director's designee, as appropriate. The PMP administrator shall take reasonable steps to verify the identity of the director or director's designee prior to providing a director or director's designee with a secure login and initial password.

a. b.A director of a licensing board with jurisdiction over a practitioner health care professional, or the director's designee, who seeks access to PMP information for an investigation shall submit to the PMP administrator in a format established by the board a written request via mail, e-mail, facsimile, or personal delivery. The request shall be signed by the director or the director's designee and shall be accompanied by an order, subpoena, or other form of legal compulsion establishing that the request is supported by a determination of probable cause.

b. c.A director of a regulatory agency with jurisdiction over a practitioner health care professional or with jurisdiction over a person receiving health care services pursuant to one or more programs provided by the agency, or the director's designee, who seeks access to PMP information for an investigation shall submit to the PMP administrator in a format established by the board a written request via mail, facsimile, e-mail, or personal delivery. The request shall be signed by the director or the director's designee and shall be accompanied by an order, subpoena, or other form of legal compulsion establishing that the request is supported by a determination of probable cause.

d. The requested information shall be provided to the requesting director or director's designee in a format established by the board and shall be delivered via the secure Web site or by an alternate delivery method determined by the PMP administrator to be appropriate.

37.4(3) Law enforcement agencies. Local, state, and federal law enforcement or prosecutorial officials engaged in the administration, investigation, or enforcement of any state or federal law relating to controlled substances shall be able to access information from the PMP database by order, subpoena, or other means of legal compulsion relating to a specific investigation of a specific individual and supported by a determination of probable cause. The board may charge a fee for the preparation and release of PMP information and reports as provided in rule 657—37.5(124).

a. Prior to accepting and processing a request for PMP database information from a law enforcement officer, the officer shall complete and submit a hard-copy registration form, provided by the board, that requires the signatures of both the officer and the officer's direct superior. The PMP administrator shall take reasonable steps to verify the identity of the officer and the officer's direct superior prior to providing the officer with a secure login and initial password.

b.A law enforcement officer shall submit to the PMP administrator in a format established by the board a written request via mail, e-mail, facsimile, or personal delivery. The request shall be signed by the requesting officer or the officer's superior. The request shall be accompanied by an order, subpoena, or warrant issued by a court or legal authority that requires a determination of probable cause and shall be processed by the PMP administrator.

c.A report identifying PMP information relating to the specific individual identified by the order, subpoena, or warrant may shall be delivered to the law enforcement officer via mail or alternate secure delivery the secure Web site or by an alternate delivery method determined by the PMP administrator to be appropriate.

37.4(4) Patients. A patient or the patient's agent may request and receive PMP information regarding prescriptions reported to have been dispensed to the patient.

a. A patient may submit a signed, written request for records of the patient's prescriptions dispensed during a specified period of time. The board shall provide the patient with a request shall identify form requiring identification of the patient by name, including any aliases used by the patient, and shall include the patient's date of birth and gender. The request form shall also include require any address where the patient resided during the time period of the request and the patient's current address and daytime telephone number. A patient may personally deliver the completed request to the PMP administrator or authorized staff member designee at the offices of the board located at 400 S.W. Eighth Street, Suite E, Des Moines, Iowa 50309-4688. The patient will be required to present current government-issued photo identification at the time of delivery of the request. A copy of the patient's identification and request shall be maintained in the records of the PMP.

b. and c. No change.

d. A report prepared pursuant to this subrule shall be delivered to the patient or the patient's agent, as appropriate, by personal delivery or via mail or alternate secure delivery.

37.4(5) Court orders and subpoenas. The PMP administrator shall provide PMP information in response to court orders and county attorney or other subpoenas issued by a court upon a determination of probable cause. The board may charge a fee for the preparation and release of PMP information and reports as provided in rule 657—37.5(124).

37.4(6) Statistical data. The PMP administrator , following review and approval by the patients rights committee, or designee may provide summary, statistical, or aggregate data to public or private entities for statistical, public research, public policy, or educational purposes. Prior to the release of any such data, the PMP administrator or designee shall remove any personal identifying information or verify that any personal identifying information that could be used to identify an individual patient, prescriber, dispenser, practitioner, or other person who is the subject of identified in the PMP information or data has been removed from the PMP information or data. The board may charge a fee for the preparation and release of statistical data as provided in rule 657—37.5(124).

37.4(7) PMP administrator access. Other than statistical data as described in subrule 37.4(6) and technical, error, and administrative function reports and information needed by PMP support staff to determine that records are received and maintained in good order or to review or resolve issues of reported or suspected erroneous data as provided in rule 657—37.7(124), any other reports concerning the information received from dispensers shall only be prepared at the direction of the board, the council, or the PMP administrator. The board and the council may compile statistical reports from PMP information for use in determining the advisability of continuing the PMP and for use in preparing required reports to the governor and the legislature. The reports shall not include information that would identify any patient, prescriber, dispenser, practitioner, practitioner's agent, or other person who is the subject of identified in the PMP information or data.

37.4(8) Electronic health and pharmacy information systems. The board may contract with electronic health record systems, health information exchanges, and electronic pharmacy information systems to securely integrate into those electronic systems access to patient prescription histories and other PMP information available to authorized practitioners and practitioners' agents. Institutional users may be established to identify the facilities and contracted electronic systems and to facilitate secure access by the prescribing practitioners and pharmacists authorized to access PMP information by and through the electronic systems.

a. EHRS, HIE, and e-pharmacy system integration contracts or agreements shall ensure protection of confidential information contained in and received from the PMP.

b. EHRS, HIE, and e-pharmacy system integration contracts or agreements shall restrict access to PMP information to authorized practitioners and practitioner agents as provided by these rules except that individual user registration with the PMP may not be required if the identity of the specific individual receiving or requesting information from the PMP, including a record of the patient whose record is requested, is logged and maintained in an alternate record and is available to the PMP administrator upon request.

c. PMP and electronic system integration may require a separate contract or agreement with a third-party interface or translation service provider to facilitate integration of the PMP into the electronic system. The contract with the service provider shall provide that translation, transmission, or other data integration services provided under the contract are accomplished via a secure encrypted channel that ensures the confidentiality of all information exchanged between the PMP and the electronic system.

Item 5. Amend rule 657—37.5(124) as follows:

657—37.5(124) Fees. The board may charge a fee and recover costs incurred for the provision of PMP information, including statistical data, except that no fees or costs shall be assessed to a dispenser for reporting to the PMP or to a practitioner or practitioner's agent for querying the PMP regarding a practitioner's patient. Any fees or costs assessed by the board shall be considered repayment receipts as defined in Iowa Code section 8.2.

Item 6. Amend subrule 37.9(1) as follows:

37.9(1) Confidentiality. A pharmacy, pharmacist, practitioner, or practitioner's agent who knowingly fails to comply with the confidentiality provisions of the law or these rules or who delegates PMP information access to another individual, except as provided in paragraph 37.4(1)"a," 37.4(1)"b," is subject to disciplinary action by the appropriate professional licensing board. The PMP administrator or a member of the program staff who knowingly fails to comply with the confidentiality provisions of the law or these rules is subject to disciplinary action by the board. In addition to any disciplinary action or sanctions imposed by a professional licensing board, a pharmacy, pharmacist, practitioner, practitioner's agent, PMP administrator, or member of the PMP program staff who knowingly accesses, uses, or discloses program information in violation of Iowa law or these rules is subject to criminal prosecution as provided in 2011 Iowa Code Supplement section 124.558.

Item 7. Amend 657—Chapter 37, implementation sentence, as follows:

These rules are intended to implement Iowa Code sections 124.551, 124.552, and 124.554 to 124.557 and 2011 Iowa Code Supplement sections 124.553 and 124.550 to124.558.