1117-0049 Supporting Statement-2025 UPDATED

Recordkeeping for Electronic Prescriptions for controlled Substances

OMB Control Number 1117-0049

OMB Expiration Date: 02/28/2025

SUPPORTING STATEMENT FOR

Recordkeeping for Electronic Prescriptions for Controlled Substances

The Drug Enforcement Administration (DEA) seeks approval by the Office of Management and Budget (OMB) for an extension of an existing collection of information that was previously approved by OMB – OMB Approval #1117-0049, Recordkeeping for Electronic Prescriptions for Controlled Substances.

A. JUSTIFICATION

1. The Controlled Substances Act (CSA) (21 U.S.C. 801 et seq.) requires DEA to establish a closed system of control for substances that have a potential for abuse or physical or psychological dependence. Section 829 of the CSA mandates that controlled substances in Schedule II may only be dispensed by a pharmacist pursuant to a written prescription, except in emergency situations. Schedule III-V substances may be dispensed by a pharmacist pursuant to a written or oral prescription issued by a practitioner. DEA’s implementing regulations are in 21 CFR part 1306. These regulations mandate the minimum information that must be included on a controlled substance prescription, along with signing and dispensing record requirements.¹ Prescribing practitioners are not required to retain records of most controlled substance prescriptions;² however, the pharmacy is required to retain the records for at least two years.³

DEA’s regulations allow controlled substances prescriptions to be written, signed, transmitted, and maintained as electronic data files.⁴ To do this, DEA has imposed certain security requirements to ensure that only DEA registrants are authorized to issue controlled substance prescriptions and that a legally defensible electronic record is created and maintained to provide forensic evidence for law enforcement agencies to use in legal actions against individuals engaged in diversion.⁵ The electronic prescriptions are not covered by this ICR as these records are part of normal business records that pharmacies are required to retain under State law.

DEA requires that each registered practitioner apply to an approved credential service provider to obtain identity proofing and a credential.⁶ Hospitals and other institutional practitioners may conduct this process in house as part of their credentialing. For practitioners currently working at or affiliated with a registered hospital or clinic, the hospital/clinic have to check a government-issued photographic identification.⁷ This may be done when the hospital/clinic issues credentials to new hires or newly affiliated physicians. For individual practitioners, two people need to enter logical access control data to grant permission for practitioners authorized to approve and sign controlled substance prescriptions using the electronic prescription application.⁸ For institutional practitioners, logical access control data is entered by two people from an entity within the hospital/clinic that is separate from the entity that conducts identity proofing in-house.⁹ Similarly, pharmacies have to set logical access controls in the pharmacy application so that only authorized employees have permission to annotate or alter prescription records.¹⁰ Finally, if the electronic prescription or pharmacy application generates an incident report, practitioners, hospitals/clinics, and pharmacies have to review the incident report to determine if the event identified by the application represents a security incident. ¹¹

2. The identity proofing, logical access controls, and registration checks are needed to ensure that only DEA registrants are granted access to electronic prescription applications to sign and issue controlled substance prescriptions. Without these, other persons could easily steal a practitioner’s identity, gain access to prescription applications, and issue prescriptions in the practitioner’s name without the practitioner’s knowledge. Without the checks, a practitioner could be subject to criminal, civil, or administrative proceedings for someone else’s crime. DEA and State and local law enforcement agencies could also have to prove that such identity theft had not occurred whenever they tried to bring a case against a practitioner who was issuing prescriptions for illegitimate reasons. The record of the identification check provides DEA and other law enforcement agencies with proof linking an individual to a particular credential used to sign prescriptions for controlled substances.

Practitioners or other authorized staff will review a computer-generated incident report, if an auditable event is identified. This check of internal audit logs provides an additional protection for practitioners to ensure that the application is not being misused. These incidents should be rare.

3. DEA will allow, but not require, registrants to issue and process electronic prescriptions for controlled substances. These records are 100 percent electronic. When practitioners elect to issue electronic prescriptions, all of the records are created and maintained electronically. Use of electronic prescriptions for controlled substances limits the data entry needed at pharmacies.

4. DEA has made efforts to identify and prevent duplication of the collection of information. This collection is not duplicative of any other DEA collection. This collection of information is unique to DEA.

5. This information collection does not have a significant economic impact on a substantial number of small entities within the meaning and intent of the Regulatory Flexibility Act, 5 U.S.C. 601–612.

6. DEA is not dictating the frequency of collection. Most of the requirements occur only at initial application or data entry. Audit log review will occur only when auditable events occur.

7. Special circumstances are not applicable to this information collection.

8. Public comment was solicited in the 60-day Federal Register Notice of Information Collection, 89 FR 93348, published November 26, 2024. DEA did not receive any comments concerning this collection. DEA has also published a 30-day Federal Register Notice of Information Collection, 90 FR 8537, on January 30, 2025.

DEA meets regularly with the affected registrant community – practitioners and pharmacies – to discuss areas of mutual interest, including regulatory activities and industry trends regarding use of technology. These meetings provide an open forum to discuss matters of mutual concern with representatives of those entities from whom the information is obtained.

9. This collection of information does not provide payments or gifts to respondents.

10. No information on individuals is collected. Confidential information is neither collected nor retained.

11. Questions of a sensitive nature are not included in this information collection.

12. Estimate of Hour Burden:

Regulated Entities

DEA estimates an annual average of 154,571 practitioners,¹² 1,526 hospitals/clinics, and 2,787 pharmacies, will respond to this information collection. This estimate is based on the average number of new registrations for these business activities from 2021-2023. While not all new registrants are expected to enroll in or implement EPCS, DEA believe this is a reasonable estimate, as a large majority of practitioners and MLPs do enroll in EPCS and are likely to re-enroll when changing employers.

Activities

Individual practitioners are estimated to spend 10 minutes completing an application for identity proofing. The applications, which will be developed by credential service providers (CSPs), usually require information that an applicant either knows or has on his person (name, address, date of birth, driver license numbers, social security number, checking account or credit card numbers, etc.). No other costs are associated with the identity proofing because this is standard business practice of the CSP. Hospitals are assumed to spend 2 minutes checking a photographic identification of each practitioner needing to be credentialed. Practitioners are assumed to take 30 minutes for an identification check at a hospital. Initial data entry for logical access control is estimated to take an average of 5 minutes; practitioners are estimated to take another minute to confirm the information. Hospitals and clinics already set access controls for their computer systems so no costs are ascribed to them for this task. At larger medical offices, a minute per registrant is assumed for checking the DEA registration; at smaller offices, the validity of the registration will be known without additional checking. Checking the audit log is estimated to take 5 minutes a quarter at practitioner offices and pharmacies and 10 minutes a month at hospitals.

DEA would also require registrants and providers to notify DEA if they think there has been a security breach. This notification could be a phone call or e-mail. DEA has not estimated a burden for these reports because it has no basis for estimating the number of reports that might be received. If the security systems work properly there should be few, if any, reports.

Table 1 shows the estimated annual number of respondents and burden hours.

Estimated Annualized Respondent Cost and Hour Burden

Activity	Number of Respondents	Frequency	Total Annual Responses	Time Per Response (Hours)	Total Annual Burden (Hours)	Hourly  Rate*	Monetized Value of Respondent Time
Practitioner	154,571	1	154,571	0.67 (40 minutes)	103,563	$ 131.22**	$13,589,537
Hospital/Clinic	1,526	1	1,526	2.13 (128 minutes)	3,250	$ 92.16	$ 299,520
Pharmacy	2,787	1	2,787	0.33 (20 minutes)	920	$ 91.92	$ 84,566
Unduplicated Totals	158,884	N/A	158,884	1.043	107,733	N/A	$13,973,623

*Hourly Rates

Based on the U.S. Bureau of Labor Statistics (BLS) data, DEA estimated the loaded hourly wage for various representative occupations likely to respond to the information collection and applied the loaded hourly wage to the estimated burden per response in table 1 to calculate cost burden per response. Then, multiplied the cost burden per response by the number of responses for the total cost burden.

For business activities practitioner, MLP, hospital/clinic, and pharmacy, the following occupation codes were used, 29-1229 Physicians, All Other, 29-1171 Nurse Practitioners, 29-1051 Pharmacists, and 11-9111 Medical and Health services Manager, respectively.¹³

	Practitioner
	Estimated hourly wage	$ 113.46
	Load for benefits (percent of labor rate)	42.20%
	Loaded labor rate ($/hour)	$ 161.34
	Hospital/Clinic
	Estimated hourly wage	$ 64.81
	Load for benefits (percent of labor rate)	42.20%
	Loaded labor rate ($/hour)	$ 92.16
	Pharmacy
	Estimated hourly wage	$ 64.64
	Load for benefits (percent of labor rate)	42.20%
	Loaded labor rate ($/hour)	$ 91.92
	Mid-Level Practitioner (MLP)
	Estimated hourly wage	$ 61.78
	Load for benefits (percent of labor rate)	42.20%
	Loaded labor rate ($/hour)	$ 87.85

** Practitioner/MLP hourly rate weighted average, $131.22 = [(91,215 x $161.34) + (63,357 x $87.85)] / (91,215 + 63,357).

13. Estimate of Cost Burden:

The primary cost burden is the cost for identity proofing and a credential, estimated to be $110 for a three-year credential. Costs for Identity Proofing and Credential is as follow.

Identity Proofing Estimated Cost Burden

Identity Proofing cost per Practitioner / MLP: $110

Practitioners: $17,002,920

Total Cost Burden: $17,002,920

14. Estimated Annualized Cost to Federal Government:

There are no costs to the Federal government.

15. Reasons for Change in Burden:

There is an increase in the number of responses due to normal increase in registrants. The change in the annual hour burden is due to an increase in annual responses. The change in the annual cost is due to change in method. Previously, the approved 2021 figure represented the “Monetized Value of Respondent Time” calculated in section 12. The new requested annual cost represents the figure from section 13. The table below summarizes the changes since the last renewal of this information collection.

	2022 Approved Burden	2025 Requested Burden	Difference
Annual responses	132,697	158,884	26,187
Annual hour burden	89,717	107,733	18,016
Annual cost ($)	10,702,112	17,002,920	6,300,808

16. Plans for Publication:

DEA doesn’t plan to publish the information from the collection.

17. Expiration Date Approval:

This is a recordkeeping requirement; DEA does not object to the OMB displaying the expiration date.

18. Exceptions to the Certification Statement:

DEA is not seeking an exception to the certification statement “Certification for Paperwork Reduction Act Submissions” for this collection of information.

Part B. Statistical Methods

The Drug Enforcement Administration is not employing statistical methods in this information collection.

1 21 CFR 1306.05.

2 21 CFR 1304.03(c).

3 21 CFR 1304.04(a), (h).

4 21 CFR 1306.05(e).

5 21 CFR 1311.105 and 21 CFR 1311.110.

6 21 CFR 1311.105

7 21 CFR 1311.110(a)(1).

8 21 CFR 1311.125(a).

9 21 CFR 1311.130.

10 21 CFR 1311.205.

11 21 CFR 1311.150(c) and 1311.215(c).

12 Includes 91,215 practitioners and 63,357 mid-level practitioners (MLP).

13 BLS, "May 2023 National occupational Employment and Wages Estimates in the United States." http://www.bls.gov/oes/current/oes_nat.htm