As we blogged about last week, DEA published its long-anticipated Notice of Proposed Rulemaking (“NPRM”) addressing suspicious orders of controlled substances. The Proposed Rule is intended to (finally) “clarify” the procedures that DEA registrants must follow for what DEA now deems “orders received under suspicious circumstances” (“ORUCS”). In particular, DEA sets forth exactly what registrants are supposed to report to DEA’s centralized reporting database if they determine, through the exercise of due diligence, that the order is indeed “suspicious” as defined in 21 C.F.R. § 1301.74(b). DEA states that the reporting requirement is one of the five “closely related legal obligations contained in the CSA and DEA regulations,” relating to the obligation to identify and report suspicious orders of controlled substances.
DEA elaborates on the five “requirements” as follows: (1) The obligation to maintain effective controls against diversion; (2) to conduct due diligence; (3) to design and operate a system to identify suspicious orders for the registrant; (4) to report suspicious orders (the reporting requirement); and (5) to refuse to distribute controlled substances that are likely to be diverted into illegitimate channels (the shipping requirement). DEA also notes that Congress’ inclusion of the phrase “may include, but not be limited to” in the definition of “suspicious order” as part of the Preventing Drug Diversion Act (“PDDA”) of 2018 clarified that an order for controlled substances may be “suspicious” for reasons of its size, pattern or frequency, including reasons “related to the customer selling the order.” While this “clarification” is indeed welcome, it surely was not readily ascertainable from either the PDDA’s, or Section 1301.74(b)’s definition of “suspicious order.” DEA’s suspicious order regulation itself had left registrants guessing on what exactly to report — and DEA second guessing those reports — for years.
Under the Proposed Rule’s clarified framework for reporting suspicious orders after their identification, registrants have two options: (1) immediately file a suspicious order report (and maintain a record of the same), or (2) conduct due diligence concerning the suspicious circumstances surrounding the ORUSC (and maintain a record of the same).
DEA states that all suspicious order reports must be entered in the DEA’s centralized database within a seven calendar day time period “upon discovering” a suspicious order. Importantly, the reports must contain certain required information, as follows:
- The DEA registration number of the registrant placing the order
- The date the order was received
- The DEA registration number of the registrant reporting the suspicious order
- The National Drug Code number, unit, dosage strength, and quantity of the controlled substances ordered
- The order form number for Schedule I and II controlled substances
- The unique transaction identification number for the suspicious order, and
- What information and circumstances render the order actually suspicious.
Readers may remember that one year ago, on October 23, 2019, DEA announced the availability of the Suspicious Orders Report System (“SORS”) Online for reporting of suspicious orders, as required by the PDDA. DEA made this announcement, however, without providing the industry any advance notice or opportunity for comment (likely because DEA was facing a statutory deadline under the PDDA to make this portal available). Importantly, SORS Online established more than just an online reporting method because DEA also for the first time required registrants to provide a “reason code” in the electronic suspicious order report. Now — a year later — it appears DEA is trying to put some context around its expectations for documenting the basis for reporting a suspicious order.
Notwithstanding this proposed “new” requirement, which seems extremely costly and burdensome if the registrant does not already have such an electronic data capture and reporting system in place, DEA states that reporting to the DEA centralized database “is estimated to impose no additional burden” on registrants. Hmmmm. DEA notes that it believes that it is further “reasonable to estimate virtually all affected registrants have information systems capable of completing, submitting, and retaining electronic suspicious order reports at minimum additional cost.” However, DEA admits that there are 15,974 practitioners and NTPs that distribute pursuant to the DEA’s “5 percent rule” that would now be required to identify and report suspicious orders. In our opinion, few of these entities have previously established comprehensive SOM policies and procedures as DEA is now requiring. Our continued review of the NRPM also raises concerns that DEA significantly underestimates the Rule’s regulatory impact and financial burden. The regulatory impact and financial burden will be addressed in a subsequent blogpost.
DEA adds that it “welcomes any comments” regarding the cost of complying with the reporting requirement, especially for those registrants that may not have access to broadband internet access. Interestingly, in continuing to address its understanding and belief this is not a significant burden on registrants, DEA also says reporting of this information is a “codification of content expected of current suspicious order reports or content subsequently requested by DEA if not reported in a suspicious order report.” Again, hmmmm. This may also leave numerous registrants (and their counsel) scratching their heads, because DEA (in its regulations, guidance or even less formal communications) never before has articulated any expectation — clear or otherwise — concerning “what” suspicious order information must be reported. It is our understanding that, contrary to DEA’s claim that this is the type of information DEA requested from registrants in follow-up communications, we know of few, if any, registrants that received follow-up communications from DEA concerning an earlier suspicious order report. In any event, such DEA follow-up was likely quite rare relevant to the number of reports the Agency received.
The comment period for the proposed rule ends on January 4, 2021, so time is ticking if for those registrants that find some (or all) of the new requirements inappropriate or otherwise unworkable. And, stay tuned for another post soon on what DEA wants to hear about in industry comments.