E9-7698. Implementation of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008

AGENCY:

Drug Enforcement Administration (DEA), Department of Justice.

ACTION:

Interim final rule with request for comments.

SUMMARY:

The Ryan Haight Online Pharmacy Consumer Protection Act, which was enacted on October 15, 2008, amended the Controlled Substances Act and Controlled Substances Import and Export Act by adding several new provisions to prevent the illegal distribution and dispensing of controlled substances by means of the Internet. DEA is hereby issuing an interim rule to amend its regulations to implement the legislation and is requesting comments on the interim rule.

DATES:

This interim rule is effective April 13, 2009, except §§ 1300.04, 1301.19, and 1304.40, which are effective April 6, 2009. Section 1300.04(i) (the definition of “practice of telemedicine”) has an implementation date of January 15, 2010, unless such date is superseded by future regulatory actions as explained in the SUPPLEMENTARY INFORMATION section.

Written comments must be postmarked on or before June 5, 2009, and electronic comments must be sent on or before midnight Eastern time June 5, 2009.

ADDRESSES:

To ensure proper handling of comments, please reference “Docket No. DEA-322” on all written and electronic correspondence. Written comments being sent via regular or express mail should be sent to the Drug Enforcement Administration, Attention: DEA Federal Register Representative/ODL, 8701 Morrissette Drive, Springfield, VA 22152. Comments may be sent to DEA by sending an electronic message to [e-mail]. Comments may also be sent electronically through http://www.regulations.gov using the electronic comment form provided on that site. An electronic copy of this document is also available at the http://www.regulations.gov Web site. DEA will accept attachments to electronic comments in Microsoft Word, WordPerfect, Adobe PDF, or Excel file formats only. DEA will not accept any file formats other than those specifically listed here.

Please note that DEA is requesting that electronic comments be submitted before midnight Eastern time on the day the comment period closes because http://www.regulations.gov terminates the public's ability to submit comments at midnight Eastern time on the day the comment period closes. Commenters in time zones other than Eastern time may want to consider this so that their electronic comments are received. All comments sent via regular or express mail will be considered timely if postmarked on the day the comment period closes.

FOR FURTHER INFORMATION CONTACT:

Mark W. Caverly, Chief, Liaison and Policy Section, Office of Diversion Control, Drug Enforcement Administration, 8701 Morrissette Drive, Springfield, VA 22152; Telephone: [phone].

SUPPLEMENTARY INFORMATION:

Posting of Public Comments: Please note that all comments received are considered part of the public record and made available for public inspection online at http://www.regulations.gov and in the DEA's public docket. Such information includes personal identifying information (such as your name, address, etc.) voluntarily submitted by the commenter.

If you want to submit personal identifying information (such as your name, address, etc.) as part of your comment, but do not want it to be posted online or made available in the public docket, you must include the phrase “PERSONAL IDENTIFYING INFORMATION” in the first paragraph of your comment. You must also place all the personal identifying information you do not want posted online or made available in the public docket in the first paragraph of your comment and identify what information you want redacted.

If you want to submit confidential business information as part of your comment, but do not want it to be posted online or made available in the public docket, you must include the phrase “CONFIDENTIAL BUSINESS INFORMATION” in the first paragraph of your comment. You must also prominently identify confidential business information to be redacted within the comment. If a comment has so much confidential business information that it cannot be effectively redacted, all or part of that comment may not be posted online or made available in the public docket.

Personal identifying information and confidential business information identified and located as set forth above will be redacted and the comment, in redacted form, will be posted online and placed in the DEA's public docket file. Please note that the Freedom of Information Act applies to all comments received. If you wish to inspect the agency's public docket file in person by appointment, please see the “For Further Information” paragraph.

Preamble

I. Legislation Upon Which These Regulations Are Based

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (Pub. L. 110-425) (hereafter, the “Ryan Haight Act” or the “Act”) was enacted on October 15, 2008. The Act amended the Controlled Substances Act (CSA) and Controlled Substances Import and Export Act (CSIEA) by adding various provisions to prevent the illegal distribution and dispensing of controlled substances by means of the Internet.^[1] The law becomes effective April 13, 2009 (except for one provision relating to telemedicine discussed below). Thus, as of April 13, 2009, it will be illegal under federal law to “deliver, distribute, or dispense a controlled substance by means of the Internet, except as authorized by [the CSA]” or to aid or abet such activity. 21 U.S.C. 841(h)(1). The Act applies to all controlled substances in all schedules.

This document serves three purposes: (1) To explain the new legislation; (2) to announce the amendments to the DEA regulations that implement the new legislation; and (3) to request comments on the amendments to the regulations, which are being issued as an interim rule as contemplated in the legislation.

II. Authority in Ryan Haight Act To Issue Regulations

The Ryan Haight Act contains various provisions that call upon the Attorney General to issue regulations to implement the Act. Among these is the following general grant of authority:

The Attorney General may promulgate and enforce any rules, regulations, and procedures which may be necessary and appropriate for the efficient execution of functions under this Act or the amendments made by this Act, and, with the concurrence of the Secretary of Health and Human Services where this Act or the amendments made by this Act so provide, promulgate any interim rules necessary for the implementation of this Act or the amendments made by this Act, prior to its effective date.^[2]

This regulatory authority of the Attorney General has been delegated to the Administrator of DEA.^[3] It is evident from the foregoing provision of the Act that Congress contemplated it would be necessary for DEA to issue regulations on an interim basis in order to implement the Act within the relatively short time period between the passage of the Act (October 15, 2008) and its effective date (April 13, 2009). Indeed, Congress envisioned that DEA would need to issue interim rules “prior to its effective date” (i.e., before April 13, 2009) to effectively implement the new requirements of the Act.^[4] Accordingly, the rules published here are effective immediately while at the same time the agency is seeking public comment on them. Following the comment period, DEA will review the comments and make any modifications to the interim rule that are appropriate. Also, as explained below, the Act contemplates that DEA will, with the concurrence of the Secretary of Health and Human Services, promulgate regulations governing the issuance to practitioners of a special registration relating to the practice of telemedicine. Those regulations will be issued separately at a later date.

III. Overview of the Legislation

A. Reasons for the Legislation

The unlawful use of pharmaceutical controlled substances has reached alarming levels in the United States in recent years, causing a substantial detrimental effect on the public health and safety. According to the most recently published National Survey on Drug Use and Health (2007),^[5] 6.9 million Americans reported using psychotherapeutic drugs ^[6] nonmedically during the prior month.^[7] With specific regard to pain relievers, 5.2 million respondents reported abusing these drugs,^[8] which is an 18 percent increase from 2004.^[9] This study further indicates that, in the United States, the abuse of prescription drugs is second only to that of marijuana and is higher than the abuse of cocaine, heroin and hallucinogens combined.^[10] Among persons aged 12 and older who reported using illicit drugs for the first time in 2007, abuse of pain relievers was the most common category of first-time illicit drug use.^[11]

The false sense of security that some associate with the abuse of these substances is also alarming. Many mistakenly believe that if a drug may be prescribed for medical use, abusing that drug cannot be as harmful as abusing more conventional “street” drugs, such as heroin or cocaine. According to the 2005 Partnership Attitude Tracking Study ^[12] , 40 percent of teens surveyed believe that prescription medicines are “much safer” to use than illegal drugs. Furthermore, the same study concluded that 31 percent believe there is “nothing wrong” with using prescription medicines without a prescription “once in awhile.” ^[13]

One of the main factors contributing to the nationwide increase in the diversion of pharmaceutical controlled substances has been the rise in the number of Internet sites that sell or facilitate the sale of these drugs for other than legitimate medical purposes. While in-person “prescription mills” (practitioners' offices that readily supply drug seekers with prescriptions for controlled substances without establishing a legitimate medical basis for doing so) have always been, and remain, a significant source of diversion, the advent of rogue Web sites that cater to those who abuse pharmaceutical controlled substances has allowed the criminal operators of these sites to exploit the anonymity of the Internet to generate illicit sales of controlled substances (and/or prescriptions therefor) that far exceed those of any in-person prescription mill. This is particularly evident when examining the data relating to the sales of hydrocodone, which is the most widely abused pharmaceutical controlled substance in the United States. According to data registered distributors of controlled substances provided to DEA ^[14] in 2006, 34 pharmacies in the United States that were supplying rogue Internet sites dispensed a total of more than 98 million dosage units of hydrocodone. Hence, these pharmacies each dispensed an average of approximately 2.9 million dosage units of hydrocodone per pharmacy in a single year. By means of comparison, the average pharmacy in the United States dispenses approximately 88,000 dosage units of hydrocodone per year.

Congress passed the Ryan Haight Act precisely because of “the increasing use of prescription controlled substances by adolescents and others for nonmedical purposes, which has been exacerbated by drug trafficking on the Internet.” ^[15] The person for whom the Act was named, Ryan Haight, was “a California high school honors student and athlete who died in 2001 from an overdose of controlled substances that he had purchased from a rogue online pharmacy.” ^[16] According to the Senate Report accompanying the legislation, “Ease of access to the Internet, combined with lack of medical supervision, has led to tragic consequences in the online purchase of prescription controlled substances.” ^[17] The Senate Report then cited a list of examples of persons in the United States who had died from overdoses of controlled substances obtained via the Internet.^[18]

B. Common Methods Employed by Operators of Rogue Web Sites That Sell Pharmaceutical Controlled Substances

The rogue Web sites that the Ryan Haight Act seeks to eliminate take on a variety of appearances and use a variety of methods. One common factor is that all these Web sites are marketed toward drug seekers who are willing to pay a premium to obtain pharmaceutical controlled substances without having a legitimate medical need for them. While the “business models” that the operators of these sites employ to evade detection by law enforcement and/or to create the facade of compliance with the law have evolved significantly over time, there tend to be three categories of participants in these schemes: the prescribing practitioner; the pharmacy that fills the prescriptions; and the criminal facilitator (a non-DEA registrant) who runs the operation.^[19]

While it has always been illegal to dispense a controlled substance without a legitimate medical purpose, prior to the Act, a rogue operator could design a site that would make it clear to drug seekers that pharmaceutical controlled substances could be obtained through the site without a legitimate medical purpose. For example, a typical rogue site would display prominently on its homepage a list of the pharmaceutical controlled substances that it sold and prompt customers to click on their desired drugs. These Web sites could easily be found by using any of various Internet search engines and entering search terms such as “hydrocodone no prescription.” Unsolicited e-mails or other forms of online advertising and marketing often steered potential customers to these Web sites; the advertisements announced that controlled substances could be readily obtained through the Web site without an in-person medical evaluation and sometimes without even a prescription—thus insuring a drug seeking customer could obtain the controlled substance without a legitimate medical need.

Thus, prior to passage of the Act, attracting customers was relatively easy for these rogue Web sites. However, to deliver the goods that the customers were seeking (pharmaceutical controlled substances and/or prescriptions for such), the operator of the rogue Web site usually had to enlist the services of two types of DEA registrants: a practitioner and pharmacy. Thus, the typical criminal facilitator had to recruit an unscrupulous practitioner willing to prescribe controlled substances without a legitimate medical evaluation obtained through a bona fide doctor-patient relationship. While the overwhelming majority of practitioners would want no part of this type of improper arrangement, criminal facilitators were able to find some unscrupulous practitioners willing to participate. Investigations have revealed that these facilitators often target practitioners who carry significant debt, such as those recently graduated from medical school, or those who have retired and are looking for some “extra income.” Regardless of the motivations of the participating practitioners, the facilitator would persuade them to enter into an agreement whereby they would agree to write prescriptions for controlled substances without adhering to the standard professional practices employed by practitioners when evaluating the medical condition of patients and determining the appropriate treatment in return for payment from the facilitator based on the number of prescriptions they would write. These arrangements operated in several ways. In some instances, the facilitator would arrange for a practitioner to issue prescriptions for controlled substances based solely on reviewing online questionnaires the customers submitted to the Web site. Other schemes involved facilitators requiring the customers of the Web site to fax some documentation that purported to be the customers' “medical records” and then having an unscrupulous practitioner issue prescriptions for controlled substances based on a “review” of these faxed documents. A third type of scheme involved the facilitator having customers of the Web site call a telephone number staffed by employees of the site, answer a series of questions purporting to create a “medical history,” and then have unscrupulous practitioners write the prescriptions based on these answers. Whatever the methods employed, these rogue Web site operations were merely a sham, as every step in the process was designed to sell customers controlled substances and/or prescriptions for controlled substances without regard to actual medical need.

Some criminal facilitators have been content to take in the profits associated with selling the prescriptions for controlled substances. (Some rogue Web sites charge customers a separate fee for arranging the issuance of prescriptions.) Others have sought to increase their profits by also having customers fill the prescriptions through a pharmacy affiliated with the Web site. To achieve the latter, the criminal facilitator needed to enter into an agreement with an unscrupulous pharmacy that was willing—for a fee—to fill prescriptions for controlled substances with essentially no questions asked and for as many prescriptions as the Web site could steer toward the pharmacy.^[20] In addition to paying the pharmacy for the cost of the drugs, the criminal facilitator would also typically pay the pharmacy an agreed upon amount that, in some instances, amounted to millions of dollars. Given the amount of money to be made from these arrangements, DEA has seen pharmacies close their doors completely to walk-in customers and convert their entire business to filling orders generated from rogue Web sites. In some instances, criminal facilitators have used multiple brick and mortar pharmacies to service their list of drug seeking customers. In other cases, a single pharmacy has supplied multiple rogue Web sites.

These rogue Web sites generally provide the customer with a wide variety of quick and easy payment methods, such as cash-on-delivery, lines of credit, and credit “gift” cards. They also typically structure the various steps of the ordering process so as to link and shift the buyer to different Web sites, making it difficult for investigators to connect payments, products, and Web providers together. Rarely do such rogue Web sites contain any identifying information about where the online pharmacy is located or who owns or operates the Web site. On the contrary, these Web sites frequently fluctuate in name and number minute by minute. Finally, the typical rogue Web site fails to provide any information on how a patient may contact the prescribing practitioner or the pharmacist to consult with them about the drug(s) ordered, including drug interactions and adverse reactions.

Recognizing that these rogue Web sites fuel the abuse of prescription controlled substances and thereby increase the number of resulting overdoses and other harmful consequences, Congress passed the Ryan Haight Act to prevent the Internet from being exploited to facilitate such unlawful drug activity.

IV. Brief Summary of Some of the Key Provisions of the Legislation

Before examining the legislation in detail, the following is a brief recitation of two of the most important new statutory requirements: the in-person medical evaluation requirement for prescribing practitioners and the modified registration requirement for online pharmacies.

A. In-person medical evaluation requirement—One of the primary ways in which the Ryan Haight Act combats the use of the Internet to facilitate illegal sales of pharmaceutical controlled substances is by mandating, with limited exceptions, that the dispensing of controlled substances by means of the Internet be predicated on a valid prescription involving at least one in-person medical evaluation. While the lack of an in-person medical evaluation has always been viewed as a “red flag” indicating that diversion might be occurring, the Ryan Haight Act makes it unambiguous that it is a per se violation of the CSA for a practitioner to issue a prescription for a controlled substance by means of the Internet without having conducted at least one in-person medical evaluation, except in certain specified circumstances. At the same time, it is crucial to bear in mind that, as Congress expressly stated under the Act, the mere fact that the prescribing practitioner conducted one in-person medical evaluation does not demonstrate that the prescription was issued for a legitimate medical purpose within the usual course of professional practice. Even where the prescribing practitioner has complied with the requirement of at least one in-person medical evaluation, a prescription for a controlled substance must still satisfy the additional, fundamental prerequisite that has been legally mandated for more than 90 years: it must be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice.^[21]

B. Requirement of modified registration for online pharmacies—Another of the core provisions of the Act is the requirement that any person who operates a Web site that fits within the definition of an “online pharmacy” must obtain from DEA a modification of its DEA pharmacy registration that expressly authorizes such online activity. Only DEA-registered pharmacies are eligible under the Act to obtain such a modification of registration. One of the ramifications of this requirement is that those who are not DEA-registered pharmacies (for example, those nonregistrants who have heretofore facilitated unlawful Internet controlled substance sales by enlisting the services of unscrupulous pharmacies and/or prescribing practitioners) are prohibited from operating online pharmacies.

The Act's definition of “online pharmacy” encompasses more than merely legitimate pharmacies that may obtain a modification of their DEA registrations allowing them to dispense controlled substances by means of the Internet. As explained below, the definition of “online pharmacy” includes, among others, those persons who operate the types of rogue Web sites that the Act was designed to eliminate. Consistent with the longstanding structure of the CSA (since it was enacted in 1970), the Ryan Haight Act prohibits all controlled substance activities by “online pharmacies” except those expressly authorized by the Act. Again, only DEA-registered pharmacies may obtain a modification of their registration authorizing them to operate as online pharmacies. In addition, a pharmacy that has obtained such a modification of its registration may not operate as an online pharmacy unless it has notified DEA of its intent to do so and its Web site contains certain declarations designed to provide clear assurance that it is operating legitimately and in conformity with the Act. (These requirements are discussed at length below.)

V. Detailed Explanation of the Legislation

Consistent with the structure of the CSA, the Ryan Haight Act sets out numerous regulatory requirements and other substantive provisions and makes it unlawful to “knowingly or intentionally * * * deliver, distribute, or dispense a controlled substance by means of the Internet, except as authorized by [the Act].” ^[22] Thus, this explanation of the Act will be divided into two main parts: (1) Explaining the Act's regulatory requirements and other substantive provisions and (2) explaining what it means to “knowingly or intentionally * * * deliver, distribute, or dispense a controlled substance by means of the Internet.”

A. New definitions under the Act

The Act adds several new definitions to the CSA. These new statutory definitions are being added to the DEA regulations as part of this Interim Rule. While many of the new definitions are self-explanatory, some are discussed in this preamble to assist in understanding the Act.

The following are two of the key definitions in the Act, which are set forth in 21 U.S.C. 802:

(51) The term “deliver, distribute, or dispense by means of the Internet” refers, respectively, to any delivery, distribution, or dispensing of a controlled substance that is caused or facilitated by means of the Internet.

This definition is plainly broad in scope, encompassing any activity utilizing the Internet that causes or facilitates the delivery, distribution, or dispensing of a controlled substance. This definition is incorporated into the Act's definition of an “online pharmacy”:

(52) The term “online pharmacy” * * * means [with certain exceptions discussed below] a person, entity, or Internet site, whether in the United States or abroad, that knowingly or intentionally delivers, distributes, or dispenses, or offers or attempts to deliver, distribute, or dispense, a controlled substance by means of the Internet.

The definition of “online pharmacy” is also broad in scope. First, it includes not only a “person” ^[23] but also any other “entity” or “Internet site”—“whether in the United States or abroad”—that otherwise meets the definition of an “online pharmacy.” Second, it also includes not only any such person, entity or Internet site “that knowingly or intentionally delivers, distributes, or dispenses * * * a controlled substance by means of the Internet,” but also any such one who “offers or attempts” to do so.

Hence, the term “online pharmacy” includes, among other things: (i) Any Web site that sells, or offers to sell, any controlled substance or a prescription therefor to a person in the United States; (ii) any person who operates such a Web site; ^[24] (iii) any person who pays a practitioner to write prescriptions for controlled substances for customers of such a Web site; (iv) any person who pays a pharmacy to fill prescriptions for controlled substances that were issued to customers of such a Web site; (v) any pharmacy that knowingly or intentionally fills prescriptions for controlled substances that were issued to customers of such a Web site; and (vi) any person who sends an e-mail that: Offers to sell a controlled substance or a prescription for a controlled substance in a manner not authorized by the Act; directs buyers to a Web site operating in violation of the Act; or otherwise causes or facilitates the delivery, distribution, or dispensing of a controlled substance in a manner not authorized by the Act.

While the general scope of the definition of an “online pharmacy” is broad, the definition expressly excludes the following categories:

(i) Manufacturers or distributors registered under subsection (a), (b), (d), or (e) of [21 U.S.C. 823] who do not dispense controlled substances to an unregistered individual or entity;

(ii) Nonpharmacy practitioners who are registered under [21 U.S.C. 823(f)] and whose activities are authorized by that registration;

(iii) Any hospital or other medical facility that is operated by an agency of the United States (including the Armed Forces), provided such hospital or other facility is registered under [21 U.S.C. 823(f)];

(iv) A health care facility owned or operated by an Indian tribe or tribal organization, only to the extent such facility is carrying out a contract or compact under the Indian Self-Determination and Education Assistance Act;

(v) Any agent or employee of any hospital or facility referred to in clause (iii) or (iv), provided such agent or employee is lawfully acting in the usual course of business or employment, and within the scope of the official duties of such agent or employee, with such hospital or facility, and, with respect to agents or employees of health care facilities specified in clause (iv), only to the extent such individuals are furnishing services pursuant to the contracts or compacts described in such clause;

(vi) Mere advertisements that do not attempt to facilitate an actual transaction involving a controlled substance;

(vii) A person, entity, or Internet site that is not in the United States and does not facilitate the delivery, distribution, or dispensing of a controlled substance by means of the Internet to any person in the United States;

(viii) A pharmacy registered under [21 U.S.C. 823(f)] whose dispensing of controlled substances via the Internet consists solely of—

(I) Refilling prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(55)]; or

(II) Filling new prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(56)]; or

(ix) Any other persons for whom the [DEA Administrator] and the Secretary [of Health and Human Services] have jointly, by regulation, found it to be consistent with effective controls against diversion and otherwise consistent with the public health and safety to exempt from the definition of an “online pharmacy”.

21 U.S.C. 802(52)(B).

To elaborate briefly on these exceptions, under exception (i), a DEA-registered manufacturer or distributor ^[25] that uses the Internet to facilitate activities permitted by its DEA registration does not constitute an online pharmacy. Under exception (ii), a DEA-registered nonpharmacy practitioner (e.g., physician, dentist, veterinarian, scientific investigator, hospital, or other person authorized by his registration to dispense controlled substances) may do so by means of the Internet without being an online pharmacy. Under exceptions (iii) through (v), certain hospitals and other health care facilities associated with the United States government, as well as agents and employees acting in the course of their duties for such institutions, are not online pharmacies. Under exception (vi), an advertisement is not an online pharmacy, provided the advertisement does not “attempt to facilitate an actual transaction involving a controlled substance.”

Under exception (vii), a person, entity, or Internet site located outside the United States is only excepted from the definition of an online pharmacy if it “does not facilitate the delivery, distribution, or dispensing of a controlled substance by means of the Internet to any person in the United States.” (Emphasis added.) Thus, Web sites operated by persons located abroad, along with persons who operate the sites, do fall within the definition of an online pharmacy if they sell or offer to sell controlled substances to persons in the United States or otherwise “facilitate the delivery, distribution, or dispensing of a controlled substance by means of the Internet to any person in the United States.”

Under exception (viii), a DEA-registered pharmacy is excepted from the definition of an online pharmacy if it dispenses controlled substances via the Internet solely by “refilling prescriptions for controlled substances in schedule III, IV, or V” and “filling new prescriptions for controlled substances in schedule III, IV, or V” (as those terms are defined in the Act). Finally, under exception (ix), the DEA Administrator and the Secretary of Health and Human Services have the authority to jointly decide to issue regulations making further exceptions to the definition of an online pharmacy, where they determine that doing so is “consistent with effective controls against diversion and otherwise consistent with the public health and safety.” Pursuant to this clause, the regulations being issued here contain two exceptions to the definition of an online pharmacy: One relating to electronic prescribing of controlled substances and the other to the use of automated dispensing systems. These exceptions are explained below.

B. In-Person Medical Evaluation Requirement

To directly prohibit what had been the practice of many rogue Web sites—allowing customers to buy controlled substances and/or prescriptions for controlled substances via the Internet without ever seeing the prescribing practitioner in person—the Ryan Haight Act includes as one of its central features the “valid prescription” requirement. This requirement is set forth in 21 U.S.C. 829(e)(1): “No controlled substance that is a prescription drug as determined under the Federal Food, Drug, and Cosmetic Act ^[26] may be delivered, distributed, or dispensed by means of the Internet without a valid prescription.”

The Act further defines the meaning of “valid prescription” in 21 U.S.C. 829(e)(2)(A): “The term `valid prescription' means a prescription that is issued for a legitimate medical purpose in the usual course of professional practice by—(i) a practitioner who has conducted at least 1 in-person medical evaluation of the patient; or (ii) a covering practitioner.” The Act explains the meaning of “in-person medical evaluation” in 21 U.S.C. 829(e)(2)(B):

(i) The term “in-person medical evaluation” means a medical evaluation that is conducted with the patient in the physical presence of the practitioner, without regard to whether portions of the evaluation are conducted by other health professionals.

(ii) Nothing in clause (i) shall be construed to imply that 1 in-person medical evaluation demonstrates that a prescription has been issued for a legitimate medical purpose within the usual course of professional practice.

Thus, for every controlled substance that is delivered, distributed, or dispensed by means of the Internet, there must be a “valid prescription,” which means not only that the prescription must comply with the longstanding requirement of being issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice, but also that the prescribing practitioner must either (i) have conducted at least one in-person medical evaluation of the patient or (ii) meet the definition of a “covering practitioner” (explained below). Any practitioner who writes a prescription for a controlled substance that fails to comply with this provision of the Act, as well as any pharmacy that knowingly or intentionally fills such a prescription, violates 21 U.S.C. 841(h)(1).

Hence, the Act makes it unambiguous that, except in limited and specified circumstances, it is a per se violation of the CSA for a practitioner to issue a prescription for a controlled substance by means of the Internet without having conducted at least one in-person medical evaluation. However, the Act also expressly provides that a prescribing practitioner does not automatically meet the requirement of issuing a prescription for a legitimate medical purpose while acting in the usual course of professional practice merely by having conducted a single in-person medical evaluation of the patient. Rather, as with all situations in which a prescription for a controlled substance is issued, all the facts and circumstances surrounding the issuance of the prescription must be evaluated in determining whether it was issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice.^[27] A rogue Internet operation cannot, for example, defeat the purpose of the Act by establishing a method of operation in which a practitioner conducts a perfunctory in-person “evaluation” of each “patient” simply for the purpose of selling prescriptions for controlled substances to the patient in perpetuity with no follow-up visits. This topic is addressed further below in Section VII, which provides additional information for practitioners.

With respect to the term “covering practitioner,” the Act states (21 U.S.C. 829(e)(2)(C)):

The term “covering practitioner” means, with respect to a patient, a practitioner who conducts a medical evaluation (other than an in-person medical evaluation) at the request of a practitioner who—(i) has conducted at least 1 in-person medical evaluation of the patient or an evaluation of the patient through the practice of telemedicine, within the previous 24 months; and (ii) is temporarily unavailable to conduct the evaluation of the patient.

Thus, a prescribing practitioner who falls within the above definition of a “covering practitioner” need not conduct an in-person medical evaluation as a prerequisite to prescribing a controlled substance to a given patient, provided that the practitioner for whom the covering practitioner is covering has conducted an in-person medical evaluation of that patient and provided further that this covering arrangement is taking place on only a temporary basis. Moreover, just as with the primary practitioner, the requirement that the prescription must be issued in the usual course of professional practice for a legitimate medical purpose applies with equal force to a “covering practitioner.”

The Act also provides for an exception to the requirement of an in-person medical evaluation for practitioners who are engaged in the “practice of telemedicine” within the meaning of the Act. 21 U.S.C. 829(e)(3)(A). Of course, a practitioner engaged in the “practice of telemedicine” remains subject to the requirement that every prescription for a controlled substance be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. The Act provides a temporary definition of the “practice of telemedicine” pending issuance of new regulations addressing “telemedicine.” The topic of “telemedicine” is further addressed in paragraph D below.

C. Requirements for Online Pharmacies

Modified Registration Requirement—The Act imposes various requirements for those persons and other entities that fit within the Act's definition of an online pharmacy. To begin with, an online pharmacy may only operate lawfully as an online pharmacy if it is a DEA-registered pharmacy that has obtained from DEA a modification of its registration authorizing it to engage in such activity. 21 U.S.C. 823(f), 841(h)(1). An online pharmacy that is not validly registered with a modification authorizing it to operate as an online pharmacy as required by 21 U.S.C. 823(f) will violate 21 U.S.C. 841(h)(1) if it knowingly or intentionally delivers, distributes, or dispenses a controlled substance by means of the Internet. Moreover, under the Act, the only type of online pharmacy that is eligible to apply to DEA for such modification of registration is a DEA-registered pharmacy. 21 U.S.C. 823(f). Thus, any person, entity, or Internet site that falls within the definition of an online pharmacy—and is not a DEA-registered pharmacy that has obtained a modification of its registration authorizing it to operate as an online pharmacy—is necessarily violating the Act if it knowingly or intentionally delivers, distributes, or dispenses a controlled substance by means of the Internet.

The regulations being issued here set forth the process by which a DEA-registered pharmacy may apply online for a modification of its registration authorizing it to operate as an online pharmacy. Under the Act, DEA must base its decision on whether to grant or deny such an application for a modification of registration on the same statutory criteria that it must consider in evaluating an application for registration submitted by a pharmacy or other practitioner. 21 U.S.C. 823(f).

Reporting Requirement—A pharmacy that has obtained a modification of its registration authorizing it to dispense controlled substances by means of the Internet must report to DEA, on a monthly basis, the total amount of each controlled substance it dispenses. 21 U.S.C. 827(d)(2). For pharmacies that are subject to this requirement, the monthly report must include all controlled substances dispensed by any means—not just controlled substances dispensed by means of the Internet. Id. However, if a pharmacy with such a modified registration dispenses an amount that falls below the threshold in a given month, it is not required to submit a report for that month. Id. The monthly threshold is either (A) 100 or more prescriptions for controlled substances filled by the pharmacy or (B) 5,000 or more total dosage units of controlled substances dispensed. Id. Again, these threshold amounts include all controlled substances dispensed by the pharmacy by any means (through walk-in business, by mail, by means of the Internet, or otherwise). Id. If the pharmacy meets or exceeds either of the foregoing amounts in a given month, it must report to DEA the total amount of controlled substances it dispensed by any means during that month. Id. The regulations being issued here specify the time and manner in which such reports must be filed.

Statements that must appear on an online pharmacy's Web site—Every online pharmacy is required under the Act to “display in a visible and clear manner on its homepage a statement that it complies with the requirements of [21 U.S.C. 831] with respect to the delivery or sale or offer for sale of controlled substances and shall at all times display on the homepage of its Internet site a declaration of compliance in accordance with this section.” 21 U.S.C. 831(a).

In addition, the Act requires every online pharmacy to satisfy the following requirement relating to what the Act refers to as the “Internet Pharmacy Site Disclosure Information.” As set forth in 21 U.S.C. 831(c), each online pharmacy shall post in a visible and clear manner on the homepage of each Internet site it operates, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage, the following information for each pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of, that Web site:

• The name and address of the pharmacy as it appears on the pharmacy's Drug Enforcement Administration Certificate of Registration.
• The pharmacy's telephone number and e-mail address.
• The name, professional degree, and States of licensure of the pharmacist-in-charge, and a telephone number at which the pharmacist-in-charge can be contacted.
• A list of the States in which the pharmacy is licensed to dispense controlled substances.
• A certification that the pharmacy is registered under this part to deliver, distribute, or dispense by means of the Internet controlled substances.
• The name, address, telephone number, professional degree, and States of licensure of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof.
• The following statement, unless revised by the [DEA Administrator] by regulation: “This online pharmacy will only dispense a controlled substance to a person who has a valid prescription issued for a legitimate medical purpose based upon a medical relationship with a prescribing practitioner. This includes at least one prior in-person medical evaluation or medical evaluation via telemedicine in accordance with applicable requirements of section 309.”

While the foregoing requirements are largely self-explanatory, some aspects warrant special emphasis. The requirement that an online pharmacy post the foregoing information “in a visible and clear manner on the homepage of each Internet site it operates, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage” is intended to ensure that members of the public who visit such Web sites are informed about the Ryan Haight Act's core requirements and to ensure that the DEA-registered pharmacies and prescribing practitioners affiliated with the site, if any, are clearly identified. Any effort by an online pharmacy to hide or reduce the visibility on the Web site of this required information will subject those responsible to potential criminal and civil liability and, in the case of DEA registrants, potential loss of registration. The required information must be displayed “for each pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of, that Web site.” Thus, if multiple pharmacies dispense controlled substances pursuant to orders made on, through, or on behalf of, that Web site, each required category of information must be displayed for each such pharmacy.

The requirement (under paragraph (4)) that an online pharmacy list the States in which it is licensed to dispense controlled substances is designed to ensure that an online pharmacy only dispenses controlled substances to patients in States in which it is authorized to practice pharmacy. Dispensing beyond the scope of State licensure is one of the recurring transgressions of some rogue online pharmacies and generally violates State law.^[28]

State licensure requirement—The Act also requires that online pharmacies comply with State licensure requirements. Specifically, the Act requires that:

Each online pharmacy shall comply with the requirements of State law concerning the licensure of pharmacies in each State from which it, and in each State to which it, delivers, distributes, or dispenses or offers to deliver, distribute, or dispense controlled substances by means of the Internet, pursuant to applicable licensure requirements, as determined by each such State.

21 U.S.C. 831(b).

Required notification to DEA—The Act contains a provision that is designed to ensure that DEA, and the applicable State boards of pharmacy, are aware of the existence of an online pharmacy before it commences operation. The Act's notification requirements are set forth in 21 U.S.C. 831(d)(1):

Thirty days prior to offering a controlled substance for sale, delivery, distribution, or dispensing, the online pharmacy shall notify the [DEA Administrator], in such form and manner as the [Administrator] shall determine, and the State boards of pharmacy in any States in which the online pharmacy offers to sell, deliver, distribute, or dispense controlled substances.

Pursuant to this provision, the regulations being issued here provide that such notification to DEA shall be made by the pharmacy as part of the process by which it applies to DEA for a modification of its registration authorizing it to operate as an online pharmacy. The Act specifies that the foregoing notification must include the following information:

(A) The information required to be posted on the online pharmacy's Internet site under [21 U.S.C. 831(c)] and shall notify the [DEA Administrator] and the applicable State boards of pharmacy, under penalty of perjury, that the information disclosed on its Internet site under [21 U.S.C. 831(c)] is true and accurate;

(B) The online pharmacy's Internet site address and a certification that the online pharmacy shall notify the [Administrator] of any change in the address at least 30 days in advance; and

(C) the Drug Enforcement Administration registration numbers of any pharmacies and practitioners referred to in [21 U.S.C. 831(c)], as applicable.

21 U.S.C. 831(d)(2).

Thus, the information that an online pharmacy is required to post on its Web site must also be provided to DEA as part of the application for a modification of its DEA registration in order to satisfy part of the notification requirement.

Declaration of compliance—Beginning on the date on which the online pharmacy makes the notification to DEA required by 21 U.S.C. 831(d), and continuing thereafter, it must “display on the homepage of its Internet site, in such form as the [DEA Administrator] shall by regulation require, a declaration that it has made such notification to the [Administrator].” 21 U.S.C. 831(e). The regulations being issued here specify precisely the form in which this declaration must be made.

Additional considerations regarding statements, declarations, notifications, and disclosures required under the Act—As stated in 21 U.S.C. 831(f): “Any statement, declaration, notification, or disclosure required under [21 U.S.C. 831] shall be considered a report required to be kept under [the CSA].” One important effect of this provision is that, in conjunction with 21 U.S.C. 843(a)(4), it is a felony violation of the CSA to furnish false or fraudulent material information in, or omit any material information from, any statement, declaration, notification, or disclosure required under 21 U.S.C. 831.^[29]

D. Telemedicine

As indicated above, “a practitioner engaged in the practice of telemedicine” within the meaning of the Act is exempt from the requirement of an in-person medical evaluation as a prerequisite to prescribing or otherwise dispensing controlled substances by means of the Internet. Before explaining the meaning of the “practice of telemedicine,” it bears repeated emphasis that all practitioners who prescribe controlled substances—even those engaged in the practice of telemedicine—remain subject to the requirement that the prescription be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. Prescribing a controlled substance without conducting an in-person medical evaluation has always been, and remains under the Act, a strong indication (or “red flag”) of likely diversion.^[30] The Act simply made the failure to perform an in-person medical evaluation in certain circumstances ^[31] an automatic violation of the CSA, while leaving it as a factor indicative of possible diversion in all other circumstances.

The definition of the “practice of telemedicine” includes seven distinct categories that involve circumstances in which the prescribing practitioner might be unable to satisfy the Act's in-person medical evaluation requirement, yet nonetheless has sufficient medical information to prescribe a controlled substance for a legitimate medical purpose in the usual course of professional practice. In these circumstances, provided certain safeguards are in place to ensure that the practitioner who is engaged in the practice of telemedicine is able to conduct a bona fide medical evaluation of the patient at the remote location, and is otherwise acting in the usual course of professional practice, the Act contemplates that the practitioner will be permitted to prescribe controlled substances by means of the Internet despite not having conducted an in-person medical evaluation. The Act defines these categories, through the definition of “practice of telemedicine,” which is set forth in 21 U.S.C. 802(54).

The Act specifies that the definition of the “practice of telemedicine” found in 21 U.S.C. 802(54) does not take effect at the same time the rest of the Act takes effect (April 13, 2009). Rather, the Act provides for a temporary definition of the “practice of telemedicine” that will apply beginning April 13, 2009, and continuing until the earlier of two dates: (i) three months after the date on which regulations are promulgated to carry out 21 U.S.C. 831(h) [relating to the issuance of a special registration to practice telemedicine] or (ii) January 15, 2010.^[32] Until the first of the foregoing two dates is reached, the Act states that the following definition applies:

[T]he term “practice of telemedicine” means the practice of medicine in accordance with applicable Federal and State laws by a practitioner (as that term is defined in section 102 of the Controlled Substances Act (21 U.S.C. 802)) (other than a pharmacist) who is at a location remote from the patient and is communicating with the patient, or health care professional who is treating the patient, using a telecommunications system referred to in section 1834(m) of the Social Security Act (42 U.S.C. 1395m(m)), if the practitioner is using an interactive telecommunications system that satisfies the requirements of section 410.78(a)(3) of title 42, Code of Federal Regulations.

The rule being issued today contains both definitions of the practice of telemedicine (temporary and permanent), with the respective effective dates indicated.

Special registration for telemedicine—A practitioner who is engaged in the practice of telemedicine within the meaning of the Act is not subject to the mandatory in-person medical evaluation requirement of 21 U.S.C. 829(e) (although such practitioner remains subject to the requirement that all prescriptions for controlled substances be issued for a legitimate medical purpose). The Act's permanent definition of the “practice of telemedicine” includes, as an example, “a practitioner who has obtained from the [DEA Administrator] a special registration under [21 U.S.C. 831(h)].” 21 U.S.C. 802(54)(E). The Act specifies certain criteria that DEA must consider when evaluating an application for such a registration. However, the Act contemplates that DEA must issue certain regulations to effectuate this special registration provision. Specifically, the Act states: “The [DEA Administrator] shall, with the concurrence of the Secretary [of Health and Human Services], promulgate regulations specifying the limited circumstances in which a special registration under [21 U.S.C. 831(h)] may be issued and the procedures for obtaining such a special registration.” DEA will issue a separate rule promulgating regulations consistent with this directive. As explained above, until such regulations are promulgated, or until January 15, 2010 (whichever comes first), the temporary definition of the practice of telemedicine recited above remains in effect.

E. Exemptions for Electronic Prescribing of Controlled Substances and Automated Dispensing Systems

Electronic prescribing of controlled substances—On June 27, 2008, DEA published in the Federal Register a Notice of Proposed Rulemaking that would amend the DEA regulations to allow practitioners to electronically prescribe controlled substances (73 FR 36722). DEA is currently developing a final rule on electronic prescribing of controlled substances that takes into account the numerous public comments that were submitted in response to the proposed rule. Once the rule is finalized and published in the Federal Register, practitioners will be permitted to electronically prescribe controlled substances in accordance with the requirements in the regulations. In most cases, electronic prescribing of controlled substances will occur by means of the Internet. Given the Act's definitions, a pharmacy that knowingly or intentionally fills an electronic prescription for a controlled substance would (in the likely event that such an electronic prescription were transmitted via the Internet) fall within the Act's definition of an online pharmacy.

As indicated above, the Act gives the DEA Administrator, acting jointly with the Secretary of Health and Human Services, authority to exempt by regulation certain persons from the definition of an “online pharmacy,” where the Administrator and the Secretary have found that doing so is “consistent with effective controls against diversion and otherwise consistent with the public health and safety.” 21 U.S.C. 802(52)(B)(ix). Pursuant to this authority, the regulations being issued here today contain a provision that exempts from the definition of an online pharmacy any DEA-registered pharmacy “whose delivery, distribution, or dispensing of controlled substances by means of the Internet consists solely of * * * filling prescriptions that were electronically prescribed in a manner authorized by this chapter and otherwise in compliance with the Act.” 21 CFR 1300.04(h)(9). To eliminate any possible confusion as to how this exception applies, this provision of the regulations further states: “A registered pharmacy will be deemed to meet this exception if, in view of all of its activities other than [the acceptance of electronic prescriptions for controlled substances transmitted in accordance with the requirements of this chapter], it would fall outside the definition of an online pharmacy.” A DEA-registered pharmacy that is so exempted from the definition of an online pharmacy is not required to obtain a modified registration and is not subject to the reporting requirement of 21 U.S.C. 827(d)(2) or the additional requirements relating to online pharmacies set forth in 21 U.S.C. 831.

It should be understood that the exception provided in 21 CFR 1300.04(h)(9) cannot take effect until DEA issues regulations allowing for the electronic prescribing of controlled substances. Until then, electronic prescribing of controlled substances is not permitted by the DEA regulations and thus cannot form the basis for any exception to the requirement of a modified registration for DEA-registered pharmacies.

It should also be clear from the language of 21 CFR 1300.04(h)(9) that this exception provides no loophole for operators of rogue Internet Web sites or unscrupulous pharmacies that fill prescriptions generated through such sites. The mere fact that a pharmacy accepts electronic prescriptions does not, in any way, immunize the pharmacy from the requirements of the Act. Likewise, a rogue Web site that operates in violation of the Act cannot escape liability simply by having either (i) unscrupulous practitioners who have a contract to write prescriptions on behalf of the site issue such prescriptions electronically or (ii) unscrupulous pharmacies that have a contract to fill such prescriptions do so through the acceptance of electronic prescriptions. To the contrary, the regulation is written so that the exception cannot possibly be utilized by a rogue Web site; only a DEA-registered pharmacy is eligible for the exception and only to the extent it is otherwise acting in conformity with the CSA and the DEA regulations.

Exemption for automated dispensing systems—Under current DEA regulations, a DEA-registered retail pharmacy may install and operate an automated dispensing system at a long term care facility under certain specified conditions. 21 CFR 1301.27. Among other requirements, any retail pharmacy that installs and operates an automated dispensing system at a long term care facility must maintain a separate registration at each long term care facility in which its automated dispensing systems are located. Id. Prescription information may be transmitted by the retail pharmacy to the automated dispensing system via the Internet. Therefore, a pharmacy that operates an automated dispensing system at a long term care facility could potentially fall within the Act's definition of an online pharmacy. Pursuant to 21 U.S.C. 802(52)(B)(ix), the DEA Administrator and the Secretary have jointly concluded that it would be consistent with effective controls against diversion and otherwise consistent with the public health and safety to issue the following exemption. As set forth in 21 CFR 1300.04(h)(10), if a DEA-registered retail pharmacy does not deliver, distribute, or dispense, or offer to deliver, distribute, or dispense, controlled substances by means of the Internet, other than to communicate prescription information to an automated dispensing system for which it holds a separate registration at a long term care facility, that retail pharmacy is exempted from the definition of an online pharmacy. As a result, such a pharmacy is not required to obtain a modified registration and is not subject to the reporting requirement of 21 U.S.C. 827(d)(2) or the additional requirements relating to online pharmacies set forth in 21 U.S.C. 831.

VI. Criminal Provisions of the Ryan Haight Act

The Ryan Haight Act adds two new criminal offenses to the CSA. The first new offense is set forth in 21 U.S.C. 841(h)(1), which states:

It shall be unlawful for any person to knowingly or intentionally-

(A) Deliver, distribute, or dispense a controlled substance by means of the Internet, except as authorized by [the CSA]; or

(B) Aid or abet (as such terms are used in section 2 of title 18, United States Code) any activity described in subparagraph (A) that is not authorized by [the CSA].

The Act contains specific examples of conduct which would violate 21 U.S.C. 841(h)(1). These examples in the Act, however, are not an exclusive list of the types of conduct that constitute violations of 21 U.S.C. 841(h)(1). With this proviso made clear, 21 U.S.C. 841(h)(2) lists the following as examples of violations:

(A) Delivering, distributing, or dispensing a controlled substance by means of the Internet by an online pharmacy that is not validly registered with a modification authorizing such activity as required by [21 U.S.C. 823(f)] (unless exempt from such registration);

(B) Writing a prescription for a controlled substance for the purpose of delivery, distribution, or dispensation by means of the Internet in violation of [21 U.S.C. 829(e)];

(C) Serving as an agent, intermediary, or other entity that causes the Internet to be used to bring together a buyer and seller to engage in the dispensing of a controlled substance in a manner not authorized by [21 U.S.C. 823(f) or 829(e)];

(D) Offering to fill a prescription for a controlled substance based solely on a consumer's completion of an online medical questionnaire; and

(E) Making a material false, fictitious, or fraudulent statement or representation in a notification or declaration under [21 U.S.C. 831(d) or (e)].

As these examples are largely self-illuminating, and some have already been addressed in this preamble, only limited further amplification is provided here. Paragraph (C), in particular, reflects that the Act was intended not only to prohibit DEA registrants from using the Internet to facilitate the unlawful dispensing of controlled substances, but to also prohibit non-DEA registrants from doing so. Most notably, paragraph (C) is aimed squarely at the criminal facilitator whose “business plan” for operating a rogue online pharmacy is to recruit an unscrupulous practitioner to write prescriptions based on insufficient or nonexistent medical evaluations and/or an unscrupulous pharmacist to fill such prescriptions.

The Act contains certain categories of conduct that do not result in the participants falling within the Act's definition of an online pharmacy. Specifically, 21 U.S.C. 841(h)(3) states:

(A) This subsection [21 U.S.C. 841(h)(1)] does not apply to:

(i) The delivery, distribution, or dispensation of controlled substances by nonpractitioners to the extent authorized by their registration under [the CSA];

(ii) The placement on the Internet of material that merely advocates the use of a controlled substance or includes pricing information without attempting to propose or facilitate an actual transaction involving a controlled substance; or

(iii) except as provided in subparagraph (B), any activity that is limited to—

(I) the provision of a telecommunications service, or of an Internet access service or Internet information location tool (as those terms are defined in section 231 of the Communications Act of 1934) [47 U.S.C. 231]; or

(II) the transmission, storage, retrieval, hosting, formatting, or translation (or any combination thereof) of a communication, without selection or alteration of the content of the communication, except that deletion of a particular communication or material made by another person in a manner consistent with section 230(c) of the Communications Act of 1934 [47 U.S.C. 230(c)] shall not constitute such selection or alteration of the content of the communication.

(B) The exceptions under subclauses (I) and (II) of subparagraph (A)(iii) shall not apply to a person acting in concert with a person who violates paragraph (1).

Thus, paragraph (A)(i) allows DEA-registered nonpractitioners (such as manufacturers and distributors) to utilize the Internet in carrying out activities authorized by their DEA registrations (and otherwise in conformity with the CSA) without being subject to liability under 21 U.S.C. 841(h)(1). Paragraph (A)(ii) allows for Web sites that advocate the use of controlled substances or contain pricing information “without attempting to propose or facilitate an actual transaction involving a controlled substance.” Paragraph (A)(iii) exempts from application of 21 U.S.C. 841(h)(1) Internet service providers, Web hosting services, and certain other specified entities that do not alter content of Internet transmissions. However, it is crucial to bear in mind that the exception of paragraph (A)(iii) does not apply to “a person acting in concert with a person who violates [21 U.S.C. 841(h)(1)].” Thus, any person whose conduct would be sufficient to prove that he conspired to violate 21 U.S.C. 841(h)(1), or aided and abetted such violation, is not immune from prosecution under paragraph (A)(iii).

The second new criminal offense added by the Act is 21 U.S.C. 843(c)(2)(A). This provision expressly prohibits using the Internet to advertise illegal transactions in controlled substances. Specifically, this provision states:

It shall be unlawful for any person to knowingly or intentionally use the Internet, or cause the Internet to be used, to advertise the sale of, or to offer to sell, distribute, or dispense, a controlled substance where such sale, distribution, or dispensing is not authorized by [the CSA] or by the Controlled Substances Import and Export Act.

The Act further states:

Examples of activities that violate [21 U.S.C. 843(c)(2)(A)] include, but are not limited to, knowingly or intentionally causing the placement on the Internet of an advertisement that refers to or directs prospective buyers to Internet sellers of controlled substances who are not registered with a modification under [21 U.S.C. 823(f)].

Thus, for example, it is unlawful under the Act to knowingly or intentionally place an advertisement on the Internet that directs persons to a Web site that sells prescriptions for controlled substances where the operator of the Web site is not a DEA-registered pharmacy with a modification authorizing it to operate as an online pharmacy. As another example, it is unlawful under the Act to knowingly or intentionally place an advertisement on the Internet that offers to sell a controlled substance without a prescription or that directs persons to a Web site through which a controlled substance may be purchased without a prescription.

Two important points should be noted with respect to 21 U.S.C. 843(c)(2)(A). First, to establish a violation of this felony provision, it is not necessary that the person placing the advertisement actually engage in a transaction involving a controlled substance. Rather, merely placing on the Internet an advertisement that is designed to facilitate, or offers to facilitate, an illegal sale of a controlled substance is sufficient to violate 21 U.S.C. 843(c)(2)(A). Second, the Act applies to advertisements relating to violations not only of the CSA, but also of the Controlled Substances Import and Export Act (CSIEA, which is found in 21 U.S.C. 951 through 971). Thus, it is a violation of 21 U.S.C. 843(c)(2)(A) to place an advertisement on the Internet that offers, for example, to ship controlled substances into the United States for personal medical use, since doing so would violate the CSIEA.^[33] What It Means to “Knowingly or intentionally deliver, distribute, or dispense a controlled substance by means of the Internet.”

The Ryan Haight Act is structured around the phrase “knowingly or intentionally deliver, distribute, or dispense a controlled substance by means of the Internet.” The meaning of this phrase is therefore essential to the meaning of the Act. To explain its meaning, it is helpful to divide the phrase into two parts, starting with the latter half (“deliver, distribute, or dispense a controlled substance by means of the Internet”). The Act itself contains the following definition:

The term “deliver, distribute, or dispense by means of the Internet” refers, respectively, to any delivery, distribution, or dispensing of a controlled substance that is caused or facilitated by means of the Internet.

21 U.S.C. 802(51) (emphasis added). Given that the phrase “deliver, distribute, or dispense by means of the Internet” has the foregoing definition, the next question is: What does it mean to “knowingly or intentionally” deliver, distribute, or dispense a controlled substance by means of the Internet?

The phrase “knowingly or intentionally” has been a part of the CSA since its enactment in 1970. Among other provisions, 21 U.S.C. 841(a)(1) (the most widely utilized criminal provision of the CSA) makes it an offense to “knowingly or intentionally * * * manufacture, distribute, or dispense, or possess with intent to manufacture, distribute, or dispense, a controlled substance” except as authorized by the CSA. There are numerous reported federal cases, some of which are discussed below, in which practitioners and pharmacists have been convicted of violating 21 U.S.C. 841(a)(1). These cases establish clear precedent for interpreting the phrase “knowingly or intentionally” in the context of practitioners who unlawfully prescribe controlled substances and pharmacists who unlawfully fill prescriptions for controlled substances. Specifically, a practitioner may be convicted of knowingly or intentionally dispensing controlled substances in violation of the CSA where the practitioner either (i) had actual knowledge of the illegal activity or (ii) was presented with facts that put him on notice that criminal activity was particularly likely and yet intentionally failed to investigate those facts.^[34] The following statement by one federal court of appeals exemplifies the standard under which pharmacists may be held liable for knowingly or intentionally dispensing controlled substances in violation of the CSA:

The question, then, in any case where a pharmacist is charged with illegal distribution of controlled substances, is whether he knew that the purported prescription was not issued for a legitimate medical purpose or in the usual course of medical practice. The key element of knowledge may be shown by proof that the defendant deliberately closed his eyes to the true nature of the prescription.^[35]

Another federal court has similarly stated that a pharmacist may be convicted of unlawfully dispensing controlled substances where the evidence establishes that the pharmacist “deliberately closed his eyes to wrongdoing that should have been obvious to him.”^[36] Courts have referred to such conduct as “willful blindness” or “deliberate ignorance.” As one court has stated:

Ignorance is deliberate if the defendant was presented with facts that put her on notice that criminal activity was particularly likely and yet she intentionally failed to investigate those facts.* * * If, in light of certain obvious facts, reasonable inferences support a finding that a defendant's failure to investigate is equivalent to `burying one's head in the sand,' the jury may consider willful blindness as a basis for knowledge.^[37]

Thus, a pharmacist who fills a prescription that was issued in violation of any provision of the Act may be held criminally liable under 21 U.S.C. 841(h)(1) if he did so knowingly or intentionally—that is, if he either (i) had actual knowledge of the violation or (ii) deliberately disregarded facts that would have led a reasonable pharmacist to be highly suspicious about the likelihood of such a violation. Likewise, a practitioner who writes a prescription in violation of the Act may be held criminally liable under 21 U.S.C. 841(h)(1) if he did so knowingly or intentionally—which can be proven by showing that either (i) the practitioner had actual knowledge of the violation or (ii) the practitioner deliberately disregarded facts that would have led a reasonable practitioner to be highly suspicious about the likelihood of such a violation.

VII. Additional Information About the Ryan Haight Act for Pharmacists, Practitioners, Other Registrants, and Members of the Public

This section provides additional information specifically tailored to various categories of persons who are likely to be affected by, or otherwise have an interest in, the Ryan Haight Act. This information must be read in conjunction with the general information explaining the Act provided above. For example, the definitions of the terminology used in the Act will not be repeated in this section (due to their length) and should be reviewed as necessary by returning to the appropriate sections of the preamble.

A. Additional Specific Information for Pharmacists

If you are a pharmacist, and your DEA-registered pharmacy falls within the definition of an “online pharmacy,” your pharmacy must, beginning on April 13, 2009, obtain from DEA a modification of its registration authorizing it to operate as an online pharmacy. (DEA will issue to the pharmacy a Certificate of Registration indicating the modification of registration.) The Ryan Haight Act contains several exceptions to the definition of an online pharmacy, so you should review carefully these exceptions before submitting an application for such modification of registration. Among other things, particular consideration should be given to the exception set forth in 21 U.S.C. 802(52)(B)(viii) that excludes from the definition of an online pharmacy those DEA-registered pharmacies “whose dispensing of controlled substances via the Internet consists solely of * * * (I) refilling prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(55)] or (II) filling new prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(56)].”

Also, the regulations being issued here exempt from the definition of online pharmacy any registered pharmacy “whose delivery, distribution, or dispensing of controlled substances by means of the Internet consists solely of * * * filling prescriptions that were electronically prescribed in a manner authorized by this chapter and otherwise in compliance with the Act.” Given these exceptions to the definition of an online pharmacy, DEA anticipates that the overwhelming majority of pharmacies in the United States, if they follow their current practices, will not, as of April 13, 2009, fall within the definition of an online pharmacy. However, as of April 13, 2009, if a pharmacist knowingly or intentionally dispenses a controlled substance by means of the Internet, and the pharmacy fits within the definition of an online pharmacy, but does not hold a modified DEA registration authorizing it to operate as an online pharmacy, the pharmacy and the pharmacist are violating 21 U.S.C. 841(h)(1) and subject to potential criminal prosecution and loss of the pharmacy's DEA registration. Accordingly, if the anticipated activities of your pharmacy will render it an online pharmacy within the meaning of the Act, you should submit to DEA your application for a modified registration as early as possible, since you will not be permitted to engage in the activities of an online pharmacy until DEA has approved such application. To expedite matters, DEA has established an online application process for registrants to apply for such modification of registration.

In addition, as explained earlier in this preamble, any pharmacy that fits within the Act's definition of an online pharmacy must display certain information on its Web site and make certain notifications to DEA, as required by the Act and the regulations being issued here. Also, if a pharmacy has applied for and been granted a modification of its registration authorizing it to operate as an online pharmacy, it is obligated to submit monthly reports of all controlled substances dispensed by any means (walk-in business, dispensing by mail, or any other type of dispensing—whether by means of the Internet or not), provided such dispensing meets or exceeds the threshold amounts.

A pharmacist has always had a corresponding responsibility to ensure that any dispensing of controlled substances conforms with the CSA and DEA regulations.^[38] That same corresponding responsibility now applies with respect to the new requirements of the Ryan Haight Act and the implementing regulations. That is, a pharmacist's corresponding responsibility now includes ensuring that controlled substances are dispensed in conformity with the Ryan Haight Act. For example, under the Act, a pharmacist may not knowingly or intentionally fill a prescription for a controlled substance that was issued in violation of the inperson medical evaluation requirement of 21 U.S.C. 829(e).

How does a pharmacist, when presented with a prescription (whether it is a written prescription presented in person, an oral prescription, a faxed prescription, or otherwise) know whether the prescription was “dispensed by means of the Internet,” and thus subject to the requirements of the Act? Again, under the law, a pharmacist has a corresponding responsibility to ensure that any prescription filled was issued in conformity with the law and regulations. The same legal standard that has always applied in determining whether a pharmacist met this responsibility will also apply in determining whether the pharmacist acted properly in filling a prescription subject to the requirements of the Ryan Haight Act. If the pharmacist either (i) had actual knowledge that the prescription was issued by means of the Internet and that the requirements of the Act were not met or (ii) in view of all the circumstances surrounding a particular prescription, and, in the exercise of proper professional practice, should have known of such violation, or deliberately closed his eyes to circumstances indicative of a possible violation, or otherwise failed to take appropriate steps that a professional pharmacist should take to investigate suspicious circumstances, the pharmacy and pharmacist may be deemed to have knowingly or intentionally violated 21 U.S.C. 841(h)(1).

Depending on the circumstances, the relevant factors for this inquiry might include: the number of prescriptions received from a practitioner; the practitioner's pattern of prescribing; the address of the patient in relation to that of the practitioner; and the distance from the practitioner to the pharmacy. If, taking factors such as these into account, the pharmacist either (a) actually knows that the patient to whom a prescription for a controlled substance was issued was steered to the practitioner through a Web site or (b) should reasonably suspect so and fails to verify, the pharmacist who fills such a prescription will have knowingly or intentionally dispensed a controlled substance by means of the Internet. If such dispensing occurs, both the pharmacy and the pharmacist fall within the definition of an online pharmacy, and both will automatically violate 21 U.S.C. 841(h)(1) if the pharmacy does not have a modified DEA registration authorizing it to operate as an online pharmacy. Again, such a violation, or any other transgression by a pharmacist of the corresponding responsibility as it pertains to the requirements of the Act may result in criminal prosecution of the pharmacist and/or administrative proceedings to revoke the pharmacy's registration.

Pharmacists should also note that the new requirements of the Act are in addition to, and not in lieu of, the longstanding requirement that all prescriptions for controlled substances be issued by a practitioner acting in the usual course of professional practice and otherwise in conformity with the CSA and DEA regulations. Thus, when a prescription for a controlled substance has been issued by means of the Internet, even if the pharmacy that fills the prescription has obtained from DEA a modification of its registration, and even if the pharmacist has confirmed that the prescribing practitioner has conducted at least one in-person medical evaluation of the patient, the pharmacist still has the corresponding responsibility to ensure that the prescription was issued for a legitimate medical purpose in the usual course of professional practice. For example, if the pharmacist knows that a prescription for a controlled substance was issued by a practitioner who works for a Web site that sends its customers to practitioners for a one-time sham medical evaluation with the intent to sell prescriptions to the customers repeatedly thereafter with no in-person follow-up evaluations, the fact that the practitioner conducted an in-person “evaluation” purporting to comply with the Act does not excuse the pharmacist from fulfilling his corresponding responsibility to fill only those prescriptions for controlled substances that were issued for a legitimate medical purpose in the usual course of professional practice.

To list another common practice of rogue Internet site operators, if you are an owner of a pharmacy and you are approached by an “entrepreneur” who offers to funnel to you large quantities of prescriptions for filling in exchange for a fee, there is a strong possibility that you are being asked to serve as the supplier to a rogue Web site. This is especially so if such “entrepreneur” is not affiliated with a legitimate health care organization. Again, the rogue Web sites that the Act was designed to eliminate often depend on the assistance of DEA-registered pharmacies. If you as a pharmacy owner or pharmacist are asked to participate in a scheme that raises suspicions about compliance with the Act, you are risking potential criminal liability and loss of DEA registration if you agree to participate without taking reasonable steps to rule out the possibility that the scheme will violate the Act.

A pharmacist is not, however, obligated to know what cannot be known through the exercise of sound professional pharmacy practice. For example, it is conceivable that a customer could walk into a pharmacy with a prescription that was issued by means of the Internet (or such a prescription could be faxed to a pharmacy) with the pharmacist having no reasonable basis to know or suspect that it was issued by means of the Internet. As long as the pharmacist meets his corresponding responsibility to take reasonable steps under the circumstances to ensure that the prescription was issued in accordance with the requirements of the Ryan Haight Act (as well as all other applicable requirements of the CSA and DEA regulations), the pharmacist will not be held strictly liable for filling a prescription that he could not reasonably have known was issued by means of the Internet. Thus, it is absolutely unnecessary for a pharmacy to apply for a modification of its DEA registration authorizing it to operate as an online pharmacy for the sole purpose of ensuring that it does not—despite the exercise of sound professional judgment—inadvertently fill a prescription that was issued by means of the Internet.

B. Additional Specific Information for Practitioners

If you are a physician, dentist, veterinarian, mid-level practitioner, or other practitioner registered with DEA to prescribe, administer, or dispense controlled substances, and your activities involving controlled substances are limited to those authorized by your registration, you are exempted under the Ryan Haight Act from the definition of an “online pharmacy.” As a result, you are not subject to the requirement of obtaining a modified DEA registration that applies to pharmacies that dispense controlled substances by means of the Internet. Nonetheless, there are other requirements of the Act and the implementing regulations that, depending on the nature of your practice, might apply to you.

DEA believes that the overwhelming majority of practitioners in the United States, based on their current practices, do not engage in activities that constitute delivering, distributing, or dispensing controlled substances by means of the Internet.^[39] Accordingly, the overwhelming majority of practitioners need not change their practices because of the enactment of the Ryan Haight Act. However, if you are a DEA-registered practitioner who prescribes or otherwise dispenses a controlled substance by means of the Internet, you must comply with the provisions of the Act that apply to you.

First, if you are a DEA-registered practitioner who prescribes or otherwise dispenses a controlled substance by means of the Internet, you must comply with the provision of the Act relating to the in-person medical evaluation requirement, which is set forth in 21 U.S.C. 829(e). Certain exceptions apply to this requirement, as are discussed above in this preamble. Note, however, that the Act expressly states that compliance by a practitioner with the in-person medical evaluation requirement does not, by itself, satisfy the requirement that every prescription be issued for a legitimate medical purpose in the usual course of professional practice. Whether a prescription was issued for a legitimate medical purpose in the usual course of professional practice must, as always, be determined based on the totality of the circumstances under which a particular prescription was issued to a particular patient. As DEA has previously stated, “DEA recognizes that the overwhelming majority of American physicians who prescribe controlled substances do so for legitimate medical purposes [and] exercise the appropriate degree of medical supervision—as part of their routine practice during office visits.”^[40] However, this favorable characterization cannot be applied to the very small percentage of practitioners who write prescriptions on behalf of rogue Internet Web sites. Indeed, the main reason Congress enacted the Ryan Haight Act was to bring an end to the rogue Web sites that hire unscrupulous practitioners to write prescriptions without a legitimate medical purpose and outside the usual course of professional practice.

If you are a practitioner who knowingly or intentionally prescribes or otherwise dispenses controlled substances on behalf of a particular Web site, and if that Web site is not compliant with the requirements of the Act and the implementing regulations, you are dispensing controlled substances by means of the Internet in a manner not authorized by the Act. Doing so constitutes a violation of 21 U.S.C. 841(h)(1) and may result in criminal prosecution and/or administrative proceedings to revoke your DEA registration.

If you are a practitioner who writes prescriptions on behalf of a particular Web site, your name must appear prominently on that Web site. (This requirement helps to distinguish those Web sites that are compliant with the Act and the implementing regulations from those that are not compliant.) If such Web site is operated on behalf of a group medical practice in which you participate, it is sufficient that your name (along with the names of your fellow practitioners who write prescriptions on behalf of the site) are posted in a visible and clear manner on the homepage of the Web site, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage.^[41] It is anticipated that most every medical office in the United States that currently has a Web site is already in compliance with this provision as it is common practice for such Web sites to post in such manner the names of the practitioners. If, however, you are one of what is anticipated to be a very small number of practitioners who, beginning on or after April 13, 2009 (the effective date of the Ryan Haight Act), writes prescriptions on behalf of a Web site of a DEA-registered pharmacy, the Act requires the Web site to post additional information identifying you. Specifically, the Web site must post the following information in a visible and clear manner on the homepage of each Internet site it operates, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage: “The name, address, telephone number, professional degree, and States of licensure of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof.” ^[42]

How does a practitioner know whether he is writing prescriptions that are issued through, or on behalf of, a Web site? In some cases, this will be obvious to the practitioner. For example, if a practitioner is approached by a person who offers to pay the practitioner to write prescriptions for “patients” who will be routed to the practitioner through the Web site, the practitioner has actual knowledge that he is being asked to dispense controlled substances by means of the Internet within the meaning of the Act. (As most practitioners would immediately recognize, such a proposal is inherently suspect, since the legitimate practice of medicine is not structured around writing prescriptions for controlled substances and being compensated primarily or exclusively on that basis.) ^[43] The profitability of rogue Internet Web sites typically depends on the ability of the criminal facilitator who operates the site to recruit unscrupulous practitioners to enter into such types of contractual arrangements.

In response to the enactment of the Ryan Haight Act, some rogue Web sites have come up with the following approach in an effort to circumvent the new law. Drug-seeking customers who visit the rogue Web site are told that they should arrange a visit with one of the practitioners affiliated with the site to satisfy the Act's requirement of an in-person medical evaluation. Once the practitioner has gone through the motions of conducting what purports to be a medical evaluation, the “patient” will be permitted to purchase controlled substances (or prescriptions therefor) through the Web site in perpetuity, without having to see the practitioner in person again. A practitioner who might be inclined to consider entering into a contract with the operator of such a rogue Web site should consider that, in all likelihood, such an operation violates the Act—despite its purported compliance with the in-person medical evaluation requirement. For one, under the Act, the only persons who may operate Web sites through which controlled substances are prescribed or otherwise dispensed are DEA-registered practitioners (pharmacies and nonpharmacy practitioners).^[44] Thus, a non-DEA registrant may not operate a Web site that constitutes an “online pharmacy” within the meaning of the Act (which includes, for example, a Web site that sells prescriptions for controlled substances or fills such prescriptions). Second, even in the unlikely event that the person who is offering the practitioner the opportunity to participate in such a Web site is a DEA registrant with the appropriate registration allowing it to dispense controlled substances by means of the Internet, the prescribing practitioner must ensure that the Web site properly displays his name and the other required information in the manner required by the Act and the implementing regulations.

Further, even if the Web site has the required registration and posts the required information, it is difficult to envision how a conscientious practitioner could enter into a contract to provide medical evaluations and/or issue prescriptions through referrals from a Web site that is designed primarily to attract and supply persons seeking to obtain controlled substances for other than legitimate medical purposes (rather than to provide legitimate medical care to patients without a predetermined goal of selling drugs or prescriptions). Indeed, a Web site that operates in such a manner—such as by offering to arrange in-person “medical evaluations” for the purpose of allowing customers to obtain controlled substances through the Web site indefinitely thereafter—should be viewed by a practitioner as a “red flag” indicating that diversion of controlled substances to illicit channels might be occurring.

The same considerations apply if you, as a practitioner, are offered a contract or otherwise presented with a proposal to write prescriptions to customers of a Web site based on reviewing online questionnaires or faxed “medical records” or by answering telephone calls through a phone number affiliated with the Web site. If these customers are being referred to you through the Web site or at the request of the owner or operator of the Web site, any prescriptions for controlled substances you write for the customers constitute “dispensing by means of the Internet” within the meaning of the Act. As explained above, a practitioner who dispenses a controlled substance by means of the Internet in violation of the Act may be held criminally liable under 21 U.S.C. 841(h)(1) if he did so knowingly or intentionally—which can be proven by showing that either (i) the practitioner had actual knowledge of the violation or (ii) the practitioner deliberately disregarded facts that would have led a reasonable practitioner to be highly suspicious about the likelihood of such a violation. In addition, any transgression of the Act may result in administrative action to revoke the practitioner's DEA registration.

With the foregoing considerations in mind, DEA again emphasizes that the current practices of the overwhelming majority of practitioners in the United States do not involve delivering, distributing, or dispensing controlled substances by means of the Internet. This means that the vast majority of practitioners need not alter their current practices to conform to the requirements of the Ryan Haight Act.

C. Additional Specific Information for DEA-Registered Distributors

The ability of rogue Internet sites to supply controlled substances to persons who seek them for other than legitimate medical purposes depends largely on the existence of DEA-registered pharmacies that are willing to supply the customers of these Web sites. As the data provided at the beginning of this preamble illustrates, it takes only a relatively small number of unscrupulous pharmacies, working in conjunction with rogue Internet sites, to supply enormous quantities of hydrocodone and other controlled substances, causing a substantial detrimental effect on the public health and welfare. Accordingly, if you are a DEA-registered distributor, it is critical that you are vigilant in taking appropriate steps to avoid supplying the pharmacies that service the customers of rogue Web sites.

In a September 27, 2006, letter to all DEA-registered distributors, DEA specified a number of pharmacy practices that might be indicative of diversion. While all the considerations set forth in that letter remain valid today, the enactment of the Ryan Haight Act should further assist distributors in avoiding distributing controlled substances to pharmacies that are supplying customers of rogue Web sites. For example, if you are a distributor and you know that a pharmacy is soliciting buyers of controlled substances via the Internet, or is associated with an Internet site that solicits orders for controlled substances,^[45] you are on notice that the pharmacy is an “online pharmacy” under the Act. If so, it is unlawful, per se, for the pharmacy to be operating without a modified DEA registration authorizing it to operate as an online pharmacy. Under such circumstances, if the pharmacy does not have such a modified registration, it would be unlawful for you as a distributor to supply the pharmacy with controlled substances. (The pharmacy's Certificate of Registration will reflect its status as an online pharmacy in its business activity designation.) ^[46]

Even if you do not have actual knowledge that the pharmacy is operating through a Web site, if the pharmacy's buying patterns are of a volume or otherwise of a nature indicating a reasonable likelihood that the pharmacy is supplying customers of a Web site or otherwise engaging in practices that render it an online pharmacy within the meaning of the Ryan Haight Act, the sound course of action for the distributor would be to confirm that the pharmacy is complying with the Act prior to supplying the pharmacy with controlled substances.^[47]

D. Additional Specific Information for Consumers

The full title of the Ryan Haight Act is “The Ryan Haight Online Pharmacy Consumer Protection Act of 2008.” As this title implies, a primary purpose of the Act is to protect consumers by ensuring that only legitimate, law-abiding Web sites dispense controlled substances via the Internet. One of the ways the Act achieves this goal is by allowing only pharmacies who are properly registered with DEA to operate Web sites through which prescriptions for controlled substances are filled. In addition, the Act and the implementing regulations require such Web sites to fully disclose to consumers certain basic information, such as the name and telephone number of the pharmacist-in-charge, a list of the states in which the pharmacy is authorized to dispense controlled substances, the names of any practitioners who have a contractual relationship to issue prescriptions for controlled substances through referrals from the Web site, and a certification that the Web site is acting in compliance with the Act. Accordingly, the Act should make it easier for consumers to differentiate between legitimate and illegitimate Web sites that sell controlled substances.

One strong indicator of an unlawful Web site is that it lets you as a customer pick the controlled substance and then charges you a fee to arrange for a practitioner to prescribe that controlled substance to you. An unlawful Web site might further offer to refund all or part of your fee if you are not sold the prescription for your drug of choice. A Web site that engages in such practices is virtually certain to be a rogue Web site that is not operating in compliance with the Ryan Haight Act.

Consumers should also be aware that the Act also prohibits certain advertising practices relating to the types of criminal activities the Act is designed to eliminate. Specifically, the Act makes it a crime to place an advertisement on the Internet that offers to sell a controlled substance or a prescription for a controlled substance in a manner that would be illegal (in violation of the CSA or the CSIEA).^[48] For example, the Act makes it unlawful to place an advertisement on the Internet stating: “Hydrocodone! No Prescription Needed!” (or words to the same effect). This provision of the Act also makes it illegal to place an advertisement on the Internet that refers consumers to a Web site that is operating in violation of the Act (such as one that sells controlled substances but is not properly registered with DEA). This ban on illegal Internet advertising also applies to unsolicited commercial e-mail, which is sometimes referred to as “spam” or “junk e-mail.” Consequently, beginning on April 13, 2009, if you as a consumer receive an unsolicited commercial e-mail with the subject line: “Hydrocodone! No Prescription Needed!,” the sender of that e-mail has violated the law. Likewise, if you receive spam directing you to a Web site that is operating in violation of the Act, the spammer has also violated the Act.

Consumers should also be wary of rogue Web sites falsely claiming that they are allowed to sell controlled substances without complying with the Ryan Haight Act because they are located outside the United States. Any such claim is flatly wrong. In fact, as explained earlier in this preamble, it has always been unlawful under the Controlled Substances Import and Export Act (CSIEA) (even prior to the Ryan Haight Act) to ship controlled substances into the United States for personal medical use. Any person who ships controlled substances from abroad into the United States illegally, along with the person in the United States who places the order for such a shipment and thereby causes the controlled substances to be illegally shipped into the United States, violates the CSIEA and is subject to criminal prosecution.^[49]

VIII. Regulatory Changes To Implement the Ryan Haight Act

This section summarizes the regulations contained in this Interim Rule, which are being issued to implement the Ryan Haight Act. This section should be viewed as merely a summary provided for the convenience of the reader, and any registrant subject to the Ryan Haight Act should read carefully the entire preamble along with the text of the regulations being issued here.

A. Notification and Registration

As provided in 21 CFR 1304.40, all online pharmacies that intend to dispense controlled substances by means of the Internet must provide DEA with a thirty-day notice of such intent. To do this, they must apply for a modified registration via the online application process. The Administrator must approve the application for a modified registration and issue a Certificate of Registration indicating the modification before the online pharmacy may engage in any activity of an online pharmacy. As discussed previously in the preamble, the only entities that may apply for a modified registration are registrants with a valid Certificate of Registration (DEA Form 223) as a pharmacy. If you are not registered with DEA as a pharmacy and you intend to dispense controlled substances by means of the Internet, you must first apply for registration as a pharmacy in accordance with 21 CFR 1301.13. Upon receipt of the Certificate of Registration as a pharmacy from the Administrator, you may then apply for a modification to your registration to operate as an online pharmacy.

The Administrator may deny an application for such registration or such modification of registration if the Administrator determines that the issuance of such registration or modification would be inconsistent with the public interest. 21 CFR 1301.19. The same statutory criteria used in determining the public interest for purposes of evaluating an application for registration—those found in 21 U.S.C. 823(f)—will be used in evaluating an application for a modification of registration to operate as an online pharmacy.

An online pharmacy must make a separate thirty-day advance notice to the State boards of pharmacy in each State in which it intends to offer to sell, deliver, distribute, or dispense controlled substances.

In accordance with 21 U.S.C. 831, the following information must be included in the notification to DEA that must be submitted as part of the Application for Modification of Registration:

• All Internet pharmacy site disclosure information as listed below.
• A certification, under penalty of perjury, that the Internet pharmacy site disclosure information that is posted on the online pharmacy's Web site is true and accurate.
• A listing of all Internet Web site addresses (also known as the uniform resource locator or URL) owned by the online pharmacy to conduct its online business activities.
• A certification that the online pharmacy will notify DEA of any changes to any of its Internet Web site addresses (URLs) at least 30 days in advance.
• The name, address, telephone number, professional degree, DEA registration numbers and States of licensure of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof.
• The DEA registration numbers of each pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of the online pharmacy.

Pharmacies that intend to dispense controlled substances by means of the Internet must apply for the modified registration using the online registration process by going to the DEA Office of Diversion Control Web site at http://www.deadiversion.usdoj.gov. Registrants must positively acknowledge and agree to several statements during the application process. These acknowledgements will be printed on the registrant's receipt of registration for future reference. The following is a list of the acknowledgments with which a registrant must agree as part of the online pharmacy application process:

1. Pursuant to section 309(e) of the Controlled Substances Act (21 U.S.C. 829(e)), you, as an online pharmacy, acknowledge and agree that no controlled substance that is a prescription drug may be delivered, distributed, or dispensed by means of the Internet without a valid prescription.

2. Pursuant to 21 CFR 1306.09, you, as an online pharmacy, acknowledge and agree that a prescription for a controlled substance may only be dispensed by means of the Internet by a pharmacist, acting in the usual course of his professional practice, and employed in a pharmacy whose registration has been modified to authorize it to operate as an online pharmacy.

3. You, as an online pharmacy, acknowledge and understand that you may not engage in any activity of an online pharmacy, as defined in 21 CFR 1300.04(h), until your application for modified registration to operate as an online pharmacy is granted and a Certificate of Registration indicating the modification is issued by the Administrator (DEA Form 223).

4. You, as an online pharmacy, understand that the Administrator may deny an application for a modification of registration if the Administrator determines that the issuance of such modification would be inconsistent with the public interest. In determining the public interest, the Administrator considers the factors listed in 21 U.S.C. 823(f).

5. Pursuant to section 303(f) of the Controlled Substances Act (21 U.S.C. 823(f)), you, as an online pharmacy, certify that you are authorized by the appropriate state authority(ies) to modify your existing DEA registration to authorize you to dispense schedule II-V controlled substances by means of the Internet.

6. Pursuant to 21 CFR 1301.19, if you, as an online pharmacy, cease to dispense controlled substances by means of the Internet, you acknowledge and agree that you shall promptly notify the Administrator by modifying your registration to reflect the appropriate business activity.

7. Pursuant to section 307(d) of the Controlled Substances Act (21 U.S.C. 827(d)), you, as an online pharmacy, understand you are required to report the dispensing of controlled substances by means of the Internet to the Administrator in the manner set forth in 21 CFR 1304.55. This report will include the total quantity of each controlled substance that the pharmacy dispenses each calendar month. The report must be submitted to DEA electronically via online reporting, electronic file upload, or other means as approved by DEA. The monthly report shall include the date range of the reporting period, the NDC, and total quantity of each controlled substance dispensed. Reporting shall include all controlled substances dispensed via Internet transactions, mail-order, face-to-face transactions, or any other means. The report shall be submitted to DEA by the 15th day of the following month. (For threshold amounts refer to DEA Web site: http://www.deadiversion.usdoj.gov.)

8. Pursuant to section 311(a) of the Controlled Substances Act (21 U.S.C. 831(a)), you, as an online pharmacy, agree to display at all times on your homepage, in a visible and clear manner, a statement that your online pharmacy complies with the requirements of section 311 of the Act (21 U.S.C. 831) with respect to the delivery or sale or offer for sale of controlled substances.

9. Pursuant to section 311(b) of the Controlled Substances Act (21 U.S.C. 831(b)), you, as an online pharmacy, acknowledge and agree to comply with the requirements of State law concerning the licensure of pharmacies in each State from which and to which you, deliver, distribute, or dispense, or offer to deliver, distribute, or dispense controlled substances by means of the Internet.

10. Pursuant to section 311(c) of the Controlled Substances Act (21 U.S.C. 831(c)), you, as an online pharmacy, acknowledge and agree to post the following Internet Pharmacy Site Disclosure information in a visible and clear manner on the homepage of each Internet site you operate, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage:

(A) The name and address of the pharmacy as it appears on the pharmacy's DEA Certificate of Registration.

(B) The pharmacy's telephone number and e-mail address.

(C) Name of pharmacist-in charge, professional degree, States of licensure, and telephone number.

(D) List of States in which the pharmacy is licensed to dispense controlled substances.

(E) Certification that the pharmacy is registered to deliver, distribute, or dispense by means of the Internet, controlled substances.

(F) Practitioner's name, address, telephone number, professional degree, and States of licensure of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof.

(G) The following statement: “This online pharmacy is obligated to comply fully with the Controlled Substances Act and DEA regulations. As part of this obligation, this online pharmacy has obtained a modified DEA registration authorizing it to operate as an online pharmacy. In addition, this online pharmacy will only dispense a controlled substance to a person who has a valid prescription issued for a legitimate medical purpose based upon a medical relationship with a prescribing practitioner. This includes at least one prior in-person medical evaluation in accordance with section 309 of the Controlled Substances Act (21 U.S.C. 829), or a medical evaluation via telemedicine in accordance with section 102(54) of the Controlled Substances Act (21 U.S.C. 802(54)).”

11. Pursuant to section 311(d)(2)(A) of the Controlled Substances Act (21 U.S.C. 831(d)(2)(A)), you, as an online pharmacy, certify that the Internet Pharmacy Site Disclosure information disclosed on your Web site, under penalty of perjury, is true and accurate.

12. Pursuant to section 311(d) of the Controlled Substances Act (21 U.S.C. 831(d)), you, as an online pharmacy, acknowledge and agree that, thirty days prior to offering a controlled substance for sale, delivery, distribution, or dispensing, you must notify the Administrator and the State boards of pharmacy in any States in which you offer to sell, deliver, distribute, or dispense controlled substances. By fully completing and submitting this application, you will satisfy this requirement with respect to notifying the Administrator. However, you must separately notify the State boards of pharmacy as required by the Act. You understand that subsequent online pharmacy registration renewals will be accomplished by the online process and the appropriate renewal fee will apply.

13. You understand that in accordance with section 401(h) of the Act (21 U.S.C. 841(h)), as of April 13, 2009, it is unlawful for any online pharmacy to deliver, distribute, or dispense a controlled substance by means of the Internet unless such online pharmacy is validly registered with a modification of DEA registration authorizing the dispensing of controlled substances by means of the internet.

14. Pursuant to section 311(e) of the Controlled Substances Act (21 U.S.C. 831(e)), you, as an online pharmacy, understand and agree that on and after the date you apply for a modified registration, you will display on your homepage, in the manner described in 21 CFR 1304.40(d), a declaration that you have made the required notifications to the DEA Administrator.

There is no fee to apply for modification of an existing DEA registration. When a pharmacy makes application for a modified registration to conduct business as an online pharmacy, and the Administrator issues a Certificate of Registration for the modification to that pharmacy, the registration period continues from the date of the pharmacy's prior registration. When, however, an online pharmacy makes application to renew the modified registration, it will incur the appropriate application fee and, if approved, a new three-year registration period will begin.

An online pharmacy that seeks to discontinue its modification of registration authorizing it to dispense controlled substances by means of the Internet, but continue its business activity as a pharmacy, must so notify the Administrator through the online application process for modification of registration. The Administrator will issue a new Certificate of Registration to the pharmacy based on the changes made to its registration. Once the registration has been changed back to its previous status (retail pharmacy), the pharmacy is no longer authorized to dispense controlled substances by means of the Internet.

B. Licensure

An online pharmacy must comply with the requirements of State law concerning the licensure of pharmacies in each State from which it, and in each State to which it, delivers, distributes, or dispenses or offers to deliver, distribute, or dispense controlled substances by means of the Internet. 21 U.S.C. 831(b).

C. Online Pharmacy Internet Site Disclosure

Online pharmacies have a continual obligation under the Ryan Haight Act to make certain disclosures on their Web sites required by the Act. Consequently, an online pharmacy must maintain an active Web site to post the required information, statements, and other disclosures required by the Act and update the information as necessary.

D. Statement of Compliance

The Act requires that each online pharmacy shall display, at all times and in a visible and clear manner, on its homepage a statement that it complies with the requirements of section 311(a) of the Act (21 U.S.C. 831(a)) with respect to the delivery or sale or offer for sale of controlled substances. This requirement is reiterated in the regulations being issued here in 21 CFR 1304.45(a). This regulation does not require specific language to be used for this statement, but the statement must include the name of the pharmacy as displayed on its DEA Certificate of Registration and clearly state that the pharmacy is in compliance with 21 U.S.C. 831(a). The following is an example of a statement a pharmacy may post on its Web site that would meet the requirements of this provision:

XYZ Pharmacy is in full compliance with the requirements of section 311(a) of the Controlled Substances Act (21 U.S.C. 831(a)) with respect to the delivery or sale or offer for sale of controlled substances.

E. Internet Pharmacy Site Disclosure Information

The Act ^[50] and the regulations being issued here (21 CFR 1304.45(b)) require that each online pharmacy shall post in a visible and clear manner on the homepage of each Internet Web site it operates, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage, the following information for each pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of, that Web site:

• The name and address of the pharmacy as it appears on the pharmacy's DEA Certificate of Registration.
• The pharmacy's telephone number and active business e-mail address.
• The name, professional degree, and States of licensure of the pharmacist-in-charge, and a telephone number at which the pharmacist-in-charge can be contacted.
• A list of the States in which the pharmacy is licensed to dispense controlled substances.
• A certification that the pharmacy is registered under 21 CFR Part 1301 to deliver, distribute, or dispense controlled substances by means of the Internet.
• The name, address, telephone number, professional degree, and States of licensure with State license number of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof.
• The following statement: “This online pharmacy is obligated to comply fully with the Controlled Substances Act and DEA regulations. As part of this obligation, this online pharmacy has obtained a modified DEA registration authorizing it to operate as an online pharmacy. In addition, this online pharmacy will only dispense a controlled substance to a person who has a valid prescription issued for a legitimate medical purpose based upon a medical relationship with a prescribing practitioner. This includes at least one prior in-person medical evaluation in accordance with section 309 of the Controlled Substances Act (21 U.S.C. 829) or a medical evaluation via telemedicine in accordance with section 102(54) of the Controlled Substances Act (21 U.S.C. 802(54)).”

The following is a hypothetical example of a statement that would comply with all of the requirements of 21 CFR 1304.45(b) (assuming the assertions were true):

XYZ Pharmacy,

1 Main Street,

[City, State, zip code],

[Area code and telephone number],

[e-mail].

John H. Smith, R.Ph., Pharmacist-in-Charge, licensed in State.

The XYZ Pharmacy is in full compliance with the requirements of section 311(a) of the Controlled Substances Act (21 U.S.C. 831(a)). XYZ Pharmacy is licensed in [State(s)] to dispense controlled substances. The pharmacist-in-charge may be contacted at the above telephone number. XYZ Pharmacy does not have any contractual relationships with any practitioner to provide medical evaluations or issue prescriptions for controlled substances through referrals from this Web site or at the request of the owner or operator of this Web site, or any employee or agent thereof. This online pharmacy is obligated to comply fully with the Controlled Substances Act and DEA regulations. As part of this obligation, this online pharmacy has obtained a modified DEA registration authorizing it to operate as an online pharmacy. In addition, this online pharmacy will only dispense a controlled substance to a person who has a valid prescription issued for a legitimate medical purpose based upon a medical relationship with a prescribing practitioner. This includes at least one prior in-person medical evaluation in accordance with section 309 of the Controlled Substances Act (21 U.S.C. 829) or a medical evaluation via telemedicine in accordance with section 102(54) of the Controlled Substances Act (21 U.S.C. 802(54)).

F. Declaration of Compliance

On and after the date on which an online pharmacy makes the notification and applies for a modified registration, it must display, on the homepage of its Web site, a declaration that it has made such notification/application to the Administrator.

G. Reporting

The Act requires,^[51] and 21 CFR 1304.55 reiterates, that each online pharmacy must submit a monthly report to the Administrator of the total quantity of each controlled substance it has dispensed the previous calendar month. This report will be due on or before the 15th day of the following month. The report must include the total amount of such dispensing by any means, including all controlled substances dispensed via Internet transactions, mail-order transactions, face-to-face transactions, or any other means. It is not required that the online pharmacy identify the means of the dispensing in its report. The report is required for every month in which the total amount of dispensing of controlled substances by the pharmacy is either (i) over 100 prescriptions filled or (ii) 5,000 or more dosage units dispensed of all controlled substances combined.

Each online pharmacy shall report a negative response to the Administrator if, during a given calendar month, its total quantity of dispensing of controlled substances falls below both of the thresholds listed above.

The reporting required by online pharmacies under 21 CFR 1304.55 must be submitted to the Administrator electronically via online reporting, electronic file upload, or other means as approved by DEA. The report shall identify controlled substances by National Drug Code (NDC) number assigned to the product under the National Drug Code System of the Food and Drug Administration.

Online pharmacies must maintain these records for at least two years. The information must be easily accessible and available for inspection by authorized DEA employees.

A pharmacy that has changed its registration status from that of an online pharmacy back to a retail pharmacy remains responsible for submitting reports in accordance with § 1304.55 of this chapter with respect to any controlled substances that it dispensed while it was registered with a modification authorizing it to operate as an online pharmacy.

IX. Section-by-Section Discussion of the Interim Final Rule

In part 1300, new § 1300.04, containing definitions relating to the dispensing of controlled substances by means of the Internet, is added. These definitions are from the definitions contained in the Ryan Haight Act. This includes definitions of the terms “covering practitioner,” “deliver, distribute or dispense by means of the Internet,” “filling new prescriptions for controlled substances in Schedule III, IV, or V,” “homepage,” “in-person medical evaluation,” “Internet,” “online pharmacy,” “practice of telemedicine,” “refilling prescriptions for controlled substances in Schedule III, IV, or V,” “valid prescription,” and the temporary definition of “practice of telemedicine.” However, please note that the regulations being issued here expand upon the exceptions to the definition of an online pharmacy contained in the Act. Specifically, as discussed above, the regulations add two exceptions to the definition of “online pharmacy”: One relating to electronic prescriptions for controlled substances issued in a manner permitted by the DEA regulations and another relating to the utilization by retail pharmacies of automated dispensing systems at long term care facilities in a manner permitted by the DEA regulations.

In part 1301 (registration of manufacturers, distributors, and dispensers of controlled substances), new § 1301.11(b) restates the requirements of the Act that any person falling within the definition of an online pharmacy must be validly registered with a modification authorizing it to operate as an online pharmacy and that only pharmacies registered under 21 U.S.C. 823(f) may apply for such modification.

To address the modification of registration as an online pharmacy, the table in § 1301.13(e)(1) is amended in “(iv) Dispensing or instructing” to specify the application for an online pharmacy. A comment has been added in the “Coincident activities allowed” column to explain that an online pharmacy may perform the activities of both a retail and online pharmacy.

New § 1301.19 (special requirements for online pharmacies) provides in paragraphs (a), (c), and (f) that a pharmacy must request a modification of its registration authorizing it to operate as an online pharmacy by completing the online application process. This section also provides, consistent with the Ryan Haight Act, that a pharmacy registrant may not operate as an online pharmacy until the DEA Administrator grants the modified registration. Paragraph (b) requires, consistent with the Ryan Haight Act, that an online pharmacy must comply with the pharmacy license requirements of not only the State where it is located, but also of any State to which it delivers, distributes, or dispenses controlled substances. Paragraph (d) requires a pharmacy that seeks to discontinue its authorization to operate as an online pharmacy to modify its registration to reflect this change in its business activity.

Section 1301.52, which addresses termination of registrations, is revised to include modification of registration within the meaning of the Act.

Four new sections are added to 21 CFR part 1304 (records and reports of registrants) to implement the reporting requirements of the Ryan Haight Act for online pharmacies, and to specify the information the Act requires to be posted on an online pharmacy's Web site. New § 1304.40(a) requires online pharmacies to notify the Administrator and State boards of pharmacy 30 days before offering to fill prescriptions for controlled substances. Notification to the DEA Administrator will be made by applying for a modification of DEA registration. Paragraph (b) of § 1304.40 contains a list of items that must be included in the notification. Paragraph (c) requires online pharmacies in operation at the time the Ryan Haight Act becomes effective (April 13, 2009) to make this notification by May 13, 2009, but this paragraph also makes clear that, as of April 13, 2009, it is unlawful for any person to operate as an online pharmacy unless it has obtained from DEA a modification of its registration authorizing it to do so. In addition, paragraph (d) requires that on and after an online pharmacy makes notification under this section, it shall display a declaration that it has done so. Under § 1304.40(e), an online pharmacy must notify the Administrator of any changes to the information submitted in its notification thirty days prior to the change.

New section 1304.45 specifies the data elements required to be posted on the Web site of online pharmacies in a visible and clear manner, as provided in the Act.

To identify Web sites that are operating solely on behalf of DEA-registered nonpharmacy practitioners who are acting within the scope of their registrations (and thereby exempt from the definition of an online pharmacy), new § 1304.50 requires such Web sites that dispense controlled substances by means of the Internet to display in a visible and clear manner a list of those DEA-registered nonpharmacy practitioners affiliated with the Web site.

New § 1304.55 implements the requirement of the Act that each online pharmacy make a monthly report to DEA stating the total quantity of each controlled substance the pharmacy has dispensed the previous calendar month. This report must include not only the transactions made through the online pharmacy, but also any that the pharmacy made through mail order, face-to-face, or any other transaction when the pharmacy's total dispensing of controlled substances meets or exceeds the monthly threshold of either 100 prescriptions filled or 5,000 or more dosage units dispensed. Online pharmacies that do not meet this threshold in a given month are required to so notify DEA.

In part 1306 (prescriptions), new § 1306.09 includes requirements for prescriptions that track the requirements of the Act. Paragraph (a) specifies that no controlled substance may be delivered, distributed, or dispensed by means of the Internet without a valid prescription (using the definition of a valid prescription contained in the Act). Also consistent with the Act, paragraph (b) provides that a prescription may only be filled by a pharmacy whose registration has been modified as specified in the Act. Finally, paragraph (c) applies to online pharmacies the requirements of sections 1306.15 and 1306.25 regarding transfers of prescriptions between pharmacies.

X. Regulatory Certifications

A. Administrative Procedure Act

The Administrative Procedure Act (APA) generally requires agencies to publish a notice of proposed rulemaking and allow for a period of public comment prior to implementing new rules. The APA also provides, however, that agencies can be excepted from these requirements “when the agency for good cause finds (and incorporates the finding and a brief statement of reasons therefor in the rules issued) that notice and public procedure thereon are impracticable, unnecessary, or contrary to the public interest.” 5 U.S.C. 553(b)(B). DEA has concluded that “good cause” exists to promulgate this rule as an Interim Final Rule rather than a proposed rule for the following reasons.

As explained above, the Ryan Haight Act contains the following provision specifically addressing the issuance of interim rules to implement the Act:

The [DEA Administrator] may promulgate and enforce any rules, regulations, and procedures which may be necessary and appropriate for the efficient execution of functions under this Act or the amendments made by this Act, and, with the concurrence of the Secretary of Health and Human Services where this Act or the amendments made by this Act so provide, promulgate any interim rules necessary for the implementation of this Act or the amendments made by this Act, prior to its effective date.^[52]

It is evident from the foregoing provision that Congress envisioned that DEA might need to issue regulations on an interim basis to implement the Ryan Haight Act prior to the Act's effective date (April 13, 2009). This provision indicates that, given the 180 days between enactment of the Act and its effective date, Congress recognized it could be impracticable for DEA to complete notice-and-comment rulemaking within a time frame that would have allowed for regulations to become effective prior to the effective date of the Act. Similarly, this provision indicates that Congress believed it would be contrary to the public interest to delay the promulgation of regulations in a manner that would prevent implementation of the Act upon its effective date. Delaying the effective date of the regulations past the effective date of the Act would also be confusing to the public and would frustrate the intent of Congress to have the new provisions of the Act take effect on April 13, 2009. Accordingly, the rules published here are effective immediately while at the same time the agency is seeking public comment on them.

Under the APA, 5 U.S.C. 553(d), agencies must generally provide a 30-day delayed effective date for final rules. An agency may dispense with the 30-day delayed effective date requirement “for good cause found and published with the rule.” 5 U.S.C. 553(d)(3). For the reasons just discussed, DEA concludes that such good cause exists to justify an immediate effective date. In addition to the reasons provided above, DEA had to make this rule effective immediately to have in place regulatory procedures that will allow legitimate pharmacies that wish to conduct activity as an “online pharmacy” to do so upon the effective date of the Act. With the immediate effective date of these regulations, pharmacies may, sufficiently in advance of the effective date of the Act, submit applications to modify their registrations as required by the Act.

B. Executive Order 12866

The Deputy Administrator certifies that this rulemaking has been drafted in accordance with the principles in Executive Order 12866 Section 1(b). It has been determined that this is “a significant regulatory action.” Therefore, this action has been reviewed by the Office of Management and Budget. As discussed above, this action is largely codifying statutory provisions and involves limited agency discretion.

Costs. It should be noted that the costs identified here are costs associated with activities that online pharmacies are obligated to carry out to comply with the statutory requirements of the Ryan Haight Act. The regulatory provisions listed here are those which carry forward the statutory requirements mandated by the Act.

Pharmacies with existing online operations and those that wish to begin dispensing controlled substances by means of the Internet must apply to DEA to modify their registrations. Section 1304.40 requires notification to DEA. The application for modification of registration includes the notifications required by the Act; application to DEA is made with an online form. The information required is straightforward: Names, addresses, telephone numbers, the name, professional degree, and telephone number of the pharmacist-in-charge, and required certifications.

Assembly of this information and putting it in the online form in the proper manner can be accomplished by a pharmacist (Standard Occupational Code (SOC) 29-1051). The information required for the online pharmacy Web site is largely the same as that required for the notification, so the pharmacist's work will also provide the information needed for the Web site.

Since an online pharmacy must have a Web site to operate, the initial cost of setting up the Web site is not a cost of the rule. (In fact, it is now commonplace for even small retail establishments to have Web sites.) The only cost is that of entering the required information and certifications on the site. Given that the site is already, or must be, in place, DEA estimates that such revisions will be relatively minor in nature. Modification of the Web site to include the required information will, however, require additional work—work that requires some technical expertise with computer systems and programs, including Web sites. DEA expects that a computer support specialist (SOC 15-1041) will be required for this work.

Completion of the online application for modification of registration will require fifteen minutes of the pharmacist's time and half an hour of the computer support specialist's time to update the Web site with the required information. The Web site will require ongoing maintenance as information changes. This will require one hour per year of the computer-support specialist's time.

Section 1304.55 requires online pharmacies to report to DEA the total quantity of each controlled substance that the pharmacy has dispensed each calendar month. The report must include the total quantity of such dispensing by any means, regardless of whether the controlled substances are dispensed by means of the Internet. Such reporting is required for every calendar month in which the total quantity of controlled substances dispensed by the pharmacy meets or exceeds one of the following thresholds: 100 or more prescriptions for controlled substances filled; or 5,000 or more dosage units dispensed of all controlled substances combined.

Such reporting is not required now from pharmacies of any kind. Based upon common industry practice, DEA believes that virtually all pharmacies will have internal electronic recordkeeping systems which will include the necessary data. A computer programmer (SOC 15-1021) will be required to set up a system that will extract the required data from existing records and put it in a form that meets the rule and is suitable for transmission to DEA. DEA estimates that the initial set-up will take two hours of the programmer's time. DEA expects that maintenance of the reporting system will not entail any increment in cost beyond the initial work of setting up the system. DEA further assumes that a pharmacist will require ten minutes per month to transmit the monthly report to DEA.

Table 1 presents initial unit costs.

Table 1—Initial Unit Costs

Requirement	Unit time (in hours)	Hourly wage, fully loaded	Unit cost
Application for Modification of Registration (pharmacist)	0.25	$104.40	$26.10
Revision of pharmacy Web site (computer support specialist)	0.5	47.79	23.89
Establishing reporting system (programmer)	2.0	75.96	151.93
Total			201.92

Annual ongoing costs for online pharmacies comprise the cost of filing monthly reports with DEA and revising the pharmacy Web site as needed to comply with the requirements of the Act. As noted previously, DEA assumes that Web site modifications can be handled by a computer support specialist. DEA assumes one hour per year of a computer support specialist's time for those modifications and two hours a year for the pharmacist to file the reports. Table 2 presents annual ongoing costs for online pharmacies.

Table 2—Annual Ongoing Costs

Requirement	Unit time (in hours)	Hourly wage, fully loaded	Unit cost
Pharmacy Web site modification (computer support specialist)	1.0	$47.79	$47.79
Sending monthly report to DEA (pharmacist)	2.0	104.40	208.80
Total			256.59

Total costs. To estimate total costs, it is necessary to estimate the number of firms that will seek to modify their registration to that of online pharmacies. DEA estimates that 250 pharmacies will initially apply for such modification of registration. It is also necessary to estimate the number of pharmacies that will apply for such modification of registration in the future. DEA estimates that there would be a moderate number of registrants applying to modify their registrations in the two years after the first year as some other pharmacies find advantage in an online presence. After that, DEA estimates the number of pharmacies applying to modify their registrations will decline steadily, as few pharmacies will find benefit. Each year it is expected that a number of registrants applying to modify their registrations may drop out for various reasons. The total number of pharmacies in the United States has been declining. Data from the Economic Census indicate that the number of retail pharmacies fell at an annual rate of 1.7 percent from 1998 through 2006.^[53] DEA estimates that the number of online pharmacy registrants will decline at a slightly faster rate, because some pharmacies will drop their online pharmacy registrations but stay in business as retail pharmacies. DEA estimates an annual attrition rate of 2.0 percent for online pharmacies. The table below shows the estimated number of online pharmacy registrations and registrants in operation, year by year.

Table 3—Online Pharmacy Registrants

	Registrations	Registrants in operation
Year 1	250	250
Year 2	30	275
Year 3	25	295
Year 4	20	309
Year 5	20	322
Year 6	10	326
Year 7	10	329
Year 8	10	333
Year 9	9	335
Year 10	8	337
Year 11	7	337
Year 12	6	336
Year 13	5	334
Year 14	5	333
Year 15	5	331

To obtain undiscounted costs, year by year, the unit cost estimates—$201.92 for initial start-up, $256.59 for ongoing costs—are applied, respectively, to the number of online pharmacy registrations and the number of operating registrants in each year. The results are shown in the following table.

Table 4—Undiscounted Total Costs

	Initial	Ongoing	Total
Year 1	$50,480	$64,147	$114,628
Year 2	6,058	70,562	76,620
Year 3	5,048	75,566	80,614
Year 4	4,038	79,186	83,225
Year 5	4,038	82,734	86,773
Year 6	2,019	83,646	85,665
Year 7	2,019	84,538	86,558
Year 8	2,019	85,414	87,433
Year 9	1,817	86,015	87,832
Year 10	1,615	86,347	87,962
Year 11	1,413	86,416	87,830
Year 12	1,212	86,227	87,439
Year 13	1,010	85,786	86,795
Year 14	1,010	85,353	86,363
Year 15	1,010	84,929	85,939

Table 5 shows the present value and annualized cost at 7.0 percent and 3.0 percent discount rates, over fifteen years.

Table 5—Present Value and Annualized Costs

	7.0 Percent	3.0 Percent
Year 1	$114,628	$114,628
Year 2	71,607	74,388
Year 3	70,411	75,986
Year 4	67,936	76,162
Year 5	66,198	77,096
Year 6	61,078	73,895
Year 7	57,677	72,491
Year 8	54,449	71,091
Year 9	51,119	69,335
Year 10	47,846	67,416
Year 11	44,648	65,354
Year 12	41,542	63,168
Year 13	38,538	60,877
Year 14	35,837	58,809
Year 15	33,328	56,816
Total	856,843	1,077,511
Annualized	94,077	90,259

The costs are relatively modest; the annualized sum of the present values is less than $100,000 at both discount rates. Further, Table 4 shows that the undiscounted annual cost never exceeds $100,000 after the first year with its relatively large number of registrations.

Benefits. The Ryan Haight Online Pharmacy Consumer Protection Act is designed to save lives by reducing deaths from drug overdoses and otherwise lessen the detrimental consequences of pharmaceutical controlled substance abuse by restricting the ability of rogue Internet pharmacies to illegally divert dangerous controlled substance prescription drugs to millions of people, including teens, without valid prescriptions issued under a legitimate physician's care.^[54] The regulations promulgated based on this legislation will address the “wide-open channel of distribution” that currently exists for prescription controlled substances sold over the Internet, which represents an “easy availability [that] has enormous implications for public health, particularly the health of our children.^[55] A key provision of this law, the requirement for practitioners to conduct at least one in-person medical evaluation of the patient before they prescribe a prescription for a controlled substance, is a major step toward combating the use of the Internet to facilitate illegal sales of pharmaceutical controlled substances. Also, requiring online pharmacies to post the required site disclosure information, certifications, and other information on their homepage provides consumers with enhanced tools to determine the legitimacy of the online pharmacy.

C. Regulatory Flexibility Act

The Deputy Administrator hereby certifies that this rulemaking has been drafted in accordance with the Regulatory Flexibility Act (RFA) (5 U.S.C. 601-612). The RFA applies to a rule that is published by the agency as a notice of proposed rulemaking. As explained above, the Ryan Haight Act expressly contemplates that DEA will issue interim rules under the “good cause” provision of the APA as the agency deems necessary to implement the Act prior to its effective date (April 13, 2009). Thus, Congress has expressly granted DEA authority to issue regulations to implement the Act that become effective immediately without the requirement of first seeking public comment through a notice of proposed rulemaking. Consequently, the requirements of the RFA do not apply to this rule.

It also should be noted that only a limited portion of the regulatory text being issued here is subject to modification following the comment period as the bulk of the regulatory text is taken verbatim from, and mandated by, the Ryan Haight Act. DEA is seeking public comment with respect to those parts of the regulatory text about which the agency has discretion.

Although the RFA does not apply to this Interim Final Rule, DEA has reviewed the potential impacts. The rule is likely to affect a substantial number of small entities, but DEA does not believe that it will have a significant economic impact on small entities.

DEA is uncertain which pharmacies will apply to modify their registrations to that of online pharmacies. While it is possible that such applicants will be a mixture of independent pharmacies and chains, DEA believes it unlikely that many chain pharmacies will fall within the definition of an online pharmacy and thereby need to apply for the modified registration. As discussed previously, the Ryan Haight Act contains several exceptions to the definition of “online pharmacy” including the exception set forth in 21 U.S.C. 802(52)(B)(viii) that excludes from the definition of an online pharmacy those DEA-registered pharmacies “whose dispensing of controlled substances via the Internet consists solely of * * * (I) refilling prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(55)] or (II) filling new prescriptions for controlled substances in schedule III, IV, or V, as defined in paragraph [21 U.S.C. 802(56)].” Also, the regulations being issued here exempt from the definition of online pharmacy any registered pharmacy “whose delivery, distribution, or dispensing of controlled substances by means of the Internet consists solely of * * * filling prescriptions that were electronically prescribed in a manner authorized by this chapter and otherwise in compliance with the Act.” Given these exceptions to the definition of an online pharmacy, DEA anticipates that the overwhelming majority of pharmacies in the United States, if they follow their current practices, will not, as of April 13, 2009, fall within the definition of an online pharmacy.

Further, as DEA stated previously, as long as the pharmacist meets his corresponding responsibility to take reasonable steps under the circumstances of the dispensing of any particular prescription to ensure that the prescription was issued in accordance with the requirements of the Ryan Haight Act (as well as all other applicable requirements of the CSA and DEA regulations), the pharmacist will not be held strictly liable for filling a prescription that he could not reasonably have known was issued by means of the Internet. Thus, it is absolutely unnecessary for a pharmacy to apply for a modification of its DEA registration authorizing it to operate as an online pharmacy for the sole purpose of ensuring that it does not—despite the exercise of sound professional judgment—inadvertently fill a prescription that was issued by means of the Internet.

The small-business size standard for retail pharmacies is annual revenue of $7.0 million.^[56] From the 2002 Economic Census, there are data on revenue of pharmacies by revenue class. The class with the lowest average revenue is pharmacies with sales of less than $250,000 per year. Average revenue for this group is $132,000. Table 6 shows Small Business Administration standards for these and larger firms that dispense controlled substances.

Table 6—SBA Definitions of Small Entities

Industry description	NAICS code	Small business definition (sales in $)
Pharmacies and Drug Stores	446110	7,000,000
Supermarkets and Other Grocery Stores	445110	27,000,000
Discount Department Stores	452112	27,000,000
Warehouse Clubs and Supercenters	452910	25,000,000
Mail Order Houses	454113	25,000,000

DEA estimates the annual cost of compliance with the Interim Final Rule for an individual pharmacy is the annualized sum of the present value of a 15-year stream of ongoing costs and the initial start-up cost. Table 7 shows these values for 7.0 percent and 3.0 percent discount rates. The result is annualized cost of about $275. Even for the smallest pharmacies, that is not a significant economic impact.^[57]

Table 7—Annualized Cost for an Online Pharmacy

	7.0 Percent	3.0 Percent
Annual Ongoing Cost	$256.59	$256.59
PV of Ongoing Cost	2,337.00	3,063.15
Initial Cost	201.92	201.92
Sum of PV and Initial Cost	2,538.92	3,265.07
Annualized Cost	278.76	273.50

D. Paperwork Reduction Act

The Ryan Haight Act requires pharmacies that dispense controlled substances by means of the Internet to obtain a modification of their existing DEA registration to that of an online pharmacy (21 U.S.C. 823(f), 21 CFR 1301.11). To address this, DEA is revising its existing information collection, “Application for Registration (DEA Form 224), Application for Registration Renewal (DEA Form 224a), Affidavit for Chain Renewal (DEA Form 224b)” [information collection 1117-0014] to add an Application for Modification of Registration for Online Pharmacies (DEA Form 224c). This form will be completed online by pharmacies requesting to modify their registrations to that of an online pharmacy.

Application for modification of registration—The application for modification of registration will require an online pharmacy applicant to provide to DEA certain information, as discussed above. For purposes of this reporting, DEA believes that the Internet Pharmacy Site Disclosure information that applicants must supply will be immediately obtainable with minimal effort. Information such as the pharmacy's name, registration number, and contact information will be populated by DEA on the online form completed by the pharmacy applicant. Contact information for the pharmacist-in-charge should be readily available. State licensure information should be readily available as well.

DEA believes that very few legitimate pharmacies (i.e., those that comply with the law) will be affiliated with more than one Web site. Nor does it seem likely that such pharmacies will have contractual relationships with practitioners to issue prescriptions for controlled substances through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof. Thus, DEA believes that the reporting of this type of information should be minimal, if at all, and will not be burdensome for the vast majority of the limited number of pharmacies likely to apply to modify their registrations.

DEA believes that the certifications required of the online pharmacies are straightforward and can easily be included on pharmacies' Web sites and reported to DEA. DEA has provided examples of those certifications for potential use by pharmacies applying to modify their registrations.

While the new reporting and application requirements will request information not previously requested by DEA (as the Ryan Haight Act mandates), DEA believes that much of the information required to be provided as part of the applications is readily available and retrievable, thus limiting the impact of the burden for completion of this application.

DEA estimates that 250 pharmacies will apply to modify their registrations to that of online pharmacies. DEA estimates that it will take a pharmacy 15 minutes (0.25 hours) to complete an Application for Modification of Registration for Online Pharmacies (DEA Form 224c), and that it will take an online pharmacy 15 minutes (0.25 hours) to renew its online pharmacy registration. DEA notes that the Application for Modification of Registration for Online Pharmacies (DEA Form 224c) is completed and submitted online through the DEA Office of Diversion Control Web site. Because those applying for a modification of registration must already be registered with DEA, the overall number of respondents will not change. To account for the new requirement, the number of respondents using DEA-224a has been reduced by the 250 respondents DEA estimates will apply for a modification using DEA-224c. As a result, the total burden for DEA-224a has been reduced by 16.7 hours. DEA estimates that DEA-224c will have a total of 62.5 burden hours for an overall increase of 46.2 burden hours.

Reports of dispensing of controlled substances by online pharmacies—The Ryan Haight Act requires those pharmacies with modified registrations to report certain information regarding their dispensing of controlled substances to DEA. Specifically, online pharmacies are required to report to DEA the total quantity of controlled substances that the pharmacy has dispensed during each calendar month by any means, regardless of whether the controlled substances are dispensed by means of the Internet. Reports are required to be filed by every pharmacy that, at any time during a calendar month, holds a modified registration authorizing it to operate as an online pharmacy, regardless of whether the online pharmacy dispenses any controlled substances by means of the Internet during the month. Reports are required when the total quantity of controlled substances dispensed meets or exceeds either 100 or more prescriptions for controlled substances filled, or 5,000 or more dosage units dispensed of all controlled substances combined, in the calendar month for which reporting is required. If a pharmacy fills fewer than 100 prescriptions for controlled substances, and dispenses fewer than 5,000 dosage units of all controlled substances combined, in the calendar month for which reporting is required, a negative response indicating that reporting is not required must be received by DEA. Thus, each online pharmacy will report every month to DEA, either by providing actual dispensing information or by providing a negative response.

DEA believes that, of the limited number of pharmacies expected to be subject to the reporting requirement of the Act, few are likely to submit negative responses. It is reasonable to assume that online pharmacies subject to the reporting requirement will either fill 100 or more prescriptions for controlled substances, or 5,000 or more dosage units of all controlled substances combined, in any calendar month. Therefore, DEA has assumed for purposes of these estimates that all online pharmacies will report dispensing information to DEA.

DEA estimates that 250 online pharmacies will file monthly reports with DEA regarding their dispensing of controlled substances. DEA estimates that it will take each pharmacy 10 minutes to file this report.

The Department of Justice, Drug Enforcement Administration, has submitted the following information collection requests to the Office of Management and Budget (OMB) for review and clearance in accordance with the review procedures of the Paperwork Reduction Act of 1995. The information collections are published to obtain comments from the public and affected agencies.

All comments and suggestions, or questions regarding additional information, to include obtaining a copy of the proposed information collection instrument with instructions, should be directed to Mark W. Caverly, Chief, Liaison and Policy Section, Office of Diversion Control, Drug Enforcement Administration, 8701 Morrissette Drive, Springfield, VA 22152, Telephone [phone].

Written comments and suggestions from the public and affected agencies concerning the required collections of information are encouraged. Your comments on the information collection-related aspects of this rule should address one or more of the following four points:

• Evaluate whether the collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility.
• Evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used.
• Recommendations to enhance the quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.

Overview of information collection 1117-0014:

(1) Type of Information Collection: Revision of a currently approved collection.

(2) Title of the Form/Collection:

Application for Registration (DEA Form 224);

Application for Registration Renewal (DEA Form 224a);

Affidavit for Chain Renewal (DEA Form 224b);

Application for Modification of Registration for Online Pharmacies (DEA Form 224c)

(3) Agency form number, if any, and the applicable component of the Department of Justice sponsoring the collection:

Form Number: DEA Form 224, 224a, 224b, 224c;

Component: Office of Diversion Control, Drug Enforcement Administration, U.S. Department of Justice.

(4) Affected public who will be asked or required to respond, as well as a brief abstract:

Primary: Business or other for-profit.

Other: Not-for-Profit Institutions; State, Local or Tribal Government.

Abstract: All firms and individuals who distribute or dispense controlled substances must register with the DEA under the Controlled Substances Act. Pharmacies wishing to be online pharmacies must apply to modify their registrations. Such registration is mandatory under the law and needed for control measures over legal handlers of controlled substances and to monitor their activities.

(5) An estimate of the total number of respondents and the amount of time estimated for an average respondent to respond is provided in the table below. Please note that the number of respondents using DEA-224a has been reduced by the 250 respondents that DEA estimates will apply for a modification using DEA-224c. Because those applying for a modification of registration must be currently registered with DEA, the overall number of respondents will not increase. The total response time has increased by 46.2 hours as a result of the 11 additional minutes it is estimated it will take each respondent to complete DEA-224c as compared to DEA-224a.

Form	Completed	Number of respondents	Time per response	Total (in hours)
Application for Registration (DEA-224)	Paper	12,094	0.2 hours (12 minutes)	2,418.8
Application for Registration (DEA-224)	Electronic	59,283	0.13 hours (8 minutes)	7,904.4
Application for Registration Renewal (DEA-224a)	Paper	159,678	0.2 hours (12 minutes)	31,935.6
Application for Registration Renewal (DEA-224a)	Electronic	209,285	0.06 hours (4 minutes)	13,952.3
Affidavit for Chain Renewals (DEA-224b)	Electronic	16	5 hours	80
Application for Modification of Registration for Online Pharmacies (DEA-224c)	Electronic	250	0.25 hours (15 minutes)	62.5
Total		440,606		56,354

(6) An estimate of the total public burden (in hours) associated with the collection: It is estimated that this collection will create a burden of 56,354 annual burden hours.

Overview of new information collection:

(1) Type of Information Collection: New collection.

(2) Title of the Form/Collection: Reports of dispensing of controlled substances by online pharmacies.

(3) Agency form number, if any, and the applicable component of the Department of Justice sponsoring the collection:

Form Number: DEA Form 332.

Component: Office of Diversion Control, Drug Enforcement Administration, U.S. Department of Justice.

(4) Affected public who will be asked or required to respond, as well as a brief abstract:

Primary: Business or other for-profit.

Other: Not-for-Profit Institutions; State, Local or Tribal Government.

Abstract: The Controlled Substances Act (21 U.S.C. 827(d)(2)) requires online pharmacies to report to DEA the total quantity of controlled substances that the pharmacy has dispensed during each calendar month by any means, regardless of whether the controlled substances are dispensed by means of the Internet. Reports are required to be filed by every pharmacy that, at any time during a calendar month, holds a modified registration authorizing it to operate as an online pharmacy, regardless of whether the online pharmacy dispenses any controlled substances by means of the Internet during the month. Such reporting is mandated by the Ryan Haight Act and permits DEA to monitor the dispensing of controlled substances by online pharmacies.

(5) An estimate of the total number of respondents and the amount of time estimated for an average respondent to respond: It is estimated that 250 persons respond to this collection at 0.25 hours per person per month, for a total of 750 hours per year.

(6) An estimate of the total public burden (in hours) associated with the collection: 750 annual burden hours.

If additional information is required contact: Lynn Bryant, Department Clearance Officer, Information Management and Security Staff, Justice Management Division, Department of Justice, Patrick Henry Building, Suite 1600, 601 D Street, NW., Washington, DC 20530.

E. Executive Order 12988

This regulation meets the applicable standards set forth in sections 3(a) and 3(b)(2) of Executive Order 12988, Civil Justice Reform.

F. Executive Order 13132

This rulemaking does not impose enforcement responsibilities on any State; nor does it diminish the power of any State to enforce its own laws. Accordingly, this rulemaking does not have federalism implications warranting the application of Executive Order 13132.

G. Unfunded Mandates Reform Act of 1995

This rule will not result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $120,000,000 or more (adjusted for inflation) in any one year, and will not significantly or uniquely affect small governments. Therefore, no actions were deemed necessary under the provisions of the Unfunded Mandates Reform Act of 1995.

H. Congressional Review Act

This rule is not a major rule as defined by section 804 of the Small Business Regulatory Enforcement Fairness Act of 1996 (Congressional Review Act). This rule will not result in an annual effect on the economy of $100,000,000 or more; a major increase in costs or prices; or significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of United States-based companies to compete with foreign-based companies in domestic and export markets. Further, as noted above in the Administrative Procedure Act certification, DEA has concluded that “good cause” exists to promulgate this rule as an Interim Final Rule effective as set forth in the DATES section of the preamble pursuant to 5 U.S.C. 553(b)(B) and 5 U.S.C. 553(d)(3).

List of Subjects

21 CFR Part 1300

• Chemicals
• Drug traffic control

21 CFR Part 1301

• Administrative practice and procedure
• Drug traffic control
• Security measures

21 CFR Part 1304

• Drug traffic control
• Reporting and recordkeeping requirements

21 CFR Part 1306

• Drug traffic control
• Prescription drugs

For the reasons set out above, 21 CFR parts 1300, 1301, 1304, and 1306 are amended as follows:

PART 1300—DEFINITIONS

1. The authority citation for part 1300 is revised to read as follows:

Authority: 21 U.S.C. 802, 821, 829, 871(b), 951, 958(f).

2. Section 1300.04 is added to read as follows:

§ 1300.04

Definitions relating to the dispensing of controlled substances by means of the Internet.

(a) Any term not defined in this part or elsewhere in this chapter shall have the definition set forth in sections 102 and 309 of the Act (21 U.S.C. 802, 829).

(b) The term covering practitioner means, with respect to a patient, a practitioner who conducts a medical evaluation (other than an in-person medical evaluation) at the request of a practitioner who:

(1) Has conducted at least one in-person medical evaluation of the patient or an evaluation of the patient through the practice of telemedicine, within the previous 24 months; and

(2) Is temporarily unavailable to conduct the evaluation of the patient.

(c) The term deliver, distribute, or dispense by means of the Internet refers, respectively, to any delivery, distribution, or dispensing of a controlled substance that is caused or facilitated by means of the Internet.

(d) The term filling new prescriptions for controlled substances in Schedule III, IV, or V means filling a prescription for an individual for a controlled substance in Schedule III, IV, or V, if:

(1) The pharmacy dispensing that prescription has previously dispensed to the patient a controlled substance other than by means of the Internet and pursuant to the valid prescription of a practitioner that meets the applicable requirements of subsections (b) and (c) of section 309 of the Act (21 U.S.C. 829) and §§ 1306.21 and 1306.22 of this chapter (for purposes of this definition, such a prescription shall be referred to as the “original prescription”);

(2) The pharmacy contacts the practitioner who issued the original prescription at the request of that individual to determine whether the practitioner will authorize the issuance of a new prescription for that individual for the controlled substance described in paragraph (d)(1) of this section (i.e., the same controlled substance as described in paragraph (d)(1)); and

(3) The practitioner, acting in the usual course of professional practice, determines there is a legitimate medical purpose for the issuance of the new prescription.

(e) The term homepage means the opening or main page or screen of the Web site of an online pharmacy that is viewable on the Internet.

(f) The term in-person medical evaluation means a medical evaluation that is conducted with the patient in the physical presence of the practitioner, without regard to whether portions of the evaluation are conducted by other health professionals. Nothing in this paragraph shall be construed to imply that one in-person medical evaluation demonstrates that a prescription has been issued for a legitimate medical purpose within the usual course of professional practice.

(g) The term Internet means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected worldwide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocol to such protocol, to communicate information of all kinds by wire or radio.

(h) The term online pharmacy means a person, entity, or Internet site, whether in the United States or abroad, that knowingly or intentionally delivers, distributes, or dispenses, or offers or attempts to deliver, distribute, or dispense, a controlled substance by means of the Internet. The term includes, but is not limited to, a pharmacy that has obtained a modification of its registration pursuant to §§ 1301.13 and 1301.19 of this chapter that currently authorizes it to dispense controlled substances by means of the Internet, regardless of whether the pharmacy is currently dispensing controlled substances by means of the Internet. The term does not include:

(1) Manufacturers or distributors registered under subsection (a), (b), (d), or (e) of section 303 of the Act (21 U.S.C. 823(a), (b), (d), or (e)) (§ 1301.13 of this chapter) who do not dispense controlled substances to an unregistered individual or entity;

(2) Nonpharmacy practitioners who are registered under section 303(f) of the Act (21 U.S.C. 823(f)) (§ 1301.13 of this chapter) and whose activities are authorized by that registration;

(3) Any hospital or other medical facility that is operated by an agency of the United States (including the Armed Forces), provided such hospital or other facility is registered under section 303(f) of the Act (21 U.S.C. 823(f)) (§ 1301.13 of this chapter);

(4) A health care facility owned or operated by an Indian tribe or tribal organization, only to the extent such facility is carrying out a contract or compact under the Indian Self-Determination and Education Assistance Act;

(5) Any agent or employee of any hospital or facility referred to in paragraph (h)(3) or (h)(4) of this section, provided such agent or employee is lawfully acting in the usual course of business or employment, and within the scope of the official duties of such agent or employee, with such hospital or facility, and, with respect to agents or employees of health care facilities specified in paragraph (h)(4) of this section, only to the extent such individuals are furnishing services pursuant to the contracts or compacts described in such paragraph;

(6) Mere advertisements that do not attempt to facilitate an actual transaction involving a controlled substance;

(7) A person, entity, or Internet site that is not in the United States and does not facilitate the delivery, distribution, or dispensing of a controlled substance by means of the Internet to any person in the United States;

(8) A pharmacy registered under section 303(f) of the Act (21 U.S.C. 823(f)) (§ 1301.13 of this chapter) whose dispensing of controlled substances via the Internet consists solely of:

(i) Refilling prescriptions for controlled substances in Schedule III, IV, or V, as defined in paragraph (k) of this section; or

(ii) Filling new prescriptions for controlled substances in Schedule III, IV, or V, as defined in paragraph (d) of this section;

(9)(i) Any registered pharmacy whose delivery, distribution, or dispensing of controlled substances by means of the Internet consists solely of filling prescriptions that were electronically prescribed in a manner authorized by this chapter and otherwise in compliance with the Act.

(ii) A registered pharmacy will be deemed to meet this exception if, in view of all of its activities other than those referred to in paragraph (h)(9)(i) of this section, it would fall outside the definition of an online pharmacy; or

(10)(i) Any registered pharmacy whose delivery, distribution, or dispensing of controlled substances by means of the Internet consists solely of the transmission of prescription information between a pharmacy and an automated dispensing system located in a long term care facility when the registration of the automated dispensing system is held by that pharmacy as described in §§ 1301.17 and 1301.27 and the pharmacy is otherwise complying with this chapter.

(ii) A registered pharmacy will be deemed to meet this exception if, in view of all of its activities other than those referred to in paragraph (h)(10)(i) of this section, it would fall outside the definition of an online pharmacy.

(i) Effective January 15, 2010, the term practice of telemedicine means the practice of medicine in accordance with applicable Federal and State laws by a practitioner (other than a pharmacist) who is at a location remote from the patient and is communicating with the patient, or health care professional who is treating the patient, using a telecommunications system referred to in section 1834(m) of the Social Security Act (42 U.S.C. 1395m(m)), which practice falls within a category listed in the following paragraphs (i)(1) through (7):

(1) Treatment in a hospital or clinic. The practice of telemedicine is being conducted while the patient is being treated by, and physically located in, a hospital or clinic registered under section 303(f) of the Act (21 U.S.C. 823(f)) by a practitioner acting in the usual course of professional practice, who is acting in accordance with applicable State law, and who is registered under section 303(f) of the Act (21 U.S.C. 823(f)) in the State in which the patient is located, unless the practitioner:

(i) Is exempted from such registration in all States under section 302(d) of the Act (21 U.S.C. 822(d); or

(ii) Is an employee or contractor of the Department of Veterans Affairs who is acting in the scope of such employment or contract, and registered under section 303(f) of the Act (21 U.S.C. 823(f)) in any State or is utilizing the registration of a hospital or clinic operated by the Department of Veterans Affairs registered under section 303(f);

(2) Treatment in the physical presence of a practitioner. The practice of telemedicine is being conducted while the patient is being treated by, and in the physical presence of, a practitioner acting in the usual course of professional practice, who is acting in accordance with applicable State law, and who is registered under section 303(f) of the Act (21 U.S.C. 823(f)) in the State in which the patient is located, unless the practitioner:

(i) Is exempted from such registration in all States under section 302(d) of the Act (21 U.S.C. 822(d)); or

(ii) Is an employee or contractor of the Department of Veterans Affairs who is acting in the scope of such employment or contract, and registered under section 303(f) of the Act (21 U.S.C. 823(f)) in any State or is using the registration of a hospital or clinic operated by the Department of Veterans Affairs registered under section 303(f);

(3) Indian Health Service or tribal organization. The practice of telemedicine is being conducted by a practitioner who is an employee or contractor of the Indian Health Service, or is working for an Indian tribe or tribal organization under its contract or compact with the Indian Health Service under the Indian Self-Determination and Education Assistance Act; who is acting within the scope of the employment, contract, or compact; and who is designated as an Internet Eligible Controlled Substances Provider by the Secretary of Health and Human Services under section 311(g)(2) of the Act (21 U.S.C. 831(g)(2));

(4) Public health emergency declared by the Secretary of Health and Human Services. The practice of telemedicine is being conducted during a public health emergency declared by the Secretary of Health and Human Services under section 319 of the Public Health Service Act (42 U.S.C. 247d), and involves patients located in such areas, and such controlled substances, as the Secretary of Health and Human Services, with the concurrence of the Administrator, designates, provided that such designation shall not be subject to the procedures prescribed by the Administrative Procedure Act (5 U.S.C. 551-559 and 701-706);

(5) Special registration. The practice of telemedicine is being conducted by a practitioner who has obtained from the Administrator a special registration under section 311(h) of the Act (21 U.S.C. 831(h));

(6) Department of Veterans Affairs medical emergency. The practice of telemedicine is being conducted:

(i) In a medical emergency situation:

(A) That prevents the patient from being in the physical presence of a practitioner registered under section 303(f) of the Act (21 U.S.C. 823(f)) who is an employee or contractor of the Veterans Health Administration acting in the usual course of business and employment and within the scope of the official duties or contract of that employee or contractor;

(B) That prevents the patient from being physically present at a hospital or clinic operated by the Department of Veterans Affairs registered under section 303(f) of the Act (21 U.S.C. 823(f));

(C) During which the primary care practitioner of the patient or a practitioner otherwise practicing telemedicine within the meaning of this paragraph is unable to provide care or consultation; and

(D) That requires immediate intervention by a health care practitioner using controlled substances to prevent what the practitioner reasonably believes in good faith will be imminent and serious clinical consequences, such as further injury or death; and

(ii) By a practitioner that:

(A) Is an employee or contractor of the Veterans Health Administration acting within the scope of that employment or contract;

(B) Is registered under section 303(f) of the Act (21 U.S.C. 823(f)) in any State or is utilizing the registration of a hospital or clinic operated by the Department of Veterans Affairs registered under section 303(f); and

(C) Issues a controlled substance prescription in this emergency context that is limited to a maximum of a five-day supply which may not be extended or refilled; or

(7) Other circumstances specified by regulation. The practice of telemedicine is being conducted under any other circumstances that the Administrator and the Secretary of Health and Human Services have jointly, by regulation, determined to be consistent with effective controls against diversion and otherwise consistent with the public health and safety.

(j) Temporary definition of practice of telemedicine. Prior to January 15, 2010, or as otherwise specified by regulation prior to that date, instead of the definition in paragraph (i), the term practice of telemedicine means the practice of medicine in accordance with applicable Federal and State laws by a practitioner (as that term is defined in section 102 of the Act (21 U.S.C. 802)) (other than a pharmacist) who is at a location remote from the patient and is communicating with the patient, or health care professional who is treating the patient, using a telecommunications system referred to in section 1834(m) of the Social Security Act (42 U.S.C. 1395m(m)), if the practitioner is using an interactive telecommunications system that satisfies the requirements of section 410.78(a)(3) of title 42, Code of Federal Regulations.

(k) The term refilling prescriptions for controlled substances in Schedule III, IV, or V:

(1) Means the dispensing of a controlled substance in Schedule III, IV, or V in accordance with refill instructions issued by a practitioner as part of a valid prescription that meets the requirements of subsections (b) and (c) of section 309 of the Act (21 U.S.C. 829) and §§ 1306.21 and 1306.22 of this chapter, as appropriate; and

(2) Does not include the issuance of a new prescription to an individual for a controlled substance that individual was previously prescribed.

(l)(1) The term valid prescription means a prescription that is issued for a legitimate medical purpose in the usual course of professional practice by:

(i) A practitioner who has conducted at least one in-person medical evaluation of the patient; or

(ii) A covering practitioner.

(2) Nothing in this paragraph (l) shall be construed to imply that one in-person medical evaluation demonstrates that a prescription has been issued for a legitimate medical purpose within the usual course of professional practice.

PART 1301—REGISTRATION OF MANUFACTURERS, DISTRIBUTORS, AND DISPENSERS OF CONTROLLED SUBSTANCES

3. The authority citation for part 1301 is revised to read as follows:

Authority: 21 U.S.C. 821, 822, 823, 824, 831, 871(b), 875, 877, 886a, 951, 952, 953, 956, 957, 958.

4. Section 1301.11 is revised to read as follows:

§ 1301.11

Persons required to register; requirement of modification of registration authorizing activity as an online pharmacy.

(a) Every person who manufactures, distributes, dispenses, imports, or exports any controlled substance or who proposes to engage in the manufacture, distribution, dispensing, importation or exportation of any controlled substance shall obtain a registration unless exempted by law or pursuant to §§ 1301.22 through 1301.26. Except as provided in paragraph (b) of this section, only persons actually engaged in such activities are required to obtain a registration; related or affiliated persons who are not engaged in such activities are not required to be registered. (For example, a stockholder or parent corporation of a corporation manufacturing controlled substances is not required to obtain a registration.)

(b) As provided in sections 303(f) and 401(h) of the Act (21 U.S.C. 823(f) and 841(h)), it is unlawful for any person who falls within the definition of “online pharmacy” (as set forth in section 102(52) of the Act (21 U.S.C. 802(52)) and § 1300.04(h) of this chapter) to deliver, distribute, or dispense a controlled substance by means of the Internet if such person is not validly registered with a modification of such registration authorizing such activity (unless such person is exempt from such modified registration requirement under the Act or this chapter). The Act further provides that the Administrator may only issue such modification of registration to a person who is registered as a pharmacy under section 303(f) of the Act (21 U.S.C. 823(f)). Accordingly, any pharmacy registered pursuant to § 1301.13 of this part that falls within the definition of an online pharmacy and proposes to dispense controlled substances by means of the Internet must obtain a modification of its registration authorizing such activity following the submission of an application in accordance with § 1301.19 of this part. This requirement does not apply to a registered pharmacy that does not fall within the definition of an online pharmacy set forth in § 1300.04(h). Under the Act, persons other than registered pharmacies are not eligible to obtain such a modification of registration but remain liable under section 401(h) of the Act (21 U.S.C. 841(h)) if they deliver, distribute, or dispense a controlled substance while acting as an online pharmacy without being validly registered with a modification authorizing such activity.

5. Section 1301.13 is amended by revising paragraph (e)(1)(iv) and (e)(3) to read as follows:

§ 1301.13

Application for registration; time for application; expiration date; registration for independent activities; application forms, fees, contents and signature; coincident activities.

* * * * *

(e) * * *

(1) * * *

Business activity	Controlled substances	DEA application forms	Application fee (dollars)	Registration period (years)	Coincident activities allowed
*         *         *         *         *         *         *
(iv) Dispensing or instructing (includes Practitioner, Hospital/Clinic, Retail Pharmacy, Online Pharmacy, Central fill pharmacy, Teaching Institution)	Schedules II-V	New—224 Renewal—224a Online Pharmacy—224c	551 551	3	May conduct research and instructional activities with those substances for which registration was granted, except that a mid-level practitioner may conduct such research only to the extent expressly authorized under State statute. A pharmacist may manufacture an aqueous or oleaginous solution or solid dosage form containing a narcotic controlled substance in Schedule II-V in a proportion not exceeding 20% of the complete solution, compound or mixture. A retail pharmacy may perform central fill pharmacy activities. An online pharmacy may perform activities of retail pharmacy as well as online pharmacy activities.
*         *         *         *         *         *         *

* * * * *

(3) Registrants will receive renewal notifications approximately 60 days prior to the registration expiration date. DEA Forms 224a, 225a, and 363a may be mailed, as applicable, to registrants; if any registered person does not receive such notification within 45 days before the registration expiration date, the registrant must promptly give notice of such fact and may request such forms by writing to the Registration Section, Drug Enforcement Administration.

* * * * *

6. Section 1301.19 is added to read as follows:

§ 1301.19

Special requirements for online pharmacies.

(a) A pharmacy that has been issued a registration under § 1301.13 may request that the Administrator modify its registration to authorize the pharmacy to dispense controlled substances by means of the Internet as an online pharmacy. The Administrator may deny an application for a modification of registration if the Administrator determines that the issuance of a modification would be inconsistent with the public interest. In determining the public interest, the Administrator will consider the factors listed in section 303(f) of the Act (21 U.S.C. 823(f)).

(b) Each online pharmacy shall comply with the requirements of State law concerning licensure of pharmacies in each State from which it, and in each State to which it, delivers, distributes, or dispenses, or offers to deliver, distribute, or dispense controlled substances by means of the Internet.

(c) Application for a modified registration authorizing the dispensing of controlled substances by means of the Internet will be made by an online application process as specified in § 1301.13 of this part. Subsequent online pharmacy registration renewals will be accomplished by an online process.

(d) A pharmacy that seeks to discontinue its modification of registration authorizing it to dispense controlled substances by means of the Internet as an online pharmacy (but continue its business activity as a non-online pharmacy) shall so notify the Administrator by requesting to modify its registration to reflect the appropriate business activity. Once the registration has been so changed, the pharmacy may no longer dispense controlled substances by means of the Internet. A pharmacy that has so changed its registration status back to that of a non-online pharmacy remains responsible for submitting reports in accordance with § 1304.55 of this chapter with respect to any controlled substances that it dispensed while it was registered with a modification authorizing it to operate as an online pharmacy.

(e) Registrants applying for modified registrations under this section must comply with notification and reporting requirements set forth in §§ 1304.40, 1304.45, 1304.50, and 1304.55 of this chapter.

(f) No person (including a registrant) required to obtain a modification of a registration under §§ 1301.11(b) and 1301.13 of this part authorizing it to operate as an online pharmacy may engage in any activity for which such modification of registration is required until the application for such modified registration is granted and an active Certificate of Registration indicating the modification of the registration has been issued by the Administrator to such person.

7. Section 1301.52 is amended by revising paragraph (a) to read as follows:

§ 1301.52

Termination of registration; transfer of registration; distribution upon discontinuance of business.

(a) Except as provided in paragraph (b) of this section, the registration of any person, and any modifications of that registration, shall terminate if and when such person dies, ceases legal existence, or discontinues business or professional practice. Any registrant who ceases legal existence or discontinues business or professional practice shall notify the Administrator promptly of such fact.

* * * * *

PART 1304—RECORDS AND REPORTS OF REGISTRANTS

8. The authority citation for part 1304 is revised to read as follows:

Authority: 21 U.S.C. 821, 827, 831, 871(b), 958(e), 965, unless otherwise noted.

9. Section 1304.01 is revised to read as follows:

§ 1304.01

Scope of part 1304.

Inventory and other records and reports required under section 307, section 311, or section 1008(e) of the Act (21 U.S.C. 827, 831, and 958(e)) shall be in accordance with, and contain the information required by, those sections and by the sections of this part.

10. An undesignated heading and §§ 1304.40, 1304.45, 1304.50 and 1304.55 are added to read as follows:

Online Pharmacies

1304.40

Notification by online pharmacies.

1304.45

Internet Web site disclosure requirements.

1304.50

Disclosure requirements for Web sites of nonpharmacy practitioners that dispense controlled substances by means of the Internet.

1304.55

Reports by online pharmacies.

Online Pharmacies

§ 1304.40

Notification by online pharmacies.

(a) Thirty days prior to offering a controlled substance for sale, delivery, distribution, or dispensing by means of the Internet, an online pharmacy shall:

(1) Notify the Administrator of its intent to do so by submitting an application for a modified registration in accordance with §§ 1301.13 and 1301.19 of this chapter, with such application containing the information required by this section; and

(2) Notify the State boards of pharmacy in any States in which the online pharmacy offers to sell, deliver, distribute, or dispense controlled substances.

(b) The following information must be included in the notification submitted under paragraph (a) of this section:

(1) The pharmacy's Internet Pharmacy Site Disclosure information required to be posted on the homepage of the online pharmacy's Internet site under section 311(c) of the Act (21 U.S.C. 831(c)) and § 1304.45 of this part.

(2) Certification that the information disclosed on its Internet site under the Internet Pharmacy Site Disclosure is true and accurate. The statement shall be in a form similar to the following: “The above-named pharmacy, a DEA registrant, certifies, under penalty of perjury, that the information contained in this statement is true and accurate.”

(3) Each Internet site address utilized by the online pharmacy and a certification that the online pharmacy shall notify the Administrator of any change in any such Internet address at least 30 days in advance. In the event that a pharmacy delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of, more than one Web site, the pharmacy shall provide, for purposes of complying with this paragraph, the Internet site address of each such site.

(4) The DEA registration numbers of:

(i) Every pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of, each Web site referred to in paragraph (b)(3) of this section; and

(ii) Every practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof.

(c) An online pharmacy that is in operation at the time Public Law 110-425 becomes effective (April 13, 2009) must make the notifications required in this section on or before May 13, 2009. However, in accordance with section 401(h) of the Act (21 U.S.C. 841(h)), as of April 13, 2009, it is unlawful for any online pharmacy to deliver, distribute, or dispense a controlled substance by means of the Internet unless such online pharmacy is validly registered with a modification of such registration authorizing such activity.

(d) On and after the date an online pharmacy makes the notifications required under this section, each online pharmacy shall display on the homepage of its Internet site, a declaration that it has made such notifications to the Administrator in the following form: “In accordance with the Controlled Substances Act and the DEA regulations, this online pharmacy has made the notifications to the DEA Administrator required by 21 U.S.C. 831 and 21 CFR 1304.40.”

(e)(1) Except as provided in paragraphs (e)(2) and (e)(3) of this section, if any of the information required to be submitted under this section changes after the online pharmacy submits the notification to the Administrator, the online pharmacy shall notify the Administrator of the updated information no later than 30 days before the change becomes effective via the online process.

(2) If a pharmacy referred to in paragraph (b)(4)(i) of this section ceases to deliver, distribute, or dispense controlled substances pursuant to orders made on, through, or on behalf of, each Web site referred to in paragraph (b)(3) of this section, the online pharmacy shall notify the Administrator no later than 30 days after the change becomes effective via the online process.

(3) If a practitioner referred to in paragraph (b)(4)(ii) of this section ceases to have a contractual relationship with the online pharmacy, the online pharmacy shall notify the Administrator no later than 30 days after the change becomes effective via the online process.

§ 1304.45

Internet Web site disclosure requirements.

(a) Each online pharmacy shall display, at all times and in a visible and clear manner, on its homepage a statement that it complies with the requirements of section 311 of the Act (21 U.S.C. 831) with respect to the delivery or sale or offer for sale of controlled substances. This statement must include the name of the pharmacy as it appears on the DEA Certificate of Registration.

(b) Each online pharmacy shall clearly display the following information on the homepage of each Internet site it operates, or on a page directly linked to the homepage. If the information is displayed on a page directly linked to the homepage, that link on the homepage must be visible and clear. The information must be displayed for each pharmacy that delivers, distributes, or dispenses controlled substances pursuant to orders made on, through, or on behalf of that Web site.

(1) The name and address of the pharmacy as it appears on the pharmacy's DEA Certificate of Registration.

(2) The pharmacy's telephone number and e-mail address.

(3) The name, professional degree, and States of licensure of the pharmacist-in-charge, and a telephone number at which the pharmacist-in-charge can be contacted.

(4) A list of the States in which the pharmacy is licensed to dispense controlled substances.

(5) A certification that the pharmacy is registered under part 1301 of this chapter with a modification of its registration authorizing it to deliver, distribute, or dispense controlled substances by means of the Internet.

(6) The name, address, telephone number, professional degree, and States of licensure with State license number of any practitioner who has a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances, through referrals from the Web site or at the request of the owner or operator of the Web site, or any employee or agent thereof.

(7) The following statement: “This online pharmacy is obligated to comply fully with the Controlled Substances Act and DEA regulations. As part of this obligation, this online pharmacy has obtained a modified DEA registration authorizing it to operate as an online pharmacy. In addition, this online pharmacy will only dispense a controlled substance to a person who has a valid prescription issued for a legitimate medical purpose based upon a medical relationship with a prescribing practitioner. This includes at least one prior in-person medical evaluation in accordance with section 309 of the Controlled Substances Act (21 U.S.C. 829) or a medical evaluation via telemedicine in accordance with section 102(54) of the Controlled Substances Act (21 U.S.C. 802(54)).”

§ 1304.50

Disclosure requirements for Web sites of nonpharmacy practitioners that dispense controlled substances by means of the Internet.

For a Web site to identify itself as being exempt from the definition of an online pharmacy by virtue of section 102(52)(B)(ii) of the Act (21 U.S.C. 802(52)(B)(ii)) and § 1300.04(h)(2) of this chapter, the Web site shall post in a visible and clear manner on its homepage, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage, a list of the DEA-registered nonpharmacy practitioners who are affiliated with the Web site. Any nonpharmacy practitioner affiliated with such a Web site is responsible for compliance with this section. An institutional practitioner that otherwise complies with the requirements of the Act and this chapter will be deemed to meet the requirements of this section if, in lieu of posting the names of each affiliated individual practitioner, it posts its name (as it appears on its Certificate of Registration) in a visible and clear manner on its homepage and in a manner that identifies itself as being responsible for the operation of the Web site.

§ 1304.55

Reports by online pharmacies.

(a) Each online pharmacy shall report to the Administrator the total quantity of each controlled substance that the pharmacy has dispensed each calendar month. The report must include the total quantity of such dispensing by any means, regardless of whether the controlled substances are dispensed by means of the Internet. Thus, such reporting shall include all controlled substances dispensed via Internet transactions, mail-order transactions, face-to-face transactions, or any other means. However, the pharmacy is not required to describe in its report to the Administrator such means of dispensing. Such reporting is required for every calendar month in which the total quantity of controlled substances dispensed by the pharmacy meets or exceeds one of the following thresholds:

(1) 100 or more prescriptions for controlled substances filled; or

(2) 5,000 or more dosage units dispensed of all controlled substances combined.

(b) Each online pharmacy shall report a negative response if, during a given calendar month, its total dispensing of controlled substances falls below both of the thresholds in paragraph (a) of this section.

(c) The reporting requirements of this section apply to every pharmacy that, at any time during a calendar month, holds a modified registration authorizing it to operate as an online pharmacy, regardless of whether the online pharmacy dispenses any controlled substances by means of the Internet during the month.

(d) Reports will be submitted to DEA electronically via online reporting, electronic file upload, or other means as approved by DEA.

(e) Reports shall be filed every month not later than the fifteenth day of the month succeeding the month for which they are submitted.

(f) An online pharmacy filing a report under paragraph (a) of this section shall utilize the National Drug Code number assigned to the product under the National Drug Code System of the Food and Drug Administration, and indicate the total number of dosage units dispensed for each such National Drug Code number.

(g) Records required to be kept under this section must be kept by the registrant for at least two years from the date of such records. The information shall be readily retrievable from the ordinary business records of the registrant and available for inspection and copying by authorized employees of the Administration.

PART 1306—PRESCRIPTIONS

11. The authority citation for part 1306 is revised to read as follows:

Authority: 21 U.S.C. 821, 829, 831, 871(b), unless otherwise noted.

12. Section 1306.09 is added to read as follows:

§ 1306.09

Prescription requirements for online pharmacies.

(a) No controlled substance that is a prescription drug may be delivered, distributed, or dispensed by means of the Internet without a valid prescription.

(b) In accordance with the Act, it is unlawful for any person to knowingly or intentionally fill a prescription for a controlled substance that was issued in a manner that constitutes dispensing by means of the Internet unless such person is a pharmacist who is acting in the usual course of his professional practice and is acting on behalf of a pharmacy whose registration has been modified under sections 1301.13 and 1301.19 of this chapter to authorize it to operate as an online pharmacy.

(c) Any online pharmacy that participates in the transfer between pharmacies of prescription information must do so in accordance with the requirements of §§ 1306.15 and 1306.25 of this part.

Dated: April 1, 2009.

Michele M. Leonhart,

Deputy Administrator.

Footnotes

1.  Consistent with the CSA itself, the Ryan Haight Act relates solely to controlled substances. Controlled substances are those psychoactive drugs and other substances—including narcotics, stimulants, depressants, hallucinogens, and anabolic steroids—that are placed in one of the five schedules of the CSA due to their potential for abuse and likelihood that they may cause psychological or physical dependence when abused.

Controlled substances constitute only a small percentage of all pharmaceutical drugs. Approximately 10 percent of all drug prescriptions written in the United States are for controlled substances, with the remaining approximately 90 percent of prescriptions being written for noncontrolled substances. The amendments to the CSA made by the Ryan Haight Act, as well as the regulations being issued here, do not apply to noncontrolled substances.

2.  Public Law 110-425, sec. 3(k)(1).

3.  Functions vested in the Attorney General under the CSA have been delegated to the Administrator of DEA. 28 CFR 0.100. Accordingly, in this document, “DEA Administrator” will be used in place of all statutory references to the Attorney General.

4.  Congress's express grant of authority under the Ryan Haight Act to issue interim rules as the DEA Administrator finds necessary to implement the Act prior to its effective date forms the basis for the DEA Administrator's conclusion, as is set forth in Section X below, that “good cause” exists under the Administrative Procedure Act (APA) for the issuance of interim rules (those which take effect immediately on an interim basis prior to the public comment period) because “notice and public procedure thereon are impracticable, * * *[and] contrary to the public interest.” See 5 U.S.C. 553(b)(B).

5.  Available at http://www.oas.samhsa.gov/​nsduh/​2k7nsduh/​2k7Results.pdf.

6.  The study states: “Psychotherapeutics include the nonmedical use of any prescription-type pain relievers, tranquilizers, stimulants, or sedatives. Over-the-counter substances are not included.” Id. at 55.

7.  Id. at 1.

8.  Id.

9.  Compare 2004 National Survey on Drug Use and Health at 1, available at http://www.oas.samhsa.gov/​nsduh/​2k4nsduh/​2k4results.pdf.

10.  See id. at 73.

11.  Id. at 4.

12.  Partnership for a Drug-Free America; Partnership Attitude Tracking Study, Teens in grades 7 through 12, 2005; http://www.drugfree.org/​Files/​Full_​Teen_​Report (page 21).

13.  Id. at 20-21.

14.  Distributors are required to submit certain reports to DEA's ARCOS unit, as provided in 21 CFR 1304.33.

15.  S. Rep. No. 110-521, at 1 (2008).

16.  Id. at 12.

17.  Id. at 5.

18.  Id. at 5-6.

19.  The “business models” described here are not the only ones employed by operators of rogue sites; methods other than those described above have been utilized by those who divert controlled substances by means of the Internet.

20.  The small percentage of pharmacies who have so participated in these rogue Web site schemes have, in many cases, filled extraordinary numbers of prescriptions for controlled substances that dwarf the sales figures of walk-in pharmacies.

21.  21 CFR 1306.04(a); United States v. Moore, 423 U.S. 122 (1975). This requirement has been a part of federal law since the Harrison Narcotic Act of 1914. Id. at 131. For a detailed explanation of the “legitimate medical purpose requirement,” see 71 FR 52716, 52717 (2006 DEA policy statement).

22.  21 U.S.C. 841(h)(1)(A).

23.  As set forth in 1 U.S.C. 7, the word “person” includes “corporations, companies, associations, firms, partnerships, societies, and joint stock companies, as well as individuals.” Consistent therewith, the DEA regulations define “person” to include “any individual, corporation, government or governmental subdivision or agency, business trust, partnership, association, or other legal entity.” 21 CFR 1300.01(b)(34).

24.  The Act exempts certain categories of persons from the application of 21 U.S.C. 841(h)(1), such as Internet service providers and Web hosting services, so long as such persons do not act in concert with others who violate the Act.

25.  Under the CSA, a DEA-registered “distributor” delivers controlled substances to other DEA registrants; it may not administer, dispense, or otherwise deliver controlled substances to patients. See 21 U.S.C. 802(11), 822(a), 822(b), 828(a).

26.  Nearly every pharmaceutical controlled substance is a prescription drug under the Federal Food, Drug, and Cosmetic Act (FDCA). In the very rare instance where a drug contains a controlled substance but may be dispensed under the FDCA without a prescription, the DEA regulations specify the procedures a pharmacist must follow to dispense such a drug lawfully to a purchaser. 21 CFR 1306.26.

27.  For a detailed explanation of the “legitimate medical purpose requirement,” see 71 FR 52716, 52717 (2006 DEA policy statement). See also, 21 CFR 1306.04(a); United States v. Moore, 423 U.S. 122 (1975).

28.  A State may bring a civil action in federal court to enjoin any violation of the Ryan Haight Act—not merely those violations of State law—and to obtain other appropriate legal or equitable relief. 21 U.S.C. 882(c).

29.  In addition, the Act lists the following as an example of a violation of 21 U.S.C. 841(h)(1): “making a material false, fictitious, or fraudulent statement or representation in a notification or declaration under [21 U.S.C. 831(d) or (e)].” 21 U.S.C. 841(h)(2)(E). Such conduct might also subject the offender to liability under 18 U.S.C. 1001(a).

30.  See, e.g., United States v. Rosen, 582 F.2d 1032, 1036 (5th Cir. 1978).

31.  These circumstances are specified in 21 U.S.C. 829(e) and discussed above.

32.  Public Law 110-425, section 3(j).

33.  Under the CSIEA, the importation of controlled substances into the United States is prohibited except by persons registered with DEA to do so or persons exempted from such requirement. 21 U.S.C. 952, 957, 960. In accordance with the CSIEA, DEA has issued a regulation authorizing a person to import certain controlled substances for personal medical use, provided the person has the drugs in his possession upon entering the United States, makes the required declaration to the U.S. Customs and Border Protection, and otherwise complies fully with the requirements of the regulation. 21 CFR 1301.26; 69 FR 55343 (2004). Under no circumstances is it permissible under the CSIEA or the regulations for a person to have controlled substances shipped into the United States for personal medical use.

34.  United States v. Katz, 445 F.3d 1023, 1031 (8th Cir. 2006), cert. denied, 127 S.Ct. 421 (2006).

35.  United States v. Lawson, 682 F.2d 480, 482 (4th Cir. 1982) (citations omitted), cert. denied, 459 U.S. 991 (1982).

36.  United States v. Veal, 23 F.3d 985, 988 (6th Cir. 1994).

37.  Katz, 445 F.3d at 1031.

38.  See 21 CFR 1306.04(a).

39.  As discussed above, the electronic prescribing of controlled substances is not currently permitted under the DEA regulations, but DEA has proposed regulations that, once finalized, will allow such practice. The electronic prescribing of controlled substances through use of the Internet does, as explained above, constitute delivering, distributing, or dispensing controlled substances by means of the Internet. Nonetheless, since the overwhelming majority of practitioners only prescribe controlled substances to patients for whom they have conducted an in-person medical evaluation, and only for a legitimate medical purpose in the usual course of professional practice, it is anticipated that the overwhelming majority of practitioners will continue this practice once electronic prescribing of controlled substances becomes permissible under the DEA regulations. If so, such practitioners would satisfy the “valid prescription” requirement of the Ryan Haight Act.

40.  71 FR 52716, 52719 & 52723 (2006 DEA policy statement).

41.  As stated in 21 CFR 1304.50: “For a Web site to identify itself as being exempt from the definition of an online pharmacy by virtue of section 102(52)(B)(ii) of the Act (21 U.S.C. 802(52)(B)(ii)), the Web site shall post in a visible and clear manner on its homepage, or on a page directly linked thereto in which the hyperlink is also visible and clear on the homepage, a list of the DEA-registered nonpharmacy practitioners who are affiliated with the Web site. Any nonpharmacy practitioner affiliated with such a Web site is responsible for compliance with this section. An institutional practitioner that otherwise complies with the requirements of the Act and this chapter will be deemed to meet the requirements of this section if, in lieu of posting the names of each affiliated individual practitioner, it posts its name (as it appears on its Certificate of Registration) in a visible and clear manner on its homepage and in a manner that identifies itself as being responsible for the operation of the Web site.”

42.  21 U.S.C. 831(c)(6).

43.  Such an arrangement whereby compensation is based primarily or exclusively on the number of prescriptions for controlled substances issued is a “red flag” indicating that diversion of controlled substances into illicit channels might be occurring—regardless of whether the Internet is involved.

44.  See 21 U.S.C. 802(51), 802(52), 823(f), & 841(h)(1).

45.  As explained earlier in this preamble, the Ryan Haight Act contains an exception from the definition of “online pharmacy” for any pharmacy registered under 21 U.S.C. 823(f) whose dispensing of controlled substances via the Internet consists solely of “refilling prescriptions for controlled substances in schedule III, IV, or V” or “filling new prescriptions for controlled substances in schedule III, IV, or V” (as those terms are defined in 21 U.S.C. 802(55) and (56)). 21 U.S.C. 802(52)(B)(viii). Given these and other exceptions in the Act, it is anticipated that most pharmacies, if they continue their current practices, will not fall within the definition of an online pharmacy. However, a pharmacy that actively solicits buyers of controlled substances via the Internet or is associated with a Web site that does so cannot fall within the foregoing exception and, therefore, does constitute an online pharmacy.

46.  DEA provides a “Registration Validation” tool on its Web site, through which DEA registrants may query DEA's registration database regarding another DEA registrant to gather specific information about that registrant. Information available includes: The registrant's name, address, and DEA registration number; the date of expiration of the registration; business activity; and the schedules of controlled substances the registrant is authorized to handle.

47.  As with all DEA registrants, distributors have a duty to maintain effective controls against diversion of controlled substances. 21 U.S.C. 823(b)(1), 823(e)(1); 21 CFR 1301.71(a). As part of this responsibility, all distributors must design and operate a system to disclose to the registrant suspicious orders of controlled substances and must report to DEA any such suspicious orders of controlled substances in accordance with 21 CFR 1301.74(b). Failure to comply with these or any other applicable regulatory requirements may, depending on the circumstances, result in civil monetary penalties and/or administrative revocation proceedings, among other things.

48.  The exact wording of this provision is found in 21 U.S.C. 843(c)(2) and is recited above in this preamble.

49.  21 U.S.C. 952, 957, 960(a)(1).

50.  21 U.S.C. 831(c).

51.  21 U.S.C. 827(d)(2).

52.  Public Law 110-425, sec. 3(k)(1).

53.  Economic Census, Statistics of U.S. Businesses, 2006, available at http://www.census.gov/​epcd/​susb/​latest/​us/​US44.HTM#N446.

54.  Office of National Drug Control Policy, Press Release, March 1, 2008, available at http://www.ondcp.gov/​pda/​030108.html.

55.  S. Rep. No. 110-521, at 68 (2008).

56.  Small Business Administration, Table of Small Business Size Standards, August 22, 2008.

57.  Economic Census, Establishment and Firm Size, 2002, Table 4.