2020-21310. Implementation of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008

AGENCY:

Drug Enforcement Administration, Department of Justice.

ACTION:

Final rule.

SUMMARY:

On April 6, 2009, the Drug Enforcement Administration published the interim final rule titled “Implementation of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008,” which amended DEA's regulations by adding several new provisions to prevent the illegal distribution and dispensing of controlled substances by means of the internet. This action adopts the interim final rule as a final rule without change, apart from a minor technical amendment and certain changes to DEA regulations already made by intervening rules. This action also reinstates amendments that were inadvertently removed by the Controlled Substances and List I Chemical Registration and Reregistration Fees final rule published on March 15, 2012.

DATES:

This final rule is effective October 30, 2020.

FOR FURTHER INFORMATION CONTACT:

Scott A. Brinks, Diversion Control Division, Drug Enforcement Administration; Mailing Address: 8701 Morrissette Drive, Springfield, VA 22152; Telephone: [phone].

SUPPLEMENTARY INFORMATION:

Outline

I. Purpose of Regulatory Action

II. Summary of Key Provisions of the Ryan Haight Act

A. In-Person Medical Evaluation

B. Requirement of Modified Registration

C. Criminal Offenses

III. The Interim Final Rule and Subsequent Changes to DEA Regulations

IV. Discussion of Comments

A. Distributors' Responsibilities

B. Pharmacies' Responsibilities

C. Exceptions to the Definition of “Online Pharmacy”

D. Access to Medication

E. Verification of Registration

V. Section-by-Section Summary of the Final Rule

VI. Regulatory Analyses

I. Purpose of Regulatory Action

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (Pub. L. 110-425) (hereafter, the “Ryan Haight Act” or the “Act”) was enacted on October 15, 2008. The Act amended the Controlled Substances Act (CSA) by adding various provisions to prevent the illegal distribution and dispensing of controlled substances by means of the internet. The Ryan Haight Act makes it illegal under Federal law to “deliver, distribute, or dispense a controlled substance by means of the internet, except as authorized by [the CSA]” or to aid or abet such activity. 21 U.S.C. 841(h)(1).

On April 6, 2009, the Drug Enforcement Administration (DEA) published an interim final rule that served (1) to explain the Ryan Haight Act, (2) to announce amendments to DEA regulations that implemented the Act, and (3) to request comments on these amendments to the regulations. See 74 FR 15596.

Through this final rule, DEA is responding to the comments it received on the April 6, 2009, interim final rule and adopting the interim final rule as final without change (aside from a minor technical amendment and certain minor changes, discussed below, that were already made by intervening rules).

II. Summary of Some of the Key Provisions of the Ryan Haight Act

Congress passed the Ryan Haight Act because of “the increasing use of prescription controlled substances by adolescents and others for non-medical purposes, which [had] been exacerbated by drug trafficking on the internet.” ^[1] Recognizing that rogue websites fueled the abuse of prescription controlled substances and thereby increased the number of resulting overdoses and other harmful consequences, Congress passed the Ryan Haight Act to prevent the internet from being exploited to facilitate such unlawful drug activity.

Consistent with the CSA, the Ryan Haight Act set out numerous regulatory requirements and other substantive provisions. These provisions and other aspects of the Act are explained in detail in the interim final rule. See 74 FR 15597-15610. For this final rule, a summary of three key provisions of the Act will suffice: The in-person medical evaluation requirement for prescribing practitioners, the modified registration requirement for online pharmacies, and the criminal offenses the Act added to the CSA.

A. In-Person Medical Evaluation Requirement

One of the primary ways in which the Act combats the use of the internet to facilitate illegal sales of pharmaceutical controlled substances is by mandating, with limited exceptions, that the dispensing of controlled substances by means of the internet be predicated on a valid prescription issued by a practitioner who has conducted at least one in-person medical evaluation of the patient. While the lack of an in-person medical evaluation has always been viewed as highly probative evidence that a prescription has been issued outside of the usual course of professional practice and for other than a legitimate medical purpose, the Act makes it unambiguous that it is a per se violation of the CSA for a practitioner to issue a prescription for a controlled substance by means of the internet without having conducted at least one in-person medical evaluation, except in certain specified circumstances. However, as Congress expressly stated under the Act, the mere fact that the prescribing practitioner conducted one in-person medical evaluation does not demonstrate that the prescription was issued for a legitimate medical purpose within the usual course of professional practice. Even where the prescribing practitioner has complied with the requirement of at least one in-person medical evaluation, a prescription for a controlled substance must still satisfy the longstanding requirement of federal law that it must be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice.^[2]

B. Requirement of Modified Registration for Online Pharmacies

Another one of the core provisions of the Act is the requirement that any person who operates a website that fits within the definition of an “online pharmacy” must obtain from DEA a modification of its DEA pharmacy registration that expressly authorizes such online activity. Only DEA-registered pharmacies are eligible under the Act to obtain such a modification of registration. One of the ramifications of this requirement is that those who are not DEA-registered pharmacies (for example, those non-registrants who have previously facilitated unlawful internet controlled substance sales by enlisting the services of illegitimate pharmacies and/or prescribing practitioners) are prohibited from operating online pharmacies.

The Act's definition of “online pharmacy” encompasses more than merely legitimate pharmacies that may obtain a modification of their DEA registrations allowing them to dispense controlled substances by means of the internet. As explained below, the definition of “online pharmacy” includes, among others, those persons who operate the types of rogue websites that the Act was designed to eliminate. Consistent with the longstanding structure of the CSA (since it was enacted in 1970), the Act prohibits all controlled substance activities by “online pharmacies” except those expressly authorized by the Act. Again, only DEA-registered pharmacies may obtain a modification of their registration authorizing them to operate as online pharmacies. In addition, a pharmacy that has obtained such a modification of its registration may not operate as an online pharmacy unless it has notified DEA of its intent to do so and its website contains certain declarations designed to provide clear assurance that it is operating legitimately and in conformity with the Act.

C. Criminal Offenses

The Act also adds two new criminal offenses to the CSA. The first new criminal offense makes it explicitly unlawful for any person to knowingly or intentionally dispense, distribute, or deliver a controlled substance by means of the internet or to aid and abet such actions, except as authorized by the CSA, as stated in 21 U.S.C. 841(h)(1). The second new criminal offense added by the Act prohibits using the internet to knowingly or intentionally advertise illegal transactions of controlled substances that are not authorized by the CSA, as stated in 21 U.S.C. 841(h)(2). The Act contains specific examples of such conduct, as discussed in the interim final rule; however, it is important to note that the examples provided are not an exhaustive list of the types of conduct that constitute violations of 21 U.S.C. 841(h)(1) and 21 U.S.C. 841(h)(2).

III. The Interim Final Rule and Subsequent Changes to DEA Regulations

DEA published its interim final rule implementing the Ryan Haight Act at 74 FR 15596 on April 6, 2009. The interim final rule amended DEA's regulations at 21 CFR parts 1300, 1301, 1304, and 1306 to carry out the Act. The specific regulatory changes made by the interim final rule and herein adopted as a final rule are discussed in greater detail in Section V below.

While this final rule is not making any changes to the provisions of the interim final rule aside from a minor technical amendment discussed below, there have been two amendments to DEA's regulations since the interim final rule was published that have further altered regulatory language that had been amended by the interim final rule.

The first change occurred in 2011, when 21 CFR 1301.52(a) was amended to provide for immediate termination of a registration, and all modifications of that registration, upon surrender by the registrant. 76 FR 61563. This final rule does not disturb that intervening 2011 amendment.

The second change occurred in 2012, when registration fees were increased for all business activities by amending DEA regulatory provisions including 21 CFR 1301.13(e)(1). 77 FR 15234. The change in 2012 increased the three-year registration fee for dispensers (which includes pharmacies) from $551 to $731, but it did not impose any additional fee to apply for the online pharmacy modification. Unfortunately, however, this amendment—though solely intended to adjust fees—also inadvertently removed the interim final rule's changes to § 1301.13(e)(1). In particular, the interim final rule had amended § 1301.13(e)(1)(iv) to list “Online Pharmacy” as part of the business activity “[d]ispensing or instructing”; to list the online pharmacy application form, 224c; and to indicate, under “[c]oincident activities allowed” that “[a]n online pharmacy may perform activities of retail pharmacy as well as online pharmacy activities.” The revised version of § 1301.13(e)(1) placed in the Code of Federal Regulations by the 2012 amendment not only changed the fees in § 1301.13(e)(1), as intended, but also used an earlier version of the text of § 1301.13(e)(1)(iv) that did not contain the interim final rule's additions, causing them to be inadvertently removed from § 1301.13(e)(1).

Thus, the current text of §§ 1301.13(e)(1) and 1301.52(a) differs from that contained in the interim final rule as published on April 6, 2009, because of these intervening amendments. This final rule, while otherwise adopting the regulatory revisions of the interim final rule, does not disturb these intervening amendments, except to reinstate the interim final rule's changes to § 1301.13(e)(1) that were inadvertently undone by the 2012 registration fee amendment. In particular, through this action, § 1301.13(e)(1)(iv) will be updated to: (1) Include online pharmacy as a type of “dispensing or instructing” business activity; (2) add Form DEA-224c to DEA application forms column; and (3) include a statement that online pharmacies are allowed to perform activities of a retail pharmacy and online pharmacy as a coincident activity.

Thus, the publication of this final rule does not alter the text of the Code of Federal Regulations except to reinstate the interim final rule's § 1301.13(e)(1) amendments and to make one purely technical amendment to § 1304.40(c) to remove outdated information that is further discussed below.

IV. Discussion of Comments

DEA received nine comments on the interim final rule. Six commenters generally supported the rule while also raising issues of concern, and three commenters expressed opposition to the rule. The comments are summarized below, along with DEA's responses.

A. Distributors' Responsibilities

Some commenters expressed concerns that the precise scope of distributors' obligations described in the interim final rule were unclear—in particular, distributors' duty to avoid supplying pharmacies that service the customers of rogue websites. Another commenter sought clarification of whether, when a pharmacy's buying patterns indicate a reasonable likelihood that it is supplying customers of a website, distributors are required to confirm only that the pharmacy has obtained a modified pharmacy registration under the Act, or must confirm that the pharmacy is in compliance with all requirements of the CSA. The same commenter argued that the language in the interim final rule suggested that distributors would be required to have knowledge of a pharmacy's buying patterns before any transactions occurred with the pharmacy.

Some commenters stated that it is not feasible for distributors to know more about a pharmacy's online activities than what would be discovered by verifying the pharmacy's DEA registration status and conducting a routine due diligence investigation. The same commenters requested that DEA confirm whether it was the distributor's responsibility, when faced with a pharmacy whose buying patterns indicate a reasonable likelihood that it is supplying customers of a website, to either confirm that the pharmacy has a modified DEA registration, or to obtain a plausible alternative explanation to justify the buying pattern.

DEA Response. With respect to the obligation to confirm a pharmacy's compliance with the requirements of the CSA, distributors, like all DEA registrants, have a duty to maintain effective controls against the diversion of controlled substances. 21 U.S.C. 823(b)(1), 823(e)(1); 21 CFR 1301.71(a). Failure to comply with this or any other applicable regulatory requirements may, depending on the circumstances, result in civil monetary penalties and/or administrative revocation proceedings. In addition, a distributor that knowingly or intentionally distributes controlled substances to a pharmacy that is dispensing controlled substances in violation of the Ryan Haight Act is subject to criminal prosecution under 21 U.S.C. 841(h)(1).

The Act introduces new requirements to ensure a pharmacy's compliance with the registration modification provisions. This final rule does not, however, relieve distributors of their existing duty to maintain effective controls against diversion, including the obligation to conduct adequate due diligence, not only prior to distributing controlled substances to a new customer but also throughout the course of a distributor's relationship with a customer.^[3]

There are several ways for a distributor to determine whether a pharmacy is properly registered to dispense controlled substances by means of the internet. A pharmacy's certificate of registration will state that it has obtained the requisite modification of its registration. A distributor can also verify the pharmacy's status using DEA's registration validation web tool. However, as DEA explained in both Southwood and Masters, “doing `nothing more than verifying a pharmacy's DEA registration and state license' is not enough” to comply with a distributor's “duty to perform due diligence.” <sup>[4]</sup> In Masters, DEA further held that “a distributor must conduct a reasonable investigation `to determine the nature of a potential customer's business before it' sells to the customer, and the distributor cannot ignore “information which raise[s] serious doubt as to the legality of [a potential . . . customer's] business practices.” ^[5]

Continuing in Masters, DEA explained that where “a customer provides information regarding its dispensing practices that is inconsistent with other information the distributor has obtained about or from the customer, or is inconsistent with information about pharmacies' dispensing practices generally, the distributor must conduct ‘additional investigation to determine whether [its customer is] filling legitimate prescriptions.' ” ^[6] Finally, Masters explained that “the obligation to perform due diligence is ongoing throughout the course of a distributor's relationship with its customer.” ^[7] Id.

Thus, where a pharmacy's buying patterns suggest that the pharmacy is filling prescriptions for a rogue website, it is not enough for a distributor to confirm only that the pharmacy has a modified pharmacy registration under the Ryan Haight Act.^[8] Rather, the distributor must confirm that the pharmacy is in compliance with the CSA's requirement that it is filling only those prescriptions which have been issued by a practitioner acting in the usual course of professional practice for a legitimate medical purpose in accordance with 21 CFR 1306.04(a). Moreover, this requirement is not undermined by any contention that a pharmacy's buying patterns may not be known at the time of its first transaction with a specific distributor: Pursuant to section 3273(a) of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act), Public Law 115-271, 132 Stat. 3894, DEA has created an online tool which allows distributors to obtain data as to the number of distributors that have sold to a prospective customer and the total quantity and type of opioids distributed to the prospective customer during the last six months.^[9] The SUPPORT Act further provides that “[a]ll registered manufacturers and distributors shall be responsible for reviewing this information” and that, in determining whether to initiate proceedings to suspend or revoke a manufacturer's/distributor's registration, DEA “may take into account that this information . . . was available to the registrant.” ^[10] It should also be noted that federal law now provides that the failure to review this information is unlawful and is punishable by civil and criminal penalties.^[11]

In addition, nearly all pharmacies now use dispensing software which allows for the creation of a utilization/dispensing report. As Masters explains, a distributor, as part of its due diligence, should evaluate a customer's dispensing ratio of controlled to non-controlled drugs as well as such other relevant data, including the types of controlled substances, the dosage forms, and quantities dispensed, and base this evaluation on the most accurate information available.^[12] Thus, a distributor should be obtaining and reviewing utilization/dispensing reports both upon taking on a new customer and periodically throughout the course of its relationship with its customer. As Masters makes amply clear, the failure to obtain and review this information may constitute strong evidence that a distributor has failed to maintain effective controls against diversion and support a finding that its registration is inconsistent with the public interest.

Accordingly, while it is true that information as to a pharmacy's buying patterns and/or dispensing activities may not point conclusively to a finding that the pharmacy is dispensing controlled substances in violation of the Ryan Haight Act, DEA's experience has been that rogue online pharmacies present many of the same indicia of illegal dispensing activity as do brick and mortar pharmacies engaged in drug trafficking. Thus, even if a distributor does not have actual knowledge that the pharmacy is operating through a rogue website, if the pharmacy's buying patterns or other circumstances surrounding an order create a reasonable suspicion that it is supplying customers of a website or otherwise engaging in practices that render it an online pharmacy within the meaning of the Act, the distributor should, prior to filling any order for controlled substances, confirm whether the pharmacy has a modified registration. The distributor should also assess the likelihood that the pharmacy is filling only controlled substance prescriptions that comply with 21 CFR 1306.04(a).

In sum, if a pharmacy's buying patterns or the other circumstances of an order create a reasonable suspicion that it is supplying customers of a website or otherwise engaging in practices that render it an online pharmacy within the meaning of the Act, but nothing else about the order appears suspect or unlawful, a distributor will not be held liable for supplying the pharmacy controlled substances if the distributor has confirmed that the pharmacy holds a modified registration. However, merely confirming that the pharmacy holds a modified registration will not relieve the distributor of liability if the pharmacy's order raised grounds for suspicion that it was filling otherwise unlawful controlled substance prescriptions and the distributor did not properly resolve the grounds. Conversely, if a pharmacy's order initially indicates that it may be supplying customers of a website, but the distributor is able to confirm an alternative justification for the suspect features of the order, it may lawfully fill the order and supply the pharmacy with controlled substances. To be clear, however, the distributor must actually confirm the alternative justification; it cannot simply conceive of some theoretical set of circumstances under which the pharmacy's suspect order would be justified. As such, the commenters are correct that an alternative explanation can justify an otherwise suspect order, but as discussed above, distributors must conduct reasonable investigations to confirm the explanation.

B. Pharmacies' Responsibilities

One commenter raised concerns regarding the variety of factors listed in the interim final rule as relevant to determining whether a prescription was issued by means of the internet. In particular, the commenter suggested that these factors are subjective. The same commenter requested that DEA define a reasonable distance between the pharmacy and a practitioner. This comment relates to DEA's statement in the interim final rule that, in some circumstances, the distance between a pharmacy and a practitioner may be a relevant factor in assessing the likelihood that a prescription has been issued by means of the internet in violation of the Ryan Haight Act. See 74 FR 15607. Another commenter urged DEA to enforce the pharmacy requirements in the manner outlined in the interim final rule, and not apply a more stringent standard than the ones discussed there.

DEA Response. DEA appreciates the commenter's concerns regarding the factors to be considered when determining whether a pharmacist should reasonably suspect that a prescription was issued by means of the internet. Pharmacists have always had a responsibility to ensure the dispensing of controlled substances conforms with DEA's regulations and the CSA and to exercise professional judgment in determining whether a controlled substance prescription has been lawfully issued in accordance with all provisions of the CSA.^[13] While a pharmacist is not obligated to know what cannot be known through the exercise of sound professional pharmacy practice, the relevant factors set forth in the interim final rule for determining whether a pharmacist should reasonably know that a prescription was issued by means of the internet have been based on numerous decisions of both the federal courts and this Agency involving rogue internet pharmacies and the physicians who wrote the prescriptions that were filled by them.^[14] Indeed, an examination of these and other cases reveals that the factual circumstances surrounding the issuance of the controlled substance prescriptions was so obviously outside the usual course of professional practice and for other than a legitimate medical purpose that no reasonable pharmacist could claim ignorance of the unlawfulness of the prescriptions.^[15]

DEA's obligations under the Ryan Haight Act do not require it to establish a particular distance between a practitioner and pharmacy beyond which a prescription should be presumed to have been issued by means of the internet. As DEA stated in the interim final rule, the distance between a prescribing practitioner and the pharmacy is just one factor potentially relevant to assessing whether a prescription was issued by means of the internet. The Act and this rule rely on pharmacists to consider all of the circumstances surrounding a controlled substance prescription and exercise their professional judgment in determining whether to dispense the prescription. To address the other commenter's concerns about how these provisions of the Act will be enforced, the commenter should look to the standards outlined in the interim final rule, which set out the basis for DEA's enforcement of the Act's pharmacy requirements. These standards are being adopted as a final rule in this rulemaking.

C. Exceptions to the Definition of “Online Pharmacy”

The interim final rule contains ten exceptions to its definition of “online pharmacy,” eight taken directly from the Ryan Haight Act. See 21 CFR 1300.04(h)(1)-(10); 21 U.S.C. 802(52)(B). Some commenters supported three particular exceptions: Pharmacies whose dispensing of controlled substances by means of the internet consists solely of (1) filling or refilling prescriptions for controlled substances in schedules III-V, as defined in the Act, 21 CFR 1300.04(h)(8); (2) filling prescriptions that were electronically prescribed in a manner otherwise consistent with the CSA, id. 1300.04(h)(9); or (3) transmitting prescription information between a pharmacy and an automated dispensing system located in a long term care facility, when the registration of the automated dispensing system is held by the pharmacy, id. § 1300.04(h)(10).

One commenter encouraged DEA to consistently emphasize this first exception in communications regarding the Act and its requirements. Another commenter expressed concern that the precise wording of the first and second exceptions is such that a pharmacy engaging in both filling or refilling prescriptions for controlled substances in schedules III-V, as defined in the Act, and filling prescriptions that were electronically prescribed in a manner otherwise consistent with the CSA would be considered an online pharmacy. Other commenters argued that additional exceptions to the definition of online pharmacy were required to properly exclude other activities conducted by means of the internet, such as central fill and processing and telepharmacy.

DEA Response. DEA thanks the commenters for their support of the exceptions to the definition of online pharmacy.

With respect to the concern that a pharmacy engaging in activity under each of the two separate exceptions (21 CFR 1300.04(h)(8), (9)) would be considered an online pharmacy, 21 CFR 1300.04(h)(9)(ii) already allows a registrant to engage in both categories of activity without being deemed an online pharmacy: “A registered pharmacy will be deemed to meet this exception if, in view of all of its activities other than those referred to in paragraph (h)(9)(i) . . . it would fall outside the definition of an online pharmacy.” Consistent with this section, if a pharmacy fills or refills prescriptions for controlled substances in schedules III-V and also fills prescriptions that were electronically prescribed, it could still qualify for the exception in paragraph (h)(9)(i) if, considering all the activity it engages in besides filling electronic prescriptions, including filling and refilling prescriptions for controlled substances in schedules III-V, it would not meet the definition of an online pharmacy.

DEA does not believe that further limitations on the definition of an online pharmacy are necessary at this time. This rule already includes ten separate exceptions to the definition of an online pharmacy, covering a broad range of activities; a majority of pharmacies fit within one or more of these existing exceptions.

D. Access to Medication

One commenter objected to the rule on the grounds that people with disabilities and people confined to their homes who do not have a care provider to pick up medications from a pharmacy will be unable to receive the medications they need. Another commenter opposed the rule, stating that some patients need more medication than one doctor is permitted to prescribe. This commenter argued that it was neither cheap nor easy to get controlled substances from reputable online pharmacies in the United States, and that imposing additional requirements would drive patients to foreign online pharmacies or “street” dealers. A third commenter objected to the rule on the basis that it would reduce access to phentermine.

DEA Response. The ability of a patient or care provider to pick up medications from a pharmacy is outside of the scope of this rule. The amount of medication a doctor is permitted to prescribe and the costs of medication are outside of the scope of this rule. The Act provides that, subject to certain exceptions, controlled substances that are prescription drugs may not be dispensed by means of the internet without a valid prescription. In order to issue a valid prescription, the prescribing practitioner must have conducted at least one in-person medical evaluation of the patient, or else be a covering practitioner operating in a narrow set of circumstances. These requirements do not apply to the dispensing of controlled substances by practitioners engaged in the practice of telemedicine, but the Act did not modify the existing requirement that all controlled substance prescriptions, to be valid, must be issued for a legitimate medical purpose in the usual course of professional practice.

Patients who previously filled valid prescriptions by mail can continue to do so. Patients will need to visit a practitioner's office for an initial in-person medical evaluation or take part in a telemedicine encounter before being issued a prescription, but the vast majority of patients were likely already doing this before the enactment of the Act. This final rule does not decrease access to specific prescriptions of controlled substances as this rule ensures that only legitimate law abiding websites dispense controlled substances via the internet. Phentermine is a schedule IV controlled substance and all the requirements specified for schedule IV controlled substances are applicable because the new requirements do not exclude or include specific controlled substances. Furthermore, under the CSA, it is unlawful to ship controlled substances from abroad into the United States for personal medical use, and individuals who place an order for such a shipment are in violation of the CSA and subject to criminal prosecution. 21 U.S.C. 952, 957, 960(a)(1).

E. Verification of Registration

One commenter recommended that DEA create a “list serve” email system to provide distributors real-time notifications of changes in registrants' registration statuses, or to update the registration validation tool to allow registrants to check multiple DEA registrations automatically. The same commenter suggested DEA allow information obtained from the registration validation tool to be used as a suitable method of documenting verification of a customer's registration during DEA inspections. Finally, the commenter suggested DEA conduct a number of outreach efforts to increase awareness of and engagement with the new requirements of the rule among members of the public and non-registrant companies.

DEA Response. DEA thanks the commenter for these suggestions. DEA strives to provide tools and resources to registrants and the public to discontinue the diversion and abuse of controlled substances, and always appreciates receiving additional ideas for how these goals can be achieved. The commenter's suggestions, however, are beyond the scope of this rule, are not necessary for DEA to implement the Ryan Haight Act, and would require additional DEA resources to realize. Thus, DEA is not acting on these suggestions as part of this final rule, but will consider them as appropriate as DEA continues to provide additional tools and resources to registrants and the public in the future.

V. Section-by-Section Discussion of the Final Rule

As discussed above, DEA is adopting the interim final rule as a final rule without change, except for a technical amendment further explained below and certain minor changes already made by intervening rules. Thus, the interim final rule's more detailed discussion of its provisions generally remains valid. See 74 FR 15610-15613. In brief, however, the final rule consists of the following provisions, all of which were already added to the Code of Federal Regulations by the interim final rule.

In part 1300 (definitions), § 1300.04, containing definitions relating to the dispensing of controlled substances by means of the internet, was added by the interim final rule and remains unchanged. These definitions are from the definitions contained in the Act and include definitions of the following terms: “covering practitioner,” “deliver, distribute or dispense by means of the internet,” “filling new prescriptions for controlled substances in Schedule III, IV, or V,” “homepage,” “in-person medical evaluation,” “internet,” “online pharmacy,” “practice of telemedicine,” “refilling prescriptions for controlled substances in Schedule III, IV, or V,” “valid prescription,” and the temporary definition of “practice of telemedicine.” ^[16] As discussed in the interim final rule and as authorized by the Act, § 1300.04 adds two exceptions to the definition of an online pharmacy beyond the eight exceptions provided for in the Act. See 21 CFR 1300.04(h); 21 U.S.C. 802(52)(B).

In part 1301 (registration of manufacturers, distributors, and dispensers of controlled substances), § 1301.11(b) restates the requirements of the Act that any person falling within the definition of an online pharmacy must be validly registered with a modification authorizing it to operate as an online pharmacy, and that only pharmacies registered under 21 U.S.C. 823(f) may apply for such modification.

To address the modification of registration as an online pharmacy, the table in § 1301.13(e)(1) was amended by the interim final rule. “Online Pharmacy” was listed as a business activity falling under “(iv) Dispensing or instructing.” The online pharmacy application form, 224c, was noted. And a comment was added in the “Coincident activities allowed” column to explain that an online pharmacy may perform the activities of both a retail and online pharmacy. As explained above, the table in § 1301.13(e)(1) was again amended in 2012 to increase registration fees. See 77 FR 15234. The revised version of the § 1301.13(e)(1) table placed in the Code of Federal Regulations by the 2012 amendment, however, not only changed fees in § 1301.13(e)(1) but also inadvertently removed the interim final rule's additions to § 1301.13(e)(1). This final rule reinstates them.

As added by the interim final rule, § 1301.19 (special requirements for online pharmacies) provides in paragraphs (a), (c), and (f) that a pharmacy must request a modification of its registration authorizing it to operate as an online pharmacy by completing the online application process. This section also provides, consistent with the Act, that a pharmacy registrant may not operate as an online pharmacy until DEA Administrator grants the modified registration. Paragraph (b) requires, consistent with the Act, that an online pharmacy must comply with the pharmacy license requirements of not only the State where it is located, but also of any State to which it delivers, distributes, or dispenses controlled substances. Paragraph (d) requires a pharmacy that seeks to discontinue its authorization to operate as an online pharmacy to modify its registration to reflect this change in its business activity.

Section 1301.52, which addresses termination of registrations, was revised by the interim final rule to include modification of registration within the meaning of the Act. As explained above, § 1301.52 was amended by another rule in 2011. See 76 FR 61563. This 2011 revision did not disturb the interim final rule's changes, and thus the final rule requires no additional changes to § 1301.52.

Four new sections were added to 21 CFR part 1304 (records and reports of registrants) by the interim final rule to implement the reporting requirements of the Act for online pharmacies, and to specify the information the Act requires to be posted on an online pharmacy's website. This final rule leaves three of these sections unchanged, but makes a minor technical amendment to a paragraph of one of these sections, § 1304.40(c).

Section 1304.40(a) requires online pharmacies to notify the Administrator and State boards of pharmacy 30 days before offering to fill prescriptions for controlled substances by means of the internet. Notification to the Administrator is made by applying for a modification of DEA registration. Paragraph (b) of § 1304.40 contains a list of items that must be included in the notification.

In the interim final rule, § 1304.40(c) required online pharmacies in operation of the time the Act became effective (April 13, 2009) to make this notification by May 13, 2009, and stated that, since April 13, 2009, it has been unlawful for any person to operate as an online pharmacy unless it has obtained from DEA a modification of its registration authorizing it to do so. Given the passage of time since the publication of the interim final rule, the first portion of paragraph (c) is no longer relevant, specifically the text stating that an online pharmacy in operation at the time the Act became effective must make the required notification on or before May 13, 2009. As such, in this final rule, DEA is making a technical amendment to § 1304.40(c) to remove this outdated text. The revised § 1304.40(c) retains the rest of the interim final rule's paragraph (c), stating that it is unlawful for any person to operate as an online pharmacy unless it has obtained from DEA a modification of its registration authorizing it to do so.

The remainder of § 1304.40 remains unchanged. As in the interim final rule, § 1304.40(d) requires that on and after an online pharmacy makes notification under this section, it shall display a declaration that it has done so. Under § 1304.40(e), an online pharmacy must notify the Administrator of any changes to the information submitted in its notification thirty days prior to the change.

Section 1304.45 specifies the data elements required to be posted on the website of online pharmacies in a visible and clear manner, as provided in the Act.

To identify websites that are operating solely on behalf of DEA-registered non-pharmacy practitioners who are acting within the scope of their registrations (and are thereby exempt from the definition of an online pharmacy), § 1304.50 requires such websites that dispense controlled substances by means of the internet to display in a visible and clear manner a list of those DEA-registered non-pharmacy practitioners affiliated with the website.

Section 1304.55 implements the requirement of the Act that each online pharmacy make a monthly report to DEA stating the total quantity of each controlled substance the pharmacy has dispensed the previous calendar month. This report must include not only the transactions made through the online pharmacy, but also any that the pharmacy made through mail order, face-to-face, or any other transaction when the pharmacy's total dispensing of controlled substances meets or exceeds the monthly threshold of either 100 prescriptions filled or 5,000 or more dosage units dispensed. Online pharmacies that do not meet this threshold in a given month are required to notify DEA.

In part 1306 (prescriptions), § 1306.09 includes requirements for prescriptions that track the requirements of the Act. Paragraph (a) specifies that no controlled substance may be delivered, distributed, or dispensed by means of the internet without a valid prescription (using the definition of a valid prescription contained in the Act). Also consistent with the Act, paragraph (b) provides that such prescriptions may only be filled by a pharmacy whose registration has been modified as specified in the Act. Finally, paragraph (c) applies to online pharmacies the requirements of §§ 1306.15 and 1306.25 regarding transfers of prescriptions between pharmacies.

VI. Regulatory Analyses

Executive Orders 12866, 13563, and 13771

This rule was developed in accordance with the principles of Executive Orders (EOs) 12866 and 13563. E.O. 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, public health and safety, and environmental advantages; distributive impacts; and equity). E.O. 13563 is supplemental to and reaffirms the principles, structures, and definitions governing regulatory review as established in E.O. 12866. It defines a “significant regulatory action” requiring review by the Office of Management and Budget (OMB) as any regulatory action that is likely to result in a rule that may: (1) Have an annual effect on the economy of $100 million or more, or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, environment, public health or safety, or State, local, or tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in the Executive order.

As discussed above, this final rule adopts the interim final rule without change, apart from certain changes to DEA regulations already made by intervening rules and a minor technical amendment. Therefore, this final rule imposes no costs beyond the costs already imposed by the interim final rule and those intervening rules. OMB has determined that this final rule is not a “significant regulatory action” under E.O. 12866, section 3(f), Regulatory Planning and Review, and accordingly this rule has not been reviewed by OMB.

This final rule is not a significant regulatory action under E.O. 12866, and it does not impose a cost greater than zero. Therefore, this final rule is not an E.O. 13771 regulatory action.

Regulatory Flexibility Act

The interim final rule was drafted in accordance with the Regulatory Flexibility Act (RFA), 5 U.S.C. 601-612. The RFA applies to rules for which an agency publishes a general notice of proposed rulemaking. As was explained in the interim final rule, the Ryan Haight Act expressly contemplated that DEA would issue interim rules under the “good cause” provision of the APA as the agency deemed necessary to implement the Act prior to its effective date of April 13, 2009. Thus, Congress expressly granted DEA authority to issue regulations to implement the Act that become effective immediately, without the requirement of first seeking public comment through a notice of proposed rulemaking. Consequently, the requirements of the RFA did not apply to the interim final rule. Nonetheless, DEA did review the potential impacts, and determined that the rule was likely to affect a substantial number of small entities, but not likely to have a significant economic impact on those small entities. Furthermore, DEA sought comments in the interim final rule with respect to those parts of the regulatory text about which the agency has discretion. DEA received no comments regarding economic impacts. It seems unlikely, therefore, that small entities have been significantly impacted by this rule.

Paperwork Reduction Act

This final rule does not create or modify a collection of information or impose recordkeeping or reporting requirements under the Paperwork Reduction Act of 1995 beyond those modified by the interim final rule. 44 U.S.C. 3501-3521. That information collection requirement was previously approved by OMB under the assigned OMB Control Number 1117-0014. An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.

Executive Order 12988, Civil Justice Reform

This final rule meets the applicable standards set forth in sections 3(a) and 3(b)(2) of Executive Order 12988, Civil Justice Reform, to eliminate ambiguity, minimize litigation, establish clear legal standards, and reduce burden.

Executive Order 13132, Federalism

This rulemaking does not have federalism implications warranting the application of Executive Order 13132. The final rule does not have substantial direct effects on the States, on the relationship between the National Government and the States, or the distribution of power and responsibilities among the various levels of government.

Executive Order 13175, Consultation and Coordination With Indian Tribal Governments

This rule does not have substantial direct effects on the States, on the relationship between the National Government and the States, or the distribution of power and responsibilities between the Federal Government and Indian tribes.

Unfunded Mandates Reform Act of 1995

This rule will not result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted for inflation) in any one year, and will not significantly or uniquely affect small governments. Therefore, no actions were deemed necessary under the provisions of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1532.

Congressional Review Act

This rule is not a major rule as defined by the Congressional Review Act. 5 U.S.C. 804. This rule will not result in an annual effect on the economy of $100,000,000 or more; a major increase in costs or prices; or significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of United States-based companies to compete with foreign-based companies in domestic and export markets.

List of Subjects

21 CFR Part 1300

• Chemicals
• Drug traffic control

21 CFR Part 1301

• Administrative practice and procedure
• Drug traffic control
• Security measures

21 CFR Part 1304

• Drug traffic control
• Reporting and recordkeeping requirements

21 CFR Part 1306

• Drug traffic control
• Prescription drugs

For the reasons set out above, the interim final rule amending 21 CFR parts 1300, 1301, 1304, and 1306, which was published at 74 FR 15596 on April 6, 2009, and as subsequently amended at 76 FR 61563 and 77 FR 15234, is adopted as final with the following changes to 21 CFR parts 1301 and 1304:

PART 1301—REGISTRATION OF MANUFACTURERS, DISTRIBUTORS, AND DISPENSERS OF CONTROLLED SUBSTANCES

1. The authority citation for part 1301 continues to read as follows:

Authority: 21 U.S.C. 821, 822, 823, 824, 831, 871(b), 875, 877, 886a, 951, 952, 956, 957, 958, 965 unless otherwise noted.

2. In § 1301.13, revise paragraph (e)(1)(iv) to read as follows:

§ 1301.13

Application for registration; time for application; expiration date; registration for independent activities; application forms, fees, contents and signature; coincident activities.

(e) * * *

(1) * * *

Business activity	Controlled substances	DEA application forms	Application fee ($)	Registration period (years)	Coincident activities allowed
*         *         *         *         *         *         *
(iv) Dispensing or instructing (includes Practitioner, Hospital/Clinic, Retail Pharmacy, Online Pharmacy, Central Fill Pharmacy, Teaching Institution)	Schedules II-V	New—224 Renewal—224a Online Pharmacy—224c	731	3	May conduct research and instructional activities with those controlled substances for which registration was granted, except that a mid-level practitioner may conduct such research only to the extent expressly authorized under State statute. A pharmacist may manufacturer an aqueous or oleaginous solution solid dosage form containing a narcotic controlled substance in Schedule II-V in a proportion not exceeding 20% of the complete solution, compound or mixture. A retail pharmacy may perform central fill pharmacy activities. An online pharmacy may perform activities of retail pharmacy, as well as online pharmacy activities.
*         *         *         *         *         *         *

* * * * *

PART 1304—RECORDS AND REPORTS OF REGISTRANTS

3. The authority for citation for part 1304 continues to read as follows:

Authority: 21 U.S.C. 821, 827, 831, 871(b), 958(e)-(g), and 965, unless otherwise noted.

4. In § 1304.40, revise paragraph (c) to read as follows:

§ 1304.40

Notification by online pharmacies.

* * * * *

(c) It is unlawful for any online pharmacy to deliver, distribute, or dispense a controlled substance by means of the internet unless such online pharmacy is validly registered with a modification of such registration authorizing such activity.

* * * * *

Timothy J. Shea,

Acting Administrator.

Footnotes

1.  S. Rep. No. 110-521, at 1 (2008).

2.  21 CFR 1306.04(a); United States v. Moore, 423 U.S. 122 (1975). This requirement has been a part of federal law since the Harrison Narcotic Act of 1914. Id. at 131. For a detailed explanation of the “legitimate medical purpose requirement,” see 71 FR 52716, 52717 (2006 DEA policy statement).

3.  See Masters Pharmaceuticals, Inc., 80 FR 55418, 55477 (2015). See also 21 CFR 1301.71(a) (“All applicants and registrants shall provide effective controls to guard against theft and diversion of controlled substances.”); Southwood Pharmaceuticals, Inc., 72 FR 36487, 36498-36500 (2007) (discussing inadequacy of distributor's due diligence efforts with respect to rogue internet pharmacies); 21 U.S.C. 823(b)(1) (directing the Attorney General to consider an applicant's/registrant's “maintenance of effective controls against diversion of particular controlled substances into other than legitimate medical, scientific, and industrial channels” when making the public interest determination with respect to the granting or revocation of a registration to distribute schedule I and II drugs); id. 823(e)(1) (same with respect to registration to distribute schedule III through V drugs).

4.  Masters, 80 FR at 55477 (quoting Southwood, 72 FR at 36498).

5.  Id.

6.  Id. (quoting 72 FR at 55477).

7.  Id.

8.  Indeed, as of the date of this rule, no person or entity holds a modified registration authorizing the dispensing of controlled substances by means of the internet.

9.  Press Release, Drug Enforcement Administration, DEA announces enhanced tool for registered drug manufacturers and distributors to combat opioid crisis (Feb. 26, 2019).

10.  21 U.S.C. 827(f).

11.  21 U.S.C. 842(a)(17), (c)(1)(B), (c)(2)(D).

12.  80 FR at 55480-55481.

13.  See 21 CFR 1306.04(a); JM Pharmacy Group, Inc., 80 FR 28667, 28670 (2015) (quoting Ralph J. Bertolino, 55 FR 4729, 4730 (1990) (“a pharmacist must exercise professional judgment [and common sense] when filling a prescription”); id. (quoting Medic-Aid Pharmacy, 55 FR 30043, 30044 (1990) (“The administrative law judge concluded that it is not necessary to find that [the pharmacist] in fact knew that many prescriptions were presented to him that were not written for a legitimate medical purpose, for there is no question that a conscientious pharmacists would have been suspicious of these prescriptions and refused to fill them.”).

14.  See United States v. Smith, 573 F.3d 639, 657-658 (8th Cir. 2009); United States v. Nelson, 383 F.3d 1227, 1231-1232 (10th Cir. 2004); Nirmal Saran, M.D., & Nisha Saran, D.O., 73 FR 78827 (2008); Kamir Garces-Mejias, M.D., 72 FR 54931 (2007); William R. Lockridge, M.D., 73 FR 78827 (2006); Mario Alberto Diaz, 71 FR 70780 (2006); United Prescription Services, Inc., 72 FR 50397 (2007); Trinity Health Care Corp., d/b/a Oviedo Discount Pharmacy, 72 FR 30849 (2007). See also Robert Raymond Reppy, 76 FR 61154 (2011); Sun & Lake Pharmacy, Inc., 76 FR 24523 (2011).

15.  Under 21 CFR 1306.04(a), a pharmacist who knowingly fills a controlled substance prescription which has been issued outside of the usual course of professional practice has engaged in an unlawful distribution of a controlled substance in violation of 21 U.S.C. 841(a). So too, a pharmacist who knowingly or intentionally fills a controlled substance prescription issued in violation of the Ryan Haight Act commits a violation of 21 U.S.C. 841(h)(1).

While the scienter for criminal violations of section 841 requires proof that a pharmacist acted with intent, knowledge, or willful blindness, it should be noted that under the public interest standard applicable in revocation proceedings brought under 21 U.S.C. 824(a), DEA is not necessarily required to show that a pharmacist violated either section 841 or 21 CFR 1306.04(a) to establish liability. Rather, DEA can establish that a pharmacy has committed acts which render its registration inconsistent with the public interest by showing that a pharmacist engaged in the reckless or negligent dispensing of a controlled substance by failing to resolve the suspicious circumstances presented by a prescription. Cf. Paul J. Caragine, Jr., 63 FR 51592, 51601 (1998).

16.  As explained in the interim final rule, the Ryan Haight Act provided two definitions of the “practice of telemedicine,” a temporary definition and a permanent definition. See 74 FR 15603; Public Law 110-425, sec. 3(j). The interim final rule incorporated both of these definitions, with the permanent definition, 21 CFR 1300.04(i), becoming effective on January 15, 2010, and the temporary definition, 21 CFR 1300.04(j), effective before that date. The permanent definition of the “practice of telemedicine” includes practice “conducted by a practitioner who has obtained from the Administrator a special registration under section 311(h) of the Act (21 U.S.C. 831(h)).” 21 CFR 1300.04(i)(5); 21 U.S.C. 802(54)(B). The Act, as amended, contemplates that DEA will issue regulations effectuating this telemedicine special registration provision by October 24, 2019. 21 U.S.C. 831(h)(2). DEA will further address the definition and requirements of telemedicine in future rulemaking.