2024-24189. Neeraj B. Shah, M.D.; Decision and Order

Document Headings

Document headings vary by document type but may contain the following:

1. the agency or agencies that issued and signed a document
2. the number of the CFR title and the number of each part the document amends, proposes to amend, or is directly related to
3. the agency docket number / agency internal file number
4. the RIN which identifies each regulatory action listed in the Unified Agenda of Federal Regulatory and Deregulatory Actions

See the Document Drafting Handbook for more details.

Department of Justice

Drug Enforcement Administration

1. [Docket No. 23-65]

On August 30, 2023, the Drug Enforcement Administration (DEA or Government) issued an Order to Show Cause (OSC) to Neeraj B. Shah, M.D., (Respondent) of Austin, Texas. Administrative Law Judge Exhibit (ALJX) 1 (OSC), at 1. The OSC proposed the revocation of Respondent's DEA Certificate of Registration (registration), No. FS2968444, and alleged that Respondent's continued registration is inconsistent with the public interest. Id. (citing 21 U.S.C. 823(g)(1), 824(a)(4)).

A hearing was held before DEA Administrative Law Judge (ALJ) Teresa A. Wallbaum who, on March 8, 2024, issued her Recommended Rulings, Findings of Fact, Conclusions of Law, and Decision of the Administrative Law Judge (RD). The RD recommended that Respondent's registration be revoked. RD, at 33. Neither party filed exceptions to the RD. Having reviewed the entire record, the Agency adopts and hereby incorporates by reference the entirety of the ALJ's rulings, credibility findings,^[1] findings of fact, conclusions of law, sanctions analysis, and recommended sanction in the RD and summarizes and expands upon portions thereof herein.^[2]

I. Findings of Fact

The Agency finds from clear, unequivocal, and convincing evidence that Respondent failed to maintain sole possession of his hard token for issuing electronic controlled substance prescriptions, that he allowed unauthorized individuals to issue electronic controlled substance prescriptions using his DEA credentials, and that in doing so, he allowed controlled substances to be prescribed outside the usual course of professional practice and without a legitimate medical purpose. RD, at 24-27.

Respondent's Hard Token, Credentials, and Electronic Prescribing

In July 2019, Respondent ^[3] received an unsolicited fax offering employment as a prescribing practitioner with a telemedicine platform called Church Ekklasia Sozo (CES).^[4] RD, at 11-12; Tr. 184-86, 327; Respondent's Exhibit (RX) 1. The company was based out of North Carolina and Respondent lived and worked in Texas. RD, at 4, 10, 12; ALJX 8, at 2, Stips. 1-3. Respondent joined CES in September 2019 and had his first patient intake and clinical encounter in May 2020. RD, at 12; Tr. 197-98. Respondent worked as a contractor physician for CES from September 9, 2019, to December 13, 2021. RD, at 4, 11-12; Tr. 40, 192-94; ALJX 8, at 2, Stip. 2. As a condition of employment at CES, Respondent was required to obtain a hard token ^[5] for the purpose of issuing electronic controlled substance prescriptions and to give the hard token to CES staff in North Carolina. RD, at 4, 6-7, 13; Tr. 44-45, 58-59, 227-29, 231, 280, 284. Respondent admitted to giving his hard token to CES and allowing the company to keep his electronic signature on file to issue controlled substance prescriptions under his DEA registration. Id.

On December 1, 2021, a DEA Diversion Investigator (DI) ^[6] conducted a regulatory inspection of Respondent's registered premises. RD, at 3-4; Tr. 28, 31-38, 138, 141-42, 156; Government's Exhibit (GX) 2. At the inspection, the DI informed Respondent that over 1,900 prescriptions for buprenorphine products (a schedule III controlled substance) had been issued under his registration in the past two years. RD, at 4; Tr. 41-43. Respondent stated that this number was “too high” because he only saw “about 20 to 25 patients.” Id. The DI asked Respondent to show her a prescription that he had issued, and Respondent pulled up a recently issued controlled substance prescription for patient J.O. RD, at 5-6; Tr. 50-53; GX 20, at 29. The prescription bore a time stamp indicating that it had been signed by Respondent while the DI was conducting the inspection. Id. Although the prescription for J.O. purported to be signed by Respondent, Respondent told the DI that he did not know this patient, ( print page 84196) had never conducted a telemedicine appointment for this patient, and had never established a doctor-patient relationship with this patient. RD, at 8-9, 18; Tr. 107-09, 148-56, 161-63, 234, 236, 286-87, 296-97, 332; GX 24.

The DI asked how Respondent could have signed and issued this prescription during the inspection when Respondent had not conducted any telemedicine visits during that time. RD, at 5-6; Tr. 53. Respondent explained that CES had his signature on file, which allowed the company's unregistered staff to issue electronic prescriptions on his behalf. RD, at 4; Tr. 44-45. Respondent also stated that he had given his hard token to CES in North Carolina as a condition of his employment with CES.^[7] RD, at 6-7, 13; Tr. 58-59, 227-29, 231, 280, 284-85. Further, CES's owner telephonically explained that it was CES's standard procedure for nurses to sign the prescriptions, “because the [ nurses] were [ ] agent[s] of the doctor.” RD, at 4-6; Tr. 53-54.

II. Discussion

A. The Five Public Interest Factors

Under the CSA, “[a] registration . . . to . . . dispense a controlled substance . . . may be suspended or revoked by the Attorney General upon a finding that the registrant . . . has committed such acts as would render his registration under [21 U.S.C. 823] inconsistent with the public interest as determined under such section.” 21 U.S.C. 824(a). In making the public interest determination, the CSA requires consideration of the following factors:

(A) The recommendation of the appropriate State licensing board or professional disciplinary authority.

(B) The [registrant's] experience in dispensing, or conducting research with respect to controlled substances.

(C) The [registrant's] conviction record under Federal or State laws relating to the manufacture, distribution, or dispensing of controlled substances.

(D) Compliance with applicable State, Federal, or local laws relating to controlled substances.

(E) Such other conduct which may threaten the public health and safety.

21 U.S.C. 823(g)(1).

The Agency considers these public interest factors in the disjunctive. Robert A. Leslie, M.D.,68 FR 15227, 15230 (2003). Each factor is weighed on a case-by-case basis. Morall v. Drug Enf't Admin., 412 F.3d 165, 173-74 (D.C. Cir. 2005). Any one factor, or combination of factors, may be decisive. David H. Gillis, M.D.,58 FR 37507, 37508 (1993). The inquiry is “focuse[d] on protecting the public interest.” Jayam Krishna-Iyer, M.D.,74 FR 459, 462 (2009).

The Government has the burden of proof in this proceeding. 21 CFR 1301.44. While the Agency has considered all the public interest factors in 21 U.S.C. 823(g)(1), the Government's evidence in support of its prima facie case for revoking Respondent's registration is confined to Factors B and D. RD, at 24 n.24 (finding that Factors A, C, and E do not weigh for or against the sanction sought by the Government). Having reviewed the record and the RD, the Agency adopts the ALJ's analysis, and agrees that the Government's evidence satisfies its prima facie burden of showing that Respondent's continued registration would be inconsistent with the public interest. RD, at 27, 33; 21 U.S.C. 824(a)(4).

B. Factors B and D

Evidence is considered under public interest factors B and D when it reflects compliance or non-compliance with laws related to controlled substances and experience dispensing controlled substances. See Sualeh Ashraf, M.D.,88 FR 1,095, 1,097 (2023); Kareem Hubbard, M.D.,87 FR 21,156, 21,162 (2022).

DEA regulations allow registrants to issue electronic prescriptions for controlled substances in schedules II-V. 21 CFR 1311.100(b); RD, at 23. To issue an electronic prescription for a controlled substance, the prescriber must authenticate the prescription using at least two of the following factors: (1) “Something only the practitioner knows, such as a password or response to a challenge question”; (2) “Something the practitioner is, biometric data such as a fingerprint or iris scan”; and/or (3) “Something the practitioner has, a device (hard token) separate from the computer to which the practitioner is gaining access.” 21 CFR 1311.115(a), 1311.120(b)(5), (11); RD, at 23; Tr. 45. This two-factor authentication process “constitute[s] the signing of the prescription by the practitioner.” 21 CFR 1311.140(a)(5). “[O]nly the registrant may sign the prescription,” and when signing the prescription, the registrant must comply with the two-factor authentication requirement. 21 CFR 1311.135(a); RD, at 23. Although DEA regulations permit a non-registered agent to enter data on the prescription, the registrant must sign the prescription himself. Id.

DEA regulations make clear that “[t]he practitioner must retain sole possession of the hard token” and “must not allow any other person to use the token.” ^[8] 21 CFR 1311.102(a); RD, at 23. The regulation further states that the practitioner “must not share the password or other knowledge factor, or biometric information, with any other person” and “[t]he practitioner must not allow any other person to use the token or enter the knowledge factor or other identification means to sign prescriptions for controlled substances.” Id. “Failure by the practitioner to secure the hard token, knowledge factor, or biometric information may provide a basis for revocation or suspension of registration.” Id.

Regarding the hard token, substantial record evidence, including Respondent's admission, establishes that Respondent gave his hard token to CES staff in North Carolina and allowed them to maintain physical possession of it. RD, at 25-26; Tr. 53-59, 66-67, 227-31, 237, 285. Accordingly, substantial record evidence establishes that Respondent failed to “retain sole possession of the hard token,” in violation of 21 CFR 1311.102(a). RD, at 25-26; see also Allan Alexander Rashford, M.D.,87 FR 77637, 77637-38 (2022) (revoking respondent's registration, in part, for violating 21 CFR 1311.102(a) due to “entrusting his secure credentials to his wife and son and allowing them to access and provide his PIN” to prescribe controlled substances).

Regarding credentials, substantial record evidence, including Respondent's admission, establishes that Respondent allowed CES to keep his signature on file to use in conjunction with the hard token in order to complete the two-factor authentication process for signing and issuing electronic controlled substance prescriptions on his behalf. RD, at 26; Tr. 44-45, 53-59, 157, 163, 222, 225-27, 229, 231, 280, 284; GX 14; GX 20-21 (prescriptions issued by CES staff to J.O. and three other patients). In so doing, Respondent violated federal and state regulations that prohibit any person other than the registrant from signing ( print page 84197) and authenticating an electronic controlled substance prescription. RD, at 26; Tr. 57-58; 21 CFR 1311.135(a); 22 Tex. Admin. Code § 315.3(c)(1) (requiring Texas practitioners to comply with the requirements set forth in 21 CFR 1311).

Respondent allowed illegal electronic controlled substance prescriptions to be issued under his registration by giving away his hard token and two-factor authentication credentials.^[9] RD, at 4-5, 16, 26, 32; Tr. 42-43, 226. The regulations governing the issuance of electronic controlled substance prescriptions do not “relieve[] a practitioner of his responsibility to dispense controlled substances only for a legitimate medical purpose while acting in the usual course of his professional practice.” 21 CFR 1311.102(k); RD, at 23; see also21 CFR 1311.100(f). “The practitioner has the same responsibilities when issuing [an electronic prescription] as when issuing a paper or oral prescription,” including the requirement “to ensure the validity of [that] prescription.” 21 CFR 1311.102(k); RD, at 23.

Under DEA regulations, a controlled substance prescription may only “be issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his professional practice.” 21 CFR 1306.04(a). Similarly, under Texas law, a controlled substance prescription may only be issued “for a valid medical purpose and in the course of medical practice.” Tex. Health & Safety Code § 481.071(a). Texas law states that prescribing a controlled substance “without first establishing a valid practitioner-patient relationship” falls outside the scope of professional medical practice. 22 Tex. Admin. Code § 190.8(1)(L).

Respondent admitted that he never established a doctor-patient relationship with J.O., yet thirteen prescriptions were written for J.O. using Respondent's hard token and electronic signature.^[10] RD, at 8-9, 18, 26; Tr. 107-09, 148-56, 161-63, 234, 286-87, 296-97, 332; GX 20, 24. Accordingly, these prescriptions were issued without a legitimate medical purpose and outside the usual course of professional practice, in violation of federal and state law.^[11] RD, at 26; 21 CFR 1306.04(a); Tex. Health & Safety Code § 481.071(a); 22 Tex. Admin. Code § 190.8(1)(L).

In sum, and in agreement with the RD, the Agency finds that the record contains substantial evidence that Respondent acted in violation of both federal and state law. RD, at 24-27; 21 U.S.C. 823(g)(1), 824(a)(4); 21 CFR 1306.04(a), 1311.100(f), 1311.102(a), (k), 1311.115(a), 1311.120(b)(5), (b)(11), 1311.125(c), 1311.135(a), 1311.140(a)(5); 22 Tex. Admin. Code § 315.3(c)(1); Tex. Health & Safety Code § 481.071(a). In weighing factors B and D, the Agency finds that the Government has established a prima facie case that Respondent committed acts that render his registration inconsistent with the public interest and support revocation of his registration. 21 U.S.C. 823(g)(1); RD, at 27.

III. Sanction

Where, as here, the Government has established sufficient grounds to issue a sanction against Respondent's registration, the burden shifts to the registrant to show why he can be entrusted with the responsibility carried by a registration. Garret Howard Smith, M.D.,83 FR 18882, 18910 (2018). “[T]rust is necessarily a fact-dependent determination based” on individual circumstances; therefore, the Agency looks at factors such as “the acceptance of responsibility and the credibility of that acceptance as it relates to the probability of repeat violations or behavior,” “the nature of the misconduct that forms the basis for sanction,” and “the Agency's interest in deterring similar acts.” Robert Wayne Locklear, M.D.,86 FR 33738, 33746 (2021). To be effective, acceptance of responsibility must be unequivocal. Mohammed Asgar, M.D.,83 FR 29569, 29573 (2018). When a registrant has committed acts inconsistent with the public interest, he must both accept responsibility and demonstrate that he has undertaken corrective measures. Holiday CVS, L.L.C., d/b/a CVS/Pharmacy Nos. 219 and 5195,77 FR 62316, 62339 (2012) (internal quotations omitted).

Here, Respondent has failed to fully and credibly accept responsibility for the proven misconduct. RD, at 27-29. When asked about his decision to surrender physical possession of the hard token to CES, Respondent expressed regret and remorse. RD, at 28; Tr. 229, 316. Respondent testified that turning over the hard token was “a decision that [he] now regret[s] and [is] extremely remorseful about.” RD, at 28; Tr. 229, 316. Regret and remorse, however, are not the same as taking ( print page 84198) ownership of the misconduct, its gravity, and its threat to public safety.^[12]

When specifically asked whether he accepted responsibility, he testified that he “accept[s] full responsibility for the mistakes that occurred.” RD, at 28; Tr. 335. However, that acceptance of responsibility was far from unequivocal as Respondent repeatedly blamed his decision to give up possession of the token on CES. RD, at 28. Respondent testified that in trusting CES with his hard token, he had “the wool pulled over [his] eyes.” Id.; Tr. 238. He testified that CES created an impression of being compliant with state and federal law. RD, at 13-17. Specifically, he testified about receiving a memorandum from the company's CEO detailing the effects of the Drug Addiction Treatment Act (DATA) of 2000 on the company's prescribing practices, RD, at 16; Tr. 199-204; RX 4, and how this memorandum gave him assurance that CES was taking regulatory compliance seriously. RD, at 16; Tr. 209-10. He also testified about a July 2021 audit report written by the company's compliance officer, a former DEA DI, which memorialized the policy that the company and its agents were authorized to issue controlled substance prescriptions on behalf of the provider. RD, at 13-16; Tr. 219-27, 314; RX 2, at 18. Respondent testified that he was “impressed that [CES] took the trouble and had retained a retired DEA investigator as their chief compliance officer to ensure that the company was following rules and regulations.” RD, at 12; Tr. 189-93, 334. He testified that all these assurances led him to believe that CES had more expertise than he did regarding regulatory compliance. RD, at 13, 31-32; Tr. 230, 283-84, 321.

Respondent also testified that he read the requirement to retain sole possession of the hard token prior to joining CES,^[13] but blamed the company for misinterpreting the regulation.^[14] RD, at 28, 31-32; Tr. 315-16. Shifting the blame onto the company further undermines his attempt to accept responsibility.^[15] Id.

Furthermore, Respondent testified that when he gave up physical possession of his hard token, he believed CES would only use the token and his credentials to issue controlled substance prescriptions for patients with whom Respondent had established a doctor-patient relationship. RD, at 16, 32; Tr. 222-23, 230, 284. Even if this was his intention, relinquishing control of the token in-and-of-itself was a clear violation of 21 CFR 1311.102(a) that allowed diversion to occur. Respondent's attempt to downplay his misconduct further undermines his acceptance of responsibility and calls into question whether he truly understands the gravity of his misconduct. RD, at 30-32. In sum, the Agency agrees with the RD that Respondent failed to unequivocally accept responsibility for the proven violations. RD, at 27-29.

The Agency is only required to consider remedial measures where a respondent has tendered a full and credible acceptance of responsibility. Ajay S. Ahuja, M.D.,84 FR 5479, 5498 n.33 (2019); Daniel A. Glick, D.D.S., 80 FR at 74810. Here, the Agency need not consider remedial measures given the lack of acceptance of responsibility. RD, at 29. Nevertheless, even if Respondent had accepted responsibility, his proposed remedial measures would not change the outcome of this case.^[16] Id.

In addition to acceptance of responsibility, the Agency looks to the egregiousness and extent of the misconduct. Garrett Howard Smith, M.D., 83 FR at 18910 (collecting cases), and considers both specific and general deterrence when determining an appropriate sanction. Daniel A. Glick, D.D.S., 80 FR at 74810.

Here, the Agency agrees with the ALJ that Respondent's misconduct was egregious. RD, at 29-30. The CSA establishes a “closed system for regulating the distribution” of controlled substances “to prevent the diversion of these substances to those who would either abuse them or sell them to those who do.” Holiday CVS, L.L.C., d/b/a CVS/Pharmacy Nos. 219 and 5195, 77 FR at 62317 (citing Gonzales, 546 U.S. at 250). DEA regulations contain a clear mandate to “retain sole possession of the hard token” for a reason: to keep the closed system of distribution closed.^[17] Gonzales, 546 U.S. at 250-51. ( print page 84199) In this case, Respondent enabled unregistered individuals at an unregistered location to issue multiple controlled substance prescriptions, including at least a year's worth of controlled substance prescriptions for patient J.O. whom Respondent had never evaluated. RD, at 4-5, 16, 18, 26, 29-30; Tr. 42-43, 50, 225-26. Therefore, by giving away his hard token and two-factor authentication data to unauthorized persons, Respondent committed egregious violations of DEA's regulations that created a risk of diversion and threatened public safety. RD, at 29-31.

The Agency also concludes that revocation of Respondent's registration is necessary to deter the registrant community from engaging in similar misconduct. RD, at 30-31. There is simply no conceivable world in which it is acceptable for a practitioner to give away his or her prescribing credentials to anyone else, including a telemedicine platform. When a practitioner is awarded the privilege of prescribing controlled substances in the form of a registration, that privilege belongs to the registrant and the registrant alone—it cannot be given away. The Agency agrees with the ALJ that the interests of general deterrence support revocation, as a lack of sanction in the current matter would send a message to the registrant community that giving away a hard token and two-factor authentication credentials can be overlooked and excused. RD, at 30; see also Jeffrey Pollock, P.A., 89 FR at 54058. Revocation is also necessary to impress upon Respondent the seriousness of his misconduct and to deter him from committing the same misconduct in the future. Id.

In sum, Respondent has not offered sufficient mitigating evidence to establish that he can be trusted with the responsibility of maintaining a DEA registration. RD, at 27-33. Accordingly, the Agency will order that Respondent's registration be revoked. RD, at 33.

Order

Pursuant to 28 CFR 0.100(b) and the authority vested in me by 21 U.S.C. 824(a), I hereby revoke DEA Certificate of Registration No. FS2968444 issued to Neeraj B. Shah, M.D. Further, pursuant to 28 CFR 0.100(b) and the authority vested in me by 21 U.S.C. 823(g)(1), I hereby deny any pending applications of Neeraj B. Shah, M.D., to renew or modify this registration, as well as any other pending application of Neeraj B. Shah, M.D., for additional registration in Texas. This Order is effective November 20, 2024.

Signing Authority

This document of the Drug Enforcement Administration was signed on October 10, 2024, by Administrator Anne Milgram. That document with the original signature and date is maintained by DEA. For administrative purposes only, and in compliance with requirements of the Office of the Federal Register, the undersigned DEA Federal Register Liaison Officer has been authorized to sign and submit the document in electronic format for publication, as an official document of DEA. This administrative process in no way alters the legal effect of this document upon publication in the Federal Register .

Heather Achbach,

Federal Register Liaison Officer, Drug Enforcement Administration.

Footnotes

1.  The Agency adopts the ALJ's summary of the witnesses' testimonies as well as the ALJ's assessment of the witnesses' credibility. RD, at 3-21.

2.  On May 30, 2024, Respondent signed a DEA Form 104, Surrender for Cause of DEA Certificate of Registration. See21 CFR 1301.52(a). Even when a registration is terminated, the Agency has discretion to adjudicate the OSC to finality. See Jeffrey D. Olsen, M.D.,84 FR 68,474, 68,479 (2019) (declining to dismiss an immediate suspension order when the registrant allowed the registration to expire before final adjudication); Steven M. Kotsonis, M.D.,85 FR 85667, 85668-69 (2020) (concluding that termination of a registration under 21 CFR 1301.52 does not preclude DEA from issuing a final decision and that the Agency would assess such matters on a case-by-case basis to determine if a final adjudication is warranted); The Pharmacy Place,86 FR 21008, 21008-09 (2021) (“Adjudicating this matter to finality will create a public record to educate current and prospective registrants about the Agency's expectations regarding the responsibilities of registrant[s] . . . under the CSA and allow stakeholders to provide feedback regarding the Agency's enforcement priorities and practices.”); Creekbend Community Pharmacy,86 FR 40627, 40628 n.4 (2021) (“Adjudicating this matter to finality will create an official record the Agency can use in any future interactions with Respondent . . . or other persons who were associated with Respondent.”). As in these cases, the Agency has evaluated the circumstances of this matter and determined that the matter should be adjudicated to finality for the purpose of creating an official record of the allegations and evidence, and educating the registrant community, the public, and stakeholders about the responsibilities associated with holding a DEA registration and the Agency's enforcement priorities.

3.  The ALJ found that “to the extent [Respondent's] testimony contradicts with that offered by [the Diversion Investigator], [she] gives full credit to the [Diversion Investigator]'s testimony.” RD, at 21. The Agency agrees with the amount of weight that the ALJ afforded Respondent's testimony.

4.  CES's staff did not hold DEA registrations. RD, at 5, 16; Tr. 50, 225-26.

5.  A hard token is a physical device similar to a key fob that may be used to authenticate an electronic prescription. Tr. 45; 21 CFR 1311.115(a)(3), 1311.140(a)(5). The hard token which Respondent used was not offered into evidence. Tr. 47. Instead, a picture of a hard token similar to one used by Respondent was admitted into evidence. Tr. 45-48; GX 22. The picture shows a small device, roughly two inches in length, with a small screen on which a PIN number would be displayed. Id. When a hard token is used to sign a prescription, the token generates a unique identification PIN number which serves as the signature on the prescription. RD, at 5; Tr. 46. The PIN is unique to each prescription and can be traced to the prescriber. Id.

6.  The Agency agrees with the ALJ's assessment that the DI was “a credible, reliable” witness and that her testimony was clear, objective, consistent, precise, and “corroborated by the documentary evidence.” RD, at 9. The ALJ found that “[t]o the extent her testimony conflicts with Respondent's testimony, . . . [she] credits [the DI].” Id. The Agency agrees with the amount of weight that the ALJ afforded Respondent's testimony.

7.  The DI informed Respondent and CES's owner that CES must cease using Respondent's registration for prescribing controlled substances and that the hard token must be returned to Respondent. RD, at 6; Tr. 58, 157, 163. After the inspection ended, Respondent sent an email to CES's owner directing CES to stop using his registration for issuing prescriptions and to overnight return his hard token to his home. RD, at 7, 17; Tr. 62, 66-69, 159, 237; GX 14.

8.  It is important to emphasize the clarity with which this requirement is stated in the regulation. The requirement to “retain sole possession” is stated simply, clearly, and unambiguously in plain language. See Electronic Prescriptions for Controlled Substances, 75 FR 16236, 16277 (Mar. 31, 2010). To further emphasize this point, the RD put it well: the requirement to retain sole possession of the hard token is set forth “in plain, simple English, and is consistent with basic common sense.” RD, at 32.

9.  The Agency finds that it is not necessary to determine the precise number of prescriptions that were issued by CES with Respondent's hard token and credentials. RD, at 26. The record clearly establishes and Respondent admitted that prescriptions were being issued under Respondent's registration for at least one patient he never saw (J.O.) and at quantities that exceeded the patients he did see. See RD, at 4, 20, 26; GX 20, at 17-29; Tr. 41-43 (when the DI informed Respondent that the PMP showed 1,900 prescriptions had been issued under his registration, he responded that this number was “too high” because he only saw “about 20 to 25 patients”); Tr. 234, 236, 286-87, 297, 332.

10.  The allegation that Respondent failed to establish a doctor-patient relationship in this case pertains only to J.O. Tr. 92. Although the Government admitted additional prescriptions into evidence that CES staff issued using Respondent's hard token—all of which were issued in violation of 21 CFR 1311.135(a)—the Government has not alleged that Respondent failed to establish a doctor-patient relationship with these patients. Tr. 81-82, 92.

11.  It is a long-standing principle of diversion law that DEA registrants are “strictly liable for all activities which occur under the authority of their registrations.” Sigrid Sanchez, M.D.,78 FR 39331, 39336 (2013). In line with this well-established principle, it is reasonable to find that a registrant can be held liable for controlled substances being prescribed outside the usual course of professional practice even when issued by someone else under his registration. For instance, where a registrant's actions allow an unregistered person to prescribe controlled substances, as Respondent did here, the registrant can be found in violation of 21 CFR 1306.04(a). Robert G. Hallermeier, M.D.,62 FR 26818, 26820 (1997). This is because the purpose of § 1306.04(a)—to ensure that “patients use controlled substances under the supervision of a doctor so as to prevent” diversion—is thwarted when a registrant allows an unregistered person to prescribe controlled substances under the registrant's registration to patients the registrant has never seen, which occurred in this case. Gonzales v. Oregon, 546 U.S. 243, 274 (2006). When a registrant allows an unauthorized person to prescribe controlled substances, such as when Respondent allowed CES's unregistered staff to prescribe controlled substances to patients Respondent had never seen, the registrant creates a “substantial risk that the drugs would be diverted and abused,” which undermines the purpose of § 1306.04(a)'s prescription requirement. Arvinder Singh, M.D.,81 FR 8247, 8249 (2016).

Holding a registrant liable for violating § 1306.04(a) where prescriptions are issued by someone else under his registration is an extension of the Agency's precedent and the principle that registrants are “strictly liable for all activities which occur under the authority of their registrations.” Sigrid Sanchez, M.D., 78 FR at 39336. For example, in the context of electronic prescriptions, the Agency has revoked a registration, in part, due to the registrant “improperly issu[ing] electronic controlled substance prescriptions by entrusting his secure credentials to his wife and son and allowing them to access and provide his PIN in the issuance of those prescriptions.” Allen Alexander Rashford, M.D., 87 FR at 77638. Similarly, DEA has long held that when a registrant allows other individuals to use their registration, a serious violation is committed. See Brian Thomas Nichol, M.D.,83 FR 47352, 47367 (2018) (concluding respondent committed a “serious violation of the CSA” when he pre-signed prescriptions and gave them to unregistered staff, creating a “substantial risk” of diversion and abuse); Rose Mary Jacinta Lewis, M.D.,72 FR 4035, 4041-42 (2007) (affirming an immediate suspension order where a registrant allowed another person to use her DEA credentials to obtain controlled substances and where such misconduct demonstrated “indifference to her obligations” and created a danger to public safety); Anthony L. Cappelli, M.D.,59 FR 42288, 42288 (1994) (“By allowing an unregistered and unauthorized person to use his DEA number, Respondent was responsible for any use and misuse of that number. Moreover, such a violation is aggravated by the fact that Respondent allowed a non-practitioner to use his DEA number at an unregistered location.”).

12.   See Nicholas P. Roussis, M.D.,86 FR 59190, 59194 (2021) (explaining “remorse and acceptance of responsibility are not the same thing” in that a respondent's remorse is primarily concerned with his unpleasant feelings whereas a full acceptance of responsibility acknowledges the harm his actions posed to the public); Ibrahim Al-Qawaqneh, D.D.S.,86 FR 10354, 10357 (2021) (finding that regret did not amount to acceptance of responsibility).

13.  Respondent testified that he read 21 CFR 1311.102(a) as part of his due diligence before joining CES; however, when the Government asked whether he was aware of a regulation prohibiting the surrender of a hard token to someone else, Respondent stated: “No. Not before I joined CES. I was not aware of this.” Tr. 316. The first words of 21 CFR 1311.102(a) are “[t]he practitioner must retain sole possession of the hard token.” Respondent's testimony that he read this regulation, given his claim that he was not aware that he had to keep the hard token, causes the Agency to question Respondent's credibility. RD, at 31; see also Daniel A. Glick, D.D.S.,80 FR 74,800, 74809 (2015) (holding ignorance of the CSA or DEA's regulations are no defense to proven violations).

14.  He acknowledged that nowhere in the company's protocols or manuals was there an assurance from the company that surrendering his hard token complied with DEA regulations. RD, at 18; Tr. 318-19.

15.  He testified that he “understand[s] the gravity of my—the mistakes that have occurred.” RD, at 28; Tr. 244. Rather than take ownership by calling them “my mistakes,” he referred to mistakes in a passive and general sense. See also Tr. 335 (referring broadly to “mistakes that occurred”). Indeed, the majority of his testimony reveals that Respondent understands the “mistakes” to mean the mistakes that CES made and the mistake that he made in trusting CES. RD, at 28; see Sualeh Ashraf, M.D., 88 FR at 1098 (discrediting respondent's acceptance of responsibility due to him blaming someone else for being the “criminal mind” behind the misconduct); Michael A. White, M.D.,79 FR 62957, 62967-68 (2014) (finding that the standard for accepting responsibility was not met where respondent blamed others for his misconduct); Robert Raymond Reppy, D.O.,76 FR 61,154, 61,180 (2011) (finding that respondent failed to fully and credibly accept responsibility where most of his testimony shifted blame to others and focused on how he was “duped” into violating the CSA). Furthermore, although Respondent acknowledged at the hearing that protecting his registration is “solely” his responsibility, this after-the-fact realization conflicts with other parts of his testimony where he blamed CES for his failure to protect his DEA registration. Tr. 335.

16.  Respondent's proposed remedial measures included deactivating all tokens that he was no longer using; hiring a third-party to conduct a regulatory compliance audit of his practice; searching the PMP for prescriptions issued under his COR; and writing a controlled substances protocol for other practitioners. Tr. 238-43. Although these measures are not without merit, the proposed remediation fails to convince the Agency that he can be trusted with a registration. John Qian, M.D.,89 FR 59934, 59937-38 (2024). In this regard, even if these measures were enacted, Respondent's insufficient acceptance of responsibility demonstrated that he believes it was CES, not himself, who bore ultimate responsibility for the proven misconduct. RD, at 27-28. In this sense, Respondent's proposed measures are not backed up by his willingness to take personal responsibility for his actions, and therefore, their remedial efficacy rings hollow. Jeffrey Pollock, P.A.,89 FR 54052, 54058 n.38 (2024). Additionally, the proposed measures are misplaced. Deactivating unused tokens and auditing his practice have no relevance to the proven violation of failing to maintain sole possession of his hard token and not sharing his authentication credentials. Likewise, checking the PMP and instructing other practitioners on their responsibilities have no bearing on the misconduct, especially given the fact that he believes the misconduct was primarily CES's fault for misleading him. RD, at 27-28. Furthermore, in light of the egregiousness of the misconduct and the need for deterrence, his proposed remedial measures are insufficient. Id. at 29.

17.  In a Notice of Proposed Rulemaking, the Agency explained that by requiring registrants to retain sole possession of the hard token, “the practitioner can eliminate the risk of fraudulent prescriptions and, if the token is lost, stolen, or compromised, he will be immediately alerted to the threat and have the authentication protocol revoked.” See Electronic Prescriptions for Controlled Substances, 73 FR 36722, 36737 (June 27, 2008). The Agency further explained that the requirement for the practitioner to retain sole possession of the hard token serves to protect the practitioner as well as the pharmacy from forged or fraudulent prescriptions, and to provide “assurance that only a legitimate practitioner issued the prescription.” Id.