2020-21302. Suspicious Orders of Controlled Substances

AGENCY:

Drug Enforcement Administration, Department of Justice.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Drug Enforcement Administration (DEA) is proposing to revise its regulations relating to suspicious orders of controlled substances, in order to implement the Preventing Drug Diversion Act of 2018 (PDDA) and to clarify the procedures a registrant must follow for orders received under suspicious circumstances (ORUSCs). Upon receipt of an ORUSC, registrants authorized to distribute controlled substances would have a choice of proceeding under one of two options (the “two option framework”). In addition, these registrants would be required to submit all suspicious order reports to a DEA centralized database, and keep records pertaining to suspicious orders and ORUSCs.

DATES:

Electronic comments must be submitted, and written comments must be postmarked, on or before January 4, 2021.

ADDRESSES:

To ensure proper handling of comments, please reference “RIN 1117-AB47/Docket No. DEA-437” on all correspondence, including any attachments.

Electronic comments: The DEA encourages that all comments be submitted electronically through the Federal eRulemaking Portal, which provides the ability to type short comments directly into the comment field on the web page or attach a file for lengthier comments. Please go to http://www.regulations.gov and follow the online instructions at that site for submitting comments. Upon submission of your comment, you will receive a Comment Tracking Number. Please be aware that submitted comments are not instantaneously available for public view on http://www.regulations.gov. If you have received a Comment Tracking Number, your comment has been successfully submitted and there is no need to resubmit the same comment. Commenters should be aware that the electronic Federal Docket Management System will not accept comments after 11:59 p.m. Eastern Time on the last day of the comment period.

Paper comments: Paper comments that duplicate the electronic submission are not necessary and are discouraged. Should you wish to mail a paper comment in lieu of an electronic comment, it should be sent via regular or express mail to: Drug Enforcement Administration, Attn: DEA Federal Register Representative/DPW, 8701 Morrissette Drive, Springfield, VA 22152.

Paperwork Reduction Act (PRA) Comments: All comments concerning collections of information under the PRA must be submitted to the Office of Information and Regulatory Affairs, Office of Management and Budget (OMB), Attention: Desk Officer for Department of Justice (DOJ), Washington, DC 20503. Please state that your comment refers to “RIN 1117-AB47/Docket No. DEA-437.”

FOR FURTHER INFORMATION CONTACT:

Scott A. Brinks, Diversion Control Division, Drug Enforcement Administration; Mailing Address: 8701 Morrissette Drive, Springfield, VA 22152, Telephone: [phone].

SUPPLEMENTARY INFORMATION:

Posting of Public Comments

Please note that all comments received are considered part of the public record. They will, unless reasonable cause is given, be made available by the DEA for public inspection online at http://www.regulations.gov. Such information includes personal identifying information (such as your name, address, etc.) voluntarily submitted by the commenter. The Freedom of Information Act applies to all comments received. If you want to submit personal identifying information (such as your name, address, etc.) as part of your comment, but do not want it to be made publicly available, you must include the phrase “PERSONAL IDENTIFYING INFORMATION” in the first paragraph of your comment. You must also place the personal identifying information you do not want to be made publicly available in the first paragraph of your comment and identify what information you want redacted.

If you want to submit confidential business information as part of your comment, but do not want it to be made publicly available, you must include the phrase “CONFIDENTIAL BUSINESS INFORMATION” in the first paragraph of your comment. You must also prominently identify confidential business information to be redacted within the comment.

Comments containing personal identifying information and confidential business information identified as directed above will generally be made publicly available in redacted form. If a comment has so much personal identifying information or confidential business information that it cannot be effectively redacted, all or part of that comment may not be made publicly available. Comments posted to http://www.regulations.gov may include any personal identifying information (such as name, address, and phone number) or confidential business information included in the text of your electronic submission that is not identified as directed above as confidential.

For easy reference, an electronic copy of this document and supplemental information (including the complete Economic Impact Analysis to this notice of proposed rulemaking) are available in their entirety under the tab “Supporting Documents” of the public docket for this action at http://www.regulations.gov under FDMS Docket ID: DEA: (RIN 1117-AB47/Docket Number DEA-437) for easy reference.

I. Executive Summary

A. Summary of the Rule

The DEA is revising its regulations relating to suspicious orders of controlled substances in order to implement the Preventing Drug Diversion Act of 2018 (PDDA) and, through the adoption of the two-option framework, to clarify the procedures a registrant must follow for orders received under suspicious circumstances (ORUSCs). Upon receipt of an ORUSC, registrants authorized to distribute controlled substances ^[1] will have a choice (under the two-option framework) to either: (1) Immediately file a suspicious order report through the DEA centralized database, decline to distribute pursuant to the suspicious order, and maintain a record of the suspicious order and any due diligence related to the suspicious order,^[2] or (2) before distributing pursuant to the order, conduct due diligence to investigate each suspicious circumstance surrounding the ORUSC, and maintain a record of its due diligence regarding the ORUSC.^[3]

Under the second option, if, through its due diligence, the registrant is able to dispel each suspicious circumstance surrounding the ORUSC within seven calendar days after receipt of the order, it is not a suspicious order. After that determination is made, the registrant may thereafter distribute pursuant to the order. The order need not be reported to the DEA as a suspicious order, but the registrant must maintain a record of its due diligence.^[4] However, if the registrant is unable, through its due diligence, to dispel each suspicious circumstance surrounding the ORUSC within seven calendar days after receiving the order, it is a suspicious order. The registrant must then promptly file a suspicious order report through the DEA centralized database, decline to distribute pursuant to the suspicious order, and maintain a record of its due diligence.^[5] All suspicious order reports must be made to the DEA centralized database and contain certain required information,^[6] and all records of suspicious orders and ORUSCs must be prepared and maintained in accordance with DEA regulations, and must contain certain required information.^[7]

Related to this two-option framework, and as discussed in more detail below,^[8] the DEA is also defining four terms in its regulations: “due diligence”, “order”, “order received under suspicious circumstances”, and “suspicious order.” ^[9]

B. Summary of the Impact of the Rule

The DEA has analyzed the impact of the rule under Executive Order 12866 (E.O.),^[10] E.O. 13771,^[11] and the Regulatory Flexibility Act (RFA).^[12] The Office of Information and Regulatory Affairs (OIRA) in the Office of Management and Budget has determined that this rulemaking is a significant regulatory action within the meaning of E.O. 12866. The DEA has therefore submitted this rule for review by OMB. In addition, the DEA has determined that this rule has a total cost savings of $2,931,000 and is therefore expected to be an E.O. 13771 deregulatory action. Finally, the DEA is certifying that this rule will not have a significant economic impact on a substantial number of small entities within the meaning of the RFA. The DEA's analysis and conclusions regarding E.O. 12866, E.O. 13771, and the RFA are discussed in further detail, below.^[13]

II. Suspicious Orders and the Opioid Epidemic

Identifying and reporting suspicious orders of controlled substances (and refusing to distribute based on such orders), has always been, and remains, the responsibility of the DEA registrant.^[14] This responsibility is of critical importance because diversion methods are constantly evolving, and because registrants are best situated to know their customers. As the DEA has previously stated, cutting off the controlled substance supply sources of “drug pushers operating under the patina of legitimate authority” is not something the DEA can do entirely by itself—rather, the DEA “must rely on registrants to fulfill their obligation under the [Controlled Substances Act (CSA)] to ensure that they do not supply controlled substances to entities which act as drug pushers.” ^[15]

Five closely related legal obligations contained in the CSA ^[16] and DEA regulations relate to the identification and reporting of suspicious orders: The obligation to maintain effective controls against diversion,^[17] to conduct due diligence,^[18] to design and operate a system to identify suspicious orders for the registrant,^[19] to report suspicious orders (the reporting requirement),^[20] and to refuse to distribute controlled substances that are likely to be diverted into illegitimate channels (the shipping requirement).^[21] The purpose of identifying and reporting suspicious orders to DEA is to provide DEA investigators in the field with information regarding potential illegal activity in an expeditious manner.

However, at various times, and in various places and manners, some registrants have failed to fulfill their obligations regarding the identification and reporting of suspicious orders. For example, some registrants failed to design or operate any system to identify suspicious orders. Other registrants designed a system, but in doing so relied solely on rigid formulas that may not identify suspicious orders.^[22] Still other registrants failed to properly operate a system, by, for example, failing to implement their internal policies regarding due diligence in the identification and reporting of suspicious orders.

Some registrants failed to file timely and specific suspicious order reports, opting instead to file no reports, or rely on the submission of Automation of Reports and Consolidated Information Systems (ARCOS) ^[23] reports as a purported substitute for submitting suspicious order reports.^[24] Other registrants filed end-of-month “excessive purchase” reports (that were reported after the order had already been filled), submitted a list of largest purchasers, or reported customers with whom the registrant had terminated a business relationship. Some registrants interpreted the definition of suspicious order found in DEA regulations to extend no further than orders deemed suspicious based on the size, pattern, or frequency of the order or orders.^[25] Reports were often filed with DEA Field Division Offices, with no fixed format, and often without a stated reason as to why the order was considered suspicious.

Other registrants filed suspicious order reports, but then distributed controlled substances pursuant to the order anyway—failing to conduct due diligence prior to distributing controlled substances by, for example, keeping sparse or inadequate records and due diligence files, or by merely verifying that their customer was a DEA registrant.

As a consequence of failing to fulfill their obligations regarding the identification and reporting of suspicious orders, some registrants were required to pay large fines and enter into Memorandums of Agreement (MOAs) with DEA requiring, among other things, that they report suspicious orders electronically and centrally to DEA Headquarters.^[26]

In sum, this was unsuccessful in detecting and preventing diversion. Suspicious orders ultimately rose to national significance through various cases. For example, one investigation revealed that between 2007 and 2012, wholesale distributors shipped 780 million hydrocodone and oxycodone pills to West Virginia, and 1,728 West Virginians fatally overdosed on these two substances.^[27] And in 2013, the nation's largest drug store chain entered into the largest settlement in DEA history, agreeing to pay $80 million in civil fines for, among other things, allegations that it failed to report suspicious orders.^[28]

Over the years, DEA has taken steps to address suspicious orders based on its own initiative, based on registrant requests that DEA further clarify their obligations under the law and provide registrants with the ability to see the distributions a particular customer has received from other distributors, and based on the PDDA. DEA has provided guidance, training, and individualized meetings for the regulated industry,^[29] and has utilized the various enforcement tools available to it under the CSA.^[30] DEA has also proactively leveraged the data that is available to it through ARCOS, and has developed a tool through ARCOS to assist distributors in making their suspicious order assessments (the “ARCOS distributor tool”).^[31] In addition, DEA has taken appropriate criminal, civil, and administrative action against distributors, pharmacies, and other practitioners. By proposing this regulation to implement the PDDA and clarify the procedures a registrant must follow in identifying and reporting suspicious orders (and refusing to distribute based on such orders), DEA is taking the next step to address suspicious orders and combat the opioid epidemic.

III. Legal Authority for the Rule

A. Legal Authority for the Rule: The CSA and Rulemaking Authority

The CSA and its implementing regulations are designed to prevent, detect, and eliminate the diversion of controlled substances into the illicit market while ensuring an adequate supply is available for the legitimate medical, scientific, research, and industrial needs of the United States. Controlled substances have the potential for abuse and dependence and are controlled to protect the public health and safety. Through the enactment of the CSA, Congress has established a closed system of distribution by making it unlawful to handle any controlled substance except in a manner authorized by the CSA. In order to maintain this closed system of distribution, the CSA imposes registration requirements on handlers of controlled substances.

The CSA also grants the Attorney General authority to promulgate and enforce any rules, regulations, and procedures which he may deem necessary and appropriate for the efficient executions of his functions under the CSA.^[32] The Attorney General delegated these authorities to the Administrator of the DEA, who in turn redelegated many of these authorities to the Deputy Administrator of the DEA and the Assistant Administrator of the DEA Office of Diversion Control.^[33]

B. Legal Authority for the Rule: Centralized Reporting Under the PDDA

On October 24, 2018, President Trump signed into law the “Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act” (SUPPORT Act).^[34] The PDDA was contained within the SUPPORT Act.^[35] The PDDA required DEA to establish a centralized database for collecting reports of suspicious orders not later than one year from the date of the PDDA's enactment. Upon discovering a suspicious order or series of orders, the PDDA required registrants to notify the DEA Administrator and Special Agent in Charge of the Division Office of the DEA for the area in which the registrant is located or conducts business, but provided that “[i]f a registrant reports a suspicious order to the DEA centralized database . . . the registrant shall be considered to have complied with the [notification] requirement . . . .” ^[36] With these provisions, the PDDA replaced DEA Field Division Office reporting (reflected in current DEA regulations at 21 CFR 1301.74(b)) with centralized reporting to DEA Headquarters.

C. Legal Authority for the Rule: Other Provisions of the PDDA

In addition to centralized reporting of suspicious orders, the PDDA required each registrant to design and operate a system to identify suspicious orders for the registrant,^[37] and to ensure that the system complies with applicable Federal and State privacy laws. The PDDA also provided that the term suspicious order “may include, but is not limited to” ^[38] size, pattern, and frequency orders.

By its codification of the phrase “may include, but is not limited to,” the PDDA clarified that an order for controlled substances can be deemed suspicious for reasons other than size, pattern, or frequency (including reasons related to the characteristics of the customer submitting the order).^[39] Therefore, systems to identify suspicious orders should be designed and operated in light of the ultimate goal of the suspicious order inquiry: to provide DEA investigators in the field with information regarding potential illegal activity in an expeditious manner. To this end, DEA is proposing to amend its regulations to provide that registrants should design privacy-law-compliant systems ^[40] not only to identify size, pattern, and frequency orders, but also to identify suspicious orders based on facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.^[41]

IV. Background Discussion

A. History of Applicable DEA Regulations

Since the CSA became law in 1970, all DEA registrants who distribute controlled substances have had a duty to maintain effective controls against diversion of controlled substances into other than legitimate medical, scientific, and industrial channels.^[42] In addition, the first regulations implementing the CSA in 1971 contained provisions regarding suspicious orders of controlled substances.^[43] These provisions, as currently codified in DEA regulations, require that registrants design and operate a system to disclose to the registrant suspicious orders of controlled substances, i.e., orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency.^[44] It also requires the registrant to “inform the Field Division Office of the Administration in his area of suspicious orders when discovered by the registrant.” ^[45]

B. History of ARCOS

In addition to the suspicious order provisions, the CSA and DEA regulations also require manufacturers and distributors to report their controlled substance transactions to DEA.^[46] DEA implements this requirement through ARCOS.^[47] ARCOS is an automated, comprehensive drug reporting system which monitors the flow of controlled substances from their point of manufacture through commercial distribution channels to point of sale or distribution at the dispensing level through the use of acquisition/distribution transaction reports.

Included in the list of controlled substance transactions tracked by ARCOS are the following: All schedule I and II materials (manufacturers and distributors), schedule III narcotic and gamma-hydroxybutyric acid (GHB) materials (manufacturers and distributors), and selected schedule III and IV psychotropic drugs (manufacturers only).^[48] ARCOS accumulates these transactions which are then summarized into reports which give investigators in Federal and State government agencies information that can then be used to identify the diversion of controlled substances into illicit channels of distribution. DEA regulations require that ARCOS acquisition/distribution reports be filed every quarter, not later than the 15th day of the month succeeding the quarter for which it is submitted.^[49]

C. ARCOS Distributor Tool

Prior to the SUPPORT Act, the DEA developed an ARCOS tool that allowed registrants to obtain a count of the number of registrants who had sold a particular controlled substance to a prospective customer in the last six months.^[50] On February 26, 2019, as part of its implementation of the SUPPORT Act, the DEA announced the launch of an enhanced tool to help more than 1,500 registered drug manufacturers and distributors in the U.S. more effectively identify potential illicit drug diversion.^[51] The enhancement allows DEA-registered manufacturers and distributors to view and download the number of distributors and the amount (anonymized data in both grams and dosage units) each distributor sold to a prospective customer in the last available six months of data.

D. The Due Diligence Requirement

1. Due Diligence and Southwood

In Southwood,^[52] the registrant failed repeatedly to comply with the effective controls requirement, the system requirement, and the reporting requirement.^[53] In Southwood, DEA noted that Respondent's due diligence measures, which initially involved nothing more than verifying license and registration, were wholly deficient.^[54] DEA stated that:

“even after being advised by agency officials that its internet pharmacy customers were likely engaged in illegal activity, Respondent failed miserably to conduct adequate due diligence. Notwithstanding the breadth of information provided during the conference call, Respondent did not stop selling to any of its internet pharmacy customers while it investigated the legitimacy of their business activities.” ^[55]

In addition, the DEA concluded that:

“Respondent repeatedly violated federal regulations by failing to report suspicious orders . . . Respondent's experience in distributing controlled substances is characterized by recurring distributions of extraordinary quantities of controlled substances to entities which then likely diverted the drugs by filling prescriptions which were unlawful. Moreover, Respondent's due diligence measures were wholly inadequate to protect against the diversion of the drugs. Respondent's failure to maintain effective controls against diversion and its experience in distributing controlled substances thus support the conclusion that its continued registration would be ‘inconsistent with the public interest.' ” ^[56]

In reaching these conclusions, DEA noted:

“In short, the direct and foreseeable consequence of the manner in which Respondent conducted its due diligence program was the likely diversion of millions of dosage units of hydrocodone. Indeed, it is especially appalling that notwithstanding the information Respondent received from both this agency and the pharmacies, it did not immediately stop distributing hydrocodone to any of the pharmacies.” ^[57]

2. Due Diligence and DEA I and II

In 2006 and 2007, DEA sent letters to DEA registrants outlining their legal obligations to report suspicious orders and conduct due diligence.^[58] These letters emphasized that, as a condition of maintaining their registration, all legitimate handlers of controlled substances must take reasonable steps to ensure that their registration is not being utilized as a source of diversion.^[59] If the closed system is to function properly, registrants must be vigilant in deciding whether a prospective customer can be trusted to deliver controlled substances only for lawful purposes.^[60] The requirement to report suspicious orders is in addition to, and not in lieu of, the general requirement to maintain effective controls against diversion.^[61] Thus, in addition to reporting all suspicious orders, a distributor has a statutory responsibility to exercise due diligence to avoid filling suspicious orders that might be diverted into other than legitimate medical, scientific, and industrial channels.^[62] Failure to exercise such due diligence could, as circumstances warrant, provide a statutory basis for revocation or suspension of a distributor's registration.^[63] In a similar vein, given the requirement that a registrant maintain effective controls against diversion, a distributor may not simply rely on the fact that the person placing the suspicious order is a DEA registrant and turn a blind eye to the suspicious circumstances.^[64] To maintain effective controls against diversion, the registrant should exercise due care in confirming the legitimacy of all orders prior to filling.^[65]

In addition, registrants' responsibility does not end merely with the filing of a suspicious order report.^[66] Registrants must conduct an independent analysis of suspicious orders prior to completing a sale to determine whether the controlled substances are likely to be diverted from legitimate channels.^[67] Reporting an order as suspicious will not absolve the registrant of responsibility if the registrant knew, or should have known, that the controlled substances were being diverted.^[68] Registrants that routinely report suspicious orders, yet fill these orders without first determining that order is not being diverted, may be failing to maintain effective controls against diversion; and failure to maintain effective controls against diversion is inconsistent with the public interest as that term is used in the CSA and may result in the revocation of the registrant's DEA Certificate of Registration.^[69]

3. Due Diligence and Masters

The Masters case,^[70] which involved due diligence within the context of a two-part system that the registrant failed to properly operate, illustrates how the due diligence requirement is relevant to both the reporting and shipping requirement. In Masters, the registrant created a system consisting of a computer program and a compliance protocol. The computer program was designed to identify and hold any order that met or exceeded the criteria for suspicious orders set out in DEA regulations. Once an order was held, the registrant's staff would implement the compliance protocol, which required an investigation of the order to determine whether it was legitimate. After this investigation, the staff could deem the order non-suspicious and ship it, or treat the order as suspicious, report it to the DEA, and decline to fill the order.^[71] However, despite having designed its system to require additional due diligence into “held” orders,^[72] the registrant failed to actually conduct the additional due diligence.

In the Masters Decision and Order, the DEA stated that “upon investigating an order, a distributor may determine that an order is not suspicious . . . .” ^[73] The DEA further explained:

“[W]hile . . . a distributor's investigation of the order (coupled with its previous due diligence efforts) may properly lead it to conclude that the order is not suspicious, the investigation must dispel all red flags indicative that a customer is engaged in diversion to render the order non-suspicious and exempt it from the requirement that the distributor `inform' the Agency about the order. Put another way, if even after investigating the order, there is any remaining basis to suspect that a customer is engaged in diversion, the order must be deemed suspicious and the Agency must be informed.” ^[74]

On appeal in Masters, the United States Court of Appeals for the District of Columbia Circuit (the Masters Court) stated:

“[o]nce a distributor has reported a suspicious order, it must make one of two choices: decline to ship the order, or conduct some ‘due diligence' and—if it is able to determine that the order is not likely to be diverted into illegitimate channels—ship the order . . . .” ^[75]

The Masters Court also added:

“it is not necessary for a distributor of controlled substances to investigate suspicious orders if it reports them to DEA and declines to fill them. But if a distributor chooses to shoulder the burden of dispelling suspicion in the hopes of shipping any it finds to be non-suspicious, and the distributor uses something like the [Suspicious Order Monitoring Program] Protocol to guide its efforts, then the distributor must actually undertake the investigation.” ^[76]

Finally, the Masters Court rooted due diligence in the reporting requirement, as something that a registrant would perform as part of its duty to report suspicious orders:

“In Masters' view, the Administrator amended two notice-and-comment rules in adjudicating this case: [the regulation defining suspicious orders and the regulation defining effective controls against the diversion of controlled substances]. We need not opine on DEA's statutory authority to use an adjudication to modify a rule enacted through notice and comment because the Administrator neither created not imposed any new duties. He relied on the existing Reporting Requirement.” ^[77]

V. Need for Regulatory Changes and Discussion of Regulatory Changes

A. Need for Regulatory Changes

A change to existing DEA regulations regarding suspicious orders is necessary in order to implement the provisions of the PDDA, and to clarify registrant obligations under the CSA in light of the issues discussed above.^[78]

B. Discussion of Regulatory Changes

1. Implementation of the PDDA

The DEA's implementation of the PDDA will involve amending existing DEA regulations in two sections (21 CFR 1300.01 and 21 CFR 1301.74), and adding a new section to DEA regulations at 21 CFR 1301.78.^[79] Specifically, the DEA will implement the PDDA by: (1) Establishing a DEA centralized database for collecting reports of suspicious orders; (2) amending DEA regulations to require that all reports of suspicious orders be submitted through the DEA centralized database; ^[80] (3) incorporating the PDDA's definition of “suspicious order” into DEA regulations; ^[81] and (4) incorporating the PDDA's requirement that registrants design and operate privacy-law-compliant suspicious order system into DEA regulations.^[82]

2. Clarification of Registrant Procedures Regarding Suspicious Orders

In addition to implementing the PDDA, DEA is proposing to amend its regulations to provide registrants with additional clarity regarding the procedures that must be followed upon receiving an order under suspicious circumstances by: (1) Clarifying the scope of the rule (as discussed below); ^[83] (2) adding definitions of “order,” “order received under suspicious circumstances,” and “due diligence” to DEA regulations; ^[84] and (3) amending DEA regulations to include procedures for identifying and reporting suspicious orders of controlled substances ^[85] consistent with the due diligence requirement articulated in the Masters and Southwood decisions. The proposed definition of “order” is intended to reflect existing business practices. The proposed definition of “order received under suspicious circumstances” is intended to capture any circumstances that might be indicative of diversion, including but not limited to orders “blocked,” “flagged,” “held,” or “pended” by a system designed and operated by a registrant to identify suspicious orders. In addition, DEA is proposing to amend its regulations to clarify that the system to identify suspicious orders shall be designed and operated by the registrant to identify suspicious orders based on facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.^[86]

3. Procedures for Identifying and Reporting Suspicious Orders of Controlled Substances

Building on the due diligence requirement discussed in Southwood and the two-part system discussed in Masters, DEA is amending its regulations to provide that, upon receipt of an ORUSC, registrants shall proceed under the following two-option framework: Either (1) immediately file a suspicious order report through the DEA centralized database, decline to distribute pursuant to the suspicious order, and maintain a record of the suspicious order and any due diligence related to the suspicious order,^[87] or (2) before distributing pursuant to the order, conduct due diligence to investigate each suspicious circumstance surrounding the ORUSC, and maintain a record of its due diligence regarding the ORUSC.^[88]

If, through its due diligence, the registrant is able to dispel each suspicious circumstance surrounding the ORUSC within seven calendar days after receipt of the order, it is not a suspicious order; after that determination is made, the registrant may then distribute pursuant to the order, and the order need not be reported to DEA as a suspicious order, but the registrant must maintain a record of its due diligence.^[89] However, if the registrant is unable, through its due diligence, to dispel each suspicious circumstance surrounding the ORUSC within seven calendar days after receiving the order, it is a suspicious order. The registrant must file a suspicious order report through the DEA centralized database and maintain a record of its due diligence.^[90]

All suspicious order reports must be made to the DEA centralized database and contain certain required information,^[91] and all records of suspicious orders and ORUSCs must be prepared and maintained in accordance with DEA regulations, and must contain certain required information.^[92] Regarding recordkeeping, the proposed rule would require more than just a “check-the-box” type of documentation. For example, new proposed § 1301.78(d) requires that the record include “how the registrant handled such orders,” “[w]hat information and circumstances rendered the order actually or potentially suspicious,” [w]hat steps, if any, the registrant took to investigate the order,” and “[i]f the registrant investigated the order, what information it obtained during its investigation, and where the registrant concludes that each suspicious circumstance has been dispelled, the specific basis for each such conclusion . . . .”

Upon notification from DEA that a suspicious order report or reports contain inaccurate or incomplete information, the registrant shall have seven calendar days to correct the inaccurate or incomplete information.^[93]

DEA believes that seven calendar days to conduct due diligence is consistent with the Masters and Southwood decisions, and with the PDDA's mandate that a registrant notify DEA “upon discovering” ^[94] a suspicious order. The seven calendar day timeframe strikes an appropriate balance between giving registrants sufficient time to act and also allowing DEA to promptly investigate potential diversion, while also recognizing that discovering a suspicious order sometimes involves a process of dispelling suspicious circumstances, and that any ORUSC that cannot be dispelled within seven days is a suspicious order (assuming that the system to identify suspicious orders for the registrant is properly designed and operated).

4. Scope of the Rule

Because the requirements related to suspicious orders are based on the CSA definition of “distribute,” ^[95] this proposed rule applies to registrants authorized to distribute controlled substances either directly (under the registrant's business activity), indirectly (as a coincident activity to the business activity), under the five percent rule, or as a treatment program compounding narcotics for treatment programs and other locations.^[96] The five percent rule permits a practitioner dispenser, under certain circumstances, to distribute controlled substances to another practitioner without having to obtain a separate DEA registration as a distributor a practitioner who is registered to dispense a controlled substance may distribute (without being registered to distribute) a quantity of such substance to another practitioner for the purpose of general dispensing by the practitioner to patients, provided inter alia that the total number of dosage units of all controlled substances distributed by the practitioner during each calendar year does not exceed 5 percent of the total number of dosage units of all controlled substances distributed and dispensed by the practitioner during the same calendar year.^[97]

Therefore, this proposed rule applies not only to persons who are registered with DEA under the business activity of distributor, but also to manufacturers and importers (who are permitted to distribute controlled substances as a coincident activity to their manufacturer or importer registration),^[98] practitioners,^[99] (who are permitted to distribute controlled substances pursuant to the five percent rule without obtaining a separate registration as a distributor), and Narcotic Treatment Programs (NTPs) distributing in controlled substances in bulk form to other NTPs. These registrants are authorized to distribute controlled substances after receiving an order from another DEA registrant.

However, the rule does not apply to reverse distributors, who are authorized by their registration to acquire controlled substances for the purpose of return or destruction ^[100] after receiving an order from another DEA registrant. In addition, because the CSA distinguishes the terms “dispense” and “administer” from the term “distribute,” ^[101] the rule does not apply to controlled substances dispensed or administered within the normal course of professional practice of a practitioner, to include prescriptions filled by a pharmacy. Therefore, pursuant to the five percent rule, a pharmacy will have to report suspicious orders for distributions of controlled substances, but would not, for example, have to report as a suspicious order, suspicious requests by a patient to have a controlled substance prescription filled.^[102]

VI. Impact of Regulatory Changes and Regulatory Analysis

A. Executive Orders 12866 (Regulatory Planning and Review), 13563 (Improving Regulation and Regulatory Review), and 13771 (Reducing Regulation and Controlling Regulatory Costs)

1. Introduction

E.O. 12866 directs agencies to assess all costs and benefits of available regulatory alternatives, and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, public health and safety, and environmental advantages, as well as distributive impacts and equity). E.O. 13563 is supplemental to and reaffirms the principles, structures, and definitions governing regulatory review as established in E.O. 12866.

Under E.O. 12866, significant regulatory actions require review by OMB. Significant regulatory actions can be either economically significant or non-economically significant. An economically significant regulatory action is any regulatory action that is likely to result in a rule that may have an annual effect on the economy of $100 million or more, or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, environment, public health or safety, or State, local, or tribal governments or communities.^[103] A non-economically significant regulatory action is any regulatory action that is likely to result in a rule that may create a serious inconsistency or otherwise interfere with an action taken or planned by another agency, may materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof, or may raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in E.O 12866.^[104]

E.O. 13771 requires an agency, unless prohibited by law, to identify at least two existing regulations to be repealed when the agency publicly proposes for notice and comment or otherwise promulgates a new regulation.^[105] In furtherance of this requirement, E.O. 13771 requires that the new incremental costs associated with new regulations, to the extent permitted by law, be offset by the elimination of existing costs associated with at least two prior regulations.^[106] According to OMB guidance implementing E.O. 13771, the requirements of E.O. 13771 only apply to each new E.O. 12866 “significant regulatory action . . . that has been finalized and that imposes total costs greater than zero.” ^[107] Furthermore, an action that has been finalized and has total costs less than zero is an “Executive Order 13771 deregulatory action.” ^[108]

DEA has analyzed the economic impact of each provision of this rule and, for the reasons discussed in detail below, estimates this rule will have a cost savings of approximately $2.9 million. Additionally, DEA does not anticipate that this rulemaking will have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities. OIRA has determined that this rulemaking is a significant regulatory action within the meaning of E.O. 12866. DEA has, therefore, submitted this rule for review by OMB.

Because this rule is estimated to have total costs less than zero, it is expected to be an E.O. 13771 deregulatory action.

2. Four Key Areas of Change

There are four key areas of regulatory change in this rule: (1) Definitions of new terms, (2) explicit inclusion of registrants, other than reverse distributors, who are authorized to distribute, (3) procedures for identifying and reporting suspicious orders, and (4) reporting and recordkeeping requirements.

With the exception of reverse distributors, this rule affects all registrants who are authorized to distribute controlled substances: Distributors, manufacturers, importers, pharmacies, hospital/clinics teaching institutions, practitioners, mid-level practitioners (MLPs), MLP-Ambulance Service, Researchers, Analytical Labs, and NTPs. As of May 6, 2019, there were 1,731 registrations authorizing the distribution of controlled substances, either directly (under the registrant's business activity) (873 distributor), or indirectly as a coincident activity to the business activity (586 manufacturer and 272 importer). Additionally, based on a sampling of DEA Forms 222 received at DEA Field Division Offices pursuant to 21 CFR 1305.13(d), DEA estimates that there are approximately 15,974 practitioners and NTPs who distribute controlled substances under the five percent rule or as a treatment program compounding narcotics for treatment programs and other locations.

a. Definition of Terms

The rule will incorporate the PDDA's definition of “suspicious order” into DEA regulations. Furthermore, to provide clarity, the rule also adds definitions of three additional terms: “order,” “order received under suspicious circumstances,” and “due diligence.” The PDDA definition of “suspicious order” parallels the long-standing definition of “suspicious orders” in DEA regulations, and does not expand or contract the current understanding of what are suspicious orders.

The definition of “order” clarifies and codifies the meaning in the context of suspicious orders. The DEA believes that this is consistent with the current understanding of the term order and anticipates this definition will not cause a change in the number of suspicious orders or change in registrant business activities. Therefore, DEA believes defining order in DEA regulations will have no economic impact on affected registrants.

The rule also includes definitions of “order received under suspicious circumstances” and “due diligence.” These definitions are intended to provide clarity in describing the procedures for identifying and reporting suspicious orders. DEA does not anticipate an increase or decrease in the number of suspicious orders reported as a direct result of the new definitions. Therefore, DEA estimates this definition will have no economic impact.

b. Explicit Inclusion of Registrants, Other Than Reverse Distributors, Who Are Authorized To Distribute

The rule amends DEA regulations to clarify that, in addition to entities that hold registration as distributors, the requirement to design and operate a system to identify suspicious orders of controlled substances for the registrant that complies with applicable Federal and State privacy laws shall also apply to practitioners when such distributions are made pursuant to the five percent rule.

This is a clarification of currently existing requirements. As all registrants are required to maintain effective controls against diversion of controlled substances, the DEA believes all practitioners who distribute pursuant to the provisions of the five percent rule already understand the requirement to “design and operate a system” also applies to them as well. A “system” in this context is a combination of people, process, and tools (such as an information system). Some registrants may rely more on information systems while other may rely more on manual processes. Regardless of whether the system is automated or manual, DEA believes the pharmacies and other practitioners who distribute pursuant to the five percent rule currently understand and operate such a system. Therefore, this proposed explicit inclusion of pharmacies and other practitioners in 21 CFR 1301.74(b) is estimated to result in no cost to affected registrants.

c. Procedures for Identifying and Reporting Suspicious Orders of Controlled Substances

The two-option framework for identifying suspicious orders is a codification of existing practices, and therefore, there is no added cost associated with the proposed suspicious order determination process. Masters and Southwood interpreted the suspicious order provisions by articulating that, upon receiving a suspicious order, a registrant has a duty to conduct due diligence before distributing pursuant to the order. DEA believes nearly all affected registrants explicitly or implicitly utilize the two-option framework. All suspicious order reports must be made to the DEA centralized database and contain certain required information, and all records of suspicious orders and ORUSCs must be prepared and maintained in accordance with DEA regulations, and must contain certain required information. Moreover, DEA estimates there is time and cost savings resulting from using the ARCOS Distributor Tool while conducting due diligence.

Between 2014 and 2018, there were an average of 338,840 suspicious order reports per year. This figure includes an estimated average of 308,540 suspicious orders per year reported to the central database and an estimated average of 30,300 orders per year reported to field offices.^[109] While the two-option framework has been in practice for a long time, DEA believes the reporting of suspicious orders versus reporting of ORUSCs has the potential to be more consistent. DEA believes, under current regulations, registrants make suspicious order reports for all ORUSCs, regardless of whether due diligence was conducted and suspicions were dispelled.

Under the proposed rule, the DEA estimates all reported average of 338,840 suspicious orders per year are ORUSCs. Based on general understanding of registrant operations and informal anecdotal discussions with registrants, DEA assumes for the purposes of this analysis that of the 338,840 suspicious orders that would be classified as ORUSC under the proposed rule, 10 percent (33,884) would fall under option 1, immediately deemed suspicious and reported as “suspicious orders.” Accordingly, the registrant would conduct due diligence on the remaining 90 percent (304,956), with the suspicion dispelled and order filled for 80 percent (271,072), and suspicion not dispelled and order rejected for the remaining 10 percent (33,884). In summary, DEA assumes that 20 percent of ORUCSs would be reported as suspicious orders and rejected, while the suspicion would be dispelled and order filled for 80 percent. DEA believes many orders previously (and currently) reported as “suspicious orders” to the central database were eventually filled after conducting due diligence and dispelling suspicion.

DEA estimates many registrants will use the ARCOS Distributor Tool in conducting due diligence. Estimated time savings is zero for those registrants who do not use the tool and approximately 30 minutes for those registrants using the tool to conduct due diligence. DEA does not have a strong basis to estimate the number of registrants who use the ARCOS Distributor Tool for conducting due diligence, but conservatively estimates the use of the tool will save registrants, on average, 10 minutes each time due diligence is conducted. Therefore, DEA estimates using the ARCOS Distributor Tool will save a total of 50,826 hours per year ^[110] while conducting due diligence. Based on a loaded hourly rate of $52.46 for a “compliance officer,” ^[111] DEA estimates the cost savings (negative cost) from using the ARCOS Distributor Tool while conducting due diligence is approximately $2,666,000 (50,826 × $52.46, rounded). As indicated above, DEA does not have a strong basis to estimate the number of times due diligence is conducted and how much time the ARCOS Distributor Tool saves per each time due diligence is conducted.^[112] DEA welcomes any comments related to this estimate.

d. Reporting and Recordkeeping Requirements

The rule contains new requirements that specify the reporting method, time limit for reporting, recordkeeping, and contents of the record. The rule requires, regardless of whether the suspicious order determination resulted from option 1 or option 2, a suspicious order report be submitted no later than seven calendar days after the order was received. The rule also requires suspicious order reports be made to the DEA centralized database. The report must include:

(1) The DEA registration number of the registrant placing the order for controlled substances;

(2) The date the order was received;

(3) The DEA registration number of the registrant reporting the suspicious order;

(4) The National Drug Code number, unit, dosage strength, and quantity of the controlled substances ordered;

(5) The order form number for schedule I and schedule II controlled substances;

(6) The unique transaction identification number for the suspicious order; and

(7) What information and circumstances rendered the order actually suspicious.

The seven calendar day reporting timeframe and the reporting of specific information to the DEA centralized database provide standardization and consistency for reporting suspicious orders. First, the seven calendar day time limit on reporting suspicious orders is estimated to impose minimal additional cost. DEA believes the requirement to report suspicious orders within seven calendar days of receiving the order is a reasonable balance between registrant operational demands, and prompt action that can lead to investigative leads. The current requirement is to report suspicious orders “when discovered” by the registrant.” ^[113] DEA believes the vast majority of suspicious orders are already reported within the seven calendar day period. Therefore, DEA estimates any cost associated with the seven calendar day time requirement is minimal.

Second, reporting to the DEA centralized database is estimated to impose no additional burden. Based on DEA's registration data, nearly 99 percent of applications for registration or renewal of registration in the previous 12 months (May 2018 to April 2019) were made online. Furthermore, although the email address is an optional data field, nearly all registrations have an email address on record. Based on these facts and the high rate of internet use in the general U.S. population,^[114] it is reasonable to estimate virtually all affected registrants have information systems capable of completing, submitting, and retaining electronic suspicious order reports at minimal additional cost. DEA acknowledges that is possible for an affected registrant not to have broadband internet access, especially in rural areas. DEA welcomes any comments regarding cost of obtaining broadband access or the cost of complying with the proposed regulations without onsite broadband internet access. No special software or equipment will be required to access and make reports to the DEA centralized database. Also, the DEA centralized database interface is very similar to ARCOS which a majority of manufacturers and distributors already use. Thus, a manufacturer or distributor familiar with ARCOS would require minimal learning when initially using the DEA centralized database. Additionally, the proposed content of suspicious order reports is a codification of content expected of current suspicious order reports or content subsequently requested by DEA if not provided in a suspicious order report. Furthermore, DEA estimates, for the estimated 30,300 suspicious order reports currently reported to the field offices, there will be an average time savings of ten minutes per report. The centralized database programmatically requires the required information in a suspicious order report. Currently, when a suspicious order report is received in the field office, it often lacks needed information. In such instances, the reporting registrant is highly likely to receive a call-back or an on-site interview from the field office, requiring more of the registrant's time to respond to DEA's inquiries. Additionally, the reduction in the number of ORUSC reported as suspicious order is expected to contribute to this decrease.^[115] Therefore, DEA estimates reporting to the centralized database will save a total of 5,050 hours per year.^[116] Based on a loaded hourly rate of $52.46 for a “compliance officer,” ^[117] DEA estimates the cost savings (negative cost) from using the centralized database is approximately $265,000 (5,050 × $52.46, rounded). DEA does not have a strong basis to estimate the time savings per a suspicious order report currently received in the field. DEA welcome any comments related to this estimate.

Additionally, the rule requires registrants to maintain a record of every suspicious order and every ORUSC, and how the registrant handled such orders.^[118] The record must be prepared no later than seven calendar days after the suspicious order or ORUSC was received and must include the following information:

(1) What information and circumstances rendered the order actually or potentially suspicious;

(2) What steps, if any, the registrant took to conduct due diligence;

(3) If the registrant conducted due diligence, what information it obtained during its investigation, and where the registrant concludes that each suspicious circumstance has been dispelled, the specific basis for each such conclusion; and

(4) Whether or not the registrant distributed controlled substances pursuant to the order.

DEA believes registrants already maintain all records documenting each suspicious order and ORUSC. DEA believes these records, in form of notations made in their internal order management systems, are maintained for at least two years as part of their ordinary business operations, even if the registrants are able to dispel the suspicious circumstances. DEA estimates the number of ORUSC will not increase as a result of the rule and remain at current levels. DEA estimates any additional costs associated with the recordkeeping requirements are minimal.

3. Summary of Costs

DEA has analyzed the economic impact of each provision of this rule and estimates there will be a total cost savings of $2,931,000. The two-option framework for identifying suspicious orders is a codification of current practices, and DEA believes nearly all affected registrants explicitly or implicitly utilize the two-option framework. DEA estimates there will be a cost savings of $2,666,000 from the implementation of the ARCOS Distributor Tool, which saves time when conducting due diligence. Additionally, reporting suspicious orders to the DEA centralized database, which saves time when reporting suspicious orders, is estimated to save of $265,000. All DEA registrants are believed to have access to the use of an internet-connected computer at no additional cost. Based on DEA's registration data, nearly 99 percent of applications for registration or renewal of registration in the previous 12 months (May 2018 to April 2019) were made online. Although the email address is an optional data field, virtually all registrations have an email address on record. No special software or equipment will be required to access and make reports to the DEA centralized database. Finally, the DEA believes registrants already create and maintain all records documenting each suspicious order and ORUSC in the form of notations made in their internal order management systems.

4. Summary of Benefits

DEA believes there are numerous non-quantifiable benefits associated with this rule. First, adding the definition of “suspicious order” aligns DEA's regulations with the PDDA, and adding other terms provides clarity and enhances understanding of required procedures when an ORUSC is received. Second, the rule's suspicious order determination process would formalize current business practices and create consistency across all registrants and DEA Field Division Offices. Third, reporting suspicious orders to the DEA centralized database would standardize reporting procedures, content of the reports, and how the reports are handled within the DEA. Suspicious orders are being reported centrally to DEA by some registrants, and the ease and efficiency of this electronic submission has been embraced by these registrants. Finally, the DEA centralized database would allow DEA to efficiently collect the data in a single database, and to generate macro-level reports and investigative leads.

B. Executive Order 12988

This rule meets the applicable standards set forth in sections 3(a) and 3(b)(2) of E.O. 12988, Civil Justice Reform to eliminate ambiguity, minimize litigation, establish clear legal standards, and reduce burden.

C. Executive Order 13132

This rule does not have federalism implications warranting the application of E.O. 13132. The rule does not have substantial direct effects on the States, on the relationship between the National Government and the States, or the distribution of power and responsibilities among the various levels of government.

D. Executive Order 13175

This rule does not have substantial direct effects on the States, on the relationship between the National Government and the States, or the distribution of power and responsibilities between the Federal Government and Indian tribes.

E. Regulatory Flexibility Act

In accordance with the RFA,^[119] the DEA evaluated the impact of this rule on small entities. DEA's evaluation of economic impact by size category indicates that the rule will not, if promulgated, have a significant economic impact on a substantial number of these small entities.

The RFA requires agencies to analyze options for regulatory relief of small entities unless it can certify that the rule will not have a significant impact on a substantial number of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. DEA has analyzed the economic impact of each provision of this rule and estimates the rule will have minimal economic impact on affected persons, including small entities.

The PDDA definition of suspicious order parallels the long-standing definition of suspicious order in DEA regulations, and does not expand or contract the current understanding of what is a suspicious order. The definition of “order” clarifies and codifies the meaning of the word in the context of suspicious orders. DEA believes that this is not a departure from the current understanding of the term order, and anticipates this definition will not cause a change in the number of suspicious orders or change in registrant business activities. The definitions of “order received under suspicious circumstances” and “due diligence” codify current understanding of the term and provide clarity in describing the procedures for identifying and reporting suspicious orders. Therefore, DEA believes the number of ORUSCs that are investigated, and the number of suspicious orders that are reported will remain consistent with current levels, and will not increase as result of this rule.

The requirement to design and operate a system to identify suspicious orders of controlled substances is not new, but is a clarification of existing requirements for distributors, manufacturers, importers, practitioners, and NTPs. All registrants are required to maintain effective controls, and to design and operate the system. Regardless of whether the system (understood as a combination of people, process, and tools) is automated or manual, DEA believes that distributors, manufacturers, importers, practitioners, and NTPs currently understand and operate such a system. Therefore, the system requirement is estimated to result in no cost to affected registrants.

This two-option framework for identifying suspicious orders is a codification of current practices. Masters and Southwood interpreted the suspicious order provisions by articulating that, upon receiving a suspicious order, a registrant has a duty to conduct due diligence before distributing pursuant to the order. DEA believes nearly all affected registrants explicitly or implicitly utilize the two-option framework. All suspicious order reports must be made to the DEA centralized database and contain certain required information, and all records of suspicious orders and ORUSCs must be prepared and maintained in accordance with DEA regulations, and must contain certain required information. DEA believes the two-option framework is a codification of existing business practices, and therefore, the number of ORUSCs and the number of suspicious orders reported will remain consistent with current levels. As discussed earlier, Masters and Southwood interpreted the suspicious order provisions by articulating that, upon receiving a suspicious order, a registrant has a duty to conduct due diligence before distributing pursuant to the order. DEA believes nearly all affected registrants explicitly or implicitly utilize the two-option framework. Moreover, DEA estimates there is time and cost savings resulting from using the ARCOS Distributor Tool while conducting due diligence.

As previously detailed,^[120] DEA estimates due diligence will be conducted on 90 percent (304,956) of all ORUSCs. DEA believes all registrants will use the ARCOS Distributor Tool in conducting due diligence and the use of the tool will save registrants 10 minutes each time due diligence is conducted. Therefore, DEA estimates using the ARCOS Distributor Tool will save a total of 50,826 hours per year while conducting due diligence. Based on a loaded hourly rate of $52.46 for a “compliance officer” ^[121] DEA estimates the cost savings from using the ARCOS Distributor Tool while conducting due diligence is approximately $2,666,000.

The rule requires, regardless of whether the suspicious order determination resulted from option 1 or option 2, a suspicious order report be submitted no later than seven calendar days after the order was received. The report must be made to the DEA centralized database with certain required information. DEA believes the requirement to report suspicious orders within seven calendar days of receiving the order is a reasonable balance between registrant operational demands, and DEA's need for prompt action that can lead to investigative leads. DEA believes the vast majority of suspicious orders are already reported within the seven calendar day period. Therefore, DEA estimates any cost associated with the seven calendar day time requirement is minimal. Additionally, reporting to the DEA centralized database is estimated to impose no additional burden. All DEA registrants are believed to have access to the use of an internet-connected computer at no additional cost. Based on DEA's registration data, nearly 99 percent of applications for registration or renewal of registration in the previous 12 months (May 2018 to April 2019) were made online. Although the email address is an optional data field, virtually all registrations have an email address on record. No special software or equipment will be required to access and make reports to the DEA centralized database. Based on these facts it is reasonable to estimate virtually all affected registrants have information systems capable of completing, submitting, and retaining electronic suspicious order reports at no additional cost. Furthermore, as detailed in section IV.1.b.iv, DEA estimates, for the estimated 30,300 suspicious order reports reported to the field, there will be a time savings of ten minutes per report. The centralized database programmatically requires the required information in a suspicious order report. Currently, when a suspicious order report is received in the field office, it often lacks needed information. In such instances, the reporting registrant is highly likely to receive a call-back or an on-site interview from the field office, requiring more of registrant's time to respond to DEA's inquiries. Additionally, the reduction in the number of ORUSC reported as suspicious order is expected to contribute to this decrease. Therefore, DEA estimates reporting to the centralized database will save a total of 5,050 hours per year. Based on a loaded hourly rate of $52.46 for a “compliance officer,” ^[122] DEA estimates the cost savings (negative cost) from using the centralized database is approximately $265,000.

Finally, the registrant must maintain a record of each suspicious order and ORUSC, and how the registrant handled the order, for two years. The record must be prepared no later than seven calendar days after the suspicious order or ORUSC was received and must include the following information:

(1) What information and circumstances rendered the order actually or potentially suspicious;

(2) What steps, if any, the registrant took to conduct due diligence;

(3) If the registrant conducted due diligence, what information it obtained during its investigation, and where the registrant concludes that each suspicious circumstance has been dispelled, the specific basis for each such conclusion; and

(4) Whether or not the registrant distributed controlled substances pursuant to the order.

DEA believes the registrants already maintain all records documenting each suspicious order and ORUSC. DEA believes these records, in the form of notations made in their internal order management systems, are already maintained for at least two years as part of their ordinary business operations, even if the registrant is able to dispel the suspicious circumstances. DEA estimates any additional costs associated with the recordkeeping requirements are minimal.

In conclusion, the rule includes clarification and codification of generally understood terms, codification of existing practices, and standardization of information submitted to the DEA (in terms of both method and content of submissions). Furthermore, DEA estimates a cost savings of $2,666,000 from the use of the ARCOS Distributor Tool and $265,000 from the use of the centralized database for the reporting of suspicious orders. Therefore, DEA estimates a total cost savings of $2,931,000.

1. Affected Registrations

With the exception of reverse distributors, this rule affects all persons who are authorized to distribute controlled substances: Distributors, manufacturers, importers, practitioners, and NTPs. As of May 6, 2019, there were 1,731 registrations authorized to distribute as distributors, manufacturers, and importers: 873 distributor, 586 manufacturer, and 272 importer. Additionally, based on sampling of DEA Forms 222 received at DEA Field Division Offices pursuant to 21 CFR 1305.13(d), DEA estimates there are approximately 15,974 practitioner and NTP registrations engaged in distribution. Therefore, DEA estimates 17,705 total registrations are affected by this rule. Table 1 details the number of affected registrations by business activity.

Table 1—Number of DEA Registrations Affected by Business Activity

Business activity	Number of registrations
Distributor	873
Manufacturer	586
Importer	272
Pharmacy	11,009
Hospital/Clinic	2,557
Teaching Institution	6
Practitioner	1,150
MLP	14
MLP-Ambulance Service	37
Researcher	45
Analytical Lab	32
Narcotic Treatment Program (NTP)	1,124
Total	17,705
Source: DEA, May 2019.

2. Number of Entities

It is common for DEA registrants to hold more than one registration, such as where a registrant handles controlled substances at multiple locations or engages in multiple types of DEA registered activities. However, RFA requirements and Small Business Administration (SBA) size standards are applicable to entities and businesses. DEA does not, in the general course of business, collect or otherwise maintain information regarding associated or parent organizations holding multiple registrations. Therefore, DEA needs some way of correlating and applying the parameters of the RFA and corresponding SBA size standards to DEA registrations (i.e., develop a relationship between the number of registrations/establishments and the number of entities).

DEA estimated the number of entities represented by the number of DEA registrations by first determining which North American Industry Classification System (NAICS) classification codes most closely represent each of the affected business activities, and then researching economic data for those codes. The business activities and their corresponding representative NAICS codes are listed in table 2 below.

Table 2—Business Activities and Representative NAICS Codes

Business activity	NAICS code	NAICS code-description
Distributor	424210	Drugs and Druggists' Sundries Merchant Wholesalers.
Manufacturer	325412	Pharmaceutical Preparation Manufacturing.
Importer	424210	Drugs and Druggists' Sundries Merchant Wholesalers.
Pharmacy	446110	Pharmacies and Drug Stores.
Hospital/Clinic	622110	General Medical and Surgical Hospitals.
Teaching Institution	611310	Colleges, Universities and Professional Schools.
Practitioner	621111	Offices of Physicians (except Mental Health Specialists).
MLP	621111	Offices of Physicians (except Mental Health Specialists).
MLP-Ambulance Service	621910	Ambulance Services.
Researcher	541712	Research and Development in the Physical, Engineering, and Life Sciences (except Biotechnology).
Analytical Lab	541380	Testing Laboratories.
NTP	621420	Outpatient Mental Health and Substance Abuse Centers.

The U.S. Census Bureau's Statistics of U.S. Businesses (SUSB) is an annual series that provides national and subnational data on the distribution of economic data by enterprise size and industry. Additionally, the SBA Office of Advocacy partially funds the U.S. Census Bureau to produce data on employer firm size in the SUSB program. SUSB employer data contain the number of firms, number of establishments, employment, and annual payroll for employment size of firm categories by location and industry. From the SUSB data, the number of firms and the number of establishments were noted and the firm-to-establishment ratio was calculated for each related NAICS code. For the purposes of this analysis, the term “firm” as defined in the SUSB is used interchangeably with “entity” as defined in the RFA. See table 3 below.^[123]

Table 3—Firm-to-Establishment Ratio for Each NAICS Code

NAICS code	NAICS code-description	Firms	Establishments	Firm-to- establishment ratio
325412	Pharmaceutical Preparation Manufacturing	988	1,290	0.7659
424210	Drugs and Druggists' Sundries Merchant Wholesalers	6,812	10,129	0.6725
446110	Pharmacies and Drug Stores	18,852	43,343	0.4349
622110	General Medical and Surgical Hospitals	2,904	5,281	0.5499
611310	Colleges, Universities and Professional Schools	2,282	4,329	0.5271
621111	Offices of Physicians (except Mental Health Specialists)	174,901	210,721	0.8300
621910	Ambulance Services	3,390	5,051	0.6712
541712	Research and Development in the Physical, Engineering, and Life Sciences (except Biotechnology)	9,634	13,411	0.7184
541380	Testing Laboratories	5,191	6,599	0.7866
621420	Outpatient Mental Health and Substance Abuse Centers	4,987	9,685	0.5149

The calculated firm-to-establishment ratios were applied to the corresponding business activities to estimate the number of entities. For example, the firm-to-establishment ratio of 0.7659 is applied to the affected 586 manufacturer registrations for an estimated 449 entities, and the firm-to-establishment ratio of 0.6725 was applied to the affected 1,145 distributor and importer registrations for an estimated 770 distributor and importer entities. In total, the 17,705 affected registrations/establishments represent 9,043 entities. Table 4 below summarizes the number of entities for each business activity.

Table 4—Number of Entities by Business Activity

Business activity	NAICS code	Affected registration/ establishments	Firm-to- establishment ratio	Affected firms
Manufacturer	325412	586	0.7659	449
Distributor, Importer	424210	1,145	0.6725	770
Pharmacy	446110	11,009	0.4349	4,788
Hospital/Clinic	622110	2,557	0.5499	1,406
Teaching Institution	611310	6	0.5271	3
Practitioner, MLP	621111	1,164	0.8300	966
MLP-Ambulance Service	621910	37	0.6712	25
Researcher	541712	45	0.7184	32
Analytical Lab	541380	32	0.7866	25
NTP	621420	1,124	0.5149	579
Total		17,705		9,043

3. Number of Small Entities

SUSB data includes the number of firms at various size ranges. To estimate the number of affected entities that are small entities, DEA compared the firm size ranges with SBA size standards for each of the representative NAICS codes from Table 2. The SBA size standard is the firm size based on the number of employees or annual receipts depending on industry.^[124] If the entire size range for the firms in the SUSB data was below the SBA size standard, all of the firms in the SUSB data size range were considered “small.” If only part of the size range for the firms in the SUSB data was below the SBA size standard, only the proportional number of firms in the SUSB data size range was considered “small.”

The number of firms below the SBA size standard for each NAICS code was added to determine the total number of small firms for that NAICS code. The number of small firms was divided by the total number of firms to estimate the “percent small firms of total” (i.e., the percent of total firms that are small firms) for all firms in the related NAICS code. The percent small firms of total firms were applied to the estimated number of entities for each business activity to estimate the number of affected entities that are small entities. DEA estimates that 7,940 (87.8 percent) of the total 9,043 affected entities are small entities. The analysis is summarized in Table 5 below.

Table 5—Number of Entities and Small Entities by Business Activity

Business activity	Affected registration/ establishments	Firm-to- establishment ratio	Affected firms	% Small entities	Affected small entities
Distributor, Importer	1,145	0.6725	770	96.2	741
Manufacturer	586	0.7659	449	93.2	419
Pharmacy	11,009	0.4349	4,788	98.0	4,694
Hospital/Clinic	2,557	0.5499	1,406	39.8	560
Teaching Institution	6	0.5271	3	58.8	2
Practitioner, MLP	1,164	0.8300	966	97.2	939
MLP-Ambulance Service	37	0.6712	25	94.7	24
Researcher	45	0.7184	32	94.4	30
Analytical Lab	32	0.7866	25	94.1	24
NTP	1,124	0.5149	579	87.6	507
Total	17,705		9,043		7,940
Percent small entity of total entities					87.8%

4. Impact on Small Entities

To comply with the RFA, DEA conducted a preliminary analysis to determine whether, if promulgated, this rule will have a significant economic impact on a substantial number of small entities. As described above, DEA estimates this rule will result in a total cost savings of $2,931,000, or an average of $324 per entity ($2,931,000/9,043), including small entities. Average cost savings of $324 is a high estimate for small entities as small entities are expected to have lower volume of distribution and fewer times due diligence is conducted or suspicious order is reported to the centralized database.

The average cost savings of $324 per entity per year was compared to the average annual receipt for the smallest of small businesses in the NAICS codes that represent the affected entities (described in Table 2). For example, for NAICS code `424210-Drugs and Druggists' Sundries Merchant Wholesalers' the smallest size category is firm size with annual receipts “less than $100,000.” There are 585 firms in this size category with an estimated combined total of $31,248,000 for an average annual receipt of $53,415 per firm.^[125] The $324 in annual cost savings per firm is 0.61 percent of $53,415. The results for each of the NAICS codes are listed in Table 6.

Table 6—Cost Savings as Percent of Annual Receipts by NAICS Codes

NAICS code	NAICS code- description	Firm size in receipts ($)	Firms	Estimated receipts ($)	Average receipt per firm ($)	Average cost savings ($)	Cost savings as percent of annual receipts
325412	Pharmaceutical Preparation Manufacturing	* 100,000-499,000	91	35,834,000	393,780	324	0.08
424210	Drugs and Druggists' Sundries Merchant Wholesalers	<100,000	585	31,248,000	53,415	324	0.61
446110	Pharmacies and Drug Stores	<100,000	751	36,066,000	48,024	324	0.67
622110	General Medical and Surgical Hospitals	* 100,000-499,000	14	3,812,000	272,286	324	0.12
611310	Colleges, Universities and Professional Schools	<100,000	163	7,510,000	46,074	324	0.70
621111	Offices of Physicians (except Mental Health Specialists)	<100,000	15,275	771,280,000	50,493	324	0.64
621910	Ambulance Services	<100,000	373	16,468,000	44,150	324	0.73
541712	Research and Development in the Physical, Engineering, and Life Sciences (except Biotechnology)	<100,000	1,457	71,428,000	49,024	324	0.66
541380	Testing Laboratories	<100,000	738	35,527,000	48,140	324	0.67
621420	Outpatient Mental Health and Substance Abuse Centers	<100,000	800	41,204,000	51,505	324	0.63
* “Estimated Receipts” not available for the smallest size range of “<100,000; therefore, used next size range of “100,000-499,000” for comparison.

DEA generally considers impacts that are greater than three percent of annual revenue to be a “significant economic impact” on an entity. As indicated in Table 6 above, the cost savings is far below the three percent threshold. Accordingly, DEA estimates that this rule will not, if promulgated, have a significant economic impact on a substantial number of small entities.

F. Unfunded Mandates Reform Act of 1995

This rule will not result in the expenditure by State, local and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted for inflation) in any one year, and will not significantly or uniquely affect small governments. Therefore, no actions were deemed necessary under the provisions of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1532.

G. Paperwork Reduction Act

Under the PRA,^[126] the DEA is not authorized to impose a penalty on persons for violating information collection requirements which do not display a current OMB control number, if one is required. Copies of existing information collections approved by OMB may be obtained at http://www.reginfo.gov/​public/​do/​PRAMain.

1. Collections of Information Associated With the Rule

Title: Reporting and Recordkeeping Requirements Related to Suspicious Orders.

OMB Control Number: 1117-New.

Form Number: N/A.

Pursuant to the PRA, the DEA is seeking approval from OMB for a new information collection related to suspicious orders. The collection would include two distinct components: The reporting of suspicious orders, and recordkeeping related to suspicious orders and ORUSCs. The rule applies to all registrants that distribute controlled substances, including manufacturers, distributors, importers, and pharmacies (and other practitioners in certain cases). The rule would amend two existing sections of DEA regulations,^[127] and would create a new section of DEA regulations ^[128] to include provisions relating to suspicious orders.

a. Reporting of Suspicious Orders

Registrants must file suspicious order reports through the DEA centralized database.^[129] Each suspicious order report must contain the following information:

• The DEA registration number of the registrant placing the order for controlled substances;
• The date the order was received;
• The DEA registration number of the registrant reporting the suspicious order;
• The National Drug Code number, unit, dosage strength, and quantity of the controlled substances ordered;
• The order form number for schedule I and schedule II controlled substances;
• The unique transaction identification number for the suspicious order; and
• What information and circumstances rendered the order actually suspicious.^[130]

Currently, DEA is not able to accurately estimate the number of suspicious orders being reported because there is no central database tracking all of these orders. For the purpose of this analysis and fulfilling this new information collection requirement, DEA initially estimates the following number of respondents, responses, and burden. Burden estimates will be updated with actual figures on next information collection renewal request. DEA estimates there will be an average of 338,840 ORUSCs, of which approximately 20 percent are reported as suspicious orders. The suspicious order reports are made as they occur, with no set frequency, and have an estimated burden of 20 minutes per response. The `number of respondents' is estimated based on the number of unique DEA numbers reporting to the centralized database; DEA does not have an estimate of the number of respondents reporting to the field offices. DEA estimates the following number of respondents and burden associated with this collection of information:

Number of respondents: 100.

Frequency of response: 677.78 per year (calculated).

Number of responses: 67,768 average per year.

Burden per response: 0.33 hour (20 minutes).

Total annual hour burden: 22,589 hours.

b. Recordkeeping for Suspicious Orders and ORUSCs

Registrants must keep records for suspicious orders and ORUSCs.^[131] These records must be kept by the registrant and be available, for at least 2 years from the date of the record, for inspection and copying by authorized employees of DEA.^[132] Each record must be prepared no later than seven calendar days after the suspicious order or ORUSC was received, must include how the registrant handled such orders, and must include the following information:

• What information and circumstances rendered the order actually or potentially suspicious;
• What steps, if any, the registrant took to investigate the order;
• If the registrant investigated the order, what information it obtained during its investigation, and where the registrant concludes that each suspicious circumstance has been dispelled, the specific basis for each such conclusion; and
• Whether or not the registrant distributed controlled substances pursuant to the order.^[133]

Currently, DEA is not able to accurately estimate the number of suspicious orders or ORUSCs. For the purpose of this analysis and fulfilling this new information collection requirement, DEA initially estimates the following number of respondents, responses, and burden. Burden estimates will be updated with actual figures on next information collection renewal request. DEA estimates there will be an average of 338,840 ORUSCs, of which approximately 20 percent are reported as suspicious orders and the remaining 80 percent are ORUSCs that require keeping of the abovementioned records. The recordkeeping is conducted as the events occur, with no set frequency, and have an estimated burden of 15 minute per response. The `number of respondents' is estimated based on the number of unique DEA numbers reporting to the centralized database; DEA does not have an estimate of the number of respondents reporting to the field offices. DEA estimates the following number of respondents and burden associated with this collection of information:

Number of respondents: 100.

Frequency of response: 2,710.72 per year (calculated).

Number of responses: 271,072 average per year.

Burden per response: 0.25 hour (15 minutes).

Total annual hour burden: 67,768 hours.

2. Request for Comments Regarding the Proposed Information Collections

Written comments and suggestions from the public and affected entities concerning the proposed collections of information are encouraged. Under the PRA, DEA is required to provide a notice regarding the proposed collections of information in the Federal Register with the notice of proposed rulemaking and solicit public comment.^[134] The PRA requires DEA to solicit comment on the following issues:

• Whether the proposed collection of information is necessary for the proper performance of the functions of DEA, including whether the information shall have practical utility.
• The accuracy of DEA's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions used.
• Recommendations to enhance the quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology.

Please send written comments to the Office of Information and Regulatory Affairs, OMB, Attention: Desk Officer for DOJ, Washington, DC 20503. Please state that your comments refer to RIN 1117-AB47/Docket No. DEA-437. All comments must be submitted to OMB on or before January 4, 2021. The final rule will respond to any OMB or public comments on the information collection requirements contained in this proposal.

List of Subjects

21 CFR Part 1300

• Chemicals
• Drug traffic control

21 CFR Part 1301 Administrative practice and procedure, Drug traffic control, Exports, Imports, Security measures.

• Administrative practice and procedure
• Drug traffic control
• Exports
• Imports
• Security measures

For the reasons set forth above, the DEA proposes to amend 21 CFR parts 1300 and 1301 as follows:

PART 1300—DEFINITIONS

1. The authority citation for part 1300 is revised to read as follows:

Authority: 21 U.S.C. 802, 821, 822, 823, 829, 832, 871(b), 951, 958(f).

2. In § 1300.01, amend paragraph (b) by adding definitions of “Due diligence,” “Order,” “Order received under suspicious circumstances,” and “Suspicious order” in alphabetical order to read as follows:

§ 1300.01

Definitions relating to controlled substances.

* * * * *

(b) * * *

Due diligence means a reasonable and documented investigation into persons and orders (coupled with other appropriate investigations, including previous investigations into persons and orders) that includes, but is not limited to, verification that a person (or a person submitting an order) holds the appropriate DEA registration, verification that a person (or a person submitting an order) holds all licenses required by the state(s) in which a person (or a person submitting an order) conducts business with respect to controlled substances, examination of each suspicious circumstance surrounding an order, and examination of all facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.

* * * * *

Order means any communication by a person to a registrant proposing or requesting a distribution of a controlled substance, regardless of how it is labeled by the person or the registrant, and regardless of whether a distribution is made by the registrant, except that simple price/availability inquiries, standing alone, do not constitute an order.

Order received under suspicious circumstances means an order potentially meeting the definition of suspicious order.

* * * * *

Suspicious order includes, but is not limited to, an order of unusual size, an order deviating substantially from a normal pattern, or an order of unusual frequency.

* * * * *

PART 1301—REGISTRATION OF MANUFACTURERS, DISTRIBUTORS, AND DISPENSERS OF CONTROLLED SUBSTANCES

3. The authority citation for part 1301 is revised to read as follows:

Authority: 21 U.S.C. 821, 822, 823, 824, 831, 832, 871(b), 875, 877, 886a, 951, 952, 953, 956, 957, 958, 965.

4. In § 1301.74, revise the section heading and paragraph (b) to read as follows:

§ 1301.74

Other security controls for non-practitioners; non-practitioners and practitioners for orders received under suspicious circumstances; narcotic treatment programs and compounders for narcotic treatment programs.

* * * * *

(b)(1) Each registrant shall design and operate a system to identify suspicious orders of controlled substances for the registrant that complies with applicable Federal and State privacy laws. The system shall be designed and operated to identify orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency. In addition, the system shall be designed and operated to identify suspicious orders based on facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.

(2) Registrants in receipt of an order received under suspicious circumstances shall follow the procedures set forth in § 1301.78(a).

(3) In addition to entities that are registered as distributors, the requirements in this paragraph (b) shall also apply to registrants authorized to distribute controlled substances. However, controlled substances dispensed or administered within the normal course of professional practice of a practitioner, to include prescriptions filled by a pharmacy, and orders placed by registrants to DEA registered reverse distributors requesting the return or destruction of controlled substances, are not distributions subject to the provisions of this part.

* * * * *

5. Add § 1301.78 to read as follows:

§ 1301.78

Procedures for identifying and reporting suspicious orders of controlled substances.

(a) Upon receipt of an order received under suspicious circumstances, the registrant shall proceed under one of the following two options:

(1) The registrant shall decline to distribute pursuant to the suspicious order, immediately file a suspicious order report through the DEA centralized database (which includes the information described in paragraph (b) of this section), and maintain a record of the suspicious order and any due diligence related to the suspicious order (which includes at least the information described in paragraph (c) of this section); or

(2) The registrant, before distributing pursuant to the order received under suspicious circumstances, shall conduct due diligence to investigate each suspicious circumstance surrounding the order.

(i) If, through its due diligence, the registrant is able to dispel each suspicious circumstance surrounding the order received under suspicious circumstances within seven calendar days after receiving the order, it is not a suspicious order; the registrant may then distribute pursuant to the order, and the order need not be reported to the DEA as a suspicious order, but the registrant must maintain a record of its due diligence which includes at least the information described in paragraph (c) of this section.

(ii) If the registrant, through its due diligence, is unable to dispel each suspicious circumstance surrounding the order received under suspicious circumstances within seven calendar days after receiving the order, it is a suspicious order; the registrant shall file a suspicious order report through the DEA centralized database, which includes the information described in paragraph (b) of this section, decline to distribute pursuant to the suspicious order, and maintain a record of its due diligence which includes at least the information described in paragraph (c) of this section.

(b)(1) Registrants shall report suspicious orders to the DEA centralized database. The report, identifying each suspicious order, must include the following information:

(i) The DEA registration number of the registrant placing the order for controlled substances;

(ii) The date the order was received;

(iii) The DEA registration number of the registrant reporting the suspicious order;

(iv) The National Drug Code number, unit, dosage strength, and quantity of the controlled substances ordered;

(v) The order form number for schedule I and schedule II controlled substances;

(vi) The unique transaction identification number for the suspicious order; and

(vii) What information and circumstances rendered the order actually suspicious.

(2) Upon notification from the DEA that a suspicious order report or reports contain inaccurate or incomplete information, the registrant shall have seven calendar days to correct the inaccurate or incomplete information.

(c) Registrants shall maintain a record of every suspicious order and every order received under suspicious circumstances for at least two years from the date of such record in accordance with 21 CFR 1304.04(a), and how the registrant handled such orders. The record must be prepared no later than seven calendar days after the suspicious order or order received under suspicious circumstances was received and must include the following information:

(1) What information and circumstances rendered the order actually or potentially suspicious;

(2) What steps, if any, the registrant took to conduct due diligence;

(3) If the registrant conducted due diligence, what information it obtained during its investigation, and where the registrant concludes that each suspicious circumstance has been dispelled, the specific basis for each such conclusion; and

(4) Whether or not the registrant distributed controlled substances pursuant to the order.

Timothy J. Shea,

Acting Administrator.

Footnotes

1.  See Section IV.E titled “Scope of the Rule,” below.

2.  Proposed new 21 CFR 1301.78(a)(1). Although the registrant may not be conducting due diligence to dispel each suspicious circumstance under the first option, it could conduct due diligence related to its initial determination to decline the order. See proposed new 21 CFR 1300.01(b)'s definition of “due diligence” which includes “examination of each suspicious circumstance surrounding an order, and examination of all facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.”

3.  Proposed new 21 CFR 1301.78(a)(2).

4.  Proposed new 21 CFR 1301.78(a)(2)(i).

5.  Proposed new 21 CFR 1301.78(a)(2)(ii).

6.  Proposed new 21 CFR 1301.78(b).

7.  Proposed new 21 CFR 1301.78(c).

8.  See Section V.B.3 titled “Procedures for Identifying and Reporting Suspicious Orders of Controlled Substances,” below.

9.  Proposed new 21 CFR 1300.01(b).

10.  E.O. 12866, “Regulatory Planning and Review,” September 30, 1993, published in the Federal Register at 58 FR 51735 on October 4, 1993.

11.  E.O. 13771, “Reducing Regulation and Controlling Regulatory Costs,” January 30, 2017, published in the Federal Register at 82 FR 9339 on February 3, 2017.

12.  5 U.S.C. 601-612.

13.  See Part VI titled “Impact of Regulatory Changes and Regulatory Analysis,” below.

14.  “DEA registrant” in this context refers generally to the responsibility of all registrants, and not specifically to any particular group.

15.  Southwood Pharmaceuticals, Inc.; Revocation of Registration, published in the Federal Register at 72 FR 36487, 36504 on July 3, 2007.

16.  The DEA implements and enforces Titles II and III of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (Pub. L. 91-513), as amended. Titles II and III are known as the “Controlled Substances Act” and the “Controlled Substances Import and Export Act,” respectively, and are collectively referred to as the “Controlled Substances Act” or “CSA” for purposes of this document. The CSA is codified at 21 U.S.C. 801-971. The DEA publishes implementing regulations for these statutes in Title 21 of the Code of Federal Regulations (CFR), chapter II.

17.  See 21 U.S.C. 823(b)(1) and (e)(1) (requiring the Attorney General to consider “maintenance of effective controls against diversion” in determining whether to register an applicant to distribute controlled substances) and 21 CFR 1301.71(a) (“[a]ll applicants and registrants shall provide effective controls and procedures to guard against theft and diversion of controlled substances”).

18.  See Section IV.D titled “The Due Diligence Requirement,” below.

19.  Current DEA regulations require that “[t]he registrant shall design and operate a system to disclose to the registrant suspicious orders of controlled substances.” 21 CFR 1301.74(b). Similarly, the PDDA required that the system be designed and operated to “identify” suspicious orders for the registrant. For purposes of this document, the PDDA phrase “identify for” will be used in place of the phrase “disclose to.”

20.  See 21 CFR 1301.74(b), and Sections III.B (titled “Legal Authority for the Rule: Centralized Reporting Under the PDDA”), III.C (titled “Legal Authority for the Rule: Other Provisions of the PDDA”), and IV.A (titled “History of Relevant DEA Regulations”), below.

21.  See Section IV.D, titled “The Due Diligence Requirement,” below.

22.  Examples of terms used to describe information system formulas in the context of suspicious orders include “algorithm,” “blocked,” “flagged,” “held,” “order of interest,” “pended,” or “threshold.”

23.  The CSA requires manufacturers and distributors to report their controlled substance transactions to the DEA on a quarterly basis, and the DEA implements this requirement through ARCOS. ARCOS and the ARCOS Distributor Tool are discussed in further detail in Sections IV.B and IV.C, below.

24.  The ARCOS reporting requirement and the suspicious orders serve two different purposes. While ARCOS provides the DEA with information regarding trends in the diversion of controlled substances, the reports need not be submitted until fifteen days after the end of the reporting period. In contrast, a suspicious order must be reported when discovered by the registrant. The suspicious orders reporting requirement exists to provide investigators in the field with information regarding potential illegal activity in an expeditious manner. See, e.g., Southwood Pharmaceuticals, Inc.; Revocation of Registration, published in the Federal Register at 72 FR 36487, 36501 on July 3, 2007.

25.  21 CFR 1301.74(b) (suspicious orders “include orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency”). For purposes of this document, orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency will be referred to as “size, pattern, and frequency orders.” As discussed below in Section III.C titled “Legal Authority for the Rule: Other Provisions of the PDDA,” the PDDA provided that the term suspicious order “may include, but is no limited to” size, pattern, and frequency orders.

26.  Registrants were already under a legal obligation to report suspicious orders. The MOAs required that the reports be filed electronically and centrally. Since the deployment of the ARCOS distributor tool and the on-line reporting system, the number of suspicious order reports has increased.

27.  See “Drug firms poured 780M painkillers into WV amid rise of overdoses,” Eric Eyre Staff Writer, Charleston Gazette-Mail, December 17, 2016. https://www.wvgazettemail.com/​news/​cops_​and_​courts/​drug-firms-poured-m-painkillers-into-wv-amid-rise-of/​article_​99026dad-8ed5-5075-90fa-adb906a36214.html. The relevance of West Virginia to suspicious orders has been generally recognized and accepted, including by congressional committees, as it illustrated the nature of the relationship and interaction between distributors and their customer pharmacies with respect to controlled substances.

28.  See DEA Press Release, “Walgreens Agrees to Pay a Record Settlement of $80 Million for Civil Penalties Under the Controlled Substances Act,” June 11, 2013. https://www.dea.gov/​press-releases/​2013/​06/​11/​walgreens-agrees-pay-record-settlement-80-million-civil-penalties-under.

29.  For example, through its Distributor Initiative, the DEA educated registrants on identification and reporting of suspicious orders and on maintaining effective controls against diversion. As part of the Initiative, the DEA polled ARCOS data and met with individual distributors to highlight various indicia of suspicious orders for their consideration. In addition, the DEA held industry conferences and sent guidance letters to industry regarding suspicious orders.

30.  The CSA provides that it shall be unlawful for any person . . . to refuse or negligently fail to make, keep, or furnish any record, report, notification, declaration, order or order form, statement, invoice, or information required under this subchapter or subchapter II of this chapter . . . .” 21 U.S.C. 842(a)(5). The CSA also provides that a violation of this section carries a civil penalty which shall not exceed $10,000, but that “[i]f a violation of this section is prosecuted by an information or indictment which alleges that the violation was committed knowingly and the trier of fact specifically finds that the violation was so committed, such person shall . . . be sentenced to imprisonment of not more than one year or a fine under Title 18, or both. 21 U.S.C. 842(c)(1)(B) and 842(c)(2)(A).In addition to the loss of registration through administrative actions such as Orders to Show Cause and Immediate Suspension Orders, the DEA uses a wide array of diversion enforcement tools to ensure its registrants are in compliance with the CSA. These include civil penalties and criminal charges. See, e.g., https://www.justice.gov/​usao-sdny/​pr/​manhattan-us-attorney-and-dea-announce-charges-against-rochester-drug-co-operative-and.

31.  See Section IV.C titled “ARCOS Distributor Tool,” below.

32.  21 U.S.C. 871.

33.  28 CFR 0.100 through 0.104.

34.  Public Law 115-271.

35.  The PDDA is comprised of Sections 3291 and 3292 of the SUPPORT Act.

36.  SUPPORT Act, Section 3292. The registrant's notification requirement is codified at 21 U.S.C. 832(a)(3). The DEA's requirement to establish a centralized database is codified at 21 U.S.C. 832(b).

37.  As noted above, the PDDA provisions are similar to current DEA regulations with respect to the system to identify suspicious orders for the registrant.

38.  SUPPORT Act, Section 3292, codified at 21 U.S.C. 802(57). The PDDA's “may include, but is not limited to” clause is an addition to existing law, which currently provides that “[s]uspicious orders include orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency.” 21 CFR 1301.74(b).

39.  See Section IV.D. titled “The Due Diligence Requirement,” below.

40.  The PDDA, Section 3292, as codified at 21 U.S.C. 832(a)(2), provides that “[e]ach registrant shall . . . ensure that the system designed and operated . . . by the registrant complies with applicable Federal and State privacy laws . . . .“

41.  Proposed amended 1301.74(b)(1). See also Section V.B. titled “Discussion of Regulatory Changes,” below.

42.  21 U.S.C. 823(b)(1) and (e)(1) (requiring the Attorney General to consider “maintenance of effective controls against diversion” in determining whether to register an applicant to distribute controlled substances); 21 CFR 1301.71(a) (“[a]ll applicants and registrants shall provide effective controls and procedures to guard against theft and diversion of controlled substances”).

43.  Bureau of Narcotics and Dangerous Drugs, DOJ, “Regulations Implementing the Comprehensive Drug Abuse Prevention Control Act of 1970,” published in the Federal Register at 36 FR 7775, 7785 on April 24, 1971.

44.  21 CFR 1301.74(b).

45.  21 CFR 1301.74(b). As discussed above in Section III.B titled “Legal Authority for the Rule: Centralized Reporting Under the PDDA,” the PDDA replaced DEA Field Division Office reporting with centralized reporting to DEA Headquarters.

46.  21 U.S.C. 827(d) (“Every manufacturer registered under section 823 of this title shall . . . make periodic reports to the [DEA] of every sale, delivery or other disposal by him of any controlled substance, and each distributor shall make such report with respect to narcotic controlled substances, identifying by the registration number assigned under this subchapter the person or establishment (unless exempt from registration under section 822(d) of this title) to whom such sale, delivery, or other disposal was made.”).

47.  The DEA ARCOS regulations are found at 21 CFR 1304.33.

48.  21 CFR 1304.33(c).

49.  21 CFR 1304.33(b).

50.  https://www.dea.gov/​press-releases/​2018/​02/​14/​dea-creates-new-resource-help-distributors-avoid-oversupplying-opioids.

51.  https://www.dea.gov/​press-releases/​2019/​02/​26/​dea-announces-enhanced-tool-registered-drug-manufacturers-and.

52.  Southwood Pharmaceuticals, Inc.; Revocation of Registration, published in the Federal Register at 72 FR 36487 on July 3, 2007.

53.  Southwood Pharmaceuticals, Inc.; Revocation of Registration, published in the Federal Register at 72 FR 36487, 36498 on July 3, 2007.

54.  Southwood Pharmaceuticals, Inc.; Revocation of Registration, published in the Federal Register at 72 FR 36487, 36498 on July 3, 2007.

55.  Southwood Pharmaceuticals, Inc.; Revocation of Registration, published in the Federal Register at 72 FR 36487, 36500 on July 3, 2007.

56.  Southwood Pharmaceuticals, Inc.; Revocation of Registration, published in the Federal Register at 72 FR 36487, 36501-36502 on July 3, 2007.

57.  Southwood Pharmaceuticals, Inc.; Revocation of Registration, published in the Federal Register at 72 FR 36487, 36500 on July 3, 2007.

58.  Letters from Joseph T. Rannazzisi, Deputy Assistant Administrator, DEA Office of Diversion Control to DEA Registrants, September 27, 2006 (“DEA I”) and December 20, 2007 (“DEA II”). Whereas DEA I discussed the responsibility to exercise due diligence to avoid filling suspicious orders that might be diverted, DEA II reiterated the responsibility to inform the DEA of suspicious orders.

59.  DEA I, pg. 1.

60.  DEA I, pg. 1.

61.  DEA I, pg. 2.

62.  DEA I, pg. 2.

63.  DEA I, pg. 2.

64.  DEA I, pg. 2.

65.  DEA I, pg. 2.

66.  DEA II, pg. 1.

67.  DEA II, pg. 1.

68.  DEA II, pg. 1.

69.  DEA II, pg. 2.

70.  The Masters case is comprised of a decision by the United States Court of Appeals for the District of Columbia Circuit Decision and a DEA Decision and Order. See Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206 (D.C. Cir. 2017) and Masters Pharmaceuticals, Inc.; Decision and Order, published in the Federal Register at 80 FR 55418 on September 15, 2015.

71.  Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206, 213-214 (D.C. Cir. 2017).

72.  In Masters, the registrant's system provided that held orders “be subject to additional due diligence.” Masters Pharmaceuticals, Inc.; Decision and Order, published in the Federal Register at 80 FR 55418, 55427 on September 15, 2015.

73.  Masters Pharmaceuticals, Inc.; Decision and Order, published in the Federal Register at 80 FR 55418, 55420 on September 15, 2015.

74.  Masters Pharmaceuticals, Inc.; Decision and Order, published in the Federal Register at 80 FR 55418, 55478 on September 15, 2015.

75.  Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206, 212-213 (D.C. Cir. 2017).

76.  Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206, 222 (D.C. Cir. 2017).

77.  Masters Pharmaceuticals, Inc. v. DEA, 861 F.3d 206, 220 (D.C. Cir. 2017).

78.  See Section II titled “Suspicious Orders and the Opioid Epidemic,” above.

79.  The existing regulations to be amended at 21 CFR 1300.01 are titled “Definitions relating to controlled substances” and at 21 CFR 1301.74 are titled “Other security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment programs.” In addition to amending the text of 21 CFR 1301.74, the DEA is amending the title of 21 CFR 1301.74 to clarify that it applies to “non-practitioners and practitioners for orders received under suspicious circumstances.” The new regulations at 21 CFR 1301.78 are titled “Procedures for identifying and reporting suspicious orders of controlled substances.”

80.  Proposed new 21 CFR 1301.78(a)(1) and (a)(2)(ii).

81.  Proposed amended 21 CFR 1300.01(b).

82.  Proposed amended 21 CFR 1301.74(b).

83.  Proposed amended title to 21 CFR 1301.74 and proposed amended 21 CFR 1301.74(b).

84.  Proposed amended 21 CFR 1300.01(b).

85.  Proposed amended 21 CFR 1301.74(b) and proposed new 21 CFR 1301.78.

86.  Proposed amended 21 CFR 1301.74(b).

87.  Proposed new 21 CFR 1301.78(a)(1).

88.  Proposed new 21 CFR 1301.78(a)(2).

89.  Proposed new 21 CFR 1301.78(a)(2)(i).

90.  Proposed new 21 CFR 1301.78(a)(2)(ii).

91.  Proposed new 21 CFR 1301.78(b).

92.  Proposed new 21 CFR 1301.78(c).

93.  Proposed new 21 CFR 1301.78(b).

94.  Sec. 3292.

95.  See 21 U.S.C. 802(11) (“[t]he term ‘distribute' means to deliver (other than by administering or dispensing) a controlled substance”), 21 U.S.C. 823(b)(1) and (e)(1) (requiring the Attorney General to consider “maintenance of effective controls against diversion” in determining whether to register an applicant to distribute controlled substances) and 21 CFR 1301.74(a) (“[b]efore distributing a controlled substance” a registrant shall make a good faith inquiry to determine that their customer is registered to possess the controlled substance) (emphasis added).

96.  See 21 CFR 1304.25(a)(7) (requiring persons registered or authorized to compound narcotic drugs for off-site use in a narcotic treatment program to maintain records of the quantity distributed in bulk form to other programs) (emphasis added).

97.  21 CFR 1307.11(a)(1)(iv).

98.  21 CFR 1301.13(e)(1)(i) and (viii).

99.  21 U.S.C. 802(21) (“[t]he term ‘practitioner' means a physician, dentist, veterinarian, scientific investigator, pharmacy, hospital, or other person licensed, registered, or otherwise permitted, by the United States or the jurisdiction in which he practices or does research, to distribute, dispense, conduct research with respect to, administer, or use in teaching or chemical analysis, a controlled substance in the course of professional practice or research”). As discussed below, the specific practitioners affected by this rule are pharmacies, hospital/clinics teaching institutions, practitioners, mid-level practitioners (MLPs), MLP-ambulance service, researchers, and analytical labs.

100.  See 21 CFR 1300.01(b) (defining “Reverse distribute” and “Reverse distributor”).

101.  See 21 U.S.C. 802(2) (defining “administer”), 21 U.S.C. 802(10) (defining “dispense”), and 21 U.S.C. 802(11) (defining “distribute”). Compare 21 U.S.C. 802(11) (defining distribute as “to deliver [a controlled substance] (other than by administering or dispensing) . . . .”) with 21 U.S.C. 802(10) (defining dispense as “to deliver a controlled substance to an ultimate user or research subject by, or pursuant to the lawful order of, a practitioner, including the prescribing and administering of a controlled substance . . . .”).

102.  Although, in this example, the pharmacy would not have a duty to report a suspicious order, this scenario would nevertheless be relevant to the pharmacist's “corresponding responsibility.” See 21 CFR 1306.04(a) (“[t]he responsibility for the proper prescribing and dispensing of controlled substances is upon the prescribing practitioner, but a corresponding responsibility rests with the pharmacist who fills the prescription”).

103.  Executive Order 12866, Sec. 3(f)(1).

104.  Executive Order 12866, Sec. 3(f)(2)-(4).

105.  Executive Order 13771, Sec. 2(a).

106.  Executive Order 13771, Sec. 2(c).

107.  Executive Office of the President, Office of Management and Budget, M-17-21, April 5, 2017. https://www.whitehouse.gov/​sites/​whitehouse.gov/​files/​omb/​memoranda/​2017/​M-17-21-OMB.pdf,, pg. 3.

108.  Executive Office of the President, Office of Management and Budget, M-17-21, April 5, 2017. https://www.whitehouse.gov/​sites/​whitehouse.gov/​files/​omb/​memoranda/​2017/​M-17-21-OMB.pdf,, pg. 4.

109.  A suspicious orders central database has been in operation since prior to 2014 to allow certain registrants to report electronically pursuant to an MOA. The number of suspicious order reports steadily decreased from 447,140 in 2014 to 102,434 in 2018 due to the decrease in number of registrants under an MOA. Despite this decrease, the DEA uses an average (rather than projecting a trend) of 338,840 because the decrease is a result of fewer registrants reporting, not decreasing number of reported suspicious orders. Since the DEA does not have much data beyond what was reported to the central database, it decided to use the data as-is. The average number of suspicious orders reported to the field is based on a poll of field offices conducted in 2017.

110.  304,956 × 10 × (1/60) = 50,826.

111.  The DEA utilizes the wage rate for “Compliance Officer” (SOC 13-1041, 2018 Standard Occupational Classification, https://www.bls.gov/​soc/​2018/​major_​groups.htm), in the “Merchant Wholesalers, Nondurable Goods (4242 and 4246 only)” industry. The mean hourly wage for that position and industry according to the May 2018 National Occupational Employment and Wage Estimates United States (https://www.bls.gov/​oes/​current/​oes_​nat.htm) is $36.76. Based on the BLS report, “Employer Costs for Employee Compensation—March 2019,” (ECEC) (https://www.bls.gov/​news.release/​pdf/​ecec.pdf) an additional 42.7% load (for “private industry”) is added to the wage rate to account for benefits. $36.76 × 1.427 = $52.46.

112.  In addition to cost savings resulting from the use of the ARCOS Distributor Tool in conducting due diligence of an ORUSC, DEA anticipates there will be a cost savings to registrants from using the ARCOS Distributor Tool during a manufacturer or distributor's “on-boarding” process for accepting a new customer. While the ARCOS Distributor Tool is expected to save manufacturers and distributors time and cost associated with due diligence conducted during the evaluation of a prospective customer, each registrant is expected to have its own proprietary process for the evaluation and DEA does not have a strong basis to quantify the cost savings.

113.  21 CFR 1301.74(b).

114.  An estimated 81% of households in U.S. households had a broadband internet subscription in 2016. Camille Ryan, U.S. Census Bureau, Computer and Internet Use in the United States: 2016, Issued August 2018.

115.  Similar to the discussion above, a total of 20% of ORUSCs are suspicious orders that require reporting to the DEA. The remaining 80% of ORUSCs are estimated to have suspicion dispelled.

116.  30,300 × 10 × (1/60) = 50,826.

117.  See Footnote 78, above.

118.  Proposed new 21 CFR 1301.78(c).

119.  5 U.S.C. 601-612.

120.  See Section VI.A.2.c. titled “Procedures for Identifying and Reporting Suspicious Orders of Controlled Substances,” above.

121.  See Footnote 78, above.

122.  Ibid.

123.  Two different data sources were used to develop Table 3. Data table directly from SUSB contained detailed firm size by number of employees, while the data table from the Advocacy contained detailed firm size by annual receipts. Therefore, for NAICS codes 325412, 424210, and 541712, which size determination is by the number of employees, the data set from SUSB is used—2015 SUSB Annual Datasets by Establishment Industry, table: “U.S. & states, NAICS, detailed employment sizes (U.S., 6-digit and states, NAICS sectors), https://www.census.gov/​data/​datasets/​2015/​econ/​susb/​2015-susb.html.” (Accessed July 3, 2019). For the remaining NAICS codes, which size determination is by annual receipts, the data set from the advocacy is used—SBA Office of Advocacy, Firm Size Data, U.S. static data, https://www.sba.gov/​advocacy/​firm-size-data. (Accessed July 3, 2019.)

124.  “U.S. Small Business Administration Table of Small Business Size Standards Matched to North American Industry Classification System Codes,” October 1, 2017. https://www.sba.gov/​sites/​default/​files/​files/​Size_​Standards_​Table.pdf.

125.  SBA Office of Advocacy, Firm Size Data, U.S. static data, https://www.sba.gov/​advocacy/​firm-size-data. (Accessed July 3, 2019.)

126.  44 U.S.C. 3501 et seq.

127.  Proposed amended 21 CFR 1300.01 and proposed amended 21 CFR 1301.74.

128.  Proposed new 21 CFR 1301.78.

129.  Proposed new § 1301.78(b).

130.  Proposed new 21 CFR 1301.78(b).

131.  Proposed new 21 CFR 1301.78(c).

132.  21 CFR 1304.04(a).

133.  Proposed new 21 CFR 1301.78(c).

134.  44 U.S.C. 3506(c)(2).