In a recently issued Request for Proposal (RFP) for Information Technology (IT) and other services in support of the Diversion Control Division, DEA indicated that it will be creating a new section in the Code of Federal Regulations. 21 C.F.R. 1301.78, will contain the suspicious order reporting requirement that is currently found in 21 C.F.R. 1301.74(b). DEA intends to define the term “suspicious order” with a list of specific factors to consider when scrutinizing an order. DEA is expected to require that the “presence of any one or more of these factors renders the order a suspicious order,” which must be reported to DEA via a secure network application for Suspicious Order Reporting System (SORS).

DEA will require the report to contain relevant information regarding the order, such as:

  • name, title, and phone number of the person who placed the order;
  • DEA registration number and name of the entity seeking to purchase the controlled substances;
  • the date the order was received; how the order was submitted (e.g., electronically, by paper, or orally);
  • DEA registration number of the registrant, phone number, and name of the person employed by the registrant who received the order;
  • the National Drug Code number and the quantity of the controlled substance ordered;
  • the order form number (DEA Form 222) for schedule I and II controlled substances or the registrants’ internal order reference number (i.e., purchase order number, invoice number, etc.) for schedule III through schedule V controlled substances; and
  • a copy of the order form for schedule I and schedule II controlled substances or a copy of the internal order reference form for schedule III through V controlled substances.

DEA will also require that the registrant submit additional information to the agency “if the registrant elected to proceed with the order,” including “what steps the registrant took to determine whether the order was for legitimate medical, scientific, research, or industrial purposes and whether the registrant ultimately distributed the controlled substances ordered, and, if so, the date on which the distribution occurred.”

Of course, the devil will be in the final details. While greater clarity in suspicious order detection and reporting is necessary, requirements that impose significant changes to IT systems and business operations could force some companies out of business and/or adversely impact the availability of pharmaceutical controlled substances for legitimate medical needs. For instance, there is a varied level of IT sophistication within the regulated community. This new regulation will undoubtedly require registrants to make investments in their IT infrastructure. This may be too costly for those “smaller” registrants who operate one or two distribution facilities. It will be a time-consuming endeavor for large, multi-facility registrants with sophisticated IT systems to make their system compatible with SORS and to provide for automated reporting. Likewise, registrants that operate in multiple jurisdictions will often have different compliance obligations due to laws and regulations that vary from state to state. DEA would be wise to consider implementing one national standard for suspicious order reporting that would preempt suspicious order reporting requirements at the state level. In lieu of reporting at the state level, DEA could share its database with the relevant state regulatory bodies, much like how many state regulators share Prescription Drug Monitoring Program data with DEA. Hopefully, these and other issues will be considered and addressed by DEA prior to issuance of a final rule.

The regulated industry has been requesting greater clarity from DEA on suspicious order reporting for more than a decade. DEA has finally acquiesced. Beyond the traditional notice and comment period afforded by the Administrative Procedure Act, I would strongly urge DEA to meet with industry and collaborate on implementing suspicious order reporting requirements that industry can actually implement and that provide DEA with actionable intelligence on potential bad actors.