The Drug Enforcement Administration (DEA) published its long-awaited Notice of Proposed Rulemaking  (NPRM)  regarding suspicious orders of controlled substances. This will likely be the most heavily scrutinized rule issued by DEA this year. Registrants impacted by this rule should submit comments within sixty (60) days of publication in the Federal Register.

Be sure to take advantage of this rare opportunity as this may be the best and last chance (for a very long time) for registrants to have a say in one of the most contentious areas of controlled substance compliance.

There is a lot to unpack here. For now, I am going to just lay out the new framework. A deeper analysis will follow in the coming days.

DEA’s expansion of the definition of what constitutes a suspicious order is perhaps the most significant (but not entirely unexpected) change found in the NPRM.  The historic definition of suspicious orders (orders of unusual size, volume, or frequency) has now been modified to include

orders based on facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.

 New Defined Terms

Right up front, DEA introduces a new term, “orders received under suspicious circumstances (ORUSC).”  AN ORUSC is defined in the NPRM as “an order potentially meeting the definition of a suspicious order.”  Not terribly helpful, but I think this is what most registrants would consider a “pended” or “flagged” order, in addition to orders that are otherwise indicative of diversion (i.e., based on subjective factors or “red flags”).

DEA, for the first time, also defines “due diligence” as

a reasonable and documented investigation into persons and orders (coupled with other appropriate investigations, including previous investigations into persons and orders) that includes, but is not limited to, verification that a person (or a person submitting an order) holds the appropriate DEA registration, verification that a person (or a person submitting an order) holds all licenses required by the state(s) in which a person (or a person submitting an order) conducts business with respect to controlled substances, examination of each suspicious circumstance surrounding an order, and examination of all facts and circumstances that may be relevant indicators of diversion in determining whether a person (or a person submitting an order) is engaged in, or is likely to engage in, the diversion of controlled substances.

(emphasis is mine). That is a mouthful and leaves a lot of subjectivity and opportunity for Monday morning quarterbacking.

The third newly defined term provided by DEA is “order,” which means

any communication by a person to a registrant proposing or requesting a distribution of a controlled substance, regardless of how it is labeled by the person or the registrant, and regardless of whether a distribution is made by the registrant, except that simple price/availability inquiries, standing alone, do not constitute an order.

Again, I expect to see a lot of comments regarding this very broad definition.

New Process

The proposed regulation creates a framework incorporating the two most common methods of detecting and reporting suspicious orders. In this regard, the new process is somewhat industry friendly.  DEA summarizes the two-option framework as follows

[u]pon receipt of an ORUSC, registrants authorized to distribute controlled substances will have a choice (under the two-option framework) to either: (1) immediately file a suspicious order report through the DEA centralized database, decline to distribute pursuant to the suspicious order, and maintain a record of the suspicious order and any due diligence related to the suspicious order, or (2) before distributing pursuant to the order, conduct due diligence to investigate each suspicious circumstance surrounding the ORUSC, and maintain a record of its due diligence regarding the ORUSC.

If a registrant chooses to follow option 2, they have seven days to investigate the ORUSC.  If their investigation does not fully dispel the suspicious circumstances of the order with the seven-day window, the order must be reported to DEA as a suspicious order.

Reporting Suspicious Orders to DEA

DEA is requiring all suspicious orders to be reported to the DEA centralized database (see here) and must include the following information

  • The DEA registration number of the registrant placing the order for controlled substances;
  • The date the order was received;
  • The DEA registration number of the registrant reporting the suspicious order;
  • The National Drug Code number, unit, dosage strength, and quantity of the controlled substances ordered;
  • The order form number for schedule I and schedule II controlled substances;
  • The unique transaction identification number for the suspicious order; and
  • What information and circumstances rendered the order actually suspicious.

The last requirement is going to be the biggest sticking point, absent additional clarification from DEA.

Recordkeeping

Another significant change is that, for each ORUSC and/or suspicious order identified and/or reported, the registrant must now also maintain a record documenting the investigation of such order containing the following required information

  • What information and circumstances rendered the order actually or potentially suspicious;
  • What steps, if any, the registrant took to conduct due diligence;
  • If the registrant conducted due diligence, what information it obtained during its investigation, and where the registrant concludes that each suspicious circumstance has been dispelled, the specific basis for each such conclusion; and
  • Whether or not the registrant distributed controlled substances pursuant to the order.

That’s it for now.  Let me know if you have any comments or questions.