Loading
The Oregon Administrative Rules contain OARs filed through May 15, 2017
 
QUESTIONS ABOUT THE CONTENT OR MEANING OF THIS AGENCY'S RULES?
CLICK HERE TO ACCESS RULES COORDINATOR CONTACT INFORMATION

 

OREGON HEALTH AUTHORITY,
PUBLIC HEALTH DIVISION

 

DIVISION 23

PRESCRIPTION DRUG MONITORING PROGRAM

333-023-0800

Purpose

The purpose of the Prescription Drug Monitoring Program rules (OAR 333-023-0800 through 333-023-0820) is to define operational processes of a prescription drug monitoring program.

Stat. Auth.: ORS 431.962
Stats. Implemented: ORS 431.962
Hist,: DMAP 6-2011, f. & cert. ef. 5-5-11; Renumbered from 410-121-4000, PH 28-2015, f. 12-29-15, cert. ef. 1-1-16

333-023-0805

Definitions

Unless otherwise stated in OAR 333-023-0800 through 333-023-0830, or the context of OAR 333-023-0800 through 333-023-0830 requires otherwise, the following definitions apply to OAR 333-023-0800 through 333-023-0830:

(1) "Approved entity" means an eligible entity that has been approved by the Authority to connect a health information technology system to the prescription monitoring data integration solution.

(2)"Authority" means the Oregon Health Authority.

(3) "Controlled substance" means a prescription drug classified in Schedules II through IV under the Federal Controlled Substances Act, 21 U.S.C. 811 and 812, as modified under ORS 475.035.

(4) "Delegate" means a member of staff of a practitioner or pharmacist who is authorized by the practitioner or pharmacist to access the system on his or her behalf.

(5) "Dispense" and "dispensing" have the meaning given those terms in ORS 689.005.

(6) "Eligible entity" means an organization or entity that operates, or provides or makes available a health information technology system to a practitioner or pharmacist or a member of the practitioner’s or pharmacist’s staff.

(7) "Health information technology system" means an information processing application using computer hardware and software for the storage, retrieval, sharing and use of health care information, data and knowledge for communication, decision-making, quality, safety and efficiency of a clinical practice.

(8) "Health professional regulatory board" has the meaning given that term in ORS 676.160.

(9) "Patient record" means a collection of documents, either paper or electronically, that provides an account of patient care.

(10) "Pharmacy" has the meaning given that term in ORS 689.005 but does not include a pharmacy in an institution as defined in ORS 179.010.

(11) "Practitioner" has the meaning given that term in ORS 431.960.

(12) "Prescription drug" has the meaning given that term in ORS 689.005.

(13) "System" means the secure electronic system used to monitor reported prescription drug information.

(14) "Unsecure data" means data that is electronic and is not encrypted at the level established by the National Institute of Standards and Technology.

(15) "Vendor" means the private entity under contract with the Authority to operate the system.

Stat. Auth.: ORS 431.962
Stats. Implemented: ORS 431.962 - 431.978 & 431.992
Hist,: DMAP 6-2011, f. & cert. ef. 5-5-11; DMAP 64-2013, f. & cert. ef. 11-19-13; Renumbered from 410-121-4005, PH 28-2015, f. 12-29-15, cert. ef. 1-1-16; PH 2-2017, f. & cert. ef. 1-10-17

333-023-0810

Reporting Requirements

(1) Not later than 72 hours after dispensing a controlled substance a pharmacy shall electronically report to the Authority the following information for prescription drugs dispensed that are classified in schedules II through IV under the federal Controlled Substances Act, 21 U.S.C. 811 and 812, as modified by the State Board of Pharmacy by rule under ORS 475.035:

(a) Patient’s full name, address, date of birth, and sex;

(b) Pharmacy Drug Enforcement Administration Registration Number (or other identifying number in lieu of such registration number);

(c) Prescriber name and Drug Enforcement Administration Registration Number (or other identifying number in lieu of such registration number);

(d) Identification of the controlled substance using a national drug code number;

(e) Prescription number;

(f) Date the prescription was written;

(g) Date the drug was dispensed;

(h) Number of metric units dispensed;

(i) Number of days supplied; and

(j) Number of refills authorized by the prescriber and the number of the fill of the prescription.

(2) A pharmacy located outside of the state and licensed by the Oregon Board of Pharmacy shall electronically report the required information for controlled substances dispensed to residents of Oregon.

(3) A pharmacy shall submit data formatted in the American Society for Automation in Pharmacy (ASAP) 2007 version 4 release 1 specification standard.

(4) Data submitted by a pharmacy shall meet criteria prescribed by the Authority before it is uploaded into the system.

(5) A pharmacy shall be responsible for the correction of errors in the submitted data. Corrections shall be submitted no later than one week after the data was submitted.

(6) A pharmacy that has not dispensed any controlled substances during a seven-day reporting period must submit a zero report to the Authority at the end of the reporting period.

(7) A pharmacy that does not dispense any controlled substances or any controlled substances directly to a patient may request a waiver from the Authority for exemption from the reporting requirement. A pharmacy requesting a no reporting waiver shall submit to the Authority a written waiver request form provided by the Authority.

(8) If the Authority approves or denies the no reporting waiver request, the Authority shall provide written notification of approval or denial to the pharmacy. The duration of the waiver shall be two years at which time the pharmacy must reapply.

(9) A pharmacy may request a waiver from the Authority for exemption from the electronic reporting method. A pharmacy requesting an electronic reporting waiver shall submit to the Authority a written waiver request form provided by the Authority that contains the reason for the requested waiver.

(10) The Authority may grant a waiver of the electronic reporting requirement for good cause as determined by the Authority. Good cause includes financial hardship and not having an automated recordkeeping system.

(a) If the Authority approves the electronic reporting waiver, the Authority shall provide written notification to the pharmacy. The Authority shall determine an alternative reporting method for the pharmacy granted a waiver. The duration of the waiver shall be two years at which time the pharmacy must reapply.

(b) If the Authority denies the electronic reporting waiver, the Authority shall provide written notification to the pharmacy explaining why the request was denied. The Authority may offer alternative suggestions for reporting to facilitate participation in the program.

Stat. Auth.: ORS 431.962
Stats. Implemented: ORS 431.962 & 431.964
Hist,: DMAP 6-2011, f. & cert. ef. 5-5-11; DMAP 64-2013, f. & cert. ef. 11-19-13; Renumbered from 410-121-4010, PH 28-2015, f. 12-29-15, cert. ef. 1-1-16

333-023-0815

Notification to Patients

Using language provided by the Authority, a pharmacy shall notify each patient receiving a controlled substance about the Prescription Drug Monitoring Program before or when the controlled substance is dispensed to the patient. The notification shall include that the prescription will be entered into the system.

Stat. Auth.: ORS 431.962
Stats. Implemented: ORS 431.962
Hist,: DMAP 6-2011, f. & cert. ef. 5-5-11; Renumbered from 410-121-4015, PH 28-2015, f. 12-29-15, cert. ef. 1-1-16

333-023-0820

Information Access

(1) System Access. Only the following individuals or entities may access the system:

(a) Practitioners and pharmacists authorized to prescribe or dispense controlled substances;

(b) Delegates;

(c) Designated representatives of the Authority and any vendor contracted to establish or maintain the system;

(d) State Medical Examiner and designees of the State Medical Examiner.

(2) All entities or individuals who request access from the Authority for the creation of user accounts shall agree to terms and conditions of use of the system.

(3) All delegates must be authorized by a practitioner or pharmacist with an active system account.

(4) The Authority shall monitor the system for unusual and potentially unauthorized use. When such use is detected, the user account shall be immediately deactivated.

(5) The vendor, a practitioner, a pharmacist, a pharmacy, or an approved entity shall report to the Authority within 24 hours any suspected breach of the system or unauthorized access.

(6) When the Authority is informed of any suspected breach of the system or unauthorized access, the Authority shall notify the Authority’s Information Security Office and investigate.

(7) If patient data is determined to have been breached or accessed without proper authorization, the Authority shall notify all affected patients, the Attorney General, and the applicable health professional regulatory board as soon as possible but no later than 30 days from the date of the final determination that a breach or unauthorized access occurred. Notice shall be made by first class mail to a patient or a patient’s next of kin if the patient is deceased. The notice shall include:

(a) The date the breach or unauthorized access was discovered and the date the Authority believes the breach or unauthorized access occurred;

(b) The data that was breached or accessed without proper authorization;

(c) Steps the individual can take to protect him or herself from identity or medical identity theft;

(d) Mitigation steps taken by the Authority; and

(e) Steps the Authority will take to reasonably ensure such a breach does not occur in the future.

(8) Practitioner, Pharmacist, and Delegate Access. A practitioner, pharmacist, or delegate who chooses to request access to the system shall apply for a user account as follows:

(a) Complete and submit an application provided by the Authority that includes identifying information and credentials;

(b) Agree to terms and conditions of use of the system that defines the limits of access, allowable use of patient information, and penalties for misuse of the system; and

(c) Mail to the Authority an application.

(9) State Medical Examiner Access. The State Medical Examiner or his or her designee shall apply for a user account as required in section (8) of this rule and indicate their license type as Medical Examiner.

(10) The Authority shall compare the licensure requirements between Oregon practitioners and similarly licensed professionals in California, Idaho, and Washington. The Authority’s determination of similar licensure requirements shall be based upon scope of practice and formulary.

(11) The Authority shall review each application to authenticate before granting approval of a new account.

(12) If the Authority learns that an applicant has provided inaccurate or false information on an application, the Authority shall deny access to the system or terminate access to the system if access has already been established. The Authority may send written notification to the appropriate health professional regulatory board or oversight entity.

(13) A practitioner or pharmacist who is an authorized system user shall notify the Authority when his or her license or DEA registration has been limited, revoked, or voluntarily retired. A practitioner or pharmacist who changes or terminates employment shall notify the Authority of that change.

(14) When the Authority learns that a practitioner or pharmacist’s license has been limited or revoked, the Authority shall deny further access to the system.

(15) When a delegate for any reason is no longer authorized as a delegate by a practitioner or pharmacist, the practitioner or pharmacist shall revoke the delegation and notify the Authority.

(16) When the account of a delegate is inactive for more than six months, the account shall be deactivated by the Authority.

(17) When for any reason access of a designee of the State Medical Examiner must be revoked, the State Medical Examiner shall notify the Authority.

(18) Each time a practitioner or pharmacist makes a patient query he or she shall certify that requests are in connection with the treatment of a patient in his or her care and agree to terms and conditions of use of the system.

(19) Each time the State Medical Examiner or designee of the State Medical Examiner makes a patient query he or she shall certify that requests are for the purpose of conducting a specific medicolegal investigation or autopsy where there is reason to believe controlled substances contributed to the death and agree to terms and conditions of use of the system.

(20) Each time a delegate makes a patient query he or she shall certify that requests are in connection with the treatment of a patient of the practitioner or pharmacist for whom the delegate is conducting the query, agree to terms and conditions of use, and indicate the authorizing practitioner or pharmacist for whom the delegate is conducting the query.

(21) Practitioners and pharmacists with delegates must conduct monthly audits of delegate use to monitor for potential misuse of the system.

(22) When a practitioner or pharmacist learns of any potential unauthorized use of the system or system data by a delegate, the practitioner or pharmacist shall:

(a) Revoke the delegation; and

(b) Notify the Authority of the potential unauthorized use.

(23) When the State Medical Examiner learns of any potential unauthorized use of the system or system data by a designee, the State Medical Examiner shall notify the Authority.

(24) When the Authority learns of any potential unauthorized use of the system or system data, the Authority shall revoke the user’s access to the system, notify the Authority’s Information Security Office, and investigate.

(a) If the Authority determines unauthorized use occurred, the Authority shall send written notification to the appropriate health professional regulatory board, the Attorney General and all affected individuals.

(b) If the Authority determines unauthorized use did not occur, the Authority shall reinstate access to the system.

(25) The Authority shall send written notification to a user or a potential user when an account has been deactivated or access has been denied.

(26) Patient Access. A patient may request a report of the patient’s own controlled substance record. The patient shall mail to the Authority a request that contains the following documents:

(a) A signed and dated patient request form provided by the Authority; and

(b) A copy of the patient’s current valid U.S. driver’s license or other valid government issued photo identification.

(27) The Authority shall review the personal information submitted and verify that the patient’s identification and request match before taking further action.

(28) If the Authority cannot verify the information, the Authority shall send written notification to the patient explaining why the request cannot be processed.

(29) After the Authority has verified the request, the Authority shall query the system based upon the patient information provided in the request and securely send the report to the patient at no cost to the patient. The report shall include:

(a) A list of controlled substances dispensed to the patient including the dates of dispensation, the practitioners who prescribed the controlled substances, and the pharmacies that dispensed them; and

(b) A list of users who accessed the system for information on that specific patient with the date of each instance of access.

(30) If no data is found that matches the patient identified in the request, the Authority shall send written notification to the patient explaining possible reasons why no patient data was identified.

(31) A patient may send written notification to the Authority if he or she believes unauthorized access to his or her information has occurred. The notification shall include the patient’s name, who is suspected to have gained unauthorized access to the patient’s information, what information is suspected to have been accessed by unauthorized use, when the suspected unauthorized access occurred, and why the patient suspects the access was unauthorized. The Authority shall treat such patient notifications as potential unauthorized use of the system.

(32) A patient may request that the Authority correct information in a patient record report as follows:

(a) The patient shall specify in writing to the Authority what information in the report the patient considers incorrect.

(b) When the Authority receives a request to correct a patient’s information in the system, the Authority shall make a note in the system that the information is contested and verify the accuracy of the system data with the vendor. The vendor shall verify that the data obtained from the query is the same data received from the pharmacy.

(c) If the data is verified incorrect, the Authority shall correct the errors in consultation with the vendor and document the correction. The Authority shall send to the patient the corrected report.

(d) If the vendor verifies the data is correct, the Authority shall send written notification informing the patient that the request for correction is denied. The notice shall inform the patient of his or her rights as are applicable to the prescription drug monitoring program, the process for filing an appeal, and if there are no appeal rights, how to otherwise address or resolve the issue.

(33) The Authority shall respond to all patient requests within 10 business days after the Authority receives a request. Each response shall include information that informs the patient of his or her rights as are applicable to the prescription drug monitoring program.

(34) If the Authority denies a patient’s request to correct information, or fails to grant a patient’s request within 10 business days after the Authority receives the request, a patient may appeal the denial or failure by requesting a contested case hearing. The appeal shall be filed within 30 days after the request to correct information is denied. The appeal process is conducted pursuant to ORS chapter 183 and the Attorney General’s Uniform and Model Rules of Procedure for the Office of Administrative Hearings (OAH), OAR 137-003-0501 through 137-003-0700.

(35) Law Enforcement Access. A federal, state, or local law enforcement agency engaged in an authorized drug-related investigation of an individual may request from the Authority controlled substance information pertaining to the individual to whom the information pertains. The request shall be pursuant to a valid court order based on probable cause.

(36) A law enforcement agency shall submit to the Authority a request that contains the following:

(a) A form provided by the Authority specifying the information requested; and

(b) A copy of the court order documents.

(37) The Authority shall review the law enforcement request.

(a) If the form is complete and the court order is valid, the Authority shall query the system for the requested information and securely provide a report to the law enforcement agency.

(b) If the request or court order is not valid, the Authority shall respond to the law enforcement agency providing an explanation for the denial.

(38) Health Professional Regulatory Board Access. A health professional regulatory board investigating an individual regulated by the board may request from the Authority controlled substance information pertaining to the member.

(a) A health professional regulatory board shall submit to the Authority a form provided by the Authority specifying the information requested. The board’s executive director shall certify that the requested information is necessary for an investigation related to licensure, renewal, or disciplinary action involving the applicant, licensee, or registrant to whom the requested information pertains.

(b) The Authority shall review the regulatory board request.

(A) If a request is valid, the Authority shall query the system for the requested information and securely provide a report to the health professional regulatory board.

(B) If a request is not valid, the Authority shall respond to the health professional regulatory board providing an explanation for the denial.

(39) Researcher Access. The Authority may provide de-identified data for research purposes to a researcher. A researcher shall submit a research data request form provided by the Authority.

(a) The request shall include but is not limited to a thorough description of the study aims, data use, data storage, data destruction, and publishing guidelines.

(b) The Authority shall approve or deny research data requests based on application merit.

(c) If a request is approved, the requestor shall sign a data use agreement provided by the Authority.

(d) The Authority shall provide the minimum data set necessary that does not identify individuals.

(e) The Authority may charge researchers a reasonable fee for services involved in data access.

Stat. Auth.: ORS 431.962
Stats. Implemented: ORS 431.962 & 431.966
Hist,: DMAP 6-2011, f. & cert. ef. 5-5-11; DMAP 64-2013, f. & cert. ef. 11-19-13; Renumbered from 410-121-4020, PH 28-2015, f. 12-29-15, cert. ef. 1-1-16; PH 2-2017, f. & cert. ef. 1-10-17

333-023-0830

Approval of Health Information Technology Systems

(1) An eligible entity may apply to the Authority to allow its Health Information Technology System access to the Prescription Drug Monitoring Program data. To apply for approval, an eligible entity must complete and provide the following to the Prescription Drug Monitoring Program:

(a) An application provided by the Authority that includes contact information for the eligible entity’s Chief Information Officer, his or her designee, or equivalent, and the Compliance Officer, his or her designee, or equivalent that oversees the Health Information Technology System;

(b) An attestation that:

(A) The eligible entity’s Health Information Technology System complies with state and federal privacy and security regulations;

(B) The eligible entity provides users training on the Health Information Technology System related to the limits of access and allowable use of Prescription Drug Monitoring Program data;

(C) The eligible entity agrees to periodic participation in audit activities with the Authority; and

(D) The eligible entity agrees to terms and conditions of use of the system that defines the limits of access, allowable use of patient information, and penalties for misuse of the system;

(2) The Authority shall review the application and accompanying materials and notify the applicant whether the application has been approved.

(3) The Authority may deny an application if an eligible entity does not meet criteria. Prior to issuing a denial the Authority will work with the eligible entity to resolve any eligibility issues.

(4) An approved entity may not retain patient prescription monitoring information in the Health Information Technology System or other places except for the purpose of audits and the maintenance of patient records.

(a) For the purpose of audits, patient prescription monitoring information retrieved by the Health Information Technology System may be retained in static form only, and not retained in formats that may be accessible for future inquiry unrelated to audit purposes.

(b) For the maintenance of patient records, authorized Prescription Drug Monitoring Program users accessing patient prescription records through Health Information Technology Systems may capture and record patient prescription monitoring information in the patient record.

(5) The Authority will ensure that Health Information Technology Systems that connect with the Prescription Drug Monitoring Program meet privacy and security requirements by requiring approved entities provide an annual attestation that:

(a) Their Health Information Technology System and users meet the Health Insurance Portability and Accountability Act of 1996 and other state and federal privacy and security laws.

(b) Periodic privacy and security training is provided to users of Health Information Technology Systems that connect with the Prescription Drug Monitoring Program.

(6) Only individuals authorized by rule and who hold active Prescription Drug Monitoring Program accounts are authorized to receive results from the Prescription Drug Monitoring Program using a Health Information Technology System.

(7) The Authority may suspend or revoke approval of an approved entity that does not adhere to the Authority’s terms and conditions, including the security and privacy requirements set forth by the Authority. The Authority will notify the approved entity of a suspension or revocation of approval.

Stat. Auth.: ORS 431A.855
Stats. Implemented: ORS 431A.855 – 431A.900
Hist.: PH 2-2017, f. & cert. ef. 1-10-17

The official copy of an Oregon Administrative Rule is contained in the Administrative Order filed at the Archives Division, 800 Summer St. NE, Salem, Oregon 97310. Any discrepancies with the published version are satisfied in favor of the Administrative Order. The Oregon Administrative Rules and the Oregon Bulletin are copyrighted by the Oregon Secretary of State. Terms and Conditions of Use