What changes when a controlled drug order is electronic

This is a distribution order, not a prescription

Two different electronic systems get discussed under similar names, and confusing them leads people to the wrong conclusion.

One is the electronic prescription a clinician sends to a pharmacy. The other, described here, is the electronic order one registrant sends another to buy stock.

This one covers Schedule I and Schedule II substances only. It has nothing to say about unscheduled products, and it is not the paperwork behind a patient's medicine arriving in the mail.

What makes it worth reading is that it is the same transaction as the paper form, rebuilt around a certificate. Comparing the two shows what a signature is actually being asked to prove.

The signature is a certificate, not a name

Validity starts with the signing key. To be valid, "the purchaser must sign an electronic order for a Schedule I or II controlled substance with a digital signature issued to the purchaser, or the purchaser's agent, by DEA".

That is the whole basis of trust here. The certificate is issued by the agency, and the person or agent holding it is the person the order is attributed to.

Nine data fields must be present. They are the purchaser's registration number, the supplier's name, complete address and registration number, and the date the order was signed. Then the product name with strength or the national drug code, the quantity in a single container, and the number of containers.

The ninth is a tracking field with a prescribed shape. "A unique number the purchaser assigns to track the order." It runs to nine characters: the last two digits of the year, the letter X, and six characters the purchaser chooses.

That number matters later, because it is what a lost-order statement has to name.

One order can carry more than the controlled items

A small provision saves a lot of duplicated work, and it is easy to miss.

"An electronic order may include controlled substances that are not in schedules I and II and non-controlled substances."

So the electronic order is not restricted to the two schedules the way the paper form is. A single order can mix scheduled and unscheduled items.

That is a genuine difference from the paper system, where the form is confined to the covered substances and, for a short list of specific compounds, to those compounds alone.

Four checks before anything is filled

The supplier cannot simply read the order and ship. Four verifications are required first.

The first is technical. The supplier must "Verify the integrity of the signature and the order by using software that complies with Part 1311 of this chapter to validate the order."

The second is that the digital certificate has not expired.

The third is the one that makes this a live check rather than a stored one. The supplier must "Check the validity of the certificate holder's certificate by checking the Certificate Revocation List." That list may be cached until it expires.

The fourth is authority. The supplier verifies the registrant's eligibility to order those substances by reading the certificate extension data.

Only after that may a supplier fill the order, and only if it is one of the categories permitted to fill orders at all.

Central processing, with one line that cannot be crossed

Initial processing may happen anywhere. A supplier may enter the order, run billing and identify inventory centrally, at a location regardless of that location's own registration.

After that the order may be distributed to one or more of the supplier's registered locations for filling.

A single sentence governs the whole arrangement. "The registrant must maintain control of the processing of the order at all times."

The dedicated central-processing section adds four conditions. Each item is assigned to a specific registered location, and a linked record notes which location filled what. The original order and all linked records stay on the central system. The fourth condition "Ensures that no item is filled by more than one location."

And there is a corporate boundary. A company with central processing "must assign responsibility for filling parts of orders only to registered locations that the company owns and operates."

That rules out routing a part of an order to an affiliate or a contracted third party.

No handing the order to someone else

The paper system allows an endorsement. A supplier who cannot fill an order in time may sign it over to a second supplier, who then ships everything directly.

The electronic system removes that entirely. The section is one sentence long: "A supplier may not endorse an electronic order to another supplier to fill."

That is a real operational difference. A purchaser whose electronic order cannot be filled has to place a new order somewhere else rather than have the first supplier pass it on.

It also simplifies the record. Every electronic order has exactly one supplier from signature to shipment.

The sixty days survive the move to software

Partial filling works as it does on paper. The balance may follow in additional shipments within sixty days of the order date.

The outer limit is the same too. "No order is valid more than 60 days after its execution by the purchaser", subject to the same narrow defense procurement exception.

Delivery is tied to the certificate rather than to a printed address. The supplier "must ship the controlled substances to the registered location associated with the digital certificate used to sign the order".

The supplier keeps an electronic record of every order, and linked to it, the number of containers furnished on each item and the shipping date, plus any fields the supplier completed.

The purchaser closes the loop on arrival. It creates a record of the quantity of each item received and the date, and "The record must be electronically linked to the original order and archived."

What kills an electronic order

Five conditions stop an order being filled, and they read as a checklist of what could go wrong with a certificate.

Missing required data fields. An order not signed with an agency-issued digital certificate. A public key that will not validate the signature. A validation showing the order is invalid for any reason.

And the timing one: "The digital certificate used had expired or had been revoked prior to signature."

The supplier notifies the purchaser with a statement of the reason, and may refuse any order for any reason with a bare statement of non-acceptance.

The purchaser electronically links that statement to the original order and keeps both.

The consequence matches the paper rule and goes slightly further. "Neither a purchaser nor a supplier may correct a defective order; the purchaser must issue a new order for the order to be filled."

Losing an order that was never on paper

An electronic order can still be lost, before or after receipt, and the regulation says what to do.

The purchaser gives the supplier "a signed statement containing the unique tracking number and date of the lost order", confirming the goods were never received because the order went missing.

If a replacement is issued, the purchaser links the record of the second order and a copy of the statement to the record of the first, and retains them all.

If the first order later reaches the supplier, the supplier marks it as not accepted and returns it, and the purchaser links the returned order to its own record and the statement.

The pattern throughout is linkage. Nothing is deleted and nothing stands alone; every correction is attached to what it corrects.

Two years, two business days

Retention is stated for both sides. A purchaser must, for each order filled, "retain the original signed order and all linked records for that order for two years." It also keeps every unaccepted or defective order and each linked statement.

A supplier retains each original order filled and its linked records for two years.

Central storage is allowed with a condition. Where records sit on a central server, "the records must be readily retrievable at the registered location."

Voiding works differently from the paper rule in one respect. A supplier voiding an entire order copies it, marks the copy, and returns it, and the purchaser keeps that copy. But "The supplier is not required to retain a record of orders that are not filled."

A partial void is recorded in the linked record by showing that nothing shipped for each voided item.

The last section is the one with no paper equivalent. For each electronic order filled, a supplier must "forward either a copy of the electronic order or an electronic report of the order in a format that DEA specifies to DEA within two business days."

What the comparison is worth to a reader

The paper system reports at the close of the month. The electronic system reports within two business days. That is the sharpest single difference between them.

The others follow the same logic. A certificate that can be revoked replaces a signature that cannot, the revocation is checked at fill time, and the ability to hand an order to another supplier disappears.

The point for someone reading claims about supply chains is narrow but useful. Where this system is in play, there is a near-real-time federal record of who bought what from whom.

Where it is not in play, and for most products discussed on this site it is not, no equivalent record exists. That absence is a feature of the schedule, not a gap in a company's conduct.

One limit on this article. Only subpart C of part 1305 was read in full, together with the paper subparts for comparison. Part 1311, which sets the certificate and software requirements this subpart relies on, was not read.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. Title 21 Code of Federal Regulations section 1305.21, Requirements for electronic orders, read in full for the digital signature basis, the nine data fields and the mixed-order provision — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005
2. Title 21 Code of Federal Regulations section 1305.22, Procedure for filling electronic orders, read in full for central processing, the four pre-fill verifications, the sixty day limit and the receipt record — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005
3. Title 21 Code of Federal Regulations section 1305.23, Endorsing electronic orders, read in full — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005
4. Title 21 Code of Federal Regulations section 1305.24, Central processing of orders, read in full for the four conditions and the owned-and-operated limit — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005
5. Title 21 Code of Federal Regulations section 1305.25, Unaccepted and defective electronic orders, read in full for the five disqualifying conditions and the no-correction rule — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005
6. Title 21 Code of Federal Regulations section 1305.26, Lost electronic orders, read in full for the signed statement and the linkage requirements — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005
7. Title 21 Code of Federal Regulations section 1305.27, Preservation of electronic orders, read in full for the two year retention on both sides and the central server condition — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005
8. Title 21 Code of Federal Regulations section 1305.28, Canceling and voiding electronic orders, read in full — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005
9. Title 21 Code of Federal Regulations section 1305.29, Reporting to DEA, read in full for the two business day forwarding duty — Electronic Code of Federal Regulations, Office of the Federal Register, April 2005