The Drug Enforcement Administration's interim final rule on e-prescribing controlled substances calls for providers to use two-factor authentication but introduces a twist: the use of biometric technology as one of the methods.
The rule, set to be published March 31 in the Federal Register, aims to address a gap in the government's e-prescribing push. DEA currently bans the e-prescribing of controlled substances -- a restriction that covers some 10 percent of all prescriptions.
That prohibition compels physicians who e-prescribe to maintain a separate paper-and-fax system for controlled substances. Healthcare executives contend the situation has created a nuisance for e-prescribers and has discouraged wider adoption of e-prescribing.
DEA in June 2008 addressed the controlled substances issue in a notice of proposed rule making. The agency spelled out the conditions under which e-the prescribing of controlled substances would be permitted. Those stipulations included a requirement that practitioners use two-factor authentication to access an e-prescribing application to sign controlled substance prescriptions.
Two-factor authentication rests on something a user knows -- user ID and password, for example, and a second factor. In the case of the proposed rule, that additional factor could take two forms: a multifactor one-time password device or a multifactor cryptographic device stored on a hard token.
Public comments on the proposed rule questioned the DEA's two-factor authentication approach, with some commenters asking DEA to allow alternative authentication methods.
DEA's interim final rule hews to its 2008 effort in that it continues to require two-factor authentication. But in a departure for the earlier rule, DEA now supports biometrics as an option for the second factor.
"Two of three factors must be used: a biometric, a knowledge factor (e.g., password), or a hard token," according to the rule. "While DEA is uncertain about the extent to which existing biometric readers will be used in healthcare settings, DEA believes it is reasonable to allow for such technology because the technology is likely to improve."
The rule does not require the use of a specific form of biometric technology. DEA, however, said it is establishing standards for biometric systems in conjunction with the National Institute of Standards and Technology.
In a prepared statement, Sen. Sheldon Whitehouse (D-R.I.), called the e-prescribing of controlled substances the "key to unleashing the vast cost saving and quality improvement potential of health information technology."
Whitehouse said the interim rule "brings us one step closer to that goal," while maintaining rigorous controls to prevent illegal diversion and protect privacy.
The final rule will go into effect following a 60-day comment period. The Office of Management and Budget, which has been following the DEA's rule making, has signed off on the e-prescribing rule.
