The opioid package President Donald Trump signed last week garnered much attention. While it is largely directed at treatment and prevention, it contains several momentous provisions for those companies that manufacture, distribute or dispense opioid medications. This article discusses a few of the more important provisions that are anticipated to affect the pharmaceutical industry in its interactions with the U.S. Drug Enforcement Administration. In short, the act imposes new requirements on wholesale distributors related to handling of controlled substances and increases penalties for failing to comply with the act and, interestingly, imposes quite significant analytical and reporting hurdles on the Drug Enforcement Administration and, to a lesser extent, the U.S. Department of Health and Human Services.

The act codifies the requirement to report suspicious orders and increases the penalties for failure to do so.

First, HR6 codifies what had previously been simply a regulatory requirement that manufacturers and distributors must report to the DEA suspicious orders of controlled substances.[1] It also slightly broadens the definition of suspicious orders by defining a “suspicious order” as one that may include “but is not limited to” orders of unusual size, orders deviating substantially from a normal pattern, or orders of unusual frequency. The act mimics the current regulatory requirement that a DEA registrant must design and operate a system to identify suspicious orders, but now also requires that the system comply with applicable federal and state privacy laws. The act also requires that reports must be filed “upon discovering suspicious orders” or a “series of [suspicious] order,” and that reports must be sent to both the DEA administrator and the DEA division office where the registrant is located or conducts business.

The DEA has expended vast resources investigating and charging manufacturers, distributors and pharmacy chains with failing to report suspicious orders, and has collected hundreds of millions of dollars in settlements from errant companies. It is unclear how impactful codifying the regulatory landscape will be, but one laudable impact is the requirement that the DEA create a centralized data base to collect — and presumably analyze and report — suspicious order data from the country’s thousands of manufacturer and distributor registrants. The act requires the attorney general to establish a centralized database for collecting these reports from industry within one year. It also requires the DEA to report to Congress on its progress in creating the mandatory centralized database as well as an explanation of how the DEA utilizes industry’s suspicious order reports both before and after the passage of the act.

Careful analysis and data mining of suspicious order reports could potentially lead to more specific and accurate identification of suspicious orders, which in turn will go a long way to reduce the flow of drugs outside legitimate scientific and medical channels. But it remains to be seen how and whether the DEA will be able to successfully stand up a centralized suspicious order report data base. Certainly one challenge will be that there is no standardized template or communication mode for transmitting suspicious orders. The DEA is expected to publish a notice and petition for rule making regarding suspicious orders by February 2019. Assuming the DEA complies with this deadline, we can expect to see more clarity around both the definition of suspicious orders, and as a result of the act, a form reporting template as well as communication requirements. This will be helpful to industry.

More ominously, the new law increases the penalties for failing to report suspicious opioid orders. The act provides increased civil penalties of up to $100,000 and a criminal fine of up to $500,000 for manufacturers and distributors who fail to report suspicious orders, fail to maintain effective controls against opioid diversion or fail to review ARCOS information.[2]

The act requires the DEA to share Automated Reports and Consolidated Orders System, or ARCOS, data with regulated industry and state partners.

Manufacturers and distributors are required to report on a monthly basis its acquisitions and dispositions of all controlled substances in Schedules I and II (which include opioids). In apparent response to intense criticism that the DEA has always had in its possession data that would help industry understand the volume of controlled substances being delivered to a pharmacy, the act imposes significant new data sharing requirements on the DEA. Specifically, the new law requires the DEA, within one year from enactment, to publish on a quarterly basis the total number of distributors from which a particular pharmacy buys and the total quantity and type of opioids distributed to each pharmacy or practitioner. This will finally allow manufacturers and distributors to see the total volume a pharmacy gets from each distributor, a critical piece of information to assess whether a particular pharmacy is filling an unusual amount of prescriptions. The provisions further mandate that the DEA share information with regulatory, licensing, attorneys general and law enforcement agencies of states on a semi-annual basis related to amounts, outliers and trends of distributor and pharmacy registrants.

However, the improved data sharing does not come without a price. The new law will punish a manufacturer or distributor who does not review and assess the newly available data. In particular, the law provides that all registered manufacturers and distributors shall be responsible for reviewing the information made available by the attorney general under this subsection and may be penalized if the DEA can prove that drug manufacturers and distributors failed to consider available ARCOS data when determining whether an order for opioids is suspicious.

The act aims to empower pharmacists to refuse to fill suspicious prescriptions.

In recent years, the DEA has focused significant attention on the pharmacist’s role in preventing diversion of controlled substances. Regulations under the Controlled Substances Act provide that while “the responsibility for the proper prescribing and dispensing of controlled substances is upon the prescribing practitioner ... a corresponding responsibility rests with the pharmacist who fills the prescription.”[3] The DEA has indicated through enforcement actions and informal guidance that it interprets this obligation to mean that pharmacists have an obligation to decline to fill suspicious prescriptions and, beyond that, to ensure that no other pharmacists within a single store or drugstore chain fill prescriptions for a suspicious patient or practitioner. This is sometimes called a blanket refusal to fill. Blanket refusals are controversial because many states have regulations that require pharmacists to evaluate each and every prescription individually. Additionally, certain state regulations suggest that if a prescription appears facially valid and is written by a duly licensed practitioner, a pharmacist is required to fill it.

Ostensibly to breach this divide, Section 3212 of the act directs the Department of Health and Human Services to help develop and disseminate materials clarifying the circumstances under which pharmacists may decline to fill controlled substance prescriptions, such as when they suspect the prescriptions are fraudulent, forged or of doubtful, questionable or suspicious origin.

There is no doubt that myriad and conflicting state and federal obligations put pharmacists and the pharmacies that employ them in a challenging position. But law enforcement priorities and the opioid crisis have imposed an ever-increasing expectation on pharmacists to act as a gatekeeper to stop individual suspicious prescriptions but also to share that view widely within their stores, chains and even communities. The act’s requirement that HHS educate pharmacists about their rights and responsibilities in this area will hopefully lead to more clear guidance for pharmacists that will empower them to fulfill the gatekeeper role that they clearly play.

This article was first published on Law360.