H.B. 106 Enrolled

1

CONTROLLED SUBSTANCE DATABASE
2 AMENDMENTS
3 2009 GENERAL SESSION
4 STATE OF UTAH
5 Chief Sponsor: Bradley M. Daw
6 Senate Sponsor: Curtis S. Bramble
7
8 LONG TITLE
9 General Description:
10 This bill amends provisions of the Utah Controlled Substances Act relating to the
11 controlled substance database.
12 Highlighted Provisions:
13 This bill:
14 . defines terms;
15 . expands the purposes for which a practitioner or pharmacist may access
16 information on the controlled substance database;
17 . grants access to the controlled substance database to a mental health therapist under
18 certain circumstances;
19 . permits a practitioner to designate up to three employees, subject to approval by the
20 Division of Occupational and Professional Licensing, who can access the
21 controlled substance database on the practitioner's behalf;
22 . provides that a practitioner, or an employee of the practitioner, who obtains
23 information from the controlled substance database may include the information in
24 the patient's medical chart or file and may provide the information to others in
25 accordance with the requirements of the Health Insurance Portability and
26 Accountability Act of 1996;
27 . grants rulemaking authority to the Division of Occupational and Professional
28 Licensing;
29 . permits the Division of Occupational and Professional Licensing to impose a fee on

30 practitioners who designate an employee to access the controlled substance database, in order
31 to recover the cost of determining whether the employee is a security risk;
32 . provides that a person who is a licensed practitioner or a mental health therapist
33 shall be denied access to the database when the person is no longer licensed;
34 . provides that a person who is a relative of a deceased individual is not entitled to
35 access information from the database relating to the deceased individual based on
36 the fact or claim that the person is related to, or subrogated to the rights of, the
37 deceased individual; and
38 . makes technical changes.
39 Monies Appropriated in this Bill:
40 None
41 Other Special Clauses:
42 None
43 Utah Code Sections Affected:
44 AMENDS:
45 58-37-7.5, as last amended by Laws of Utah 2008, Chapter 313
46
47 Be it enacted by the Legislature of the state of Utah:
48 Section 1. Section 58-37-7.5 is amended to read:
49 58-37-7.5. Controlled substance database -- Pharmacy reporting requirements --
50 Access -- Penalties.
51 (1) As used in this section:
52 (a) "Board" means the Utah State Board of Pharmacy created in Section 58-17b-201 .
53 (b) "Database" means the controlled substance database created in this section.
54 (c) "Database manager" means the person responsible for operating the database, or
55 the person's designee.
56 (d) "Division" means the Division of Occupational and Professional Licensing created
57 in Section 58-1-103 .

58 (e) "Health care facility" is as defined in Section 26-21-2 .
59 (f) "Mental health therapist" is as defined in Section 58-60-102 .
60 [(f)] (g) "Pharmacy" or "pharmaceutical facility" is as defined in Section 58-17b-102 .
61 (h) "Prospective patient" means a person who:
62 (i) is seeking medical advice, medical treatment, or medical services from a
63 practitioner; and
64 (ii) the practitioner described in Subsection (1)(h)(i) is considering accepting as a
65 patient.
66 (i) "Substance abuse treatment program" is as defined in Section 62A-2-101 .
67 (2) (a) There is created within the division a controlled substance database.
68 (b) The division shall administer and direct the functioning of the database in
69 accordance with this section. The division may under state procurement laws contract with
70 another state agency or private entity to establish, operate, or maintain the database. The
71 division in collaboration with the board shall determine whether to operate the database within
72 the division or contract with another entity to operate the database, based on an analysis of
73 costs and benefits.
74 (c) The purpose of the database is to contain data as described in this section
75 regarding every prescription for a controlled substance dispensed in the state to any person
76 other than an inpatient in a licensed health care facility.
77 (d) Data required by this section shall be submitted in compliance with this section to
78 the manager of the database by the pharmacist in charge of the drug outlet where the
79 controlled substance is dispensed.
80 (3) The board shall advise the division regarding:
81 (a) establishing, maintaining, and operating the database;
82 (b) access to the database and how access is obtained; and
83 (c) control of information contained in the database.
84 (4) The pharmacist in charge shall, regarding each controlled substance dispensed by a
85 pharmacist under the pharmacist's supervision other than those dispensed for an inpatient at a

86 health care facility, submit to the manager of the database the following information, by a
87 procedure and in a format established by the division:
88 (a) name of the prescribing practitioner;
89 (b) date of the prescription;
90 (c) date the prescription was filled;
91 (d) name of the person for whom the prescription was written;
92 (e) positive identification of the person receiving the prescription, including the type
93 of identification and any identifying numbers on the identification;
94 (f) name of the controlled substance;
95 (g) quantity of controlled substance prescribed;
96 (h) strength of controlled substance;
97 (i) quantity of controlled substance dispensed;
98 (j) dosage quantity and frequency as prescribed;
99 (k) name of drug outlet dispensing the controlled substance;
100 (l) name of pharmacist dispensing the controlled substance; and
101 (m) other relevant information as required by division rule.
102 (5) The division shall maintain the database in an electronic file or by other means
103 established by the division to facilitate use of the database for identification of:
104 (a) prescribing practices and patterns of prescribing and dispensing controlled
105 substances;
106 (b) practitioners prescribing controlled substances in an unprofessional or unlawful
107 manner;
108 (c) individuals receiving prescriptions for controlled substances from licensed
109 practitioners, and who subsequently obtain dispensed controlled substances from a drug outlet
110 in quantities or with a frequency inconsistent with generally recognized standards of dosage
111 for that controlled substance; and
112 (d) individuals presenting forged or otherwise false or altered prescriptions for
113 controlled substances to a pharmacy.

114 (6) (a) The division shall by rule establish the electronic format in which the
115 information required under this section shall be submitted to the administrator of the database.
116 (b) The division shall ensure the database system records and maintains for reference:
117 (i) identification of each person who requests or receives information from the
118 database;
119 (ii) the information provided to each person; and
120 (iii) the date and time the information is requested or provided.
121 (7) The division shall make rules to:
122 (a) effectively enforce the limitations on access to the database as described in
123 Subsection (8); and
124 (b) establish standards and procedures to ensure accurate identification of individuals
125 requesting information or receiving information without request from the database.
126 (8) The manager of the database shall make information in the database available only
127 to the following persons, [and] in accordance with the [limitations stated] requirements of this
128 section and division rules:
129 (a) personnel of the division specifically assigned to conduct investigations related to
130 controlled substances laws under the jurisdiction of the division;
131 (b) authorized division personnel engaged in analysis of controlled substance
132 prescription information as a part of the assigned duties and responsibilities of their
133 employment;
134 (c) employees of the Department of Health whom the director of the Department of
135 Health assigns to conduct scientific studies regarding the use or abuse of controlled
136 substances, provided that the identity of the individuals and pharmacies in the database are
137 confidential and are not disclosed in any manner to any individual who is not directly involved
138 in the scientific studies;
139 (d) a licensed practitioner having authority to prescribe controlled substances, to the
140 extent the information:
141 (i) (A) [the information] relates specifically to a current or prospective patient of the

142 practitioner[, to whom the practitioner is]; and
143 (B) is sought by the practitioner for the purpose of:
144 (I) prescribing or considering prescribing any controlled substance[;] to the current or
145 prospective patient;
146 (II) diagnosing the current or prospective patient;
147 (III) providing medical treatment or medical advice to the current or prospective
148 patient; or
149 (IV) determining whether the current or prospective patient:
150 (Aa) is attempting to fraudulently obtain a controlled substance from the practitioner;
151 or
152 (Bb) has fraudulently obtained, or attempted to fraudulently obtain, a controlled
153 substance from the practitioner;
154 (ii) (A) relates specifically to a former patient of the practitioner; and
155 (B) is sought by the practitioner for the purpose of determining whether the former
156 patient has fraudulently obtained, or has attempted to fraudulently obtain, a controlled
157 substance from the practitioner;
158 [(ii) the information] (iii) relates specifically to an individual who has access to the
159 practitioner's Drug Enforcement Administration number, and the practitioner suspects that the
160 individual may have used the practitioner's Drug Enforcement Administration identification
161 number to fraudulently acquire or prescribe a controlled [substances; or] substance;
162 [(iii) the information] (iv) relates to the practitioner's own prescribing practices, except
163 when specifically prohibited by the division by administrative rule;
164 (v) relates to the use of the controlled substance database by an employee of the
165 practitioner, described in Subsection (8)(e); or
166 (vi) relates to any use of the practitioner's Drug Enforcement Administration
167 identification number to obtain, attempt to obtain, prescribe, or attempt to prescribe, a
168 controlled substance;
169 (e) in accordance with Subsection (17), an employee of a practitioner described in

170 Subsection (8)(d), for a purpose described in Subsection (8)(d)(i) or (ii), if:
171 (i) the employee is designated by the practitioner as a person authorized to access the
172 information on behalf of the practitioner;
173 (ii) the practitioner provides written notice to the division of the identity of the
174 employee; and
175 (iii) the division:
176 (A) grants the employee access to the database; and
177 (B) provides the employee with a password that is unique to that employee to access
178 the database in order to permit the division to comply with the requirements of Subsection
179 (6)(b) with respect to the employee;
180 [(e)] (f) a licensed pharmacist having authority to dispense controlled substances to
181 the extent the information [relates specifically to a current patient to whom that pharmacist is]
182 is sought for the purpose of:
183 (i) dispensing or considering dispensing any controlled substance; or
184 (ii) determining whether a person:
185 (A) is attempting to fraudulently obtain a controlled substance from the pharmacist; or
186 (B) has fraudulently obtained, or attempted to fraudulently obtain, a controlled
187 substance from the pharmacist;
188 [(f)] (g) federal, state, and local law enforcement authorities, and state and local
189 prosecutors, engaged as a specified duty of their employment in enforcing laws:
190 (i) regulating controlled substances; or
191 (ii) investigating insurance fraud, Medicaid fraud, or Medicare fraud; [and]
192 (h) a mental health therapist, if:
193 (i) the information relates to a patient who is:
194 (A) enrolled in a licensed substance abuse treatment program; and
195 (B) receiving treatment from, or under the direction of, the mental health therapist as
196 part of the patient's participation in the licensed substance abuse treatment program described
197 in Subsection (8)(h)(i)(A);

198 (ii) the information is sought for the purpose of determining whether the patient is
199 using a controlled substance while the patient is enrolled in the licensed substance abuse
200 treatment program described in Subsection (8)(h)(i)(A); and
201 (iii) the licensed substance abuse treatment program described in Subsection
202 (8)(h)(i)(A) is associated with a practitioner who:
203 (A) is a physician, a physician assistant, an advance practice registered nurse, or a
204 pharmacist; and
205 (B) is available to consult with the mental health therapist regarding the information
206 obtained by the mental health therapist, under this Subsection (8)(h), from the database; and
207 [(g)] (i) an individual who is the recipient of a controlled substance prescription
208 entered into the database, upon providing evidence satisfactory to the database manager that
209 the individual requesting the information is in fact the person about whom the data entry was
210 made.
211 (9) Any person who knowingly and intentionally releases any information in the
212 database in violation of the limitations under Subsection (8) is guilty of a third degree felony.
213 (10) (a) Any person who obtains or attempts to obtain information from the database
214 by misrepresentation or fraud is guilty of a third degree felony.
215 (b) Any person who obtains or attempts to obtain information from the database for a
216 purpose other than a purpose authorized by this section or by rule is guilty of a third degree
217 felony.
218 (11) (a) [A] Except as provided in Subsection (11)(d), a person may not knowingly
219 and intentionally use, release, publish, or otherwise make available to any other person or
220 entity any information obtained from the database for any purpose other than those specified
221 in Subsection (8). Each separate violation of this Subsection (11) is a third degree felony and
222 is also subject to a civil penalty not to exceed $5,000.
223 (b) The procedure for determining a civil violation of this Subsection (11) shall be in
224 accordance with Section 58-1-108 , regarding adjudicative proceedings within the division.
225 (c) Civil penalties assessed under this Subsection (11) shall be deposited in the

226 General Fund as a dedicated credit to be used by the division under Subsection 58-37-7.7 (1).
227 (d) Nothing in this Subsection (11) prohibits a person who obtains information from
228 the database under Subsection (8)(d) or (e) from:
229 (i) including the information in the person's medical chart or file for access by a
230 person authorized to review the medical chart or file; or
231 (ii) providing the information to a person in accordance with the requirements of the
232 Health Insurance Portability and Accountability Act of 1996.
233 (12) (a) The failure of a pharmacist in charge to submit information to the database as
234 required under this section after the division has submitted a specific written request for the
235 information or when the division determines the individual has a demonstrable pattern of
236 failing to submit the information as required is grounds for the division to take the following
237 actions in accordance with Section 58-1-401 :
238 (i) refuse to issue a license to the individual;
239 (ii) refuse to renew the individual's license;
240 (iii) revoke, suspend, restrict, or place on probation the license;
241 (iv) issue a public or private reprimand to the individual;
242 (v) issue a cease and desist order; and
243 (vi) impose a civil penalty of not more than $1,000 for each dispensed prescription
244 regarding which the required information is not submitted.
245 (b) Civil penalties assessed under Subsection (12)(a)(vi) shall be deposited in the
246 General Fund as a dedicated credit to be used by the division under Subsection 58-37-7.7 (1).
247 (c) The procedure for determining a civil violation of this Subsection (12) shall be in
248 accordance with Section 58-1-108 , regarding adjudicative proceedings within the division.
249 (13) An individual who has submitted information to the database in accordance with
250 this section may not be held civilly liable for having submitted the information.
251 (14) All department and the division costs necessary to establish and operate the
252 database shall be funded by appropriations from:
253 (a) the Commerce Service Fund; and

254 (b) the General Fund.
255 (15) All costs associated with recording and submitting data as required in this section
256 shall be assumed by the submitting pharmacy.
257 (16) (a) Except as provided in Subsection (16)(b), data provided to, maintained in, or
258 accessed from the database that may be identified to, or with, a particular person is not subject
259 to discovery, subpoena, or similar compulsory process in any civil, judicial, administrative, or
260 legislative proceeding, nor shall any individual or organization with lawful access to the data
261 be compelled to testify with regard to the data.
262 (b) The restrictions in Subsection (16)(a) do not apply to:
263 (i) a criminal proceeding; or
264 (ii) a civil, judicial, or administrative action brought to enforce the provisions of this
265 section, Section 58-37-7.7 , or Section 58-37-7.8 .
266 (17) (a) A practitioner described in Subsection (8)(d) may designate up to three
267 employees to access information from the database under Subsection (8)(e).
268 (b) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah
269 Administrative Rulemaking Act, to establish background check procedures to determine
270 whether an employee designated under Subsection (8)(e)(i) should be granted access to the
271 database.
272 (c) The division shall grant an employee designated under Subsection (8)(e)(i) access
273 to the database, unless the division determines, based on a background check, that the
274 employee poses a security risk to the information contained in the database.
275 (d) The division may impose a fee, in accordance with Section 63J-1-303 , on a
276 practitioner who designates an employee under Subsection (8)(e)(i), to pay for the costs
277 incurred by the division to conduct the background check and make the determination
278 described in Subsection (17)(c).
279 (18) (a) A person who is granted access to the database based on the fact that the
280 person is a licensed practitioner or a mental health therapist shall be denied access to the
281 database when the person is no longer licensed.

282 (b) A person who is granted access to the database based on the fact that the person is
283 a designated employee of a licensed practitioner shall be denied access to the database when
284 the practitioner is no longer licensed.
285 (19) A person who is a relative of a deceased individual is not entitled to access
286 information from the database relating to the deceased individual based on the fact or claim
287 that the person is:
288 (a) related to the deceased individual; or
289 (b) subrogated to the rights of the deceased individual.