H.B. 257

1

CONTROLLED SUBSTANCE DATABASE AMENDMENTS
2 2012 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Bradley M. Daw
5 Senate Sponsor: ____________
6
7 LONG TITLE
8 General Description:
9 This bill modifies Title 58, Chapter 37f, Controlled Substance Database Act, regarding
10 use of the database to obtain information from other states or the federal government,
11 access to the database by designated employees and practitioners, and the entering of
12 pain management contracts in the database.
13 Highlighted Provisions:
14 This bill:
15 . prohibits unauthorized use of the controlled substance database as a means of
16 obtaining information from other states or a federal drug monitoring program;
17 . provides for the designation by a practitioner of persons who are employed by the
18 same business as the practitioner to gain access to the database at the request of the
19 practitioner;
20 . provides a procedure for an emergency room employee to look up information in
21 the database for a practitioner who is treating an emergency room patient; and
22 . authorizes practitioners who enter into pain management contracts with patients to
23 provide a record of the contract to the division to be entered in the database.
24 Money Appropriated in this Bill:
25 None
26 Other Special Clauses:
27 None

28 Utah Code Sections Affected:
29 AMENDS:
30 58-37f-203, as enacted by Laws of Utah 2010, Chapter 287
31 58-37f-301, as last amended by Laws of Utah 2011, Chapters 38, 151, and 226
32 58-37f-601, as enacted by Laws of Utah 2010, Chapter 287
33
34 Be it enacted by the Legislature of the state of Utah:
35 Section 1. Section 58-37f-203 is amended to read:
36 58-37f-203. Submission, collection, and maintenance of data.
37 (1) The pharmacist in charge of the drug outlet where a controlled substance is
38 dispensed shall submit the data described in this section to the division:
39 (a) in accordance with the requirements of this section;
40 (b) in accordance with the procedures established by the division; and
41 (c) in the format established by the division.
42 (2) The pharmacist described in Subsection (1) shall, for each controlled substance
43 dispensed by a pharmacist under the pharmacist's supervision other than those dispensed for an
44 inpatient at a health care facility, submit to the division the following information:
45 (a) the name of the prescribing practitioner;
46 (b) the date of the prescription;
47 (c) the date the prescription was filled;
48 (d) the name of the individual for whom the prescription was written;
49 (e) positive identification of the individual receiving the prescription, including the
50 type of identification and any identifying numbers on the identification;
51 (f) the name of the controlled substance;
52 (g) the quantity of the controlled substance prescribed;
53 (h) the strength of the controlled substance;
54 (i) the quantity of the controlled substance dispensed;
55 (j) the dosage quantity and frequency as prescribed;
56 (k) the name of the drug outlet dispensing the controlled substance;
57 (l) the name of the pharmacist dispensing the controlled substance; and
58 (m) other relevant information as required by division rule.

59 (3) (a) (i) A practitioner who is licensed to prescribe a controlled substance and who
60 establishes a pain management agreement or contract with any individual may notify the
61 division under Subsection (3)(a)(ii) that the practitioner has entered into the agreement or
62 contract so that the division may enter notice of the agreement or contract in the database.
63 (ii) The physician may notify the division of a pain management agreement or contract
64 only if the individual who is a party to the agreement or contract has consented in writing that
65 the physician may notify the division.
66 (b) The notification to the division of the pain management agreement or contract shall
67 include the name and license number of the practitioner, the name and street address of the
68 individual with whom the agreement or contract is made, and the date on which the agreement
69 or contract is entered into.
70 (c) If a pain management agreement or contract under this section is terminated by the
71 practitioner or the individual who entered into the agreement or contract with the practitioner,
72 the practitioner shall advise the division of the termination.
73 (d) (i) If notified by the practitioner under Subsection (3)(a), the division shall enter the
74 name of the practitioner and the name of the person who has entered into the agreement or the
75 contract with the practitioner in the database, and shall also enter the termination of the
76 agreement or contract if notified by the practitioner.
77 (ii) The division shall make rules under Title 63G, Chapter 3, Utah Administrative
78 Rulemaking Act, establishing procedures for providing written consent of the individual,
79 notifying the division, and entering the contract or agreement, including ensuring that only the
80 minimal identification of the individual is made available as necessary to provide information
81 to practitioners.
82 [(3)] (4) (a) The division shall make rules, in accordance with Title 63G, Chapter 3,
83 Utah Administrative Rulemaking Act, to establish the electronic format in which the
84 information required under this section shall be submitted to the division.
85 (b) The division shall ensure that the database system records and maintains for
86 reference:
87 (i) the identification of each individual who requests or receives information from the
88 database;
89 (ii) the information provided to each individual; and

90 (iii) the date and time that the information is requested or provided.
91 Section 2. Section 58-37f-301 is amended to read:
92 58-37f-301. Access to database.
93 (1) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah
94 Administrative Rulemaking Act, to:
95 (a) effectively enforce the limitations on access to the database as described in this
96 part; and
97 (b) establish standards and procedures to ensure accurate identification of individuals
98 requesting information or receiving information without request from the database.
99 (2) The division shall make information in the database and information obtained from
100 other state or federal prescription monitoring programs by means of the database available only
101 to the following individuals, in accordance with the requirements of this chapter and division
102 rules:
103 (a) personnel of the division specifically assigned to conduct investigations related to
104 controlled substance laws under the jurisdiction of the division;
105 (b) authorized division personnel engaged in analysis of controlled substance
106 prescription information as a part of the assigned duties and responsibilities of their
107 employment;
108 (c) in accordance with a written agreement entered into with the department,
109 employees of the Department of Health:
110 (i) whom the director of the Department of Health assigns to conduct scientific studies
111 regarding the use or abuse of controlled substances, provided that the identity of the individuals
112 and pharmacies in the database are confidential and are not disclosed in any manner to any
113 individual who is not directly involved in the scientific studies; or
114 (ii) when the information is requested by the Department of Health in relation to a
115 person or provider whom the Department of Health suspects may be improperly obtaining or
116 providing a controlled substance;
117 (d) a licensed practitioner having authority to prescribe controlled substances, to the
118 extent the information:
119 (i) (A) relates specifically to a current or prospective patient of the practitioner; and
120 (B) is sought by the practitioner for the purpose of:

121 (I) prescribing or considering prescribing any controlled substance to the current or
122 prospective patient;
123 (II) diagnosing the current or prospective patient;
124 (III) providing medical treatment or medical advice to the current or prospective
125 patient; or
126 (IV) determining whether the current or prospective patient:
127 (Aa) is attempting to fraudulently obtain a controlled substance from the practitioner;
128 or
129 (Bb) has fraudulently obtained, or attempted to fraudulently obtain, a controlled
130 substance from the practitioner;
131 (ii) (A) relates specifically to a former patient of the practitioner; and
132 (B) is sought by the practitioner for the purpose of determining whether the former
133 patient has fraudulently obtained, or has attempted to fraudulently obtain, a controlled
134 substance from the practitioner;
135 (iii) relates specifically to an individual who has access to the practitioner's Drug
136 Enforcement Administration identification number, and the practitioner suspects that the
137 individual may have used the practitioner's Drug Enforcement Administration identification
138 number to fraudulently acquire or prescribe a controlled substance;
139 (iv) relates to the practitioner's own prescribing practices, except when specifically
140 prohibited by the division by administrative rule;
141 (v) relates to the use of the controlled substance database by an employee of the
142 practitioner, described in Subsection (2)(e); [or]
143 (vi) relates to any use of the practitioner's Drug Enforcement Administration
144 identification number to obtain, attempt to obtain, prescribe, or attempt to prescribe, a
145 controlled substance; or
146 (vii) relates to a patient who has a pain management contract with a licensed
147 practitioner;
148 (e) in accordance with Subsection (3)(a), an employee of a practitioner described in
149 Subsection (2)(d), for a purpose described in Subsection (2)(d)(i) or (ii), if:
150 (i) the employee is designated by the practitioner as an individual authorized to access
151 the information on behalf of the practitioner;

152 (ii) the practitioner provides written notice to the division of the identity of the
153 employee; and
154 (iii) the division:
155 (A) grants the employee access to the database; and
156 (B) provides the employee with a password that is unique to that employee to access
157 the database in order to permit the division to comply with the requirements of Subsection
158 58-37f-203 (3)(b) with respect to the employee;
159 (f) an employee of the same business that employs a licensed practitioner under
160 Subsection (2)(d) if:
161 (i) the employee is designated by the practitioner as an individual authorized to access
162 the information on behalf of the practitioner;
163 (ii) the practitioner and the employing business provide written notice to the division of
164 the identity of the designated employee; and
165 (iii) the division:
166 (A) grants the employee access to the database; and
167 (B) provides the employee with a password that is unique to that employee to access
168 the database in order to permit the division to comply with the requirements of Subsection
169 58-37f-203 (3)(b) with respect to the employee;
170 [(f)] (g) a licensed pharmacist having authority to dispense a controlled substance to
171 the extent the information is sought for the purpose of:
172 (i) dispensing or considering dispensing any controlled substance; or
173 (ii) determining whether a person:
174 (A) is attempting to fraudulently obtain a controlled substance from the pharmacist; or
175 (B) has fraudulently obtained, or attempted to fraudulently obtain, a controlled
176 substance from the pharmacist;
177 [(g)] (h) federal, state, and local law enforcement authorities, and state and local
178 prosecutors, engaged as a specified duty of their employment in enforcing laws:
179 (i) regulating controlled substances; or
180 (ii) investigating insurance fraud, Medicaid fraud, or Medicare fraud;
181 [(h)] (i) employees of the Office of Internal Audit and Program Integrity within the
182 Department of Health who are engaged in their specified duty of ensuring Medicaid program

183 integrity under Section 26-18-2.3 ;
184 [(i)] (j) a mental health therapist, if:
185 (i) the information relates to a patient who is:
186 (A) enrolled in a licensed substance abuse treatment program; and
187 (B) receiving treatment from, or under the direction of, the mental health therapist as
188 part of the patient's participation in the licensed substance abuse treatment program described
189 in Subsection (2)[(i)](j)(i)(A);
190 (ii) the information is sought for the purpose of determining whether the patient is
191 using a controlled substance while the patient is enrolled in the licensed substance abuse
192 treatment program described in Subsection (2)[(i)](j)(i)(A); and
193 (iii) the licensed substance abuse treatment program described in Subsection
194 (2)[(i)](j)(i)(A) is associated with a practitioner who:
195 (A) is a physician, a physician assistant, an advance practice registered nurse, or a
196 pharmacist; and
197 (B) is available to consult with the mental health therapist regarding the information
198 obtained by the mental health therapist, under this Subsection (2)[(i)](j), from the database;
199 [(j)] (k) an individual who is the recipient of a controlled substance prescription
200 entered into the database, upon providing evidence satisfactory to the division that the
201 individual requesting the information is in fact the individual about whom the data entry was
202 made;
203 [(k)] (l) the inspector general, or a designee of the inspector general, of the Office of
204 Inspector General of Medicaid Services, for the purpose of fulfilling the duties described in
205 Title 63J, Chapter 4a, Part 2, Office Duties and Powers; and
206 [(l)] (m) the following licensed physicians for the purpose of reviewing and offering an
207 opinion on an individual's request for workers' compensation benefits under Title 34A, Chapter
208 2, Workers' Compensation Act, or Title 34A, Chapter 3, Utah Occupational Disease Act:
209 (i) a member of the medical panel described in Section 34A-2-601 ; or
210 (ii) a physician offering a second opinion regarding treatment.
211 (3) (a) A practitioner described in Subsection (2)(d) may designate up to three
212 employees to access information from the database under Subsection (2)(e), (2)(f), or (4)(c).
213 (b) The division shall make rules, in accordance with Title 63G, Chapter 3, Utah

214 Administrative Rulemaking Act, to:
215 (i) establish background check procedures to determine whether an employee
216 designated under Subsection (2)(e)[(i)], (2)(f), or (4c) should be granted access to the
217 database[.]; and
218 (ii) establish the information to be provided by an emergency room employee under
219 Subsection (4).
220 (c) The division shall grant an employee designated under Subsection (2)(e)[(i)], (2)(f),
221 or (4)(c) access to the database, unless the division determines, based on a background check,
222 that the employee poses a security risk to the information contained in the database.
223 (4) (a) An individual who is employed in the emergency room of a hospital may
224 exercise access to the database under this Subsection (4) on behalf of a licensed practitioner if
225 the individual is designated under Subsection (4)(c) and the licensed practitioner:
226 (i) is employed in the emergency room;
227 (ii) is treating an emergency room patient for an emergency medical condition; and
228 (iii) requests that an individual employed in the emergency room and designated under
229 Subsection (4)(c) obtain information regarding the patient from the database as needed in the
230 course of treatment.
231 (b) The emergency room employee obtaining information from the database shall,
232 when gaining access to the database, provide to the database the name and any additional
233 identifiers regarding the requesting practitioner as required by division administrative rule
234 established under Subsection (3)(b).
235 (c) An individual employed in the emergency room under this Subsection (4) may
236 obtain information from the database as provided in Subsection (4)(a) if:
237 (i) the employee is designated by the practitioner as an individual authorized to access
238 the information on behalf of the practitioner;
239 (ii) the practitioner and the hospital operating the emergency room provide written
240 notice to the division of the identity of the designated employee; and
241 (iii) the division:
242 (A) grants the employee access to the database; and
243 (B) provides the employee with a password that is unique to that employee to access
244 the database in order to permit the division to comply with the requirements of Subsection

245 58-37f-203 (3)(b) with respect to the employee.
246 (d) The division may impose a fee, in accordance with Section 63J-1-504 , on a
247 practitioner who designates an employee under Subsection (2)(e)[(i)], (2)(f), or (4)(c) to pay for
248 the costs incurred by the division to conduct the background check and make the determination
249 described in Subsection (3)(b).
250 [(4)] (5) (a) An individual who is granted access to the database based on the fact that
251 the individual is a licensed practitioner or a mental health therapist shall be denied access to the
252 database when the individual is no longer licensed.
253 (b) An individual who is granted access to the database based on the fact that the
254 individual is a designated employee of a licensed practitioner shall be denied access to the
255 database when the practitioner is no longer licensed.
256 Section 3. Section 58-37f-601 is amended to read:
257 58-37f-601. Unlawful release or use of database information -- Criminal and civil
258 penalties.
259 (1) Any person who knowingly and intentionally releases any information in the
260 database or knowingly and intentionally releases any information obtained from other state or
261 federal prescription monitoring programs by means of the database in violation of the
262 limitations under Part 3, Access, is guilty of a third degree felony.
263 (2) (a) Any person who obtains or attempts to obtain information from the database or
264 from any other state or federal prescription monitoring programs by means of the database by
265 misrepresentation or fraud is guilty of a third degree felony.
266 (b) Any person who obtains or attempts to obtain information from the database for a
267 purpose other than a purpose authorized by this chapter or by rule is guilty of a third degree
268 felony.
269 (3) (a) Except as provided in Subsection (3)(e), a person may not knowingly and
270 intentionally use, release, publish, or otherwise make available to any other person any
271 information obtained from the database or from any other state or federal prescription
272 monitoring programs by means of the database for any purpose other than those specified in
273 Part 3, Access.
274 (b) Each separate violation of this Subsection (3) is a third degree felony and is also
275 subject to a civil penalty not to exceed $5,000.

276 (c) The procedure for determining a civil violation of this Subsection (3) [shall be] is in
277 accordance with Section 58-1-108 , regarding adjudicative proceedings within the division.
278 (d) Civil penalties assessed under this Subsection (3) shall be deposited in the General
279 Fund as a dedicated credit to be used by the division under Subsection 58-37f-502 (1).
280 (e) [Nothing in this] This Subsection (3) [prohibits] does not prohibit a person who
281 obtains information from the database under Subsection 58-37f-301 (2)(d) [or], (e), (f), or (4)(c)
282 from:
283 (i) including the information in the person's medical chart or file for access by a person
284 authorized to review the medical chart or file; or
285 (ii) providing the information to a person in accordance with the requirements of the
286 Health Insurance Portability and Accountability Act of 1996.




Legislative Review Note
as of 11-8-11 3:34 PM

Office of Legislative Research and General Counsel