Regulatory Framework August 27, 2001

2 An allowance not a mandate !

3 Elements of Electronic Orders (1) The name of the supplier from which the controlled substances are being ordered. Only one supplier may be listed on an order. (2) The street address of the supplier. (3) City and state of the supplier. (4) The date the order is submitted to the supplier. (5) The number of packages or containers of each item ordered.

4 Elements of Electronic Orders (6) The quantity in a single package. (7) The name of the controlled substance product. (8) The supplier’s DEA registration number (purchaser or supplier may complete this item). (9) The National Drug Code (purchaser or the supplier may complete this item). (10) Number of packages shipped (completed by the supplier).

5 Elements of Electronic Orders (11) Date shipped (completed by the supplier). (12) Number of packages received (purchaser completes on receipt of order). (13) Date received (purchaser completes on receipt of order). (14) The purchaser’s DEA registration number. (15) The schedules the purchaser is authorized to handle.

6 Elements of Electronic Orders (16) The purchaser’s DEA registration business activity classification. (17) A unique number the purchaser generates to track the order. (18) The purchaser’s name and address as they appear on the DEA Certificate of Registration. The data fields for the purchaser’s DEA registration number, schedules, business activity, and name and address must conform to the data in the Digital Certificate issued by DEA to the signer. These fields are the same fields that exist on the Form 222.

7 Order Transmission User authentication/activation –Control private key activation, –Ten-minute inactivity time period –Clear plain text private key from memory after use Digitally sign the order Digital transmission (fax is not acceptable) Archive (readily retrievable) 10 item order limit is eliminated

8 Order Receipt/Validation Verify that… –Certificate is not expired –Order has not been altered (signature) –Certificate has not been revoked –Extension data matches Archive must include purchaser’s certificate Daily reporting (individual transactions or summary report)

9 Technical Specifications National Institute of Standards and Technologies develops FIPS Standards –Federal Information Processing Standards –FIPS 140-1, Cryptography –186-2 Digital Signature –180-1 Hash Validated modules may be used without alteration

10 Audits Third party audit must be performed to ensure that signing/validation obligations are being met Ensuring that the audit is performed is the responsibility of the registrant When supplier develops system, audit is supplier’s responsibility Follow-up audits only required when signing/validation functionality is changed

11 Questions …