1. 1 E-222 Working Group Meeting DEA CSOS Pilot Discussion March 18, 2002

2. 2 Agenda nPhase I: Status nPhase I: Lessons Learned nPhase II: Goals nPhase II: Participant Requirements nPhase III: Planning Ahead nQuestions…

3. 3 Phase I: Status n21 registered participants in Phase I n8 digital certificates have been issued n6 completed test plans have been received (30% return rate to-date): l Mutual Drug l McKesson Corp. l McQueary Bros. Drug Company l Baxter Healthcare Corp. l Mallinckrodt Pharmaceuticals l Purdue Pharmacies LP

4. 4 Phase I: Lessons Learned nManual easily retrieved and read – noting some recommended changes! nA couple of screen shots need to be updated in the manual. nNo problems with certificate download times or errors. Total test time is averaging about 45 minutes. nStatistics will be compiled and made available once all test plans have been received. nSo far so good!!!!

5. 5 Registration Time Breakdown

6. 6 Browser Compatibility

7. 7 Phase I Timeline

8. 8 Phase II: Goals nTest forms validation process nSelect registered location/POA – begin thinking about who you will select nDownload forms nNotarization nValidate submission and adjudication process

9. 9 Phase II Timeline

10. 10 Phase II: Participant Requirements nTester must be affiliated with actual DEA registered location nForms must be properly notarized

11. 11 Phase III: Planning Ahead n Identify those participants who are willing and able to commit the resources (time and infrastructure) nTransaction sets should be finalized nWorkflows should be baselined

12. 12 Phase III Target Scope – Key Areas nOrder signing nOrder verification nRecord retention (signed order, linked data, digital certificate)

13. 13 Phase III Part A) Signing nOrder Signing l Identification of “to-be-signed” data l Activation of private key l Signature generation (supported algorithms) nSuccess Factors/Evaluation Criteria l Data format & technical compatibility—signing approach l Compatibility with current/planned workflow l Scalability (bulk orders, certificate management) l Performance l FIPS compliance

14. 14 Phase III Part B) – Verification nOrder Verification/Processing l Parsing of digital certificate [address, schedules] l Certificate Revocation List (CRL) access/processing l Order validation [integrity check, CRL check, certificate expiry check, date of order] nSuccess Factors/Evaluation Criteria l Verification logic l Compatibility with current/planned workflow l Archival compliance l Connectivity- support for LDAP through org. firewall l Performance (Internet-based l FIPS compliance

15. 15 Phase III Part C) – Record Retention nRecord Retention l Signed data [Order content] l Certificate data [Linked certificate or attached certificate?, address from certificate] l Linked data [distribution center(s), fill information, receipt information] nSuccess Factors/Evaluation Criteria l Readily retrievable l Integrity maintenance

16. 16 Phase III Logistics 1.How can the group divide and conquer? 2.… or, can Pilot participation be tailored to the partner’s business category (Pharmacy, Distributor, Manufacturer) l Order Signing—Pharmacies, Distributors l Order Verification —Distributors, manufacturers 3.Can simplifications be made that ease Pilot development without eliminating lessons learned? l Order generation (existing system vs. word processor) l Order transport (existing system vs. FTP Vs. email) 4.Will software need to be developed? l If so, how can the development be shared? l If so, can a single toolkit be used?

17. 17 Phase III Immediate Next Steps 1.Solidify Phase III Approach l Identify teams (signing, verifying) l Identify order format (EDI 850) l Identify signature approach (inside/outside) l Identify signing toolkit (EDI, Toolkit, other) 2.Estimate critical path milestones l ID estimated time to complete future workflows l ID estimated time to complete EDI 850 3.Begin exploring tech areas  ID skill requirements 4.Develop more detailed Phase III project plan

18. 18 Questions