CABINET FOR HEALTH AND FAMILY SERVICES

Office of Inspector General

Division of Audits and Investigations

(As Amended at ARRS, December 17, 2012)

      902 KAR 55:110. Monitoring system for prescription controlled substances.

      RELATES TO: KRS 218A.010(9), 218A.202, 218A.240

      STATUTORY AUTHORITY: KRS 194A.050, 218A.202(1), 218A.250

      NECESSITY, FUNCTION, AND CONFORMITY: KRS 218A.202(1) directs the Cabinet for Health and Family Services to establish an electronic system for monitoring Schedule II, III, IV, and V controlled substances that are dispensed in the Commonwealth by a practitioner or pharmacist or dispensed to an address within the Commonwealth by a pharmacy that has obtained authorization to operate from the Kentucky Board of Pharmacy. KRS 218A.250 requires the cabinet to promulgate administrative regulations pursuant to KRS Chapter 13A for carrying out the provisions of KRS Chapter 218A. [The purpose of]This administrative regulation establishes[is to establish] criteria for reporting prescription data, providing reports to authorized persons, and a waiver for a dispenser who does not have an automated recordkeeping system.

      Section 1. Definitions. (1) "Branch" means the Drug Enforcement and Professional Practices Branch in the Division of Audits and Investigations, Office of Inspector General, Cabinet for Health and Family Services.

      (2) "Cabinet personnel" means an individual who:

      (a)1. Is directly employed by the Cabinet for Health and Family Services; or

      2. Is employed by an agent or contractor of the cabinet;

      (b) Has undergone KASPER training; and

      (c) Has been approved to use the KASPER system.

      (3) "Dispenser" is defined by KRS 218A.010(9), and shall:

      (a) Include a dispenser who has a DEA (Drug Enforcement Administration) number or is a pharmacist who owns or is employed by a facility that operates a pharmacy which has a DEA number; and

      (b) Not include an individual licensed to practice veterinary medicine under KRS Chapter 321.

      (4) "Health facility" is defined by KRS 216B.015(13).

      (5)"KASPER" means Kentucky All-Schedule Prescription Electronic Reporting System.

      (6)[(5)] "Patient identifier" means a patient's:

      (a) Full name;

      (b) Address, including zip code;

      (c) Date of birth; and

      (d) Social Security number or an alternative identification number established pursuant to Section 5 of this administrative regulation.

      (7)"Practitioner" is defined by KRS 218A.010(33).

      (8)[(6)]["KASPER Reporting Form" means a form that:

      (a) Is in the format of the "KASPER Reporting Form" incorporated by reference in Section 7 of this administrative regulation; and

      (b) Contains the information specified by Section 2(2) of this administrative regulation.

      (7)] "Report" means a compilation of data concerning a patient, dispenser, practitioner, or controlled substance.

      Section 2. Data Reporting. (1) A dispenser or a health facility that has a DEA numbershall report all dispensed Schedule II, III, IV, or V controlled substances, except during the circumstances specified in KRS 218A.202(3)(a) and (b).

      (2)[Reports pursuant to subsection (1) of this section shall not be required for:

      (a) A long-term care facility as defined by KRS 216.510(1);

      (b) An ambulance provider; or

      (c) A jail, correctional or detention facility, or a juvenile detention facility.

      (3)] A dispenser of a Schedule II, III, IV, or V controlled substance shall transmit or provide the following data to the cabinet or the cabinet’s agent:

      (a) Patient identifier;

      (b) National drug code of the drug dispensed;

      (c) Metric quantity of thedrug dispensed;

      (d) Date of dispensing;

      (e) Estimated day's supply dispensed;

      (f) Drug Enforcement Administration registration number of the prescriber;

      (g) Serial number assigned by the dispenser; and

      (h) The Drug Enforcement Administration registration number of the dispenser.

      (3)[(4)](a) Prior to July 1, 2013,[(3)] the data identified in subsection (2)[(3)][(2)] of this section shall be transmitted within seven (7) days of the date of dispensing unless the cabinet grants an extension as provided in subsection (4) or (5) of this section.

      (b) Prior to July 1, 2013, a dispenser that dispenses a controlled substance for the direct administration of the controlled substance to or for a patient in a licensed health facility shall not be required to transmit the data identified in subsection (2) of this section.

      (c)Effective July 1, 2013, the data identified in subsection (2)[(3)] of this section shall be transmitted no later than close of business on the business day immediately following the dispensing unless the cabinet grants an extensionas provided in subsection (4) or (5) of this section.

      (4)[(5)][(4)](a) An extension may be granted if:

      1. The dispenser suffers a mechanical or electronic failure; or

      2. The dispenser cannot meet the deadline established by subsection (3)[(4)][(3)] of this section because of reasons beyond his or her control.

      (b) A dispenser shall apply to the branch in writing for an extension listed in paragraph (a) of this subsection within twenty-four (24) hours of discovery of the circumstances necessitating the request or on the next date state offices are open for business, following the discovery. An application for an extension shall state the justification for the extension and the period of time for which the extension is necessary.

      (5)[(6)][(5)] An extension shall be granted to a dispenser if the cabinet or its agent is unable to receive electronic reports transmitted by the dispenser.

      (6)[(7)][(6)] Except as provided in subsection (8)[(9)] of this section, the data shall be transmitted by:

      (a) An electronic device compatible with the receiving device of the cabinet or the cabinet’s agent;

      (b)[Double sided, high density micro floppy disk;

      (c) One-half (1/2) inch nine (9) track 1600 or 6250 BPI magnetic tape;

      (d)] Secure File Transfer Protocol;

      (c)[(e)] https protocol; or

      (d)[(f) CD/DVD; or

      (g)] Secure Virtual Private Network connection.

      (7)[(8)][(7)] The data shall be transmitted in the format established by the "ASAP Telecommunications Format for Controlled Substances", developed by theAmerican Society for Automation in Pharmacy, Version 4.1[May 1995], or a comparable format approved by the branch.

      (8)[(9)][(8)] A dispenser who does not have an automated recordkeeping system capable of producing an electronic report in the format established by "ASAP Telecommunications Format for Controlled Substances", shall report the data identified in subsection (2)[(3)] of this section using an Internet accessible web portal designated by the cabinet.[be granted a waiver from the electronic reporting requirement if the dispenser:

      (a) Makes a written request to the branch within twenty-four (24) hours of discovery and of the circumstances necessitating the request, or on the next date that state offices are open for business following the discovery; and

      (b) Agrees in writing to immediately begin reporting the data by submitting a completed "KASPER Reporting Form" or comparable document approved in writing by the branch.]

      Section 3. Compliance. A dispenser may presume that the patient identification information established in Section 5 of this administrative regulation and provided by the patient or the patient’s agent is correct.

      Section 4. Request for Report. (1) A written or electronic request shall be filed with the cabinet prior to the release of a report, except for a subpoena issued by a grand jury or an appropriate court order issued by a court of competent jurisdiction.

      (2) A request for a KASPER patientreport shall be made electronically at www.chfs.ky.gov/KASPER[http://chfs.ky.gov/oig/kasper].

      (3) A request for a KASPER providerreport made by[from]a peace officer authorized to receive data under KRS 218A.202, or a designated representative of a board responsible for the licensure, regulation, or discipline of prescribing practitionersshall be made by written application on the "Request for KASPER Report (Law Enforcement and Licensure Boards)", Form DCB-15L.

      (4) A medical examiner engaged in a death investigation pursuant to KRS 72.026 may query[request a]KASPER for areport on the decedent.[one (1) of the following forms:

      (a) For law enforcement, on the "Request for Law Enforcement KASPER Report", Form DCB-15L;

      (b) For judiciary, on the "Request for KASPER Report (Court)", Form DCB-15J; or

      (c) For pharmacy, on the "Request for KASPER Report", Form DCB-15P.]

      Section 5. Patient Identification Number. (1) A patient or the person obtaining the controlled substance on behalf of the patient shall disclose to the dispenser the patient's Social Security number for purposes of the dispenser's mandatory reporting to KASPER.

      (2) If a patient is an adult who does not have a Social Security number, the patient’s driver’s license number shall be disclosed.

      (3) If a patient is an adult who has not been assigned a Social Security number or a driver’s license number, the number 000-00-0000 shall be used in the Social Security field.

      (4) If a patient is a child who does not have a Social Security number or a driver's license number, the[Social Security number, driver's license number, or the] number "000-00-0000"[, as applicable, of the parent or guardian] shall be used in the Social Security field.

      (5) If a patient is an animal,[the owner’s Social Security number, driver's license number, or] the number "000-00-0000"[, as applicable,] shall be used in the Social Security number field.

      Section 6. KASPER Data and Trend Reports. Cabinet personnel shall be authorized access to the data obtained from the KASPER system and trend reports in accordance with KRS 218A.240(7)(a).

      Section 7. Data Retention. Data shall be maintained in KASPER for a period of two (2) years plus the current year prior to its transfer to the State Archives and Records Commission[Center].

      Section 8. Error Resolution. (1) A patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner’s office or clinic to whom a report has been disclosed under KRS 218A.202(8) or this administrative regulation may request that information contained in KASPER be corrected if the patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner’s office or clinic believes that any information[related to himself or herself] is inaccurate. The patient,[or] patient’s representative, practitioner, pharmacist, health facility, or private practitioner’s office or clinic shall:

      (a) Contact the dispenser who reported the information required by Section 2(2)[(3)]of this administrative regulation; and

      (b) Request that the dispenser correct the information.

      (2) If, upon receipt of a request from a patient,[or]patient’s representative, practitioner, pharmacist, health facility, or private practitioner’s office or clinic pursuant to subsection (1) of this section, the dispenser confirms that the information was reported in error, the dispenser shall:

      (a) Transmit corrected information to update the KASPER database within seven (7) days of the request for the correction; and

      (b) Notify the patient,[or] patient’s representative, practitioner, pharmacist, health facility, or private practitioner’s office or clinic that the corrected information has been transmitted.

      (3) If a dispenser maintains that information regarding the dispensing of a controlled substance was correctly reported to KASPER and the KASPER system generates a report with inaccurate information, the dispenser shall contact the Drug Enforcement and Professional Practices Branch (DEPPB) to identify the source of an error in the KASPER report, and the cabinet shall correct the information in the KASPER database.

      (4) Upon correction of information in the KASPER database pursuant to subsection (3)[(4)]of this section, cabinet staff shall notify the patient,[or]patient’s representative, practitioner, pharmacist, health facility, private practitioner’s office or clinic within five (5) working days of the correction.

      Section 9. Referrals to Licensing Boards. If the cabinet becomes aware that a prescriber or dispenser has failed to comply with the reporting requirements of KRS 218A.202 and this administrative regulation, the cabinet shall notify the licensing board or agency responsible for licensing the prescriber or dispenser.

      Section 10. Disclosure of Data or Report. (1) The cabinet shall only disclose data to the persons and entities authorized to receive that data under KRS 218A.202(6) and this administrative regulation.

      (2)(a) In addition to the purposes authorized under KRS 218A.202(6), the cabinet shall disclose data or a report to a designated class of employees or to a designated employee or employees in a health facility, or a private practitioner’s office or clinic with twenty (20) or more practitioners, if a practitioner has given written consent for the health facility, office, or clinic to query KASPER.

      (b) A private practitioner’s office or clinic with fewer than twenty (20) practitioners may submit a written request to the cabinet for a KASPER account in which data or a report is disclosed to a designated class of employees or to a designated employee or employees.

      (3) As a condition precedent to the disclosure of data or a report pursuant to subsection (2) of this section, a health facility or a private practitioner’s office or clinic shall maintain, and provide upon request by the cabinet, a copy of the health facility, or private office or clinic’s policy for the management of KASPER data and reports which:

      (a) Describes the health facility, or private office or clinic’s process for designating an employee or employees, or class of employees;

      (b) Describes the health facility, or private office or clinic’s process for maintaining a record of practitioners who have granted written consent for the health facility, or private office or clinic to request KASPER data or a report;

      (c) Describes the health facility, or private office or clinic’s internal procedures for educating the designated employee or employees, or class of employees on the:

      1. Proper use of the KASPER system;

      2. Prohibition on the improper use or intentional disclosure of KASPER data to unauthorized individuals; and

      3. Sanctions imposed for the improper use or intentional disclosure of KASPER data to unauthorized individuals, including criminal misdemeanor offenses; and

      (d) Describes the health facility, or private office or clinic’s internal procedures for auditing the account, including:

      1. The manner in which an employee is added to or removed from access to the account if the employee ends employment or is no longer designated to query KASPER; and

      2. The actions taken if a designated employee with access to the employer’s KASPER account intentionally misuses his or her privileges to KASPER data or a report, which shall include a report of the incident to the Office of Inspector General.

      (4)(a) An individual authorized to receive data under KRS 218A.202(6) and this administrative regulation shall not provide the data to any other entity except as provided in KRS 218A.202(8) and paragraph (b) of this subsection.

      (b) In addition to the purposes authorized under KRS 218A.202(8)(d), and pursuant to KRS 218A.205(2)(a) and (6), a practitioner or pharmacist who obtains KASPER data or a report under KRS 218A.202(6)(e)1. or who in good faith believes that any person, including a patient, has violated the law in attempting to obtain a prescription for a controlled substance, may report suspected improper or illegal use of a controlled substance to law enforcement or the appropriate licensing board.

      (5) A health facility or the private office or clinic of a practitioner[offices or clinics of practitioners]shall maintain and adhere to the entity’s internal policy regarding the management of KASPER data and reports.

      Section 11.Incorporation by Reference. (1) The following material is incorporated by reference:

      (a) "ASAP Telecommunications Format for Controlled Substances", American Society for Automation in Pharmacy, Version 4.1, November 2009; and[May, 1995;]

      (b)["KASPER Reporting Form", July 2008;

      (c)] "Request for[Law Enforcement] KASPER Report (Law Enforcement and Licensure Boards)", Form DCB-15L, 12/10.[, 5/06;

      (d) "Request for KASPER Report (Court)", Form DCB-15J, 5/06; and

      (e) "Request for KASPER Report", Form DCB-15P, 5/06.]

      (2) This material may be inspected, copied, or obtained, subject to applicable copyright law, at the Drug Enforcement and Professional Practices Branch, Office of the Inspector General, Cabinet for Health and Family Services, 275 E. Main Street, Frankfort, Kentucky 40621, Monday through Friday, 8 a.m. to 4:30 p.m.[This material is also available online at http://chfs.ky.gov/oig/KASPER.htm.]

MARY REINLE BEGLEY, Inspector General

AUDREY TAYSE HAYNES, Secretary

      APPROVED BY AGENCY: November 13, 2012

      FILED WITH LRC: November 14, 2012 at 3 p.m.

      CONTACT PERSON: Jill Brown, Office of Legal Services, 275 East Main Street 5 W-B, Frankfort, Kentucky 40621, phone (502) 564-7905, fax (502) 564-7573.

The administrative regulations provided here are an unofficial posting of the Kentucky Administrative Regulations. Pursuant to KRS 61.874, it is unlawful to use any records available on the Kentucky web site for a commercial purpose without agreement with the Legislative Research Commission.