On November 2, 2020, the Drug Enforcement Administration (DEA) published notice of a new Proposed Rule, “Suspicious Orders of Controlled Substances,” to “clarify the procedures a registrant must follow for orders received under suspicious circumstances.”[i] DEA’s purported “clarification” of those obligations, however, includes an entirely new framework that not only is inconsistent with prior DEA guidance as to registrants’ suspicious order reporting obligations, but more fundamentally represents a lost opportunity to achieve meaningful change. It remains to be seen whether the extended public comment period that closed on March 29, 2021, will be further extended, however, a more comprehensive solution, one that unites disparate stakeholders and data sets in a committed public-private partnership, is necessary to stem the ongoing opioid epidemic.
- DEA’s Prior Guidance Has Created a Lack of Uniform Industry Standards that Undermine Data Utility
The Proposed Rule represents DEA’s latest interpretation of registrants’ suspicious order reporting obligations. By way of background, beginning in or about 2005, DEA was confronted with an alarming rise in internet pharmacies, many without storefronts, that were filling prescriptions written by physicians located hundreds of miles from their patients. The quantities of controlled substances ordered by these pharmacies were extraordinary and facially unsupportable. In addition, many of the underlying prescriptions were invalid and written in violation of state licensing requirements that required physical examinations of patients, not online consultations. Thus, because there existed no bona fide doctor/patient relationship, the orders evinced diversion into “other than legitimate medical, scientific, and industrial channels.”[ii]
Nonetheless, DEA took the position that registrants were required to report suspicious orders irrespective whether the underlying customer was “suspicious.” For example, DEA’s Deputy Assistant Administrator instructed the industry that “[t]he size of an order alone, whether or not it deviates from a normal pattern, is enough to trigger the registrant’s responsibility to report the order as suspicious.”[iii] DEA’s early settlements further distinguished registrants’ suspicious order reporting obligations from diversion.[iv] However, following the enactment of the federal Ryan Haight Act of 2008, which required in-person medical examinations, many of the suspicious order hallmarks that DEA had relied upon in the internet pharmacy enforcement actions became much less evident. DEA refused to provide further clarification, instead routinely stating, “DEA does not endorse or approve of any specific system or approach implemented by DEA registrants to satisfy their obligations.”[v] Consequently, as recounted in the Proposed Rule, registrants adopted different approaches, including “rigid formulas,” “end-of-month excessive purchase reports,” reports of “largest purchasers,” and reports of “customers with whom the registrant had terminated a business relationship.”[vi] DEA claims that these systems “failed to fulfill” registrants’ obligations regarding the identification and reporting of suspicious orders.[vii]
The Proposed Rule, however, provides no further guidance into registrants’ obligations; it merely reiterates the “size, pattern, and frequency” standard.[viii] DEA refuses to acknowledge, apparently, that there currently exist widely divergent interpretations of these criteria across registrants, such that one registrant might report an order whereas another registrant might not report that same order. In other words, it is not surprising that DEA previously was scrutinized for failing to act “on the information it requires distributors to report.”[ix] Because no uniform reporting standards exist, DEA cannot translate effectively the voluminous suspicious order data it receives, let alone make meaningful use of that data to combat diversion.
- The Proposed Rule’s “Two-Option” Format for the Reporting of Suspicious Orders is Illusory
The Proposed Rule ostensibly permits registrants more flexibility in the administration of their suspicious order monitoring programs insofar as those systems will now be designed “not only to identify size, pattern, and frequency orders, but also to identify suspicious orders based on facts and circumstances” suggestive of whether a person “is engaged in, or is likely to engage in, the diversion of controlled substances.”[x] Orders that fall within the foregoing parameters are defined as “orders received under suspicious circumstances,” and may be processed pursuant to a “two-option framework” that requires the registrant to either (1) immediately file a suspicious order report and decline to distribute the order; or (2) before distributing pursuant to the order, “conduct due diligence to investigate each suspicious circumstance.”[xi]
Hence, through the addition of a second option that would permit otherwise suspicious orders to be cleared and shipped, DEA seeks to incentivize the industry to investigate diversion.[xii] That effort is socially desirable burden-sharing and appropriate; DEA does not possess adequate resources to police the more than 1.73 million registrants permitted to manufacture, distribute and prescribe controlled substances in the United States. Moreover, DEA’s approach is laudable insofar as it attempts to strike at diversion, not merely intake suspicious order reports of dubious value.
Nonetheless, because the Proposed Rule continues to define suspicious orders by reference to the characteristics of individual orders, it cannot effect meaningful change. First, relying on DEA’s prior guidance, many registrants have implemented sophisticated monitoring systems that use varying data points to pinpoint deviations across orders. Consequently, these systems often flag anomalies in pharmacy ordering patterns that are legitimate for countless reasons. Yet, having previously been penalized by DEA for underreporting suspicious orders, registrants likely perceive that less regulatory risk adheres to systems biased towards overreporting. Second, the proposed second option is inconsistent with business realities associated with the timely receipt, processing, packing and shipping of pharmacy orders; due diligence into “each suspicious circumstance” of an order is not realistic, regardless of the time period DEA permits for investigation. Third, the due diligence investigation of orders is not tethered to objective standards, but rather involves inherently murky and subjective assessments whether a registrant is “likely to engage” in diversion.
This third reason is perhaps the most significant hurdle to motivate industry change. In particular, registrants are unlikely to trust that good faith efforts to comply with the more subjective aspects of the Proposed Rule will not be used against them subsequently. A few examples bear note. In 2008, DEA entered a settlement with McKesson that, in many ways, mirrors the Proposed Rule. Specifically, the McKesson settlement provided that the company was not required to report, and could ship, potentially suspicious orders if, “based on a detailed review, the order is for a legitimate purpose and the controlled substances are not likely to be diverted into other than legitimate medical, scientific, or industrial channels.”[xiii] This language reasonably could be interpreted to require only the reporting of orders associated with diversion to DEA. Nonetheless, years later, McKesson was penalized by DEA for failing to report “orders of unusual size, orders deviating substantially from normal patterns, and orders of unusual frequency.”[xiv] Furthermore, DEA previously has used the cudgel of drug trafficking charges, pursuant to Title 21 of the United State Code, against registrants for customer-level diversion. In 2014, FedEx Corporation was indicted by the Department of Justice for drug trafficking conspiracy based on FedEx’s role in filling orders from internet pharmacies operating in violation of federal and state laws—despite FedEx’s cooperation in DEA investigations against customers. Although the case eventually was voluntarily dismissed, prosecutors alleged that FedEx had acted “knowingly” to fill orders that were diverted. Thus, registrants likely will not voluntarily embrace a reporting methodology that risks exposing them to amplified accusations that they “knowingly” fostered diversion.
In short, DEA’s purported second option is unworkable and unrealistic, leaving no viable option for registrants but to continue reporting suspicious orders based on one-off order deviations from broader data sets, the vast majority of which are not suggestive of diversion. All parties suffer this outcome: DEA will continue to be criticized; registrants will be vilified unfairly; and the rest of us will be deprived of an effective public-private partnership in an area that desperately calls for such a solution.
III. Fusion Centers Would Unite Stakeholders and Data Sets Towards a Comprehensive Solution
The determination whether a registrant is engaged in diversion is extremely nuanced and cannot be made based on ordering data alone. Accordingly, although DEA recently capitulated to distributors’ repeated requests that they be permitted access to ARCOS data,[xv] critical information remains siloed across government and industry participants. For example, state prescription drug monitoring programs help to illuminate potential diversion where it occurs most frequently, at the practitioner/patient level. That state data, however, often is unavailable to other investigators, including federal agencies, absent a subpoena, and is not shared with distributors or manufacturers. Similarly, DEA criminal investigators have access to various investigative techniques, including wiretaps and cooperating witnesses, to probe whether diversion is occurring. Further, different distributors possess different data sets, often regarding the same customer. Finally, manufacturers also possess data regarding the sale of their products to downstream customers, whether that be in the form of chargebacks or marketing analyses.
Where information is dispersed among different constituents, fusion centers have been utilized with great success to target illicit activity, including by the Department of Homeland Security. DHS describes the centers it operates as “focal points in states and major urban areas for the receipt, analysis, gathering and sharing of threat-related information between State, Local, Tribal and Territorial, federal and private sector partners.”[xvi] At least on the criminal side, DEA also is familiar with such collaboration, and relies on the Organized Crime Drug Enforcement Task Forces (OCDETF) Program to combine federal, state and local law enforcement resources, though private sector partnerships are less common. DEA’s Diversion Control Division, however, already works closely with the private sector, and therefore is well-positioned to cultivate those relationships.
Such cooperation between government and private sectors would maximize the effectiveness of data and information located within DEA and throughout the supply chain. Of course, such an initiative necessarily would need to countenance specific protocols, including favorable treatment for self-disclosures and compliance program credit, that are routine in similarly Department of Justice programs. In short, the climate and opportunity at hand would permit DEA to levitate its focus from individual orders to a broader industry coalition. Instead, the Proposed Rule simply appends a doomed alternative onto the existing infirm reporting scheme. DEA is led by some of the most dedicated and committed public servants in the country; its Diversion Control Division can and should do better.
* Anthony J. Mahajan formerly served as Chief Counsel to McKesson Corp., where he was responsible for providing legal advice to the business regarding compliance with suspicious order reporting requirements and McKesson’s 2017 settlement with the Department of Justice and DEA regarding controlled substances. He previously was employed as an Assistant U.S. Attorney for the U.S. Department of Justice, where he investigated and prosecuted controlled substance offenses against manufacturers, distributors, pharmacies and health care professionals. Mr. Mahajan currently serves as Chair of Frier Levitt’s White Collar Defense & Government Investigations practice.
How Frier Levitt Can Help
Frier Levitt has a team of experienced attorneys dedicated solely to White Collar Defense & Government Investigations. Contact Frier Levitt today to speak to an attorney.
[i] Suspicious Orders of Controlled Substances, 85 Fed. Reg. 69282, 69284 (Nov. 2, 2020) (“Proposed Rule”).
[ii] 21 U.S.C. § 823(b)(1) (2020).
[iii] Drug Enforcement Administration, Letter from DEA Deputy Assistant Administrator, Office of Diversion Control, to Registrants, at 1 (Dec. 27, 2007), https://www.docketbird.com/court-documents/In-re-National-Prescription-Opiate-Litigation/Exhibit-C-Dec-27-2007-DEA-Letter/ohnd-1:2017-md-02804-02207-003.
[iv] See, e.g., Settlement & Release Agreement and Administrative MOU Between U.S. Department of Justice (DOJ), DEA and McKesson Corporation, at II.2(c) (“DEA agrees and acknowledges that neither the CSA, DEA regulations, nor the terms of this Agreement establish a requirement that reporting of a suspicious order means that a customer be designated as a suspicious customer.”) (May 2, 2008), https://www.dea.gov/sites/default/files/2018-06/Pharmaceutical%20Agreements%20-%20McKesson%20-%202008_0.pdf.
[v] Administrative Memorandum of Agreement Between DOJ, DEA and McKesson Corp., at 8 (Jan. 17, 2017), https://www.justice.gov/opa/press-release/file/928476/download.
[vi] 85 F.R. at 69284.
[vii] Id.
[viii] Id. at 69285; 21 C.F.R. § 1301.74(b).
[ix] Red Flags and Warning Signs Ignored: Opioid Distribution and Enforcement Concerns in West Virginia, Subcommittee on Oversight and Investigations, at 64 (Dec. 19, 2018), https://republicans-energycommerce.house.gov/wp-content/uploads/2018/12/Opioid-Distribution-Report-FinalREV.pdf.
[x] 85 F.R. at 69285.
[xi] Id. at 69288.
[xii] See id. at 69284 (“The purpose of identifying and reporting suspicious orders to DEA is to provide DEA investigators in the field with information regarding potential illegal activity in an expeditious manner.”).
[xiii] 2008 McKesson Settlement, supra n.iv, at II.1.a (emphasis added).
[xiv] 2017 McKesson Settlement, supra n.v, at I.3.d.
[xv] Manufacturers and distributors are required to report all sales of Schedule I and II controlled substances, and specified other controlled substance sales, to DEA’s Automated Reports and Consolidated Orders System (ARCOS).
[xvi] Department of Homeland Security, Fusion Centers, http://www.dhs.gov/fusion-centers (last visited Apr. 10, 2021).
