Second Regular Session Sixty-eighth General Assembly STATE OF COLORADO INTRODUCED LLS NO. 12-0217.01 Christy Chase x2008 HOUSE BILL 12-1242 HOUSE SPONSORSHIP Massey, Kefalas, Summers SENATE SPONSORSHIP Boyd, House Committees Senate Committees Health and Environment Economic and Business Development A BILL FOR AN ACT Concerning the creation of an electronic biometric prescribing system using biometric identifiers to transmit information pertaining to the distribution of certain medications. Bill Summary (Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://www.leg.state.co.us/billsummaries.) The bill requires the division of registrations (division) in the department of regulatory agencies, by January 1, 2013, to develop an electronic system to monitor and store in a secure database information pertaining to: The prescribing of prescription drugs; The dispensing or delivery of prescription drugs by a prescription drug outlet (PDO) or health care practitioner (practitioner); and The dispensing or delivery of restricted over-the-counter substances, also known as methamphetamine precursor drugs, by a PDO or practitioner. Practitioners and PDOs are required to maintain biometric scanning devices and to use those devices to obtain a biometric scan of a person's biometric identifier, such as a fingerprint or retinal scan, and to submit the scan to the database. Practitioners and PDOs are also required, prior to prescribing or dispensing a prescription drug or dispensing a restricted over-the-counter substance, to submit specified information to the database, including: The date of the prescription order; The name of the substance prescribed or dispensed, including strength, quantity, and directions for use; The name and address of the practitioner or PDO, as applicable; and The name and address of the person receiving the substance, as applicable, in an encrypted format. Once the information is received, the database assigns a unique identifying number to the particular prescription order or restricted over-the-counter substance and immediately transmits to the practitioner or PDO, as applicable, the following: The identifying number for the substance; The names of the substances prescribed or dispensed in connection with the biometric scan that may conflict with or overlap the practitioner's prescription order or the restricted over-the-counter substance; and The name and address of the practitioner whose prescription order may conflict with or overlap the prescribing practitioner's prescription or restricted over-the-counter substance and the name and address of the practitioner or PDO that dispensed or delivered the conflicting or overlapping prescription or restricted over-the-counter substance. Before dispensing or delivering a prescription drug or restricted over-the-counter substance, the practitioner or PDO is to submit the biometric scan to the database, and the database is to immediately transmit to the practitioner or PDO the following: The names of the substances that have been prescribed in connection with the biometric scan that may conflict with or overlap the substance to be dispensed or delivered; The name and address of the practitioner whose order may conflict with or overlap the prescription drug or restricted over-the-counter substance to be dispensed or delivered and the full name and address of the practitioner or PDO that dispensed or delivered the conflicting or overlapping prescription or restricted over-the-counter substance; A graduated alert system indicating the potential dangers related to dispensing or prescribing the substances as they relate to any conflicting or overlapping prescriptions; A warning or critical alert relating to the severity of the conflict or overlap, requiring the practitioner to biometrically acknowledge receipt of the conflict or overlap; and A warning or critical alert relating to the severity of the conflict or overlap to additional practitioners who provided or delivered the conflicting or overlapping substances. The bill makes exceptions for practitioners who administer a substance directly to the patient and for substances dispensed in an inpatient or residential facility. A person who fails to comply with the requirements of the bill commits a class 1 misdemeanor. Be it enacted by the General Assembly of the State of Colorado: SECTION 1. In Colorado Revised Statutes, 12-22-702, amend (1); and add (1.3), (1.5), (1.7), (3.5), and (9) as follows: 12-22-702. Definitions. As used in this part 7, unless the context otherwise requires: (1) "Board" means the state board of pharmacy "Biometric identifier" means an established unique form of biological identification that is readily compared and matched, such as a fingerprint, retinal scan, or other means of similar biometric identification approved by the division and authorized for retention in a database. (1.3) "Biometric scan" means an electronic scan of a biometric identifier. (1.5) "Biometric scanning device" means an electronic scanning device that is approved by the division and is designed to accurately capture a biometric identifier. (1.7) "Board" means the state board of pharmacy. (3.5) "Database" means an electronic database or network of databases that is maintained or contracted for by the division and that maintains and compares each biometric scan and the information contained within the scan in conformity with section 12-22-705.5. (9) "Restricted over-the-counter substance" has the same meaning as "methamphetamine precursor drug", as that term is defined in section 18-18-412.8 (4) (a), C.R.S. SECTION 2. In Colorado Revised Statutes, add 12-22-705.5 as follows: 12-22-705.5. Electronic monitoring - dispensing of prescription drugs and restricted over-the-counter substances - database - exclusions - penalties. (1) By January 1, 2013, the division shall adopt an electronic prescribing system to facilitate the transmission of electronic orders, to monitor the collection of biometric identifiers, and to record and store, in a secure, anonymous database, information pertaining to the following: (a) The prescribing of prescription drugs, including those that are controlled substances, by practitioners in this state; (b) The dispensing or delivering of prescription drugs to an individual in this state by a prescription drug outlet or practitioner; and (c) The dispensing or delivering of restricted over-the-counter substances to an individual in this state by a prescription drug outlet or practitioner. (2) A practitioner who prescribes, dispenses, or delivers a prescription drug or restricted over-the-counter substance in this state shall maintain in the practitioner's office an active and operational biometric scanning device that is connected to the database. A practitioner who prescribes, dispenses, or delivers a prescription drug or restricted over-the-counter substance to a person in this state shall obtain a biometric scan of an approved biometric identifier of the person through use of the biometric scanning device and shall submit the biometric scan to the database. (3) A prescription drug outlet that dispenses or delivers a prescription drug or restricted over-the-counter substance shall maintain in the prescription drug outlet an active and operational biometric scanning device connected to the database. A prescription drug outlet that dispenses or delivers a prescription drug or restricted over-the-counter substance to a person in this state shall obtain a biometric scan of an approved biometric identifier of the person through use of the biometric scanning device and shall submit the biometric scan to the database. (4) Before prescribing or dispensing a prescription drug to a person in this state, every practitioner shall submit the following information to the database: (a) The biometric scan of the person's biometric identifier; (b) The full name and address of the prescribing practitioner; (c) The date of each order; (d) The name of the prescription drug prescribed or dispensed, including the strength, quantity, and directions for use; (e) The intended prescription drug outlet, in the case of orders that will be filled electronically; and (f) The information from the person required to facilitate a valid order, including name and address. Before submission, this information must be encrypted with the intended prescription drug outlet's encryption key via public key cryptography so that the information, when stored on the database, is only accessible by the intended prescription drug outlet with the required decryption key. (5) Before dispensing or delivering a prescription drug or a restricted over-the-counter substance to a person in this state, every practitioner and prescription drug outlet shall submit the following information to the database: (a) The biometric scan of the person's biometric identifier; (b) The full name and address of the prescribing practitioner; (c) The date of each order; and (d) The name of the prescription drug or restricted over-the-counter substance prescribed or dispensed and the strength, quantity, and directions for use of the prescription drug or restricted over-the-counter substance. (6) After receiving the information required under subsections (4) and (5) of this section, the database shall assign the order or restricted over-the-counter substance a unique identifying number and shall immediately transmit the following to the prescribing practitioner or prescription drug outlet: (a) The unique identifying number; (b) The names of the prescription drugs that have been prescribed or dispensed in connection with the biometric scan submitted that may conflict with or overlap the prescribing practitioner's order or restricted over-the-counter substance; and (c) The full name and address of each practitioner whose order may conflict with or overlap the prescribing practitioner's order or restricted over-the-counter substance and the full name and address of the practitioner or prescription drug outlet that dispensed or delivered the conflicting or overlapping prescription or restricted over-the-counter substance. (7) Before dispensing or delivering an order for a prescription drug or dispensing or delivering a restricted over-the-counter substance, the prescription drug outlet or dispensing practitioner shall submit the biometric scan of the person's biometric identifier to the database, and the database shall immediately transmit the following to the prescription drug outlet or dispensing practitioner: (a) The names of the prescription drugs that have been prescribed or restricted over-the-counter substances to be dispensed in connection with the biometric scan submitted that may conflict with or overlap the prescription drug or restricted over-the-counter substance to be dispensed or delivered; (b) The full name and address of each practitioner whose order may conflict with or overlap the prescription drug or restricted over-the-counter substance to be dispensed or delivered and the full name and address of the practitioner or prescription drug outlet that dispensed or delivered the conflicting or overlapping prescription or restricted over-the-counter substance; (c) A graduated alert system, where applicable, indicating the potential dangers related to dispensing or prescribing the prescription drugs or restricted over-the-counter substances as they relate to any conflicting or overlapping prescriptions; (d) A warning or critical alert, where applicable, as it relates to the severity of the conflict or overlap, requiring the practitioner to biometrically acknowledge receipt of the conflict or overlap; and (e) A warning or critical alert, where applicable, as it relates to the severity of the conflict or overlap to additional practitioners who provided or delivered the conflicting or overlapping prescription drugs or restricted over-the-counter substances. (8) The database must not retain unencrypted personal protected health care information other than the biometric scans and prescription information provided to the database pursuant to subsections (6) and (7) of this section. The database may retain encrypted personal protected health care information in the case of electronic prescriptions if the only entity able to decrypt the information is the intended prescription drug outlet for delivery or dispensing. This section does not preclude practitioners and prescription drug outlets from retaining personal information about their patients that is collected and maintained in their regular course of business in compliance with applicable law. (9) This section does not apply to substances: (a) Administered by a practitioner directly to his or her patient; (b) Dispensed or delivered by a practitioner authorized to prescribe prescription drugs directly to a patient and limited to an amount adequate to treat the patient for a period of no more than seventy-two hours; (c) Dispensed or delivered by a practitioner or a prescription drug outlet to a patient of an inpatient facility that is an other outlet registered pursuant to this article; (d) Ordered from an other outlet registered under this article in accordance with internal policy and procedure; (e) Dispensed or delivered by a prescription drug outlet or administered by a practitioner to a patient or resident receiving care from a hospital, nursing home, assisted living facility, home health care agency, hospice, or intermediate care facility for the developmentally disabled that is licensed or certified in this state; (f) Prescribed by a practitioner for a patient younger than sixteen years of age; (g) Prescribed or dispensed pursuant to rule adopted by the board; or (h) Administered, prescribed, dispensed, or delivered under circumstances in which the prescription drug outlet or practitioner cannot, in good faith, comply with this section. (10) A dispensing practitioner or prescription drug outlet who dispenses or delivers a prescription drug or restricted over-the-counter substance shall submit the information required under this section to the division, or to a person or agency authorized by the division, in an electronic format approved by the division. The division, or the person or agency authorized by the division, shall maintain the information for no longer than twenty-four months after the date of receipt and shall thereafter expunge the information from the database unless otherwise directed by a court of competent jurisdiction. (11) All transmissions required by this section must comply with relevant federal and state privacy and security laws. (12) By January 1, 2013, the division, in collaboration with the board and the Colorado medical board, shall adopt rules pursuant to article 4 of title 24, C.R.S., governing the administration of this section, including rules governing access to the database by practitioners and prescription drug outlets and implementing procedures to be employed when a biometric scanning device is inoperable or the database is inaccessible. (13) A person who knowingly fails to comply with this section commits a class 1 misdemeanor, punishable as provided in section 18-1.3-501, C.R.S. SECTION 3. Applicability. The provisions of this act apply to the prescribing, dispensing, and delivery of prescription drugs and restricted over-the-counter substances on or after the effective date of this act. SECTION 4. Safety clause. The general assembly hereby finds, determines, and declares that this act is necessary for the immediate preservation of the public peace, health, and safety.