CHAPTER 37
IOWA PRESCRIPTION MONITORING PROGRAM
657—37.1(124) Purpose. These rules establish a prescription monitoring program that compiles a central database of reportable prescriptions dispensed to patients in Iowa. An authorized health care practitioner may, but is not required to, access prescription monitoring program (PMP) information regarding the practitioner’s patient to assist in determining appropriate treatment options and to improve the quality of patient care. The PMP is intended to provide a health care practitioner with a resource for information regarding a patient’s use of controlled substances. This database will assist the practitioner in identifying any potential diversion, misuse, or abuse of controlled substances without impeding the appropriate medical use of controlled substances.
[ARC 7903B, IAB 7/1/09, effective 8/5/09]
657—37.2(124) Definitions. As used in this chapter:
“Board” means the Iowa board of pharmacy.
“Controlled substance” means a drug, substance, or immediate precursor in Schedules I through V set forth in Iowa Code chapter 124, division II.
“Council” means the PMP advisory council established pursuant to Iowa Code section 124.555 to provide oversight and to co-manage PMP activities with the board.
“Database information” or “PMP information” means information submitted to and maintained by the PMP database.
“DEA number” means the registration number issued to an individual or pharmacy by the U.S. Department of Justice, Drug Enforcement Administration authorizing the individual or pharmacy to engage in the prescribing, dispensing, distributing, or procuring of a controlled substance.
“Dispenser” means a person who delivers to the ultimate user a substance required to be reported to the PMP database. “Dispenser” includes a pharmacy located outside the state of Iowa that is licensed by the board with a nonresident pharmacy license authorizing the pharmacy to dispense prescription drugs to patients physically located in Iowa. “Dispenser” does not include a person exempt from reporting pursuant to subrule 37.3(1).
“Health care professional” means a person who, by education, training, certification, or licensure, is qualified to provide and is engaged in providing health care to patients. “Health care professional” does not include clerical or administrative staff. “Health care professional,” other than a licensed prescriber or pharmacist, may include, but is not limited to, a certified pharmacy technician or a technician trainee, a nurse, or a medical assistant or supervised trainee such as a pharmacist-intern or student, a medical student, or a nursing student.
“National drug code” or “NDC number” means the universal product identifier used in the United States to identify a specific human drug product.
“Patient” means the person or animal that is the ultimate user of a drug for whom a prescription is issued or for whom a drug is dispensed.
“Patient's agent” means a person legally authorized to make health care decisions or gain access to health care records on behalf of the patient for purposes of directing the patient’s care.
“Patients rights committee” or “committee” means the physician and pharmacist members of the council responsible for monitoring and ensuring protection and preservation of patients’ rights as provided in Iowa Code section 124.555(3)“e.”
“PMP administrator” means the board staff person or persons designated to manage the PMP under the direction and oversight of the board and the council.
“Practitioner” means a prescriber or a pharmacist.
“Practitioner’s agent” means a health care professional who is employed by or under the direct supervision of a health care practitioner and who is authorized by the practitioner to access PMP information as provided in subrule 37.4(1).
“Prescriber” means a licensed health care professional with the authority to prescribe prescription drugs including controlled substances.
“Prescription monitoring program” or “PMP” means the program established pursuant to these rules for the collection and maintenance of PMP information and for the provision of PMP information to authorized individuals, including health care providers, for use in treatment of their patients.
“Prescription monitoring program database” or “PMP database” means a centralized database of reportable controlled substance prescriptions dispensed to patients and includes data access logs, security tracking information, and records of each individual who requests PMP information.
“Reportable prescription” means the record of a Schedule II, III, or IV controlled substance dispensed by a pharmacy to a patient pursuant to a prescriber-authorized prescription. “Reportable prescription” does not include those records excluded in subrule 37.3(1).
“Schedule II, III, and IV controlled substances” means those substances that are identified and listed as Schedule II, III, or IV substances in Iowa Code sections 124.205 through 124.210 or in the federal Controlled Substances Act (21 U.S.C. Section 812).
[ARC 7903B, IAB 7/1/09, effective 8/5/09; ARC 0056C, IAB 4/4/12, effective 7/1/12; ARC 0242C, IAB 8/8/12, effective 1/1/13]
657—37.3(124) Requirements for the PMP. Each dispenser, unless identified as exempt from reporting pursuant to subrule 37.3(1), shall submit to the PMP administrator a record of each reportable prescription dispensed during a reporting period. A dispenser located outside the state of Iowa, unless identified as exempt from reporting pursuant to subrule 37.3(1), shall submit to the PMP administrator a record of each reportable prescription dispensed during a reporting period to a patient located in Iowa.
	37.3(1) Exemptions. The dispensing of a controlled substance as described in this subrule shall not be considered a reportable prescription. A dispenser engaged in the distribution of controlled substances solely pursuant to one or more of the practices identified in paragraphs 37.3(1)“a” or 37.3(1)“b” shall so notify the PMP administrator and shall be exempt from reporting to the PMP.
	a. 	A licensed hospital pharmacy shall not be required to report the dispensing of a controlled substance for the purposes of inpatient hospital care, the dispensing of a prescription for a starter supply of a controlled substance at the time of a patient’s discharge from such a facility, or the dispensing of a prescription for a controlled substance in a quantity adequate to treat the patient for a maximum of 72 hours. A hospital pharmacy claiming exemption from reporting pursuant to this paragraph shall certify to the board that the hospital pharmacy dispenses only as provided by this paragraph.
	b. 	A licensed pharmacy shall not be required to report the dispensing of a controlled substance for a patient residing in a long-term care facility or for a patient residing in an inpatient hospice facility. A pharmacy claiming exemption from reporting pursuant to this paragraph shall certify to the board that the pharmacy dispenses only to patients residing in a long-term care facility or to patients residing in an inpatient hospice facility.
	c. 	A prescriber or other authorized person who administers or dispenses a controlled substance, including samples of a controlled substance, for the purposes of outpatient care shall not be required to report such administration or dispensing. This exception shall not apply to a pharmacist who administers a controlled substance, as directed by the prescriber, pursuant to a prescription.
	d. 	A wholesale distributor of a controlled substance shall not be required to report the wholesale distribution of such a substance.
	37.3(2) Data elements. The information submitted for each prescription shall include, at a minimum, the following items:
	a. 	Dispenser DEA number.
	b. 	Date the prescription is filled.
	c. 	Prescription number.
	d. 	Indication as to whether the prescription is new or a refill.
	e. 	NDC number for the drug dispensed.
	f. 	Quantity of the drug dispensed.
	g. 	Number of days of drug therapy provided by the drug as dispensed.
	h. 	Patient name.
	i. 	Patient address including street address, city, state, and ZIP code.
	j. 	Patient date of birth.
	k. 	Patient gender.
	l. 	Prescriber DEA number.
	m. 	Date the prescription was issued by the prescriber.
	n. 	Method of payment as either third-party payer or patient cash payment.
	37.3(3) Reporting periods. A record of each reportable prescription dispensed shall be submitted by each dispenser at least weekly. Records may be submitted with greater frequency than required by this subrule. Records of reportable prescriptions dispensed between Sunday and Saturday each week shall be submitted no later than the following Wednesday. However, a pharmacy that is currently submitting prescription dispensing records to another state’s PMP on an alternative weekly reporting schedule may request authority to submit records to the Iowa PMP pursuant to that established schedule. The request shall be submitted in writing via e-mail, fax, or regular mail to the PMP administrator. The request shall identify the pharmacy by name, address, and Iowa pharmacy license number and shall define the alternative reporting period. The PMP administrator is hereby authorized to accept the pharmacy’s alternative weekly reporting schedule.
	37.3(4) Transmission methods. Prescription information shall be transmitted using one of the following methods:
	a. 	Data upload to a reporting Web site via a secure Internet connection. The PMP administrator will provide dispensers with initial secure login and password information. Dispensers will be required to register on the reporting Web site prior to initial data upload.
	b. 	Electronic media including CD-ROM, DVD, or diskette, accompanied by a transmittal form identifying the dispenser submitting the electronic media, the number of prescription records included on the media, and the individual submitting the media.
	c. 	If a dispenser does not have an automated record-keeping system capable of producing an electronic report as provided in this rule, the dispenser may submit prescription information on the industry standard universal claim form. The dispenser may complete and submit the claim form on the reporting Web site or, if the dispenser does not have Internet access, the completed paper claim form may be submitted.
	d. 	Chain pharmacies and pharmacies under shared ownership may submit combined data transmissions on behalf of all facilities by utilizing the secure FTP procedure.
	37.3(5) Zero reports. If a dispenser has not been identified as exempt from reporting to the PMP and the dispenser did not dispense any reportable prescriptions during a reporting period, the dispenser shall submit a zero report via the established reporting Web site. If such a dispenser does not have Internet access, the dispenser shall notify the PMP administrator via mail or facsimile transmission that the dispenser did not dispense any reportable prescriptions during the reporting period. The schedule identified in subrule 37.3(3) shall determine timely submission of zero reports.
[ARC 7903B, IAB 7/1/09, effective 8/5/09; ARC 0242C, IAB 8/8/12, effective 1/1/13]
657—37.4(124) Access to database information. All information contained in the PMP database, including prescription information submitted for inclusion in the PMP database and records of requests for PMP information, shall be privileged and strictly confidential and not subject to public or open records laws. The board, council, and PMP administrator shall maintain procedures to ensure the privacy and confidentiality of patients, prescribers, dispensers, practitioners, practitioners’ agents, and patient information collected, recorded, transmitted, and maintained in the PMP database and to ensure that program information is not disclosed to persons except as provided in this rule.
	37.4(1) Prescribers and pharmacists. A health care practitioner authorized to prescribe or dispense controlled substances may obtain PMP information regarding the practitioner’s patient, or a patient seeking treatment from the practitioner, for the purpose of providing patient health care. A practitioner may authorize no more than three health care professionals to act as the practitioner’s agents for the purpose of requesting PMP information regarding a practitioner’s patients.
	a. 	Prior to being granted access to PMP information, a practitioner or a practitioner’s agent shall submit an individual request for registration and program access. A practitioner or a practitioner’s agent with Internet access may register via a secure Web site established by the board for that purpose. A practitioner without Internet access shall submit a written registration request on a form provided by the PMP administrator. A practitioner without Internet access shall not authorize a practitioner’s agent to register for or to access PMP information on behalf of the practitioner. The PMP administrator shall take reasonable steps to verify the identity of a practitioner or practitioner’s agent and to verify a practitioner’s credentials prior to providing a practitioner or practitioner’s agent with a secure login and initial password. Each practitioner or practitioner’s agent registered to access PMP information shall securely maintain and use the login and password assigned to the individual practitioner or practitioner’s agent. Except in an emergency when the patient would be placed in greater jeopardy by restricting PMP information access to the practitioner or practitioner’s agent, a registered practitioner shall not share the practitioner’s secure login and password information and shall not delegate PMP information access to another health care practitioner or to an unregistered agent. A registered practitioner’s agent shall not delegate PMP information access to another individual.
	b. 	A practitioner or practitioner’s agent with Internet access may submit a request for PMP information via a secure Web site established by the board for that purpose. The requested information shall be provided to the requesting practitioner or practitioner’s agent in a format established by the board and shall be delivered via the secure Web site.
	c. 	A practitioner without Internet access may submit to the PMP administrator a written request for PMP information via mail or facsimile transmission. The written request shall be in a format established by the board and shall be signed by the requesting practitioner. Prior to processing a written request for PMP information, the PMP administrator shall take reasonable steps to verify the request, which may include but not be limited to a telephone call to the practitioner at a telephone number known to be the number for the practitioner’s practice.
	d. 	A practitioner or practitioner’s agent who requests and receives PMP information consistent with the requirements and intent of these rules may provide that information to another practitioner who is involved in the care of the patient who is the subject of the information. Information from the PMP database remains privileged and strictly confidential. Such disclosures among practitioners shall be consistent with these rules and federal and state laws regarding the confidentiality of patient information. The information shall be used for medical or pharmaceutical care purposes.
	37.4(2) Regulatory agencies and boards. Professional licensing boards and regulatory agencies that supervise or regulate a health care practitioner or that provide payment for health care services shall be able to access information from the PMP database only pursuant to an order, subpoena, or other means of legal compulsion relating to a specific investigation of a specific individual and supported by a determination of probable cause.
	a. 	A director of a licensing board with jurisdiction over a practitioner, or the director’s designee, who seeks access to PMP information for an investigation shall submit to the PMP administrator in a format established by the board a written request via mail, facsimile, or personal delivery. The request shall be signed by the director or the director’s designee and shall be accompanied by an order, subpoena, or other form of legal compulsion establishing that the request is supported by a determination of probable cause.
	b. 	A director of a regulatory agency with jurisdiction over a practitioner or with jurisdiction over a person receiving health care services pursuant to one or more programs provided by the agency, or the director’s designee, who seeks access to PMP information for an investigation shall submit to the PMP administrator in a format established by the board a written request via mail, facsimile, or personal delivery. The request shall be signed by the director or the director’s designee and shall be accompanied by an order, subpoena, or other form of legal compulsion establishing that the request is supported by a determination of probable cause.
	37.4(3) Law enforcement agencies. Local, state, and federal law enforcement or prosecutorial officials engaged in the administration, investigation, or enforcement of any state or federal law relating to controlled substances shall be able to access information from the PMP database by order, subpoena, or other means of legal compulsion relating to a specific investigation of a specific individual and supported by a determination of probable cause. A law enforcement officer shall submit to the PMP administrator in a format established by the board a written request via mail, facsimile, or personal delivery. The request shall be signed by the requesting officer or the officer’s superior. The request shall be accompanied by an order, subpoena, or warrant issued by a court or legal authority that requires a determination of probable cause and shall be processed by the PMP administrator. A report identifying PMP information relating to the specific individual identified by the order, subpoena, or warrant may be delivered to the law enforcement officer via mail or alternate secure delivery.
	37.4(4) Patients. A patient or the patient’s agent may request and receive PMP information regarding prescriptions reported to have been dispensed to the patient.
	a. 	A patient may submit a signed, written request for records of the patient’s prescriptions dispensed during a specified period of time. The request shall identify the patient by name, including any aliases used by the patient, and shall include the patient’s date of birth and gender. The request shall also include any address where the patient resided during the time period of the request and the patient’s current address and daytime telephone number. A patient may personally deliver the request to the PMP administrator or authorized staff member at the offices of the board located at 400 S.W. Eighth Street, Suite E, Des Moines, Iowa 50309-4688. The patient will be required to present current government-issued photo identification at the time of delivery of the request. A copy of the patient’s identification shall be maintained in the records of the PMP.
	b. 	A patient who is unable to personally deliver the request to the board offices may submit a request via mail or commercial delivery service. The request shall comply with all provisions of paragraph “a” above, and the signature of the requesting patient shall be witnessed and the patient’s identity shall be attested to by a currently registered notary public. In addition to the notary’s signature and assurance of the patient’s identity, the notary shall certify a copy of the patient’s government-issued photo identification and that certified copy shall be submitted with the written request. The request shall be submitted to the Iowa Board of Pharmacy at the address identified in paragraph “a.”
	c. 	In the case of a patient whose health care decisions have been legally transferred to the patient’s agent, the patient’s agent may submit a request on behalf of the patient pursuant to the appropriate procedure in paragraph “a” or “b.” In addition to the patient’s information, the patient’s agent shall be identified by name, current address, and telephone number. In lieu of the patient’s signature and identification, the patient’s agent shall sign the request and the government-issued photo identification shall identify the patient’s agent. The patient’s agent shall include a certified copy of the legal document that transferred control over decisions regarding the patient’s health care to the patient’s agent.
	37.4(5) Court orders and subpoenas. The PMP administrator shall provide PMP information in response to court orders and county attorney or other subpoenas issued by a court upon a determination of probable cause.
	37.4(6) Statistical data. The PMP administrator, following review and approval by the patients rights committee, may provide summary, statistical, or aggregate data to public or private entities for statistical, research, or educational purposes. Prior to the release of any such data, the PMP administrator shall remove any information that could be used to identify an individual patient, prescriber, dispenser, practitioner, or other person who is the subject of the PMP information or data.
	37.4(7) PMP administrator access. Other than technical, error, and administrative function reports and information needed by PMP support staff to determine that records are received and maintained in good order or to review or resolve issues of reported or suspected erroneous data as provided in rule 657—37.7(124), any other reports concerning the information received from dispensers shall only be prepared at the direction of the board, the council, or the PMP administrator. The board and the council may compile statistical reports from PMP information for use in determining the advisability of continuing the PMP and for use in preparing required reports to the governor and the legislature. The reports shall not include information that would identify any patient, prescriber, dispenser, practitioner, practitioner’s agent, or other person who is the subject of the PMP information or data.
[ARC 7903B, IAB 7/1/09, effective 8/5/09; ARC 0056C, IAB 4/4/12, effective 7/1/12]
657—37.5(124) Fees. The board may charge a fee and recover costs incurred for the provision of PMP information, including statistical data, except that no fees or costs shall be assessed to a dispenser for reporting to the PMP or to a practitioner for querying the PMP regarding a practitioner’s patient. Any fees or costs assessed by the board shall be considered repayment receipts as defined in Iowa Code section 8.2.
[ARC 7903B, IAB 7/1/09, effective 8/5/09]
657—37.6(124) PMP information retained. All dispenser records of prescriptions reported to the PMP shall be retained by the PMP for a period of four years following the date of the record. All records of access to or query of PMP information shall be retained by the PMP for a period of four years following the date of the record. At least semiannually, all PMP information identified as exceeding that four-year period shall be deleted from the PMP and discarded in a manner to maintain the confidentiality of the PMP information and data. Statistical data and reports from which all personally identifiable information has been removed or which do not contain personally identifiable information as provided in subrules 37.4(6) and 37.4(7) may be retained by the PMP for historical purposes.
[ARC 7903B, IAB 7/1/09, effective 8/5/09]
657—37.7(124) Information errors. Any person who believes that PMP information about that person is false or in error shall submit a written statement to the PMP administrator. The statement shall identify the information the person believes to be false or in error and the reason the individual believes the information to be false or in error. The PMP administrator may examine the information identified in the statement and may request the assistance of the board’s compliance staff to determine whether or not the PMP information is accurate. Prior to initiating any action to correct, delete, or amend any PMP information, the PMP administrator shall submit the statement and the resulting report to the patients rights committee for review and approval of the recommended action. If correction, deletion, or amendment of any PMP information is authorized, that action shall be accomplished by the PMP administrator within 72 hours of the committee’s decision. The PMP administrator shall respond, in writing, to the person who submitted the statement charging that the PMP information was false or in error. The response shall identify the action approved by the committee.
[ARC 7903B, IAB 7/1/09, effective 8/5/09]
657—37.8(124) Dispenser and practitioner records. Nothing in these rules shall apply to records created or maintained in the regular course of business of a pharmacy or health care practitioner. All information, documents, or records otherwise available from pharmacies or health care practitioners shall not be construed as immune from discovery or use in any civil proceedings merely because the information contained in those records was reported to the PMP in accordance with these rules.
[ARC 7903B, IAB 7/1/09, effective 8/5/09]
657—37.9(124) Prohibited acts. The PMP administrator shall report to the licensing board of a dispenser, a practitioner, or a practitioner’s agent any known violation of the confidentiality provisions or the reporting requirements of the law and these rules for which the dispenser, practitioner, or practitioner’s agent is subject to disciplinary action.
	37.9(1) Confidentiality. A pharmacy, pharmacist, practitioner, or practitioner’s agent who knowingly fails to comply with the confidentiality provisions of the law or these rules or who delegates PMP information access to another individual, except as provided in paragraph 37.4(1)“a,” is subject to disciplinary action by the appropriate professional licensing board. The PMP administrator or a member of the program staff who knowingly fails to comply with the confidentiality provisions of the law or these rules is subject to disciplinary action by the board. In addition to any disciplinary action or sanctions imposed by a professional licensing board, a pharmacy, pharmacist, practitioner, practitioner’s agent, PMP administrator, or member of the PMP program staff who knowingly accesses, uses, or discloses program information in violation of Iowa law or these rules is subject to criminal prosecution as provided in 2011 Iowa Code Supplement section 124.558.
	37.9(2) Dispenser reporting. A dispenser or a pharmacist who fails to comply with the reporting requirements of the law or these rules may be subject to disciplinary action by the board.
[ARC 7903B, IAB 7/1/09, effective 8/5/09; ARC 0056C, IAB 4/4/12, effective 7/1/12]
These rules are intended to implement Iowa Code sections 124.551, 124.552, and 124.554 to 124.557 and 2011 Iowa Code Supplement sections 124.553 and 124.558.
[Filed ARC 7903B (Notice ARC 7676B, IAB 4/8/09), IAB 7/1/09, effective 8/5/09]
[Filed ARC 0056C (Notice ARC 9921B, IAB 12/14/11), IAB 4/4/12, effective 7/1/12]
[Filed ARC 0242C (Notice ARC 0074C, IAB 4/4/12), IAB 8/8/12, effective 1/1/13]