CHAPTER 37
IOWA PRESCRIPTION MONITORING PROGRAM
657—37.1(124) Purpose and scope. These rules establish a prescription monitoring program (PMP) that compiles a central database of reportable prescriptions dispensed to patients in Iowa. An authorized health care practitioner shall access PMP information when mandated by the practitioner’s licensing authority regarding the practitioner’s patient to assist in determining appropriate treatment options and to improve the quality of patient care. The PMP is intended to provide a practitioner with a resource for information regarding a patient’s use of controlled substances and to serve as a tool to assess a prescriber’s prescribing practices. This database will assist the practitioner in identifying any potential diversion, misuse, or abuse of controlled substances without impeding the appropriate medical use of controlled substances.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.2(124) Definitions. For the purposes of this chapter, the following definitions shall apply.
“Administer” means to provide or apply a controlled substance to a patient for immediate use within the prescribing practitioner’s practice location. Administration does not include dispensing.
“Board” means the Iowa board of pharmacy.
“Client” means the owner, owner’s designee, or other person responsible for an animal patient.
“Controlled substance” means a drug in Schedules II through V set forth in Iowa Code chapter 124, division II.
“Council” means the PMP advisory council established pursuant to Iowa Code section 124.555 to provide oversight and to co-manage PMP activities with the board.
“CSA registration” means registration with the board under the Iowa uniform controlled substances Act pursuant to 657—Chapter 10.
“DEA number” means the registration number issued to an individual or pharmacy by the U.S. Department of Justice, Drug Enforcement Administration (DEA), authorizing the individual or pharmacy to engage in the prescribing, dispensing, distributing, or procuring of a controlled substance.
“Dispense” means to provide a controlled substance to a patient for self-use outside of the prescribing practitioner’s practice location. Dispensing does not include administration.
“Dispenser” means a pharmacy or prescriber, regardless of location, who delivers to the ultimate user a substance required to be reported to the PMP. “Dispenser” does not include a person exempt from reporting pursuant to subrule 37.7(2).
“First responder” means an emergency medical care provider, a registered nurse staffing an authorized service program under Iowa Code section 147A.12, a physician assistant staffing an authorized service program under Iowa Code section 147A.13, a firefighter, or a peace officer as defined in Iowa Code section 801.4, who is trained and authorized to administer an opioid antagonist.
“Health care facility” means a residential care facility, a nursing facility, an intermediate care facility for persons with mental illness, or an intermediate care facility for persons with an intellectual disability.
“Health care professional” means a person who, by certification, registration, or licensure, is qualified to provide and is engaged in providing health care to patients. “Health care professional” does not include clerical or administrative staff. A health care professional shall be credentialed in a manner that permits verification and regulation of the health care professional’s credentials.
“Health care system” means an organization that includes at least one hospital or at least one group of practitioners that provides comprehensive care that are connected with each other through common ownership or management.
“HIPAA” means the Health Insurance Portability and Accountability Act.
“Law enforcement” means an entity or agency with jurisdiction to investigate or prosecute violations of criminal law. “Law enforcement” includes, but is not limited to, such agencies as police departments, United States attorneys, the DEA, county attorneys, and the Medicaid fraud control unit.
“Licensing authority” means an agency that licenses or registers health care professionals and has jurisdiction to enforce governing laws over those individuals who are licensed or registered. “Licensing authority” includes, but is not limited to, professional licensing boards and the DEA.
“NarxCare” means an analytics tool and care management platform that helps practitioners analyze real-time data from the PMP. The platform analyzes patient data and history to provide a patient risk score and usage patterns to help practitioners identify potential risk factors.
“NDC number” means the universal product identifier used in the United States to identify a specific human drug.
“Opioid antagonist” means a drug that binds to opioid receptors and blocks or inhibits the effects of opioids acting on those receptors, including but not limited to naloxone hydrochloride or any other similarly acting drug approved by the United States Food and Drug Administration.
“Patient” means a person or animal to whom a prescription is prescribed or dispensed.
“PMP administrator” means staff persons designated to manage and administer the PMP under the direction and oversight of the board and the council.
“Practitioner” means a prescriber or a pharmacist.
“Practitioner’s delegate” means a health care professional who is under the supervision of a PMP-registered practitioner and who is authorized by the practitioner to access PMP information on the practitioner’s behalf.
“Prescriber” means an individual with an active CSA registration who has the authority to prescribe controlled substances. For the purposes of this chapter, “prescriber” does not include a licensed veterinarian.
“Prescription monitoring program” or “PMP” means the program established pursuant to these rules for the collection and maintenance of PMP information and for the provision of PMP information to authorized individuals.
“Reportable prescription” means the record of a controlled substance administered or dispensed by a practitioner and the record of an opioid antagonist dispensed by a practitioner or administered by a first responder. “Reportable prescription” shall not include records identified in subrule 37.7(1). “Reportable prescription” shall include, but not be limited to:
	1.	The dispensing of a controlled substance to an emergency department patient;
	2.	The administration of a controlled substance to a patient at the discretion of the treating practitioner
	3.	The administration or dispensing of an opioid antagonist to an emergency department patient;
	4.	The dispensing of a controlled substance sample;
	5.	The dispensing of a controlled substance or opioid antagonist to a patient upon discharge from a hospital or care facility; and
	6.	The dispensing of a Schedule V controlled substance without a prescription pursuant to rule 657—10.33(124,155A).
[ARC 4397C, IAB 4/10/19, effective 5/15/19; ARC 5545C, IAB 4/7/21, effective 5/12/21]
657—37.3(124) Registration. Registration for the PMP pursuant to this rule shall be via the Iowa PMP AWARxE website at iowa.pmpaware.net.
	37.3(1) Prescribers.  A prescriber shall register for the PMP at the same time the prescriber registers or renews a CSA registration pursuant to 657—Chapter 10. A licensed veterinarian with an active CSA registration may register for the PMP. Registration for the PMP shall also require the prescriber’s DEA number.
	37.3(2) Pharmacists. A pharmacist who is involved in patient care shall register for the PMP at the same time the pharmacist becomes licensed or renews a license pursuant to 657—Chapter 2.
	37.3(3) Practitioner’s delegates. A practitioner may authorize an adequate number of health care professionals who actively work with the practitioner to act as the practitioner’s delegates for the purpose of requesting PMP information. A practitioner’s delegate shall be licensed, registered, certified, or otherwise credentialed as a health care professional in a manner that permits verification of the health care professional’s credentials. The practitioner shall be responsible for the PMP information access of the practitioner’s delegates.
	37.3(4) Law enforcement officials. A law enforcement official may register for the PMP to access information by order, subpoena, or other means of legal compulsion relating to a specific investigation and supported by a determination of probable cause.
	37.3(5) Licensing authority. A licensing authority official may register for the PMP to access information by order, subpoena, or other means of legal compulsion relating to a specific investigation and supported by a determination of probable cause.
	37.3(6) Medical examiners and medical examiner investigators. A medical examiner or a medical examiner investigator may register for the PMP to access information when the information relates to an investigation being conducted by the examiner or investigator.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.4 and 37.5  Reserved.
657—37.6(124) Security of PMP credentials. Each user registered to access PMP information shall securely maintain and use the login and password and any other secure access credentials assigned to the individual user. Except in an emergency when a patient would be placed in greater jeopardy by restricting PMP information access to the user, a registered user shall not share the user’s secure access credentials.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.7(124) PMP reporting—exemptions.
	37.7(1) Exempted dispensing or administration. The dispensing or administration of a controlled substance as described in this subrule shall not be considered a reportable prescription. A pharmacy engaged in the distribution of controlled substances solely pursuant to one or more of the practices identified in this subrule shall notify the PMP administrator of the exempted practice, and the pharmacy shall not be required to report to the PMP.
	a. 	The dispensing by a licensed hospital pharmacy for the purposes of inpatient hospital care.
	b. 	The dispensing by a licensed pharmacy for a patient residing in a health care facility or inpatient hospice facility.
	c. 	The administration by a prescriber of a controlled substance for the purposes of outpatient procedures and treatment.
	d. 	The sale by a licensed pharmacy of a Schedule V controlled substance without a prescription which sale is subject to the reporting requirements of 657—Chapter 100.
	37.7(2) Exempted practitioners. The following entities or individuals shall not be required to report to the PMP and shall not be required to notify the PMP administrator of their exempted status:
	a. 	A licensed pharmacy that does not have a CSA registration and does not dispense controlled substances in or into Iowa.
	b. 	A licensed veterinarian who administers or dispenses a controlled substance in the normal course of the veterinarian’s professional practice.
	c. 	A DEA-registered narcotic treatment program which is subject to the record-keeping provisions of 21 CFR Section 1304.24.
[ARC 4397C, IAB 4/10/19, effective 5/15/19; ARC 5545C, IAB 4/7/21, effective 5/12/21]
657—37.8(124) PMP reporting—dispensing prescribers. Each dispensing prescriber, unless exempt pursuant to rule 657—37.7(124), shall submit to the PMP a record of each reportable prescription dispensed during a reporting period pursuant to subrule 37.12(2). For purposes of prescriber dispensing, the prescriber shall also be identified as the dispenser or pharmacy. A veterinarian may, but shall not be required to, submit to the PMP a record of reportable prescriptions dispensed by the veterinarian.
[ARC 4397C, IAB 4/10/19, effective 5/15/19; ARC 5545C, IAB 4/7/21, effective 5/12/21]
657—37.9(124) PMP reporting—pharmacies. Each pharmacy, unless exempt pursuant to rule 657—37.7(124), shall submit to the PMP either a record of each reportable prescription dispensed or administered during a reporting period pursuant to subrule 37.12(2) or a zero report pursuant to subrule 37.12(4), as appropriate.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.10 and 37.11  Reserved.
657—37.12(124) Reporting requirements.
	37.12(1) Data elements. The information submitted to the PMP for each reportable prescription shall be accurate and shall include, at a minimum, the following data elements:
	a. 	Dispenser DEA number.
	b. 	Date the prescription is dispensed or administered.
	c. 	Prescription number or unique identification number.
	d. 	NDC number of the drug dispensed or administered.
	e. 	Quantity of the drug dispensed or administered.
	f. 	Number of days of drug therapy provided by the drug dispensed or administered.
	g. 	Patient legal first and last names.
	h. 	Patient address including street address, city, state, and ZIP code.
	i. 	Patient phone number.
	j. 	Patient date of birth.
	k. 	Patient gender.
	l. 	Prescriber name and DEA number.
	m. 	Date the prescription was issued by the prescriber.
	n. 	Method of payment.
	o. 	Form of transmission of prescription origin.
	p. 	Refill number.
	q. 	Number of refills authorized.
	r. 	Indication as to whether the prescription is new or a refill.
	37.12(2) Reporting periods. A record of each reportable administration or prescription dispensed shall be submitted by each dispenser no later than the next business day following administration or dispensing.
	37.12(3) Transmission. Prescription dispensing and administration information shall be transmitted via the PMP’s current version of data upload or electronic submission.
	37.12(4) Zero reports. If a pharmacy did not dispense or administer any reportable prescriptions during a reporting period, the dispenser shall submit a zero report no later than the next business day.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.13(124) Opioid antagonist administration by first responders.
	37.13(1) The administration of an opioid antagonist by a first responder shall be reported to the PMP, unless such administration was reported to the Iowa department of public health bureau of emergency and trauma services.
	37.13(2) The reporting of the administration of an opioid antagonist by a first responder shall include the following data elements:
	a. 	Patient first and last names.
	b. 	First and last names of the individual who administered the opioid antagonist.
	c. 	Date of administration.
	d. 	Quantity of the opioid antagonist administered.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.14 and 37.15  Reserved.
657—37.16(124) Access to PMP information. All information contained in the PMP is confidential and shall only be accessed as provided in this rule. All requests for PMP information must comply with the format specified by the board for the particular type of request. Once information is accessed, further dissemination or use of that information is governed by applicable federal and state laws governing the person who accessed the information. The board may charge a fee to recover the actual costs associated with responding to any request by a person other than a practitioner or a practitioner’s delegate. Any fees or costs assessed by the board shall be considered repayment receipts as defined in Iowa Code section 8.2.
	37.16(1) Prescribers. A prescriber may access a patient’s prescription history report; the prescriber’s activity report; proactive alerts or system user notes, such as peer-to-peer communication; and NarxCare reports. A veterinarian with authority to prescribe controlled substances may access a current patient’s or client’s prescription history report if the veterinarian has a reasonable basis to suspect the client may be abusing drugs or mistreating an animal.
	37.16(2) Pharmacists.
	a. 	A pharmacist may access a patient’s or client’s prescription history report; proactive alerts or system user notes, such as peer-to-peer communication; and NarxCare reports.
	b. 	A pharmacist shall review a patient’s or client’s prescription history report prior to dispensing a Schedule V controlled substance without a prescription pursuant to rule 657—10.33(124,155A).
	37.16(3) Practitioner’s delegates. A practitioner’s delegate may access a patient’s prescription history report; proactive alerts or system user notes, such as peer-to-peer communication; and NarxCare reports.
	37.16(4) Licensing authority officials.
	a. 	A licensing authority with jurisdiction over a practitioner may obtain the following information, if the request is accompanied by a subpoena compelling disclosure of such information for a specific investigation into the prescribing or dispensing practices of the licensee: prescription history reports; proactive alerts or system user notes, such as peer-to-peer communication; PMP access logs and login records; and NarxCare reports.
	b. 	A licensing authority with jurisdiction over a health care professional may obtain the following information, if the request is accompanied by a subpoena compelling disclosure of such information for a specific investigation into the licensee’s misuse of controlled substances: the licensee’s prescription history report.
	37.16(5) Law enforcement officials. A law enforcement official may obtain a patient’s prescription history report and the prescribing or dispensing practices of a prescriber if the request is accompanied by a subpoena or other means of legal compulsion compelling disclosure of such information for use in a specific investigation.
	37.16(6) Medical examiners and medical examiner investigators. A medical examiner or medical examiner investigator may obtain a decedent’s prescription history report for use in a specific investigation.
	37.16(7) Patients. A patient or the patient’s agent may request the patient’s own prescription history report by using the board’s patient request form. The request can be personally delivered to the board office where the patient will be required to present current government-issued photo identification at the time of the delivery of the request. A patient who is unable to personally deliver the request to the board office may submit a notarized request, along with a certified copy of the patient’s government-issued photo identification, via mail or commercial delivery service. The following agents may submit a request on behalf of a patient: an individual with a medical power of attorney for the patient, a patient’s attorney, or an executor of the patient’s estate. In addition to the patient’s information, the patient’s agent shall be identified by name, current address, and telephone number. In lieu of the patient’s signature and identification, the patient’s agent shall sign the request and the government-issued photo identification shall identify the patient’s agent. The patient’s agent shall include a copy of the legal document that establishes the agency relationship with the patient.
[ARC 4397C, IAB 4/10/19, effective 5/15/19; ARC 5545C, IAB 4/7/21, effective 5/12/21]
657—37.17(124) Integrated systems. A practitioner or a health care system may integrate its electronic health record system or a pharmacy may integrate its automated data processing system with the PMP using an application programming interface. Use of an integrated system shall comply with all of the following:
	37.17(1) The integrated system shall log each user’s access to PMP information. Access logs shall be retained by the practitioner, health care system, or pharmacy for a minimum of four years from the date of access and shall be provided to the board upon request.
	37.17(2) If the user identified in access logs is not the practitioner, the integrated system shall clearly identify on which practitioner’s behalf the user was accessing PMP information. A practitioner’s delegate using an integrated system is required to maintain active PMP registration.
	37.17(3) The integrated system shall maintain appropriate administrative, technical, and physical security measures to safeguard against unauthorized access, disclosure, or theft of PMP information and shall meet all HIPAA requirements for safeguarding protected health information.
	37.17(4) The practitioner, health care system, or pharmacy shall notify the PMP administrator of any breach in the electronic health record system that may have included PMP information within 72 hours of making the determination that a breach occurred.
	37.17(5) An integrated system shall comply with all requirements in subchapter VI of Iowa Code chapter 124 and all requirements of this chapter.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.18(124) PMP administrator access.
	37.18(1) PMP staff. The board may designate PMP administrators who may access any PMP information needed to perform the functions of the job.
	37.18(2) Statistical data. The PMP administrator or designee may provide summary, statistical, or aggregate data to public or private entities for statistical, public research, public policy, or educational purposes. The board may charge a fee to recover the actual costs associated with responding to a request for PMP data pursuant to this subrule. Any fees or costs assessed by the board shall be considered repayment receipts as defined in Iowa Code section 8.2.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.19(124) Prescriber activity reports. The PMP administrator shall, at least annually, electronically issue to each prescriber who prescribed a controlled substance that was reported to the program as dispensed in or into this state during the preceding reporting period an activity report which shall include, at a minimum, the following:
	1.	A summary of the prescriber’s history of prescribing controlled substances,
	2.	A comparison of the prescriber’s history of prescribing controlled substances with the history of other prescribers of the same profession or specialty,
	3.	The prescriber’s history of program use,
	4.	General patient risk factors, and
	5.	Educational updates.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.20(124) Proactive notifications.  The PMP administrator shall provide notification to a practitioner when a patient may be practitioner shopping or at risk of abusing or misusing a controlled substance based on criteria and thresholds determined by the board and the advisory council. A proactive notification pursuant to this rule will be initiated when a patient obtains prescriptions for controlled substances from a minimum number of prescribing practitioners and from a minimum number of pharmacies within a maximum number of days which exceed the thresholds established by the board and advisory council. The notification will suggest review of the patient’s prescription history.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.21(124) Record retention. The PMP shall retain all reported prescriptions, all records of access to or query of PMP information, and all information distributed to practitioners in proactive notifications for a minimum of four years from the date of the record.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.22(124) Information errors. Any person who believes that PMP information is erroneous shall notify the pharmacy or dispensing practitioner. Upon notification of a potential error in PMP information, the pharmacy or dispensing practitioner shall promptly correct erroneous information in the record.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
657—37.23(124) Discipline. Any licensee who fails to comply with the provisions of the law or these rules is subject to disciplinary action by the board and may be subject to criminal prosecution.
[ARC 4397C, IAB 4/10/19, effective 5/15/19]
These rules are intended to implement Iowa Code sections 124.550 to 124.558.
[Filed ARC 7903B (Notice ARC 7676B, IAB 4/8/09), IAB 7/1/09, effective 8/5/09]
[Filed ARC 0056C (Notice ARC 9921B, IAB 12/14/11), IAB 4/4/12, effective 7/1/12]
[Filed ARC 0242C (Notice ARC 0074C, IAB 4/4/12), IAB 8/8/12, effective 1/1/13]
[Filed ARC 3102C (Notice ARC 2905C, IAB 1/18/17), IAB 6/7/17, effective 7/12/17]
[Filed ARC 3743C (Notice ARC 3505C, IAB 12/20/17), IAB 4/11/18, effective 5/16/18]
[Filed ARC 4397C (Notice ARC 4205C, IAB 1/2/19), IAB 4/10/19, effective 5/15/19]
[Filed ARC 5545C (Notice ARC 5369C, IAB 12/30/20), IAB 4/7/21, effective 5/12/21]