When Must Pharmacists Verify a Prescriber’s DEA Registration? Two Recent Decisions Muddy the Waters

By John A. Gilbert, Jr. –

After more than four months without any substantive registrant decisions, the Drug Enforcement Administration (“DEA”) published 11 administrative decisions within two days last week.  Among these are two related cases involving allegations that a pharmacist failed to verify a prescriber DEA registration before filling a prescription for controlled substances.  JM Pharmacy Group, Inc. d/b/a Farmacia Nueva and Best Pharma Corp, 80 Fed. Reg. 28,667 (May 19, 2015) and Farmacia Yani, 80 Fed. Reg. 29,053 (May 20, 2015).  In both cases, the prescriber DEA number had been terminated or expired.

In overruling the Administrative Law Judges’ (“ALJ”) opinion in both cases, the Administrator held that pharmacists would not violate their corresponding responsibility by failing to verify a DEA registration unless the pharmacist had knowledge that the prescriber’s DEA registration had expired or was invalid.  Also, while finding that a pharmacist has some “duty” to verify a DEA registration, the Administrator determined that DEA has failed to provide guidance to the industry on the appropriate standard, and thus specifically declined to articulate a standard in either case.  These cases appear to narrow DEA’s enforcement authority against pharmacies that do not routinely verify DEA registrations; however, it remains unclear as to when a pharmacist must verify a DEA registration and the circumstances where DEA may find that a pharmacist “has reason to know” that a prescriber’s DEA registration is invalid.  This is all the more significant given that DEA has pursued administrative and civil penalties against registrants for failing to verify DEA registrations of terminated or expired practitioners.  

Both cases involved pharmacies located in Puerto Rico that had applied to become registered with DEA as retail pharmacies.  In the JM Pharmacy matter, DEA alleged that two pharmacies filled more than 170 prescriptions between January 2009 and November 2011 that were written by a doctor whose DEA certificate of registration (“COR”) had been revoked.  80 Fed. Reg. at 28,669.  The pharmacist admitted he never verified the practitioner registration because the pharmacy “understood” the registration was valid and relied on the fact that the patients’ insurance carriers had processed claims for the dispensed prescriptions.  Id. at 28,670.  In the Farmacia Yani matter, the government alleged that the pharmacy filled more than 200 controlled substance prescriptions over a time period of about 29 months for a prescriber whose COR had been expired during this entire period.  80 Fed. Reg. at 29,062.  In that case, the pharmacist also admitted she never tried to verify the prescriber registration.  

The DEA attorneys argued that the pharmacists violated their corresponding responsibility by failing to verify the prescriber’s DEA registration before filling a prescription for a controlled substance.  See 21 C.F.R. § 1306.04(a).  (In the Farmacia Yani matter, the government also argued that the pharmacist violated 21 U.S.C. §  843(a)(2), which imposes liability on a person who uses an expired DEA registration to dispense a prescription.  The Administrator acknowledged that this criminal law could apply in these types of cases, but stated that liability under this section only applied if the pharmacist acted knowingly or intentionally.  80 Fed. Reg. at 29,062.)  In both cases the ALJ agreed and found that the pharmacies had violated their corresponding responsibility.  However, the Administrator disagreed.  The Administrator noted that neither the Controlled Substances Act (“CSA”) nor DEA regulations require a pharmacist to verify a DEA registration before filling a prescription.  In fact, the Administrator found that the Agency had previously acknowledged there was no requirement that a pharmacist verify a DEA registration before filling a prescription when it promulgated its rule on electronic prescriptions.  Interim Final Rule on Electronic Prescriptions for Controlled Substances, 75 Fed. Reg. 16,236, 16,266 (Mar. 31, 2010).  In that rulemaking DEA stated that it is not necessary for a pharmacist who receives electronic prescriptions to check the CSA database every time to confirm that the prescribing practitioner is properly registered with the DEA.  Id.

Therefore, the Administrator ruled that the pharmacists did not violate their corresponding responsibility because there was no evidence the pharmacists in these cases had knowledge that the prescriber did not maintain a valid DEA registration.  The Administrator found that the requisite scienter for finding a violation of a pharmacist’s corresponding responsibility is knowledge or reason to know that a prescription is not valid.  Regarding the “reason to know” standard, the Administrator held that this means “deliberate ignorance or willful blindness.”  80 Fed. Reg. at 28,673.  Relying on the definition from the Supreme Court’s decision in Global-Tech Appliances, Inc. v. SEB, 131 S. Ct. 2060, 2070-71 (2011), the Administrator noted the Supreme Court “made clear that a ‘willfully blind defendant is one who takes deliberate actions to avoid confirming a high probability of wrongdoing and who can almost be said to have actually known the critical facts.’”  80 Fed. Reg. 28,672 (quoting Global-Tech Appliance, Inc., 131 S. Ct. at 2070-71).  The Administrator further quoted the Supreme Court’s finding that willful blindness occurs when: “1) the defendant subjectively believes that there is a high probability that a fact exists, and 2) the defendant must take deliberate actions to avoid learning of that fact.”  Id.  Consequently, the Administrator held that because there is no explicit statutory or regulatory duty for a pharmacy to determine whether a prescribing doctor’s COR is valid, the pharmacies in question did not violate their corresponding responsibility absent proof that they had any reason to know that the doctors’ CORs had been revoked.  The Administrator noted that the “corresponding responsibility to ensure the dispensing of valid prescriptions extends to the pharmacy itself.”  80 Fed. Reg. at 28,685.

The Administrator noted that DEA counsel failed to provide any expert testimony that a reasonable pharmacist would have inferred that the prescribers in question were not registered, or that this fact would have been so highly probable that the pharmacist should have refused to dispense the prescription.  Id. at 28,673, n.24.   The Administrator also found that these cases should be distinguished from the DEA’s decision in Holiday CVS, L.L.C., 77 Fed. Reg. 62,316 (Oct. 12, 2012), where the Administrator held CVS’s pharmacists liable under the corresponding responsibility standard for failing to verify a prescriber’s DEA registration.  Id. at 28,671.  The Administrator reasoned that, in Holiday CVS, the pharmacists were found to have had “knowledge” that the prescriber was not registered because the prescriber’s revocation of registration had been published in the Federal Register and the pharmacies maintained a database of DEA registrations for prescribers, which was available to the pharmacists when they filled a prescription.  Id. 

Despite determining that neither pharmacy in the present cases had violated its corresponding responsibility, the Administrator, relying on dictum from a prior decision, (Medicine Shoppe-Jonesborough, 73 Fed. Reg. 364, 381 (Jan. 2, 2008)), found that the pharmacists had violated a “duty” to periodically check to see that a prescriber retained authority to practice medicine and dispense controlled substances.  80 Fed. Reg. at 28,673; 80 Fed. Reg. at 29,063 (citations omitted).  Nevertheless, the Administrator made it clear that until the DEA publishes guidance to the regulated industry on the scope of this duty, the Administrator will give “nominal weight” to any such duty to verify DEA registrations because DEA did not prove that such “misconduct” was “intentional or knowing”  Id. at 28,673.  Specially, the Administrator found:

[I]f the Agency intends to enforce this duty in other cases, it must provide the regulated community with guidance as to its scope.  However, while such guidance can be announced in an adjudicatory proceeding, the process of adjudication is not well suited for doing so. . . .  Accordingly, I decline to set forth how frequently a pharmacy must verify that prescriber is registered.  

Id.  Thus, while the Administrator found that there is some “duty” to verify a DEA registration, and a failure to verify that registration is a breach of that duty, DEA cannot enforce that duty without providing guidance to the regulated community concerning its scope.   See id. 

In the JM Pharmacy case, the Administrator denied the applications the COR because she found the pharmacy had falsified the application for registration, but noted that only nominal weight would be given to evidence that the pharmacy failed in its duty to verify DEA registrations.  In the Farmacia Yani, case the Administrator gave little weight to respondent’s failure to verify DEA registrations and ruled that the application would be held in abeyance for six months; but the application would be granted if the respondent  completed a course on controlled substance dispensing and corresponding responsibility. 

These decisions raise questions as to when DEA may find that a pharmacist has sufficient “knowledge” to show that it has violated its corresponding responsibility in filling a prescription for an expired or terminated DEA COR.  For example, while the Administrator in the current cases would not impute “knowledge” under the corresponding responsibility standard to two pharmacies that — for more than two years — did not even try to verify a DEA registration, the Administrator reaffirmed her 2012 holding that two CVS pharmacies violated their corresponding responsibility because the prescriber’s revocation was published in the Federal Register and the company maintained a database of prescriber DEA registrations.  As noted by the ALJs in the current decisions, the pharmacies could have checked the registration on the DEA diversion website (which was accessible to any pharmacist with an internet connection), contacted the local DEA office or contracted with a private service to verify the DEA registration.  See, e.g., 80 Fed. Reg. at 28,686.  Moreover, the Administrator acknowledged that the availability of the DEA website had been published in the Federal Register as part of the electronic prescription Interim Final Rule.  75 Fed. Reg. at 16,266.  But the Administrator did not believe this was sufficient evidence that the pharmacists knew or had reason to know the prescribers’ DEA registration had been terminated or expired.  While the Administrator would not impute “knowledge” of these DEA registration verification sources to the pharmacies, it found that the CVS pharmacies should have had knowledge about the Federal Register notice regarding the prescriber revocation or what information was available in the CVS database (assuming the database was accurate concerning the validity of the DEA registrations).  This appears like a double standard.  Moreover, it is questionable whether the facts presented in Holiday CVS would satisfy the new “knowledge” standard articulated by the Administrator.   

While DEA has imposed a “knowledge” requirement on any determination whether a pharmacist has violated its corresponding responsibility for failing to verify a DEA registration, these decisions also establish a nebulous and undefined “duty” to verify a DEA registration.  But the Administrator’s ruling is clear: Until DEA promulgates guidance or regulations defining the duty to verify a DEA registration, the Administrator had held that DEA should give little weight to any evidence of a breach of that duty.