No Longer “Waiting for Godot,” Godot has arrived. DEA Finally Issues a Proposed Rule on Suspicious Orders

Today, more than two years after Congress passed the Preventing Drug Diversion Act of 2018 (PDDA) and after more than a decade of industry requests for regulations addressing the Drug Enforcement Administration’s (DEA) interpretation of suspicious order requirements under 21 C.F.R. § 1301.74(b), DEA has finally spoken, with its proposed rule “to revise its regulations relating to suspicious orders” and “clarify the procedures a registrant must follow” to identify and report suspicious orders.  Suspicious Orders of Controlled Substances, Notice of Proposed Rulemaking, 85 Fed. Reg. 69,282 (Nov. 3, 2020).

DEA’s New Definitions

DEA’s proposed rule establishes three new definitions: (1) “orders received under suspicious circumstances (ORUSC),” (2) “order,” and (3) “due diligence.”  DEA’s existing regulations only define a “suspicious order,” which the PDDA codified in 2018 as including orders, or a “series of orders” of unusual size, pattern or frequency.  DEA’s new definition of an “order received under suspicious circumstances” is essentially a prequel to a suspicious order determination permitting registrants to identify an order as “potentially suspicious.”  The regulatory definition of ORUSC is critical for DEA to establish the two-option order review framework summarized below.

DEA defines the term “order,” to standardize what is a controlled substance order, which definition is far broader than considered before.  DEA proposes the following “order” definition:

[A]ny communication by a person to a registrant proposing or requesting a distribution of a controlled substance, regardless of how it is labeled by the person or the registrant, and regardless of whether the distribution is made by the registrant, except that simple price/availability inquiries, standing alone, do not constitute an order.

(Emphasis added.)

DEA’s definition raises questions when one considers the logistical and financial differences in the way that the regulated industry engages in distribution of controlled substances.  And, speaking of the “regulated” industry, DEA clarifies that proposed suspicious order reporting requirements will apply to practitioners when such distributions are made pursuant to the five percent rule.  The rule also will apply to “all registrants authorized to distribute controlled substances: distributors, manufacturers, importers, pharmacies, hospital/clinics teaching institutions, practitioners, Mid-level Practitioners (MLP), MLP- Ambulance Services, Researchers, Analytical Labs and NTPs,” but not reverse distributors.

The Two-Option Framework for Orders

After years of telling the regulated industry that it would not approve any particular method for identifying and reporting suspicious orders, DEA is now establishing a “two-option framework.”  The NPRM states that, upon receipt of an ORUSC, registrants will have a choice: (1) immediately file a suspicious order report through the DEA centralized database, decline to distribute the order, and maintain a record including any due diligence conducted related to the suspicious order; or, (2) before distributing pursuant to the order, conduct due diligence to investigate each suspicious circumstance surrounding the ORUSC, and maintain a record of its due diligence regarding the ORUSC.  The two options proposed by DEA are consistent with the D.C. Circuit’s 2017 Masters Decision and a recognition that, in the absence of sorely needed guidance from DEA over the past decade, most manufacturers and distributors have adopted some variation of these two options, otherwise known as a “Flag and Terminate,“ or  “Order of Interest” systems.

In regard to the second option, the DEA is establishing a deadline of seven calendar days for the registrant to determine if all of the suspicious circumstances for the held order have been resolved.  If the registrant is able to resolve all suspicious circumstances, then the order is not considered a suspicious order.  The registrant must maintain a record of its due diligence (thus likely leaving registrants’ due diligence subject to DEA scrutiny and second-guessing in the future).

Due Diligence Requirements

DEA defines its expectations for “due diligence” that a registrant must follow — within a seven calendar-day time period — before clearing an order to ship.  The expansive definition of “due diligence” includes: a “reasonable and documented investigation” and “examination of all facts and circumstances.”  And, concerning another “broad” definition, DEA’s new regulation will require the following concerning the system to identify suspicious orders:

In addition, the system shall be designed and operated to identify suspicious orders based on facts and circumstances that may be relevant indicators of diversion in determine whether hat person (or a person submitting an order) is engaged in, or is likely to engage in the diversion of controlled substances.

The failure to conduct sufficient due diligence has been at the heart of a number of civil and criminal settlements, and litigated cases over the years.  It will be interesting to see how these new requirements compare to already well-established industry procedures.  For example, DEA states that, “regarding recordkeeping, the proposed rule would require more than just a ‘check the box’ type of documentation.”  DEA also footnoted “rigid formulas” (using the terms “algorithm,” “blocked,” “flagged,” “held,” “order of interest,” “pended,” or “threshold”) that may not identify suspicious orders.  The new rule instead would require the registrant’s “record” to include:

(1) how the registrant handled such orders;

(2) what information and circumstances rendered the order actually or potentially suspicious;

(3) what steps if any the registrant took to investigate the order;

(4) if the registrant investigated the order, what information it obtained during its investigation;

(5) where the registrant concludes that each suspicious circumstances had been dispelled the specific basis for each such conclusion.

Of course, the significant irony here is that the rulemaking comes more than 15 years since DEA first announced its “Distributor Initiative,” which resulted in hundreds of millions of dollars in civil penalties, administrative suspensions and revocations of registrations, and several criminal charges — all based on DEA’s claims that the industry failed to comply with the requirement to identify and report suspicious orders.  Like the play, the regulated industry has been waiting for guidance from DEA concerning what “is” a suspicious order, other than an order of unusual size, pattern or frequency; and what to do about a suspicious order once detected.  As a result of its waiting, industry has engaged in all sorts of philosophical (and likely quite expensive) interpretations of DEA’s vague order monitoring requirements.  And while waiting, registrants have moved forward developing policies, procedures and elaborate monitoring systems without clear guidance from DEA as to its expectations.  Industry generally relied instead on two DEA “guidance” letters to industry dated in 2006 and 2007, and two cases referenced in the NPRM, Southwood and the fairly recent Masters decision, in developing “systems” to report to the registrant orders of unusual size, frequency and pattern.

More to Come

The NPRM provides additional background and detail as to how DEA arrived at the proposed rule, which will be the subject of further posts in the coming days, including, but not limited to, a post on the content of reports that must be submitted to DEA once an order is deemed suspicious, and a  post on industry comments on the proposed rule.  So, while the wait is over, we are just beginning another act in DEA long-running suspicious order saga.