902 Ky. Admin. Regs. 55:110

Current through Register Vol. 51, No. 5, November 1, 2024

Section 902 KAR 55:110 - Monitoring system for prescription controlled substances

RELATES TO: KRS 72.026, 216B.015(13), 218A.010(12), (40), 218A.202, 218A.205(2) (a), (6), 218A.240(7)(a), 42 C.F.R. Part 2

NECESSITY, FUNCTION, AND CONFORMITY: KRS 218A.202(1) directs the Cabinet for Health and Family Services to establish and maintain an electronic system for monitoring Schedule II, III, IV, and V controlled substances. KRS 218A.250 requires the cabinet to promulgate administrative regulations pursuant to KRS Chapter 13A for carrying out the provisions of KRS Chapter 218A. This administrative regulation establishes criteria for reporting prescription data, establishes procedures to correct errors, and allows for disclosure of data to authorized persons.

Section 1. Definitions.

(1) "Branch" means the Drug Enforcement and Professional Practices Branch in the Division of Audits and Investigations, Office of Inspector General, Cabinet for Health and Family Services.

(2) "Cabinet personnel" means an individual who:

(a)

1. Is directly employed by the Cabinet for Health and Family Services; or

2. Is employed by an agent or contractor of the cabinet;

(b) Has undergone KASPER training; and

(c) Has been approved to use the KASPER system.

(3) "Central registry" is an entity defined by 908 KAR 1:374, Section 1(3) that may report information to KASPER on behalf of a narcotic treatment program.

(4) "Dispenser" is defined by KRS 218A.010(12), and:

(a) Includes a dispenser who has a DEA (Drug Enforcement Administration) number or is a pharmacist who owns or is employed by a facility that operates a pharmacy that has a DEA number;

(b) Includes a narcotic treatment program licensed pursuant to 908 KAR 1:374; and

(c) Does not include an individual licensed to practice veterinary medicine under KRS Chapter 321.

(5) "Health facility" is defined by KRS 216B.015(13).

(6) "KASPER" means Kentucky All-Schedule Prescription Electronic Reporting System.

(7) "Patient identifier" means a patient's:

(a) Full name;

(b) Address, including zip code;

(c) Date of birth; and

(d) Social Security number or an alternative identification number established pursuant to Section 5 of this administrative regulation.

(8) "Practitioner" is defined by KRS 218A.010(40).

(9) "Report" means a compilation of data concerning a patient, dispenser, practitioner, or controlled substance.

(10) "Suspected drug overdose" means an acute condition that:

(a) Includes conditions such as physical illness, coma, mania, or hysteria that is the result of consumption or use of a controlled substance, or another substance with which a controlled substance was combined; and

(b) Relates to injury or poisoning by any substance corresponding to the following International Classification of Disease (ICD) version 10 (ICD-10) codes available at https://www.cms.gov/Medicare/Coding/ICD10:

1. T40;

2. T42; or

3. T43.

Section 2. Data Reporting.

(1) A dispenser or a health facility that has a DEA number shall report all dispensed Schedule II, III, IV, or V controlled substances, except:

(a) During the circumstances specified in KRS 218A.202(3)(a) through (c); or

(b) If the controlled substance is dispensed by a narcotic treatment program for use to treat substance use disorder and the patient has not provided written consent that meets the requirements of 42 C.F.R. 2.31.

(2) A dispenser of a Schedule II, III, I V, or V controlled substance shall transmit or provide the following data to the cabinet or the cabinet's agent:

(a) Patient identifier;

(b) National drug code of the drug dispensed;

(c) Metric quantity of the drug dispensed;

(d) Date of dispensing;

(e) Estimated days the supply of dispensed medication will last;

(f) Drug Enforcement Administration registration number of the prescriber;

(g) Prescription number or dispensing identification number assigned by the dispenser or health facility; and

(h) The Drug Enforcement Administration registration number of the dispenser.

(3) The data identified in subsection (2) of this section shall be transmitted no later than close of business on the business day immediately following the dispensing unless the cabinet grants an extension as provided in subsection (4) or (5) of this section.

(4)

(a) An extension may be granted if the dispenser, health facility, or central registry:

1. Suffers a mechanical or electronic failure; or

2. Cannot meet the deadline established by subsection (3) of this section because of reasons beyond his or her control.

(b) To request an extension, a written request shall:

1. Be submitted to the branch:

a. Within twenty-four (24) hours of discovery of the circumstances necessitating the request; or

b. If state offices are closed, on the next day that state offices are open for business following discovery of the circumstances necessitating the request; and

2. Provide a justification for the extension, including the length of time the extension is necessary.

(5) An extension shall be granted if the cabinet or its agent is unable to receive electronic reports transmitted by the dispenser.

(6) Except as provided in subsection (8) of this section, the data shall be transmitted by:

(a) An electronic device compatible with the receiving device of the cabinet or the cabinet's agent;

(b) Secure File Transfer Protocol;

(c) https protocol; or

(d) Secure Virtual Private Network connection.

(7) The data shall be transmitted in the telecommunications format for controlled substances established by the most recent version of the Implementation Guide, ASAP Standard for Prescription Monitoring Programs, developed by the American Society for Automation in Pharmacy available at asapnet.org, or a comparable format approved by the branch.

(8) A dispenser who does not have an automated recordkeeping system capable of producing an electronic report in the telecommunications format for controlled substances established by the Implementation Guide, ASAP Standard for Prescription Monitoring Programs shall report the data identified in subsection (2) of this section using an Internet accessible web portal designated by the cabinet.

(9) To meet the reporting requirement of KRS 218A.202(4), a hospital shall report to the cabinet all positive toxicology screens ordered by the hospital's emergency department to evaluate a patient's suspected drug overdose via the Kentucky Health Information Exchange.

Section 3. Compliance. A dispenser may presume that the patient identification information provided by the patient or the patient's agent in accordance with Section 5 of this administrative regulation is correct.

Section 4. Request for Report.

(1) A written or electronic request shall be filed with the cabinet prior to the release of a report, except for a subpoena issued by a grand jury or an appropriate court order issued by a court of competent jurisdiction.

(2) A request for a KASPER patient report shall be made electronically at www.chfs.ky.gov/KASPER.

(3)

(a) A request for a KASPER provider report made by a law enforcement or prosecutorial official authorized to receive data under KRS 218A.202, or a designated representative of a board responsible for the licensure, regulation, or discipline of prescribing practitioners shall be made by written application on the KASPER Report Request for Law Enforcement and Licensure Boards, Form DCB-20L.

(b) If the request made by a law enforcement or prosecutorial official authorized to receive data under KRS 218A.202 is for KASPER data on dispensing of controlled substances by a narcotic treatment program to treat substance use disorder, a report shall not be disclosed to the official unless there is a valid court order and subpoena requiring the release of the information and all other applicable provisions of 42 C.F.R. Part 2 , Subpart E are met.

(4) A medical examiner engaged in a death investigation pursuant to KRS 72.026 may query KASPER for a report on the decedent.

Section 5. Patient Identification Number.

(1) A patient or the person obtaining the controlled substance on behalf of the patient shall disclose to the dispenser the patient's Social Security number for purposes of the dispenser's mandatory reporting to KASPER.

(2) If a patient is an adult who does not have a Social Security number, the patient's driver's license number shall be disclosed.

(3) If a patient is an adult who has not been assigned a Social Security number or a driver's license number, the number 000-00-0000 shall be used in the Social Security field.

(4) If a patient is a child who does not have a Social Security number or a driver's license number, the number "000-00-0000" shall be used in the Social Security field.

(5) If a patient is an animal, the number "000-00-0000" shall be used in the Social Security number field.

Section 6. KASPER Data and Trend Reports. Cabinet personnel shall have authorized access to the data obtained from the KASPER system and trend reports in accordance with KRS 218A.240(7)(a).

Section 7. Data Retention. Data shall be maintained in KASPER according to the Office of Inspector General's retention schedule on file with the State Libraries, Archives and Records Commission.

Section 8. Error Resolution.

(1) A patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic to whom a report has been disclosed under KRS 218A.202(9) or this administrative regulation may request that information contained in KASPER be corrected if the patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic believes that any information is inaccurate. The patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic shall:

(a) Contact the dispenser who reported the information required by Section 2(2) of this administrative regulation; and

(b) Request that the dispenser correct the information.

(2) If, upon receipt of a request from a patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic pursuant to subsection (1) of this section, the dispenser confirms that the information was reported in error, the dispenser shall:

(a) Transmit corrected information to update the KASPER database within seven (7) calendar days of the request for the correction; and

(b) Notify the patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic that the corrected information has been transmitted.

(3) If a dispenser identifies a KASPER system generated error, the dispenser shall notify the branch. Upon verification of the error, the branch shall:

(a) Correct the information in the KASPER database; and

(b) Notify the patient, patient's representative, practitioner, pharmacist, health facility, private practitioner's office or clinic within five (5) working days of the correction.

Section 9. Referrals to Licensing Boards. If the cabinet becomes aware that a prescriber or dispenser has failed to comply with the reporting requirements of KRS 218A.202 and this administrative regulation, the cabinet shall notify the licensing board or agency responsible for licensing the prescriber or dispenser.

Section 10. Disclosure of Data or Report.

(1) The cabinet shall only disclose data to:

(a) The persons and entities authorized to receive that data under KRS 218A.202(7); and

(b) The persons and entities authorized to receive data pursuant to 42 C.F.R. Part 2, Subparts C, D, and E if the data to be disclosed includes information on controlled substances dispensed by a narcotic treatment program for use to treat substance use disorder.

(2) As a condition precedent to the disclosure of data or a report pursuant to KRS 218A.202(7)(f), a hospital or long-term care facility shall maintain, and provide upon request by the cabinet, a copy of the hospital or long-term care facility's policy for the management of KASPER data and reports, which:

(a) Describes the hospital or long-term care facility's internal procedures for educating the designated employee or employees on the:

1. Proper use of the KASPER system;

2. Prohibition on the improper use or intentional disclosure of KASPER data to unauthorized individuals; and

3. Sanctions imposed for the improper use or intentional disclosure of KASPER data to unauthorized individuals, including criminal misdemeanor offenses; and

(b) Describes the hospital or long-term care facility's internal procedures for auditing the account, including:

1. The manner in which an employee is added to or removed from access to the account if the employee ends employment or is no longer designated to query KASPER; and

2. The actions taken if a designated employee with access to the employer's KASPER account intentionally misuses his or her privileges to KASPER data or a report, which shall include a report of the incident to the branch.

(3)

(a) An individual authorized to receive data under KRS 218A.202(7) shall not provide the data to any other entity except:

1. As provided in KRS 218A.202(9); and

2. For substance use disorder treatment data, as provided in 42 C.F.R. 2.32; or

(b) As provided in paragraph (c) of this subsection.

(c) In addition to the purposes authorized under KRS 218A.202(9)(e), and pursuant to KRS 218A.205(2)(a) and (6), a practitioner or pharmacist who obtains KASPER data or a report under KRS 218A.202(7)(e) 1. or who in good faith believes that any person, including a patient, has violated the law in attempting to obtain a prescription for a controlled substance, may report suspected improper or illegal use of a controlled substance to law enforcement or the appropriate licensing board.

(4) A hospital or long-term care facility shall maintain and adhere to the entity's internal policy regarding the management of KASPER data and reports.

Section 11. Incorporation by Reference.

(1) "KASPER Report Request for Law Enforcement and Licensure Boards", Form DCB-20L, October 2022, is incorporated by reference.

(2) This material may be inspected, copied, or obtained, subject to applicable copyright law, at the Drug Enforcement and Professional Practices Branch, Office of the Inspector General, Cabinet for Health and Family Services, 275 E. Main Street, Frankfort, Kentucky 40621, Monday through Friday, 8 a.m. to 4:30 p.m. This material may also be viewed on the Office of Inspector General's Web site at: https://chfs.ky.gov/agencies/os/oig/dai/deppb/Pages/kasper.aspx.

902 KAR 55:110

25 Ky.R. 966; 1367; eff. 12-16-1998; 32 Ky.R. 1927; 33 Ky.R. 120; eff. 7-24-2006; 34 Ky.R. 2609; 35 Ky.R. 283; eff. 9-5-2008; 2615; eff. 7-31-2009; 39 Ky.R. 629; 1218; 1413; 2033; eff. 3-4-2013; 44 Ky.R. 378, 1026, 1346; eff. 1-5-2018; TAm eff. 3-20-2020; 49 Ky.R. 1357, 2111; eff. 6/21/2023.

STATUTORY AUTHORITY: KRS 194A.050, 218A.202(1), (18), 218A.250