21 U.S.C. § 832 — Suspicious orders

design and operate a system to identify suspicious orders for the registrant;

ensure that the system designed and operated under paragraph (1) by the registrant complies with applicable Federal and State^* privacy laws; and

upon discovering a suspicious order or series of orders, notify the Administrator of the Drug Enforcement Administration^* and the Special Agent^* in Charge of the Division Office of the Drug^* Enforcement Administration for the area in which the registrant is located or conducts business.

Not later than 1 year after October 24, 2018, the Attorney General shall establish a centralized database for collecting reports of suspicious orders.

If a registrant reports a suspicious order to the centralized database established under paragraph (1), the registrant shall be considered to have complied with the requirement under subsection (a)(3) to notify the Administrator of the Drug Enforcement Administration and the Special Agent in Charge of the Division Office of the Drug Enforcement Administration for the area in which the registrant is located or conducts business.

The Attorney General shall prepare and make available information regarding suspicious orders in a State, including information in the database established under subsection (b)(1), to the point of contact for purposes of administrative, civil, and criminal oversight relating to the diversion of controlled substances for the State, as designated by the Governor or chief executive officer of the State.

The Attorney General shall provide information in accordance with paragraph (1) within a reasonable period of time after obtaining the information.

In establishing the process for the provision of information under this subsection, the Attorney General shall coordinate with States to ensure that the Attorney General has access to information, as permitted under State law, possessed by the States relating to prescriptions for controlled substances that will assist in enforcing Federal law.