42 U.S.C. § 280g–3 — Prescription drug monitoring program

(a) Program: (1) In general — each fiscal year, the Secretary, through the CDC Director and coordinating with other agencies as appropriate, must support states or localities to improve how efficiently PDMPs are used, including (A) establishing and implementing a PDMP; (B) maintaining a PDMP; and (C) improving a PDMP by (i) enhancing features to work toward universal use by providers and their delegates (as state law allows), faster inclusion of data, active management including sending unsolicited reports to providers, and the easiest possible use of and access to the PDMP; (ii) working with the Office of the National Coordinator for Health IT to improve intrastate interoperability, by folding PDMPs into electronic health records and health IT infrastructure and linking PDMP data to other state systems, such as pharmacy benefit managers, medical examiners and coroners, the state's Medicaid program, workers' compensation data, and VA and Indian Health Service prescribing data in the state; (iii) working with that same office to improve interstate interoperability, through sharing dispensing data near-real-time across state lines and integrating automated multistate queries into clinical workflow; or (iv) improving the ability to include treatment availability resources and referral capabilities within the PDMP. (2) Legislation — to get support, a state or locality must show it has enacted legislation or regulations (A) providing for the PDMP's implementation, and (B) allowing appropriate penalties for unauthorized use and disclosure of PDMP information. (b) PDMP strategies: The Secretary must encourage a state or locality to implement strategies that improve (1) reporting of a controlled substance dispensing event within 24 hours; (2) each prescribing practitioner's (or their designee's) consultation of the PDMP before starting treatment with a controlled substance, or any substance the state requires be reported, and throughout ongoing treatment; (3) consultation of the PDMP before dispensing such a substance; (4) proactive notification to a practitioner when patterns of possible controlled substance misuse, including opioid misuse, are detected; (5) availability of PDMP data to other states, as state law allows; and (6) availability of nonidentifiable information to the CDC for surveillance, epidemiology, statistical research, or educational purposes. (c) Drug misuse and abuse: Consulting practitioners, dispensers, and other stakeholders, a state receiving support (1) must set up a program to notify practitioners and dispensers of information that helps identify and prevent illegal diversion or misuse of controlled substances; (2) may, to the extent state law permits, notify authorities responsible for drug diversion investigations if PDMP data indicates illegal diversion or abuse; (3) may analyze controlled substance program data to give state agencies aggregate reports, in as close to real time as practicable, on prescribing patterns flagged as risky, consistent with federal and state law and excluding protected health information; and (4) may access prescription information, such as claims data, to keep prescribing and dispensing history as current as practicable, consistent with federal and state law and excluding protected health information. (d) Evaluation and reporting: As a condition of support, a state must report on interoperability with other states' and federal agencies' PDMPs where appropriate, intrastate interoperability with health IT systems like electronic health records, health information exchanges, and e-prescribing where appropriate, and whether the state gives automatic, up-to-date, or daily patient information when a practitioner (or permitted designee) requests it. (e) Evaluation and reporting: A state receiving support must give the Secretary aggregate nonidentifiable information, as state law permits, so the Secretary can (1) evaluate how well the state's program is achieving the purpose in subsection (a), or (2) prepare the report to Congress required by subsection (i)(2). (f) Education and access to the monitoring system: A state receiving support must (1) help prescribers, dispensers, and their delegates, as state law permits, use the PDMP, to the extent practicable; and (2) educate prescribers and dispensers on the benefits of using PDMPs. (g) Electronic format: The Secretary may issue guidelines for a uniform electronic format for reporting, sharing, and disclosing PDMP information, consistent as possible with standards recognized by the Office of the National Coordinator for Health IT. (h) Rules of construction: (1) Functions otherwise authorized by law — nothing here restricts any local, state, or federal law enforcement, narcotics control, licensure, disciplinary, or program authority from performing functions otherwise authorized by law. (2) Additional privacy protections — nothing here stops a state from adding privacy protections. (3) Federal privacy requirements — nothing here supersedes federal privacy or confidentiality rules, including HIPAA regulations and section 290dd–2 of this title. (4) No Federal private cause of action — nothing here creates a federal private right to sue. (5) Promoting State choice — nothing here lets the Secretary require states to use a specific vendor or interoperability connection, other than aligning with nationally recognized, consensus-based open standards under sections 300jj–11 and 300jj–14. (i) Progress report: Within 3 years of October 24, 2018, the Secretary must (1) complete a study that (A) determines grantees' progress establishing and implementing PDMPs under this section; (B) analyzes how much PDMPs have (i) reduced inappropriate use, abuse, diversion, and overdose involving controlled substances, (ii) built or strengthened links to substance use disorder treatment, or (iii) affected patient access to care in PDMP states; (C) determines grantees' progress on interstate and intrastate interoperability, including technical, legal, and financial barriers and recommendations to address them; (D) determines grantees' progress implementing near-real-time electronic PDMPs; (E) analyzes privacy protections for information reported to each state's or locality's PDMP and recommends any additional federal or state requirements; (F) determines states' or localities' progress adopting alternatives to centralized data storage, such as peer-to-peer sharing or data pointer systems, and the potential of such alternatives to boost privacy and security; and (G) evaluates the penalties states or localities have enacted for unauthorized PDMP use or disclosure and the criteria the Secretary used to judge whether they qualify as "appropriate" under subsection (a)(2); and (2) submit a report to Congress on the study's results. (j) Advisory Council: (1) Establishment — a state or locality may establish an advisory council to help establish, improve, or maintain a PDMP. (2) Limitation — a state or locality may not use federal funds for that council's operations. (3) Sense of Congress — Congress believes a state or locality setting up such a council should consult appropriate professional boards and other interested parties. (k) Definitions: (1) "Controlled substance" means a substance in schedule II, III, or IV of section 812 of title 21, as defined in section 802 of title 21. (2) "Dispense" means delivering a controlled substance to an ultimate user under a practitioner's lawful order, regardless of whether the Internet or other means is used. (3) "Dispenser" means a physician, pharmacist, or other person who dispenses a controlled substance to an ultimate user. (4) "Interstate interoperability" means a PDMP's ability to electronically share reported information with another state when the dispensing involves an ultimate user or a prescriber based in that other state. (5) "Intrastate interoperability" means integrating PDMP data within electronic health records and health IT infrastructure, or linking a PDMP to other state systems, including the state's Medicaid program, workers' compensation programs, and medical examiners or coroners. (6) "Nonidentifiable information" means information that does not identify, and gives no reasonable basis to identify, a practitioner, dispenser, or ultimate user. (7) "PDMP" means a state-controlled prescription drug monitoring program. (8) "Practitioner" means a physician, dentist, veterinarian, scientific investigator, pharmacy, hospital, or other person licensed, registered, or otherwise permitted to distribute, dispense, research, administer, or teach about a controlled substance in professional practice or research. (9) "State" means each of the 50 states, the District of Columbia, and any commonwealth or territory of the United States. (10) "Ultimate user" means a person who obtained from a dispenser, and possesses, a controlled substance for their own use, a household member's use, or the use of an animal owned by them or a household member. (11) "Clinical workflow" means integrating automated PDMP data queries and analytics into health IT such as electronic health record systems, health information exchanges, or pharmacy dispensing software, to streamline provider access through automated queries.