42 U.S.C. § 280g–3 — Prescription drug monitoring program

(a) Program: (1) Each fiscal year, the Secretary^*, through the Director^* of the CDC and coordinating with other agency heads as appropriate, must support States or localities to improve the efficiency and use of PDMPs, including (A) establishing and implementing a PDMP; (B) maintaining a PDMP; and (C) improving a PDMP by (i) enhancing its functions toward universal use by providers and their delegates (to the extent State law allows), more timely data inclusion, active management including proactive reports to providers, and the highest ease of use and access (to the extent State law allows); (ii) with the Office of the National Coordinator for Health Information Technology, improving in-state interoperability by folding PDMPs into electronic health records and health IT infrastructure, and linking PDMP data to other in-state systems, including pharmacy benefit managers, medical examiners and coroners, the State Medicaid program, workers' compensation data, and VA and Indian Health Service^* prescribing data; (iii) with that same office, improving cross-state interoperability through near-real-time sharing of dispensing data across State lines and integrating automated multistate queries into clinical workflow; or (iv) improving the PDMP's ability to include treatment^* availability resources and referrals. (2) As a condition of support, the Secretary must require a State or locality to show it has enacted legislation or regulations (A) implementing the PDMP, and (B) allowing appropriate penalties for unauthorized use and disclosure of PDMP information.

(b) PDMP strategies: The Secretary must encourage a State or locality to implement strategies that improve (1) reporting a dispensing event to an ultimate user within 24 hours; (2) having each prescribing practitioner or their designee consult the PDMP before starting and during controlled-substance treatment; (3) having dispensers consult the PDMP before dispensing; (4) proactively notifying a practitioner when a patient's pattern suggests controlled-substance misuse, including opioid misuse; (5) making PDMP data available to other States, as State law allows; and (6) making nonidentifiable information available to the CDC for surveillance, epidemiology, statistical research, or education.

(c) Drug^* misuse and abuse: Consulting practitioners, dispensers, and other stakeholders, a State receiving support (1) must set up a program to notify practitioners and dispensers of information that helps identify and prevent unlawful diversion or misuse of controlled substances; (2) may, to the extent State law allows, notify drug-diversion investigation authorities if PDMP data indicates unlawful diversion or abuse; (3) may analyze controlled substance program data to give appropriate State agencies aggregate, near-real-time reports on prescribing patterns that may risk misuse, abuse, addiction, or overdose, complying with federal and State law and never including protected health information; and (4) may access prescription information, such as claims data, to keep prescribing and dispensing history close to real time, again complying with federal and State law and never including protected health information.

(d) Evaluation and reporting: As a condition of support, a State must report on its PDMP's interoperability with other States' and federal PDMPs, its in-state interoperability with health IT systems like electronic health records, health information exchanges, and e-prescribing, and whether it gives a practitioner (or permitted designee) automatic, up-to-date, or daily patient information on request.

(e) Evaluation and reporting: A State receiving support must give the Secretary aggregate, nonidentifiable information, as State law permits, so the Secretary can (1) evaluate how well the State's program is achieving subsection (a)'s purpose, or (2) prepare the report to Congress required by subsection (i)(2).

(f) Education and access to the monitoring system: A State receiving support must (1) help prescribers, dispensers, and their delegates use the PDMP, as State law permits and as practicable; and (2) educate them on the PDMP's benefits.

(g) Electronic format: The Secretary may issue guidelines for a uniform electronic format for reporting, sharing, and disclosing PDMP information, consistent where possible with standards from the Office of the National Coordinator for Health Information Technology.

(h) Rules of construction: (1) Nothing in this section restricts any local, State, or federal law enforcement, narcotics control, licensure, disciplinary, or program authority from performing functions otherwise authorized by law. (2) Nothing preempts a State from imposing additional privacy protections. (3) Nothing supersedes federal privacy or confidentiality requirements, including HIPAA regulations and section 290dd-2 of this title. (4) Nothing creates a federal private cause of action. (5) Nothing authorizes the Secretary to require States to use a specific vendor or interoperability connection, other than to align with nationally recognized, consensus-based open standards under sections 300jj-11 and 300jj-14 of this title.

(i) Progress report: By 3 years after October 24, 2018, the Secretary must (1) complete a study that (A) determines grantees' progress establishing and implementing PDMPs consistent with this section; (B) analyzes how much PDMP operation has (i) reduced inappropriate use, abuse, diversion, and overdose of controlled substances, (ii) established or strengthened links to substance use disorder treatment, or (iii) affected patient access to care in PDMP States; (C) determines grantees' progress toward interstate and intrastate interoperability, including technical, legal, and financial barriers and recommendations for addressing them; (D) determines grantees' progress implementing near-real-time electronic PDMPs; (E) analyzes the privacy protections for information reported to the PDMP in each funded State or locality, with any recommendations for additional federal or State protections; (F) determines States' or localities' progress implementing alternatives to centralized data storage, such as peer-to-peer file sharing or data pointer systems, and their potential to boost privacy and security; and (G) evaluates the penalties States or localities have enacted for unauthorized use and disclosure of PDMP information, and the criteria the Secretary uses to judge whether those penalties are "appropriate" under subsection (a)(2); and (2) submit a report to Congress on the study's results.

(j) Advisory Council: (1) A State or locality may establish an advisory council to help establish, improve, or maintain a PDMP under this section. (2) A State or locality may not use federal funds for that council's operations. (3) Congress believes such a council should consult appropriate professional boards and other interested parties.

(k) Definitions: "Controlled substance" means a controlled substance, as defined in title 21, section 802, in schedule II, III, or IV of section 812 of that title. "Dispense" means delivering a controlled substance to an ultimate user by, or under, a practitioner's lawful order, whether or not delivered over the Internet. "Dispenser" means a physician, pharmacist, or other person who dispenses a controlled substance to an ultimate user. "Interstate interoperability" means a PDMP's ability to electronically share reported information with another State, where the dispensing involves an ultimate user or a prescriber based in that other State. "Intrastate interoperability" means integrating PDMP data within electronic health records and health IT infrastructure, or linking a PDMP to other in-state data systems, including the State's Medicaid program, workers' compensation programs, and medical examiners or coroners. "Nonidentifiable information" means information that doesn't identify a practitioner, dispenser, or ultimate user, and that has no reasonable basis for being used to identify one. "PDMP" means a State-controlled prescription drug monitoring program. "Practitioner" means a physician, dentist, veterinarian, scientific investigator, pharmacy, hospital, or other person licensed, registered, or otherwise permitted by the United States or a jurisdiction to distribute, dispense, research, administer, or teach with a controlled substance in professional practice or research. "State" means each of the 50 States, the District of Columbia, and any commonwealth or territory of the United States. "Ultimate user" means a person who has obtained and possesses a controlled substance from a dispenser for their own use, a household member's use, or the use of an animal they or a household member owns. "Clinical workflow" means integrating automated PDMP queries and analytics into health information technologies such as electronic health records, health information exchanges, or pharmacy dispensing software, to streamline provider access.