KGA/KACS NOTE: This posting is intended to provide comprehensive information regarding retailer reposibilites to be in compliance with the Combat Meth Act. The compliance date is September 30th. While this memorandum is lengthy, it provides detailed information regarding the act. If you have questions regarding this memorandum, please feel free to contact Ted Mason at 502-459-7111 or firstname.lastname@example.org
M E M O R A N D U M
FROM: Deborah White,
Vice President &
Associate General Counsel
DATE: September 20, 2006
RE: DEA Combat Methamphetamine Epidemic Act Interim Final Rule for Retail Sales of PSE and Related Over-the-Counter Medications
The purpose of this memorandum is to summarize the requirements of the interim final rule published late yesterday by the Drug Enforcement Administration (DEA) to implement the Combat Methamphetamine Epidemic Act (CMEA). The non-Federal Register text and accompanying informational materials may be found at the following website: www.deadiversion.usdoj.gov/meth. This page also has links to the retailer training materials and the self-certification portal, both of which are discussed below.
Overall, and although there was minimal opportunity for input, we were successful in persuading the agency of the merits of certain regulatory interpretations. For example, the agency clearly states that the 9 gram per 30 day limitation applies to consumers, and not to retailers. This means that retailers are not responsible for ensuring that consumers do not exceed the 9 gram per 30 day limitation -- an interpretation of the statute that FMI has advocated since its passage. Similarly, DEA notes that retailers will not be required to track multiple sales at individual stores or across multiple retail outlets, which would have been an onerous task of DEA had interpreted the statute to place this requirement on retailers. Moreover, DEA will only require certifications to be submitted on an annual basis and the agency will accept bulk certifications for groups of stores, both practical implementation steps that FMI urged.
On the other hand, a retailer who wants to certify more than 10 stores will need to submit the certification by mail, which seems to stand in clear contravention of the CMEA (see below). Perhaps even more disturbing is the warning contained in the preamble that DEA intends to propose to require retailers to pay for the privilege of certifying compliance with the training components of the statute. In this regard, DEA expects to propose a $32 per store fee in a separate rulemaking. In addition, DEA (perhaps not surprisingly) failed to issue any guidance with respect to the interplay between the Health Insurance Portability and Accountability Act (HIPAA) and the information given by consumers in the CMEA lobook. Moreover, DEA’s interpretation of the interplay between the federal and various state laws (discussed below) will be difficult to implement.
As discussed more fully below, despite the fact that this is an interim final rule, we will continue to work with the agency to advocate further refinements to the rule. Of course, all feedback from the membership in this regard is welcome and greatly appreciated.
DEA issued the rule as an interim final rule with most parts becoming effective upon publication in the Federal Register (which is expected to occur within the next day or two) and almost all others effective on September 30, 2006, as required by the statute. The requirement that written logbooks be maintained in a bound format will not become effective for 60 days from date of Federal Register publication.
Based in part on meetings and conversations that FMI and others in the industry have had with DEA and the Administration, the press release that accompanies the regulations indicates that “DEA is aware of the short period of time available for retailers to come into compliance with the regulations and will work with industry to provide compliance assistance to ensure that retailers are able to sell covered medications in accordance with the requirements of the law.” Toward this end, DEA has provided assistance resources, but the Agency has offered no assurance that enforcement will not begin on September 30, 2006. Nonetheless, FMI will continue to work with DEA to attempt to ensure a smooth transition.
The products covered by the regulation are ‘scheduled listed chemical products,’ which are any nonprescription products that contain ephedrine, pseudoephedrine, or phenylpropanolamine and are marketed lawfully under the Federal Food, Drug & Cosmetic Act.
For the most part, DEA is specific and accurate in distinguishing between the 3.6 gram per day sales limitation that applies to retailers and the 9 gram per month purchase limitation that applies to customers. In fact, the retail sales regulations do not even mention the purchase limitation. The regulations do, however, require each regulated seller to ‘ensure’ that sales are not made in excess of the limitation. 21 CFR 1314.25(a). In comments, we will remind DEA to note that the CMEA does not require retailers to check the logbook to determine whether the sales limitation is exceeded in any one day.
In a helpful aside, DEA does note in the preamble that the Agency is not mandating that regulated sellers, other than mail order and mobile retail vendors, track multiple sales to individuals on a single day within the same retail outlet or across outlets of the same company. Preamble at 29. An alternative interpretation would have been extremely onerous on retailers.
Consistent with the statute, the regulations require covered products to be held so that customers do not have direct access to the products before the sale is made. Product may be placed behind any counter or in a locked cabinet that is located in an area of the facility to which consumers do have direct access. 21 CFR 1314.25. In the preamble, DEA notes that the agency has not provided specific cabinet specifications, but advises that the cabinet should be ‘substantial enough that it cannot be easily picked up and removed.’ Preamble at 13. DEA recommends that the cabinet should be similar to those used to store items, such as cigarettes, that can be accessed only by sales staff. Preamble at 13.
Consistent with the statute, the regulations provide a long list of acceptable photo identification forms. 21 CFR 1314.30(b)(1). The list is enumerated on pages 14 and 15 of the preamble.
Consistent with the statute, the regulations require retailers to keep logbooks of sales of scheduled listed chemicals and permits logbooks to be maintained in either written or electronic format. DEA has not, however, issued a sample or recommended format; accordingly, retailers may use any format that meets the statutory requirements. Accordingly, for your immediate purposes, FMI has posted a sample logbook page on our website www.fmi.org.
If the retailer opts for written format, the logbook must be created and maintained in a bound record book, however, in the one extended implementation date, DEA grants retailers 60 days from date of Federal Register publication to create and maintain the bound logbook.
The logbook must contain the following: name and address of purchaser; product and quantity sold; date and time of purchase; purchaser’s signature; and a declaration written by DEA regarding the penalties associated with giving false information to the government. The “quantity sold” can be indicated in several ways, including by weight of product and number of packages, rather than total weight of the active ingredients. We recommended this approach to avoid a situation in which sales clerks are required to calculate the total grams of active ingredient in multiple packages.
Logbook entries must be maintained for two years after the date on which the entry was made. 21 CFR 1314.30(f). Records must be maintained at the place of business at which the transaction occurred, unless the regulated seller notifies the agency (following procedures specified in the regulation) that the records will be kept in a single central location. 21 CFR 1314.30(h). Nonetheless, the records must be “readily retrievable and available for inspection and copying by authorized employees” of DEA. 21 CFR 1314.30(i).
18 USC 1001 Declaration:
As required by CMEA, the regulations set forth the 18 USC 1001 declaration that the statute requires all logbooks to include. 21 CFR 1314.30(f). The required declaration is as follows:
WARNING: Section 1001 of Title 18, United States Code, states that whoever, with respect to the logbook, knowingly and willfully falsifies, conceals, or covers up by any trick, scheme, or device a material fact, or makes any materially false, fictitious, or fraudulent statement or representation, or makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry, shall be fined not more than $250,000 if an individual or $500,000 if an organization, imprisoned not more than five years, or both.
DEA notes in the preamble that the inclusion of this information in either bound or electronic logbooks may present implementation challenges and authorizes the seller to “prominently display the notice where the purchaser will see it when entering or providing the information” covered by the declaration as an alternative to including the declaration in the logbook itself. Preamble at 16.
Reporting and Privacy:
DEA interprets the pre-existing regulations to require retailers to report ‘any unusual or excessive loss or disappearance of a scheduled listed chemical product under the control of the regulated person.’ 21 CFR 1314.15(a). As required by CMEA, DEA includes a provision for protecting the privacy of individuals, which restricts disclosure of information to DEA and state and local law enforcement officials; interestingly, the regulatory provision authorizing logbook disclosures specifically cites the loss reporting requirements of Section 1314.15. 21 CFR 1314.45.
The privacy rules prohibit disclosure of logbook information, except to ensure compliance or to facilitate a recall to protect public health and safety. Lastly, the regulations include a good faith exemption for a retailer who inadvertently discloses logbook information to federal, state or local law enforcement authorities and provides that the regulated seller is immune from civil liability unless the release constitutes gross negligence or intentional, wanton or willful misconduct. 21 CFR 1314.45(c). We will watch for DEA’s interpretation and application of this provision in practice.
Despite repeated requests, however, the Agency’s rule does not address the interplay between the Health Insurance Portability and Accountability Act (HIPAA) and the CMEA logbook requirements.
As set forth in the statute, the regulations require both customers and retailers to perform certain actions at the time of the sales transaction. The customer must present the photo ID described above, sign the logbook, and enter the customer’s name and address, and date and time of sale. 21 CFR 1314.30(b). However, “if it is not feasible for the purchaser to enter the information electronically,” the seller can ask the purchaser for the seller’s name/address information and enter it on the purchaser’s behalf. 21 CFR 1314.30(c). Regardless of how the information is entered, DEA is clear that the customer must sign the logbook. Preamble at 14.
The seller is required to verify that the name entered in the logbook “corresponds” to the name on the photo ID and that the date/time of the transaction are correct. The seller is also required to enter the name of the product and quantity sold, which information may be captured by point-of-sale and bar code readers for electronic logbooks. Preamble at 13.
CMEA and the accompanying regulations require that the regulated seller train the following two classes of employees on the requirements of the CMEA using criteria issued by DEA: (1) persons who hand product to consumers and (2) persons who accept payment from consumers for the product. 21 CFR 1314.35. The regulated seller is required to maintain all records demonstrating that the necessary employees have undergone the training. 21 CFR 1314.35(b). In the preamble, the agency recommends that each covered employee sign an acknowledgment of training and that the regulated seller maintain the record in the employee’s personnel file. Preamble at 19.
As many of you are aware, DEA issued the substance of a training program, which is available on the DEA website noted above. DEA’s training must be used in order for the regulated seller’s training to meet the regulatory requirements, although retailers may include additional information, such as the material included in the FMI training program. Preamble at 18. Interestingly, DEA states in the preamble that the agency will separately issue further training criteria. Preamble at 10. Although unclear what these might be, frequency of training might be one element.
In order to sell scheduled listed chemical products, retailers must submit to DEA a certification for each retail location that all employees covered by the statute (see above) have been trained in accordance with the CMEA and that the retailer understands and agrees to comply with all of the requirements of the regulations. 21 CFR 1314.40(a), (c). Following the initial self-certification, DEA will advise each applicant that their next renewal is due between 12 and 23 months from the initial self-certification. After that, certifications will be made annually. 21 CFR 1314.40(b).
As noted above, the certification program that DEA has implemented allows a single certification to cover multiple stores, however, if more than 10 stores are certified in a given batch, retailers will be required to submit the certification by mail. See preamble at 19. Arguably, this approach is in contravention of the CMEA, which requires that the self-certification “program shall be carried out through an internet site.” See 21 USC 830(e)(1)(B)(iii)(I). The preamble does not address whether self-certifications may be aggregated by a third party, such as a state association, and submitted on behalf of the group as a whole.
One issue on which DEA requests comment is the type of employee who should be authorized to sign the self-certification. Preamble at 19-20. DEA notes that the person should be in a position to know that all employees who require training have been trained and that the store is in compliance with all other measures.
Perhaps the most disturbing issue related to certification, however, is the proposal that DEA plans to issue that will require retailers to pay DEA to certify their stores to sell covered products. Preamble at 20-25. DEA calculated the fee based on the total costs involved in setting up, administering and enforcing the program. Based on the assumption that 89,000 stores will certify, DEA asserts that the per store fee will be $32. FMI will carefully examine the legal rationale DEA asserts in support of the fee and will file comments and invoke other measures as necessary.
The rules reprint the CMEA provision that allows employers to “guard against individuals who present a risk” with respect to theft of the covered products by allowing employers to ask prospective employees whether they have ever been convicted of a crime related to covered products or controlled substances, regardless of whether State law might prohibit such methods or inquiries. 21 CFR 1314.50. Clearly, then, in at least one respect, the federal law preempts state laws.
General Interaction with State Laws:
Section 1314.10 states that nothing in the DEA regulation preempts state law on the same subject matter unless there is a positive conflict between the DEA rules and a State law so that the two cannot consistently stand together. 21 CFR 1314.10. The preamble explains that DEA will take, essentially, an ‘element by element’ approach to the preemption question. That is, each type of state requirement (e.g., logbook, training, etc) must be compared against the analogous federal requirement and the more stringent of the two must be applied.
If you are aware of anomalous situations created by this approach, please advise. Although we expect that a holistic approach, under which a retailer could apply either the state law or the federal law in its entirety, might be preferable to retailers, we also expect that it will be difficult to convince DEA to change its position in this respect absent some significant examples of hardship from the industry. Nonetheless, DEA has indicated a willingness to accept comment on this issue, particularly relative to the interaction between state and federal logbook requirements. Preamble at 25-26. Accordingly, we welcome any feedback you can provide in this area.
If DEA determines that a regulated seller is selling covered products in violation of the CMEA, DEA will issue an order to the regulated seller to “show cause” why the regulated seller should not be prohibited from selling covered products. 21 CFR 1314.150. DEA has the right to suspend the regulated seller’s ability to sell the products if the agency “finds that there is an imminent danger to public health or safety.” 21 CFR 1314.155. The regulations allow the regulated seller to request a hearing and require DEA to provide the legal basis for the hearing and a summary of the matters of fact and law asserted. Id.
CMEA, itself, however, provides fairly high standards of judgment. For example, it is a violation of the Act to exceed the 3.6 gram per day sales limitation if the retailer does so “knowing at the time of the transaction involved (independent of consulting the logbook …) that the transaction is a violation.” 21 USC 842(a)(12)(A). Similarly, it is a violation “to knowingly or recklessly sell” covered products in a non-liquid/non-unit dose format or without complying with the logbook and certification requirements. 21 USC 842(a)(12)(B), 842(a)(13). Congress could have used a lower standard (such as “negligently”) or none at all, in which case, any sale in contravention of the CMEA would have been a violation of the Act.
Throughout the CMEA, Congress instructs DEA to issue regulations governing various aspects of the retail sale of covered product. In most cases, a separate statute, the Administrative Procedure Act (APA), requires agencies to issue regulations through notice and comment rulemaking. 5 USC 553. The APA does provide an exception that allows an agency to issue a final rule without first providing the opportunity for public comment when the agency “for good cause finds (and incorporates the finding and a brief statement of reasons therefore in the rules issued) that notice and public procedure thereto are impracticable, unnecessary, or contrary to the public interest.” 5 USC 553(b)(B). As DEA notes, the courts have required that this exception be “‘narrowly construed and only reluctantly countenanced.’” Preamble at 33, citing Am. Fed’n of Gov’t Employees v. Block, 655 F2d 1153, 1156 (D.C.Cir. 1981).
Nonetheless, DEA invokes the “good cause” exception here because of a “combination of several extraordinary factors,” which really comes down to the fact that DEA used up all of the statutorily provided implementation time in issuing the interim final rule. Indeed, DEA states, “[b]ased on the effective date of this law, it is impracticable for DEA to comply with the APA’s notice and comment requirements due to the limited time involved.” Preamble at 33. DEA also asserts that the good cause exception should apply because the statute was essentially self-implementing and regulations were, therefore, unnecessary. See Preamble at 4.
Obviously, Congress did not believe that the time was too short or that regulations were unnecessary or Congress would not have required DEA to issue them. Resolution could be obtained by filing an APA challenge against the rules, but such challenges are difficult to win and are likely only to require the agency to conduct rulemaking again, even though the statute would continue in effect.
FMI will, nonetheless, file comments with the Agency on the overall interim final rule on the issues noted above, as well as the cost-benefit analysis that DEA uses to support the rule. If you have any feedback, please do not hesitate to contact me at email@example.com or 202 220 0614.
Although the statute applies to mail order, mobile retail vendors, and transactions conducted through various other media, this memorandum summarizes only the requirements that apply to the retail sales of scheduled listed chemical products to individuals for personal use by retail distributors such as grocery stores, general merchandise stores, drug stores, or other entities or persons whose activities as distributors relating to drug products containing pseudoephedrine, ephedrine or phenylpropanolamine are limited almost exclusively to sales for personal use, both in number of sales and volume of sales, either directly to walk-in customers or in face-to-face transactions by direct sales.
It is not entirely clear how the 60 day implementation framework will operate in practice. We will also seek more information on the bound volumes, themselves.
Neither the regulation nor the preamble squarely addresses the issue of when it is “not feasible” for the purchaser to enter the information directly. Nonetheless, the preamble mentions in this context situations such as when a computer terminal is located behind the pharmacy counter or when a consumer finds it difficult or impossible to enter the information themselves. In these cases, DEA states that the seller should “ask the customer for the information and enter it, rather than simply copying it off the photo ID.” Preamble at 14. DEA also requests comments on whether systems that are currently used to capture signatures for credit or debit card purchases can be reprogrammed to allow customers to enter name and address, as well as signature. Preamble at 14.