ARTICLE 1. ADMINISTRATION
R4-23-110. Definitions
In addition to definitions in A.R.S. § 32-1901, the following definitions apply to 4 A.A.C. 23:
"CSPMP" means the Controlled Substances Prescription Monitoring Program established
under A.R.S. Title 36, Chapter 28.
“Security paper features” means the attributes incorporated into the paper of a prescription
order, referenced in A.R.S. § 32-1968(A)(4), that is are approved by the Board or its staff
and that includes one or more of the following features that attempt to prevent duplication
or aid the authentication of a paper document: laid lines, enhanced laid lines,
thermochromic ink, artificial watermark, fluorescent ink, chemical void, persistent void,
penetrating numbers, high-resolution border, high-resolution latent images, micro-printing,
prismatic printing, embossed images, abrasion ink, holograms, and foil stamping.
ARTICLE 5. RECODOFIED CONTROLLED SUBSTANCES PRESCRIPTION
MONITORING PROGRAM
R4-23-501.
Recodified Controlled Substances Prescription Monitoring Program
Registration
A. Under A.R.S. § 36-2606, a medical practitioner who is issued a license under A.R.S. Title
32, Chapter 7, 11, 13, 14, 15, 16, 17, 21, 25, or 29 and possesses a current DEA registration
under the Federal Controlled Substances Act shall have a current CSPMP registration
issued by the Board.
B. Application. To obtain a CSPMP registration, a person shall submit a completed
application on a form furnished by the Board that includes:
1. Applicant’s name, address, mailing address, if different, email address, telephone
number, facsimile number, license number issued under A.R.S. Title 32, Chapter 7,
11, 13, 14, 15, 16, 17, 21, 25, or 29, and DEA registration number;
2. Whether the applicant's license and DEA registration listed in subsection (B)(1) are
current and in good standing, and if not, the status of the license and registration; and
3. Date signed and applicant’s verified signature.
C. Registration. Within seven business days of receipt of a completed application specified in
subsection (B), the Board office shall determine whether an application is complete. If the
application is complete, the Board office shall issue a registration number and mail a
current renewal receipt to the applicant. If the application is incomplete, the Board office
shall issue a notice of incompleteness. An applicant with an incomplete application shall
comply with the requirements of R4-23-202(F)(2) and (3).
D. Registration renewal. As specified in A.R.S. § 36-2606(C), the Board shall automatically
suspend the registration of any registrant that fails to renew the registration on or before
May 1 of the year in which the renewal is due. The Board shall vacate a suspension if the
registrant submits a renewal application. A suspended registrant is prohibited from
accessing information in the prescription monitoring program database.
E. Pharmacy registration and renewal. Each pharmacy with a current Board-issued pharmacy
permit and a current DEA registration is automatically registered in the CSPMP. Existing
pharmacy permittees who possess a current DEA registration will receive a registration
receipt before the implementation date of the CSPMP. For pharmacy permits issued on or
1
F.
after the CSPMP implementation date, the Board will issue a registration receipt when
issuing the pharmacy's permit. Each pharmacy shall renew the CSPMP registration on or
before May 1 of the year in which the renewal is due. The Board shall automatically
suspend the registration of any registrant that fails to renew the registration on or before the
date on which the renewal is due. The Board shall vacate a suspension if the registrant
submits a renewal application. A suspended registrant is prohibited from accessing
information in the prescription monitoring program database.
CSPMP database access. A medical practitioner or pharmacy that chooses to use the
CSPMP database shall request a user name and password in writing from the CSPMP
Director. Upon receipt of the request, the CSPMP Director or designee shall issue a user
name and password provided the medical practitioner or pharmacy is in compliance with
the registration requirements of this Section.
R4-23-502.
Recodified Requirements for Data Format and Transmission
A. Each dispenser shall submit to the Board or its designee by electronic means information
regarding each prescription dispensed for a controlled substance listed in Schedules II, III,
and IV of A.R.S. Title 36, Chapter 27, the Arizona Uniform Controlled Substances Act.
The information reported shall conform to the August 31, 2005 Version 003, Release 000
ASAP Rules-based Standard Implementation Guide for Prescription Monitoring Programs
published by the American Society for Automation in Pharmacy as specified in A.R.S. §
36-2608(B). The information submitted for each prescription shall include:
1. The name, address, telephone number, prescription number, and DEA registration
number of the dispenser;
2. The name, address, gender, date of birth, and telephone number of the person or, if
for an animal, the owner of the animal for whom the prescription is written;
3. The name, address, telephone number, and DEA registration number of the
prescribing medical practitioner;
4. The quantity and National Drug Code (NDC) number of the Schedule II, III, or IV
controlled substance dispensed;
5. The date the prescription was dispensed;
6. The number of refills, if any, authorized by the medical practitioner;
7. The date the prescription was issued;
8. The method of payment identified as cash or third party; and
9. Whether the prescription is new or a refill.
B. A dispenser shall submit the required information electronically unless the Board approves
a waiver as specified in subsection (D).
C. A dispenser's electronic data transfer equipment including hardware, software, and internet
connections shall meet the privacy and security standards of the Health Insurance
Portability and Accountability Act (HIPAA) of 1996 and A.R.S. § 12-2292, in addition to
common internet industry standards for privacy and security. A dispenser shall ensure that
each electronic transmission meets the following data protection requirements:
1. Data shall be at least 128bit encryption in transmission and at rest; and
2. Data shall be transmitted via secure email, telephone modem, diskette, CD-ROM,
tape, secure File Transfer Protocol (FTP), Virtual Private Network (VPN), or other
Board-approved media.
2
D.
E.
A dispenser who does not have an automated record keeping system capable of producing
an electronic report in the Board established format may request a waiver from electronic
reporting by submitting a written request to the Board. The Board shall grant the request if
the dispenser agrees in writing to report the data by submitting a completed universal claim
form supplied by the Board or its designee.
Unless otherwise approved by the Board, a dispenser shall report by the close of business
on each Friday the required information for the previous week, Sunday through Saturday. If
a Friday falls on a state holiday, the dispenser shall report the information on the following
business day. The Board may approve a less frequent reporting period if a dispenser makes
a showing that a less frequent reporting period will not reduce the effectiveness of the
system or jeopardize the public health.
R4-23-503.
A.
B.
C.
Repealed Access to Controlled Substances Prescription Monitoring
Program Data
Except as provided in A.R.S. § 36-2604(B) and (C) and this Section, prescription
information submitted to the Board or its designee is confidential and is not subject to
public inspection.
The Board or its designee shall review the prescription information collected under A.R.S.
Title 36, Chapter 28 and R4-23-502. If the Board or its designee has reason to believe an
act of unprofessional or illegal conduct has occurred, the Board or its designee shall notify
the appropriate professional licensing board or law enforcement or criminal justice agency
and provide the prescription information required for an investigation.
The Board or its designee is authorized to release data collected by the program to the
following:
1. A person who is authorized to prescribe or dispense a controlled substance to assist
that person to provide medical or pharmaceutical care to a patient or to evaluate a
patient;
2. An individual who requests the individual's own controlled substance prescription
information under A.R.S. § 12-2293;
3. A professional licensing board established under A.R.S. Title 32, Chapter 7, 11, 13,
14, 15, 16, 17, 18, 21, 25, or 26. Except as required under subsection (B), the Board
or its designee shall provide this information only if the requesting board states in
writing that the information is necessary for an open investigation or complaint;
4. A local, state, or federal law enforcement or criminal justice agency. Except as
required under subsection (B), the Board or its designee shall provide this information
only if the requesting agency states in writing that the information is necessary for an
open investigation or complaint;
5. The Arizona Health Care Cost Containment System Administration regarding
individuals who are receiving services under A.R.S. Title 36, Chapter 29. Except as
required under subsection (B), the Board or its designee shall provide this information
only if the Administration states in writing that the information is necessary for an
open investigation or complaint;
6. A person serving a lawful order of a court of competent jurisdiction; and
7. The Board staff for purposes of administration and enforcement of A.R.S. § Title 36,
Chapter 28 and this Article.
3
D.
The Board or its designee may provide data to public or private entities for statistical,
research, or educational purposes after removing information that could be used to identify
individual patients or persons who received prescriptions from dispensers.
R4-23-504.
Repealed Computerized Central Database Tracking System Task Force
A. The Board shall appoint a task force to help it administer the computerized central database
tracking system as specified in A.R.S. § 36-2603.
B. The Task Force shall meet at least once each year and at the call of the chairperson to
establish the procedures and conditions relating to the release of prescription information
specified in A.R.S. § 36-2604 and R4-23-503.
C. The Task Force shall determine:
1. The information to be screened;
2. The frequency and thresholds for screening; and
3. The parameters for using the information to notify medical practitioners, patients, and
pharmacies to educate and provide for patient management and treatment options.
D. The Board shall review and approve the procedures and conditions established by the Task
Force as needed but at least once every calendar year.
R4-23-505.
Repealed Reports
A. Before releasing prescription monitoring program data, the Board or its designee shall
receive a written request for controlled substance prescription information.
B. A person authorized to access CSPMP data under R4-23-503(C) (1) through (6) shall
submit a written request that:
1. Specifies the information requested for the report;
2. For a medical practitioner, provides a statement that the report's purpose is to provide
medical or pharmaceutical care to a patient or to evaluate a patient;
3. For an individual obtaining the individual's own controlled substance prescription
information, provides a form of non-expired government-issued identification;
4. For a professional licensing board, states that the information is necessary for an open
investigation or complaint;
5. For a local, state, or federal law enforcement or criminal justice agency, states that the
information is necessary for an open investigation or complaint;
6. For the AHCCCS Administration, states that the information is necessary for an open
investigation or complaint; and
7. For a person serving a lawful order of a court of competent jurisdiction, provides a
copy of the court order.
C. The Board or its designee may provide reports through U.S. mail, other common carrier,
facsimile, or secured electronic media or may allow reports to be picked up in-person at the
Board office.
4