The Change Healthcare cyberattack in 2024 brought new light on the many challenges cyberattacks can pose for pharmacies and how pharmacies can handle dispensing electronic prescriptions during a cyberattack. In June 2024, the DEA’s Diversion Control Division released a guidance document titled “Drug Enforcement Administration (DEA) Registered Pharmacies Dispensing Electronic Prescriptions During a Cyberattack.” The document is meant to assist DEA-registered pharmacies understand their options for receiving prescriptions if affected by a cyberattack or disruption to electronic prescribing. The guidance allows pharmacies to use alternative methods, such as written, fax, and oral prescriptions, when electronic prescribing systems are down due to a cyberattack. During a cyberattack, the DEA notes that they do not require e-prescribing of controlled substances; this flexibility ensures continuous patient care without requiring additional DEA documentation. However, pharmacies must still adhere to state-specific regulations, which may impose stricter requirements.

The DEA’s guidance to pharmacies regarding written and faxed prescriptions during a cyberattack is especially important, as millions of patients and businesses can be affected by such disturbances. The emphasis on using written and faxed orders exposes pharmacies to an increased risk of fraudulent prescriptions, but not implementing such guidance can negatively impact patients who are in need of the medication.

Of course, there is more than just the DEA and its requirements to consider. State laws and regulations can also impact how pharmacies deal with cyberattacks. As an example, PHSL compared the DEA guidance document to Pennsylvania requirements to compare how the DEA’s recommendations would be impacted by state law. Pennsylvania law, under Act 96 of 2018, mandates the use of electronic prescriptions for all Schedule II-V controlled substances. This law was created to reduce fraudulent activity and ensure accurate prescription transmission and transfers.

Key Pennsylvania Laws and Regulations Related to DEA Cyberattack Guidance

1. Pennsylvania Act 96 of 2018 – Mandatory Electronic Prescribing of Controlled Substances
   1. Primary Requirements: Pennsylvania Act 96 mandates that all Schedule II-V controlled substances be prescribed electronically, effective October 24, 2019. The primary goal is to reduce prescription fraud, diversion, and opioid misuse by ensuring accurate and traceable electronic transmissions.
   2. Exemptions and Emergency Provisions: Act 96 provides specific exemptions allowing pharmacies to accept paper, faxed, or oral prescriptions during electronic disruptions, including cyberattacks, technical failures, and lack of internet or EHR system access. Pennsylvania requires pharmacies to document these instances within 72 hours, creating a clear audit trail for accountability.
   3. Interface with DEA Guidance: The DEA’s guidance aligns well with Act 96, which permits non-electronic methods when electronic systems are compromised. However, Pennsylvania’s requirement for prompt documentation within 72 hours adds an extra layer of compliance, reinforcing DEA flexibility with state-level accountability.
2. Pennsylvania Prescription Drug Monitoring Program (PDMP) Act
   1. PDMP Reporting: Pennsylvania law mandates that all prescriptions for Schedule II-V controlled substances be logged into the PDMP by the close of the next business day, enabling real-time monitoring to identify potential misuse or diversion. This requirement applies to all prescriptions and does not make exemptions for prescriptions filled during cyber disruptions.
   2. Interface with DEA Guidance: While the DEA allows non-electronic prescriptions during emergencies, Pennsylvania’s PDMP requires that these prescriptions still be entered into the monitoring system promptly. This ensures that even during electronic disruptions, Pennsylvania maintains comprehensive oversight of controlled substance distribution, strengthening both DEA and state-level objectives for accountability and monitoring.
3. Pharmacist Responsibility and Recordkeeping Requirements (The Pennsylvania Pharmacy Act and Title 49, Chapter 27 of the Pennsylvania Code)
   1. Corresponding Responsibility: The Pennsylvania Pharmacy Act and Title 49 of the Pennsylvania Code impose a “corresponding responsibility” on pharmacists to ensure the legitimacy of every prescription they dispense. This requirement applies to both electronic and non-electronic prescriptions, ensuring pharmacists verify all controlled substance prescriptions regardless of the dispensing method.
   2. Recordkeeping Standards: Pennsylvania law mandates that pharmacies maintain detailed records of all prescriptions, including those filled through alternative methods during electronic system failures. This helps ensure compliance with DEA requirements and allows for efficient audits of controlled substance records during cyber incidents.
   3. DEA and State Interface: DEA guidance also emphasizes pharmacists’ responsibility for prescription validity. Pennsylvania’s laws support this by mandating comprehensive documentation and verification steps, ensuring state pharmacies maintain oversight even when using alternative dispensing methods due to cyber disruptions.
4. Controlled Substance, Drug, Device, and Cosmetic Act (CSDDCA) of Pennsylvania
   1. Emergency Dispensing Provisions: The CSDDCA allows pharmacists to dispense controlled substances during emergencies using alternative methods, such as oral or faxed prescriptions, ensuring that patients continue to receive necessary medications during electronic outages.
   2. Alignment with DEA Guidance: Both the DEA’s guidance and CSDDCA emergency provisions support alternative dispensing methods to maintain patient care during system disruptions. Pennsylvania further strengthens these provisions with required documentation, supporting both DEA and state standards for secure dispensing practices during emergencies.
5. Pennsylvania’s Health and Safety Code – Chapter 25: Data and System Security Regulations
   1. Cybersecurity and Data Security Requirements: Although Pennsylvania does not mandate specific cybersecurity protocols for pharmacies, Chapter 25 of the Health and Safety Code encourages adopting best practices such as data encryption, multi-factor authentication, and regular system vulnerability assessments. These practices help protect against cyber threats and support the secure transmission of electronic prescriptions.
   2. Interface with DEA Guidance: While the DEA does not require specific cybersecurity measures, its emphasis on preparedness aligns with Pennsylvania’s encouragement of data security best practices. Adopting these measures helps pharmacies enhance resilience against cyberattacks, supporting both Act 96’s electronic prescribing requirements and the DEA’s focus on secure, continuous dispensing.
6. Pennsylvania Title 35 – Health and Safety (Public Health Emergency Preparedness)
   1. Emergency Provisions for Public Health Crises: Title 35 includes provisions that allow healthcare providers to modify dispensing practices during public health emergencies or major events, including cyberattacks, ensuring that patients continue to receive their medications.
   2. Alignment with DEA Cyberattack Guidance: Title 35 aligns with the DEA’s emergency flexibility by allowing pharmacies to adapt to alternative dispensing methods during crises. Pennsylvania’s additional focus on documentation and compliance supports the DEA’s guidance, ensuring that pharmacies can meet patient needs while adhering to secure dispensing protocols.
7. Cybersecurity and Infrastructure Security Agency (CISA) Guidelines on Data Security
   1. Cybersecurity Recommendations: Although CISA guidelines are not legally binding in Pennsylvania, they offer cybersecurity best practices relevant to pharmacy systems, including multi-factor authentication, regular vulnerability assessments, and restricted access protocols.
   2. Relevance to DEA Guidance: CISA’s recommended practices complement both Pennsylvania and DEA’s emphasis on preparedness, helping pharmacies mitigate risks of cyber threats. By implementing these measures, Pennsylvania pharmacies can comply with both state and federal standards, reinforcing Act 96’s electronic prescribing mandates while supporting DEA’s guidance on secure dispensing during cyber incidents.

How DEA Guidance Interfaces with Pennsylvania Law

1. Alternative Prescription Methods and Documentation Requirements:
   1. DEA Flexibility: The DEA allows pharmacies to use paper, fax, and oral prescriptions during cyber incidents, ensuring continuity in patient care.
   2. Pennsylvania’s Structured Compliance: Act 96 requires documentation within 72 hours of using non-electronic prescriptions, creating a specific timeline for compliance. Additionally, PDMP integration ensures all dispensed controlled substances are logged, strengthening DEA’s guidance with Pennsylvania’s additional layers of monitoring and accountability.
2. PDMP for Continuous Monitoring:
   1. DEA’s Allowance: The DEA’s guidance provides flexibility for pharmacies to use alternative methods during emergencies.
   2. Pennsylvania’s PDMP Requirements: The PDMP mandate requires real-time tracking of all controlled substance prescriptions, including those issued through non-electronic methods during a cyber event. This reporting provides Pennsylvania with a consistent oversight mechanism, reinforcing DEA’s focus on monitoring and accountability.
3. Pharmacist Responsibility and Verification:
   1. DEA’s Emphasis on Legitimacy Verification: The DEA guidance underscores the importance of pharmacists verifying each prescription to ensure compliance.
   2. Corresponding Responsibility Under Pennsylvania Law: Pennsylvania law holds pharmacists responsible for verifying prescription authenticity, ensuring pharmacies maintain rigorous oversight in controlled substance dispensing, in line with DEA requirements.
4. Cybersecurity and System Resilience:
   1. DEA’s Preparedness Focus: Although DEA does not mandate specific cybersecurity protocols, it encourages contingency planning for cyber incidents.
   2. Pennsylvania’s Health and Safety Standards: Supported by CISA recommendations, Pennsylvania encourages cybersecurity best practices to prevent system breaches. Implementing these measures help pharmacies maintain compliance with Act 96 and supports DEA’s emphasis on proactive cyber preparedness.
5. Public Health Preparedness and Emergency Dispensing:
   1. DEA’s Guidance for Emergencies: The DEA guidance allows for emergency dispensing to ensure patient access during system outages.
   2. Pennsylvania’s Emergency Preparedness Laws: Title 35 permits pharmacies to adapt dispensing practices during public health emergencies, aligning closely with DEA guidance to ensure continuous patient care.

The DEA’s guidance on handling electronic prescription interruptions during a cyberattack effectively interfaces with Pennsylvania’s controlled substance regulations. Through structured documentation requirements, PDMP tracking, pharmacist responsibilities, and cybersecurity measures, Pennsylvania law complements DEA guidance, ensuring that patient care, regulatory compliance, and data security are upheld during electronic disruptions. Other states requiring EPCS may have different laws and exceptions for such events.

This review only covers PHSL’s home state of Pennsylvania.  Pharmacists should review and understand their options in the event of cyberattack or electronic prescription interruptions to ensure state and federal requirements are followed.  PHSL is pleased to work with clients to better understand how other state laws compare to DEA guidance.  PHSL is a pharmacist-led consulting company, not a law firm. This post is not intended to provide legal advice.

Winter 2025 Newsletter:

First-In-Class Therapies Top List of FDA 2024 Novel Approvals