Title 21
Food and Drugs

Chapter 28
Uniform Controlled Substances Act

Article III
Regulation of Manufacturing, Distributing, Prescribing, Administering, and Dispensing Controlled Substances

§ 21-28-3.32. Electronic prescription database. [Effective until January 1, 2023; see Sunset Provision note.]

(a) The information contained in any prescription-drug-monitoring database maintained by the department of health pursuant to § 21-28-3.18 shall be disclosed only:

(1) To a practitioner who certifies that the requested information is for the purpose of evaluating the need for, or providing medical treatment to, a current patient to whom the practitioner is prescribing or considering prescribing a controlled substance;

(2) To a pharmacist who certifies that the requested information is for a current client to whom the pharmacist is dispensing, or considering dispensing, a controlled substance;

(3) To an authorized designee of the practitioner and/or pharmacist to consult the prescription-drug-monitoring database on the practitioner’s and/or pharmacist’s behalf, or to a medical director of the practitioner’s practice for quality improvement activities within the practice, provided that:

(i) The designee so authorized is employed by the same professional practice or pharmacy;

(ii) The practitioner or pharmacist takes reasonable steps to ensure that the designee is sufficiently competent in the use of the database;

(iii) The practitioner or pharmacist remains responsible for ensuring that access to the database by the designee is limited to authorized purposes as provided for in subsections (a)(1) and (a)(2);

(iv) The practitioner or pharmacist remains responsible for ensuring access to the database by the designee occurs in a manner that protects the confidentiality of information obtained from the database and remains responsible for any breach of confidentiality;

(v) The practitioner or pharmacist terminates the designee’s access to the database at the termination of the designee’s employment; and

(vi) The ultimate decision as to whether or not to prescribe or dispense a controlled substance remains with the practitioner or pharmacist and is reasonably informed by the relevant, controlled-substance history information obtained from the database;

(4) Pursuant to a valid search warrant based on probable cause to believe a violation of federal or state criminal law has occurred and that specified information contained in the database would assist in the investigation of the crime;

(5) By a department employee to a certified law enforcement prescription drug diversion investigator of a qualified law enforcement agency for use in an investigation.

(i) A certified law enforcement prescription drug diversion investigator shall provide to the department the following information in order to receive information from the database:

(A) The identification credentials assigned by the department; and

(B) The case number of the investigation.

(ii) A qualified law enforcement agency shall submit to the department quarterly reports of the data received by all certified law enforcement prescription drug diversion investigators in the qualified law enforcement agency, including, without limitation:

(A) Written verification that the inquiries were part of a lawful prescription drug diversion investigation as provided to the department through the case number of the investigation; and

(B) A brief description of each case closed during that quarter for which the qualified law enforcement agency used information from the database; and

(C) The disposition of the investigation.

(iii) The department shall:

(A) Create a verification form for use under subsection (a)(5)(ii)(A) of this section; and

(B) Make the verification form available annually to the qualified law enforcement agency.

(iv) The verification form under subsection (a)(5)(ii)(A) of this section shall be submitted to the department within thirty (30) days of receipt of the form by the qualified law enforcement agency.

(v) Failure to submit a verification form under subsection (a)(5)(iv) of this section shall result in the immediate suspension of disclosure of information from the database by the department to the qualified law enforcement agency and its certified law enforcement prescription drug diversion investigators until a determination is made by the department to allow continued disclosure.

(vi) The director shall, beginning January 1, 2018, and annually thereafter, review disclosure of information pursuant to subsection (a)(5) of this section. Thereafter, the disclosure of information pursuant to subsection (a)(5) of this section shall automatically renew for successive one-year terms unless the director provides written notice to:

(A) The qualified law enforcement agencies; and

(B) The speaker of the house and the president of the senate, at least sixty (60) days in advance of the then-existing term’s end, that the department wishes to discontinue providing information from the database pursuant to this subsection. The director may reinstitute disclosure by providing written notice to the same parties;

(6) To a patient who requests his or her own prescription information, or the parent or legal guardian of a minor child who requests the minor child’s prescription information;

(7) To a health professional regulatory board that documents, in writing, that the requested information is necessary for an investigation related to licensure, renewal, or disciplinary action involving the applicant, licensee, or registrant to whom the requested information pertains;

(8) To any vendor or contractor with whom the department has contracted, pursuant to state purchasing law and regulations in the contracting of vendors, to establish or maintain the electronic system of the prescription-drug-monitoring database;

(9) To public or private entities for statistical, research, or educational purposes, after removing the patient and prescriber information that could be used to identify individual patients. This shall not include entities receiving a waiver from the institutional review board; or

(10) To any vendor, agent, contractor, or designee who or that operates an electronic health record or clinical-management system for the purpose of sharing data with practitioners, pharmacists, or licensed healthcare facilities or designees.

(b) Information stored in the prescription-drug-monitoring database shall include only the following:

(1) Patient’s first and last name and/or patient identification number; provided, however, the patient’s social security number shall not be recorded in whole or in part, patient sex, patient date of birth, and patient address;

(2) Prescribing practitioner’s name and Drug Enforcement Administration prescriber-information number;

(3) Prescribing practitioner’s office or hospital contact information;

(4) Prescription name, prescription number, prescription species code, national drug code number, prescription dosage, prescription quantity, days’ supply, new-refill code, number of refills authorized, date the prescription was written, date the prescription was filled, payment type; provided, however, no credit card number shall be recorded in whole or in part; and

(5) The Drug Enforcement Administration pharmacy number of the pharmacy filling the prescription.

(c) The department shall disclose any information relating to a patient maintained in the prescription-drug-monitoring database to that patient, at no cost to the patient, within thirty (30) business days after the department receives a written request from the patient for the information. This information shall include the records maintained by the department pursuant to subsection (e). Notwithstanding the above, the department may, at the request of the law enforcement agency, withhold, for up to sixty (60) days following the conclusion of a law enforcement investigation that has been confirmed by the department, the disclosure to the patient that information has been obtained pursuant to subsections (a)(4) and (a)(5) of this section.

(d) A patient may request, from the dispensing pharmacy, correction of any inaccurate information contained within the prescription-drug-monitoring database in accordance with the procedure specified by § 5-37.3-5(c).

(e) The department shall, for the period of time that prescription information is maintained, maintain records of the information disclosed through the prescription-drug-monitoring database, including, but not limited to:

(1) The identity of each person who requests or receives information from the prescription-drug-monitoring database and the organization, if any, the person represents;

(2) The information released to each person or organization and the basis for its release under subsection (a); and

(3) The dates the information was requested and provided.

(f) Prescription information contained within the prescription-drug-monitoring database shall be removed no later than five (5) years from the date the information is entered into the database. Records in existence prior to the enactment of this section shall be removed no later than ten (10) years from the date the information is entered into the database.

(g) The department shall promptly notify any affected individual of an improper disclosure of information from the prescription-drug-monitoring database or a breach in the security of the prescription-drug-monitoring database that poses a significant risk of disclosure of patient information to an unauthorized individual.

(h) At the time of signing a prescription that is required by the department to be entered into the prescription-drug-monitoring database, the prescribing practitioner shall inform the patient in writing of the existence of the prescription-drug-monitoring database; the patient’s right to access his or her own prescription information; and the name and contact information of the agency operating the program.

(i) No person shall access information in the prescription-monitoring-database except to the extent and for the purposes authorized by subsection (a).

(j) In any civil action allowing a violation of this chapter, the court may award damages, including punitive damages, and reasonable attorneys’ fees and costs to a prevailing plaintiff, and injunctive and any other appropriate relief.

(k) Any pharmacist who, in his or her professional judgment, refuses to fill a prescription based on information contained within the prescription-drug-monitoring database shall inform the prescribing physician within twenty-four (24) hours.

(l) All practitioners shall, as a condition of the initial registration or renewal of the practitioner’s authority to prescribe controlled substances, register with the prescription-drug-monitoring database maintained by the department of health.

(m) The prescription-monitoring program shall be reviewed prior to starting any opioid. A prescribing practitioner, or designee as authorized by subsection (a)(3) of this section, shall review the prescription-monitoring program prior to refilling or initiating opioid therapy with an intrathecal pump. For patients the prescribing practitioner is maintaining on continuous opioid therapy for pain for three (3) months or longer, the prescribing practitioner shall review information from the prescription-monitoring program at least every three (3) months. Documentation of that review shall be noted in the patient’s medical record.

(n) The department shall improve the usefulness and value of the prescription-drug-monitoring database program by increasing its analytical functionality, timeliness, and scope, such as by:

(1) Utilizing data from additional data sources as permissible under state and federal statutes;

(2) Analyzing information submitted to the prescription-drug-monitoring database to ensure that prescription data collected from dispensing pharmacists is readily accessible for a given patient; to identify unusual or aberrant patterns of prescribing, dispensing, or receiving controlled substances; and to generate an automatic alert when such patterns arise to automate standard reports; and to provide ad hoc reports on a real-time basis on this data as well as other data feeds. These reports shall comply with the patient confidentiality requirements of federal and state law;

(3) Developing regulations to ensure that prescription-drug-monitoring analyses are updated and disseminated regularly to appropriate officials and that summary reports are provided to the general assembly on or before February 1 of each year. Given the intent to decrease the number of Rhode Island citizens affected by opioid use, the department shall provide an interim report on the status of the directives included herein and any progress made as of October 1, 2016. In the development of the regulations, the department may include any of the following analytical functions, within the boundaries of patient confidentiality rights under state and federal law:

(i) Consolidate raw prescription data collected from dispensing pharmacists into a single view of all prescriptions filled for a given patient;

(ii) Identify unusual or aberrant patterns of prescribing controlled substances, by relevant prescriber attributes, and generate an automatic alert when these patterns arise;

(iii) Identify unusual or aberrant patterns of receiving prescriptions for controlled substances, by relevant patient attributes, and generate an automatic alert when these patterns arise;

(iv) Identify unusual or aberrant patterns of dispensing controlled substances, by relevant dispenser attributes, and generate an automatic alert when these patterns arise;

(v) Identify and visually display linkages among prescribers, patients, and dispensers that can be used to detect any collusive behaviors; and

(vi) The department shall apply for federal funding in support of the goals and objectives contained in this subsection.

§ 21-28-3.32. Electronic prescription database. [Effective January 1, 2023; see Sunset Provision note.]

(a) The information contained in any prescription-drug-monitoring database maintained by the department of health pursuant to § 21-28-3.18 shall be disclosed only:

(1) To a practitioner who certifies that the requested information is for the purpose of evaluating the need for, or providing medical treatment to, a current patient to whom the practitioner is prescribing or considering prescribing a controlled substance;

(2) To a pharmacist who certifies that the requested information is for a current client to whom the pharmacist is dispensing, or considering dispensing, a controlled substance;

(3) To an authorized designee of the practitioner and/or pharmacist to consult the prescription-drug-monitoring database on the practitioner’s and/or pharmacist’s behalf, or to a medical director of the practitioner’s practice for quality improvement activities within the practice, provided that:

(i) The designee so authorized is employed by the same professional practice or pharmacy;

(ii) The practitioner or pharmacist takes reasonable steps to ensure that the designee is sufficiently competent in the use of the database;

(iii) The practitioner or pharmacist remains responsible for ensuring that access to the database by the designee is limited to authorized purposes as provided for in subsections (a)(1) and (a)(2);

(iv) The practitioner or pharmacist remains responsible for ensuring access to the database by the designee occurs in a manner that protects the confidentiality of information obtained from the database and remains responsible for any breach of confidentiality;

(v) The practitioner or pharmacist terminates the designee’s access to the database at the termination of the designee’s employment; and

(vi) The ultimate decision as to whether or not to prescribe or dispense a controlled substance remains with the practitioner or pharmacist and is reasonably informed by the relevant, controlled substance history information obtained from the database;

(4) Pursuant to a valid search warrant based on probable cause to believe a violation of federal or state criminal law has occurred and that specified information contained in the database would assist in the investigation of the crime;

(5) To a patient who requests his or her own prescription information, or the parent or legal guardian of a minor child who requests the minor child’s prescription information;

(6) To a health professional regulatory board that documents, in writing, that the requested information is necessary for an investigation related to licensure, renewal, or disciplinary action involving the applicant, licensee, or registrant to whom the requested information pertains;

(7) To any vendor or contractor with whom the department has contracted, pursuant to state purchasing law and regulations in the contracting of vendors, to establish or maintain the electronic system of the prescription-drug-monitoring database;

(8) To public or private entities for statistical, research, or educational purposes, after removing the patient and prescriber information that could be used to identify individual patients. This shall not include entities receiving a waiver from the institutional review board; or

(9) To any vendor, agent, contractor, or designee who operates an electronic health record or clinical-management system for the purpose of sharing data with practitioners, pharmacists, or licensed healthcare facilities or designees.

(b) Information stored in the prescription-drug-monitoring database shall include only the following:

(1) Patient’s first and last name and/or patient identification number; provided, however, the patient’s social security number shall not be recorded in whole or in part, patient sex, patient date of birth, and patient address;

(2) Prescribing practitioner’s name and Drug Enforcement Administration prescriber-information number;

(3) Prescribing practitioner’s office or hospital contact information;

(4) Prescription name, prescription number, prescription species code, national drug code number, prescription dosage, prescription quantity, days’ supply, new-refill code, number of refills authorized, date the prescription was written, date the prescription was filled, payment type; provided, however, no credit card number shall be recorded in whole or in part; and

(5) The Drug Enforcement Administration pharmacy number of the pharmacy filling the prescription.

(c) The department shall disclose any information relating to a patient maintained in the prescription-drug-monitoring database to that patient, at no cost to the patient, within thirty (30) business days after the department receives a written request from the patient for the information. This information shall include the records maintained by the department pursuant to subsection (e). Notwithstanding the above, the department may, at the request of the law enforcement agency, withhold, for up to sixty (60) days following the conclusion of a law enforcement investigation, the disclosure to the patient that information has been obtained pursuant to subdivision (a)(4).

(d) A patient may request, from the dispensing pharmacy, correction of any inaccurate information contained within the prescription-drug-monitoring database in accordance with the procedure specified by § 5-37.3-5(c).

(e) The department shall, for the period of time that prescription information is maintained, maintain records of the information disclosed through the prescription-drug-monitoring database, including, but not limited to:

(1) The identity of each person who requests or receives information from the prescription-drug-monitoring database and the organization, if any, the person represents;

(2) The information released to each person or organization and the basis for its release under subsection (a); and

(3) The dates the information was requested and provided.

(f) Prescription information contained within the prescription-drug-monitoring database shall be removed no later than five (5) years from the date the information is entered into the database. Records in existence prior to the enactment of this section shall be removed no later than ten (10) years from the date the information is entered into the database.

(g) The department shall promptly notify any affected individual of an improper disclosure of information from the prescription-drug-monitoring database or a breach in the security of the prescription-drug-monitoring database that poses a significant risk of disclosure of patient information to an unauthorized individual.

(h) At the time of signing a prescription that is required by the department to be entered into the prescription-drug-monitoring database, the prescribing practitioner shall inform the patient in writing of the existence of the prescription-drug-monitoring database; the patient’s right to access his or her own prescription information; and the name and contact information of the agency operating the program.

(i) No person shall access information in the prescription-monitoring database except to the extent and for the purposes authorized by subsection (a).

(j) In any civil action allowing a violation of this chapter, the court may award damages, including punitive damages, and reasonable attorneys’ fees and costs to a prevailing plaintiff, and injunctive and any other appropriate relief.

(k) Any pharmacist who, in his or her professional judgment, refuses to fill a prescription based on information contained within the prescription-drug-monitoring database shall inform the prescribing physician within twenty-four (24) hours.

(l) All practitioners shall, as a condition of the initial registration or renewal of the practitioner’s authority to prescribe controlled substances, register with the prescription-drug-monitoring database maintained by the department of health.

(m) The prescription-monitoring program shall be reviewed prior to starting any opioid. A prescribing practitioner, or designee as authorized by subsection (a)(3) of this section, shall review the prescription-monitoring program prior to refilling or initiating opioid therapy with an intrathecal pump. For patients the prescribing practitioner is maintaining on continuous opioid therapy for pain for three (3) months or longer, the prescribing practitioner shall review information from the prescription-monitoring program at least every three (3) months. Documentation of that review shall be noted in the patient’s medical record.

(n) The department shall improve the usefulness and value of the prescription-drug-monitoring database program by increasing its analytical functionality, timeliness, and scope, such as by:

(1) Utilizing data from additional data sources as permissible under state and federal statutes;

(2) Analyzing information submitted to the prescription-drug-monitoring database to ensure that prescription data collected from dispensing pharmacists is readily accessible for a given patient; to identify unusual or aberrant patterns of prescribing, dispensing, or receiving controlled substances; and to generate an automatic alert when such patterns arise to automate standard reports and to provide ad hoc reports on a real-time basis on this data as well as other data feeds. These reports shall comply with the patient confidentiality requirements of federal and state law;

(3) Developing regulations to ensure that prescription-drug-monitoring analyses are updated and disseminated regularly to appropriate officials and that summary reports are provided to the general assembly on or before February 1 of each year. Given the intent to decrease the number of Rhode Island citizens affected by opioid use, the department shall provide an interim report on the status of the directives included herein and any progress made as of October 1, 2016. In the development of the regulations, the department may include any of the following analytical functions, within the boundaries of patient confidentiality rights under state and federal law:

(i) Consolidate raw prescription data collected from dispensing pharmacists into a single view of all prescriptions filled for a given patient;

(ii) Identify unusual or aberrant patterns of prescribing controlled substances, by relevant prescriber attributes, and generate an automatic alert when these patterns arise;

(iii) Identify unusual or aberrant patterns of receiving prescriptions for controlled substances, by relevant patient attributes, and generate an automatic alert when these patterns arise;

(iv) Identify unusual or aberrant patterns of dispensing controlled substances, by relevant dispenser attributes, and generate an automatic alert when these patterns arise;

(v) Identify and visually display linkages among prescribers, patients, and dispensers that can be used to detect any collusive behaviors; and

(vi) The department shall apply for federal funding in support of the goals and objectives contained in this subsection.