Title 902 | Chapter 055 | Regulation 110
SUPERSEDED
This document is no longer current.
902 KAR 55:110.Monitoring system for prescription controlled substances.
Section 1.
Definitions.(1)
"Branch" means the Drug Enforcement and Professional Practices Branch in the Division of Audits and Investigations, Office of Inspector General, Cabinet for Health and Family Services.(2)
"Cabinet personnel" means an individual who:(a)
1.
Is directly employed by the Cabinet for Health and Family Services; or2.
Is employed by an agent or contractor of the cabinet;(b)
Has undergone KASPER training; and(c)
Has been approved to use the KASPER system.(3)
"Dispenser" is defined by KRS 218A.010(11), and shall:(a)
Include a dispenser who has a DEA (Drug Enforcement Administration) number or is a pharmacist who owns or is employed by a facility that operates a pharmacy that has a DEA number; and(b)
Not include an individual licensed to practice veterinary medicine under KRS Chapter 321.(4)
"Health facility" is defined by KRS 216B.015(13).(5)
"KASPER" means Kentucky All-Schedule Prescription Electronic Reporting System.(6)
"Patient identifier" means a patient's:(a)
Full name;(b)
Address, including zip code;(c)
Date of birth; and(d)
Social Security number or an alternative identification number established pursuant to Section 5 of this administrative regulation.(7)
"Practitioner" is defined by KRS 218A.010(39).(8)
"Report" means a compilation of data concerning a patient, dispenser, practitioner, or controlled substance.(9)
"Suspected drug overdose" means an acute condition that:(a)
May include physical illness, coma, mania, or hysteria that is the result of consumption or use of a controlled substance, or another substance with which a controlled substance was combined; and(b)
Relates to injury, poisoning by, or other adverse effect of any substance corresponding to the following International Classification of Disease (ICD) version 10 (ICD-10) codes, or equivalent codes in the most recent version of the International Statistical Classification of Diseases and Related Health Problems:1.
T40;2.
T42; or3.
T43.Section 2.
Data Reporting.(1)
A dispenser or a health facility that has a DEA number shall report all dispensed Schedule II, III, IV, or V controlled substances, except during the circumstances specified in KRS 218A.202(3)(a) through (c).(2)
A dispenser of a Schedule II, III, IV, or V controlled substance shall transmit or provide the following data to the cabinet or the cabinet's agent:(a)
Patient identifier;(b)
National drug code of the drug dispensed;(c)
Metric quantity of the drug dispensed;(d)
Date of dispensing;(e)
Estimated days the supply of dispensed medication will last;(f)
Drug Enforcement Administration registration number of the prescriber;(g)
Prescription number assigned by the dispenser; and(h)
The Drug Enforcement Administration registration number of the dispenser.(3)
The data identified in subsection (2) of this section shall be transmitted no later than close of business on the business day immediately following the dispensing unless the cabinet grants an extension as provided in subsection (4) or (5) of this section.(4)
(a)
An extension may be granted if:1.
The dispenser suffers a mechanical or electronic failure; or2.
The dispenser cannot meet the deadline established by subsection (3) of this section because of reasons beyond his or her control.(b)
A dispenser shall apply to the branch in writing for an extension listed in paragraph (a) of this subsection within twenty-four (24) hours of discovery of the circumstances necessitating the request or on the next date state offices are open for business, following the discovery. An application for an extension shall state the justification for the extension and the period of time for which the extension is necessary.(5)
An extension shall be granted to a dispenser if the cabinet or its agent is unable to receive electronic reports transmitted by the dispenser.(6)
Except as provided in subsection (8) of this section, the data shall be transmitted by:(a)
An electronic device compatible with the receiving device of the cabinet or the cabinet's agent;(b)
Secure File Transfer Protocol;(c)
https protocol; or(d)
Secure Virtual Private Network connection.(7)
The data shall be transmitted in the telecommunications format for controlled substances established by the Implementation Guide,ASAP Standard for Prescription Monitoring Programs, developed by the American Society for Automation in Pharmacy, Version 4.2, or a comparable format approved by the branch.(8)
A dispenser who does not have an automated recordkeeping system capable of producing an electronic report in the telecommunications format for controlled substances established by the Implementation Guide, ASAP Standard for Prescription Monitoring Programs shall report the data identified in subsection (2) of this section using an Internet accessible web portal designated by the cabinet.(9)
To meet the reporting requirement of KRS 218A.202(4), a hospital shall report to the cabinet all positive toxicology screens ordered by the hospital's emergency department to evaluate a patient's suspected drug overdose via the Kentucky Health Information Exchange.Section 3.
Compliance. A dispenser may presume that the patient identification information established in Section 5 of this administrative regulation and provided by the patient or the patient's agent is correct.Section 4.
Request for Report.(1)
A written or electronic request shall be filed with the cabinet prior to the release of a report, except for a subpoena issued by a grand jury or an appropriate court order issued by a court of competent jurisdiction.(2)
A request for a KASPER patient report shall be made electronically at www.chfs.ky.gov/KASPER.(3)
A request for a KASPER provider report made by a peace officer authorized to receive data under KRS 218A.202, or a designated representative of a board responsible for the licensure, regulation, or discipline of prescribing practitioners shall be made by written application on the KASPER Report Request for Law Enforcement and Licensure Boards, Form DCB-20L.(4)
A medical examiner engaged in a death investigation pursuant to KRS 72.026 may query KASPER for a report on the decedent.Section 5.
Patient Identification Number.(1)
A patient or the person obtaining the controlled substance on behalf of the patient shall disclose to the dispenser the patient's Social Security number for purposes of the dispenser's mandatory reporting to KASPER.(2)
If a patient is an adult who does not have a Social Security number, the patient's driver's license number shall be disclosed.(3)
If a patient is an adult who has not been assigned a Social Security number or a driver's license number, the number 000-00-0000 shall be used in the Social Security field.(4)
If a patient is a child who does not have a Social Security number or a driver's license number, the number "000-00-0000" shall be used in the Social Security field.(5)
If a patient is an animal, the number "000-00-0000" shall be used in the Social Security number field.Section 6.
KASPER Data and Trend Reports. Cabinet personnel shall have authorized access to the data obtained from the KASPER system and trend reports in accordance with KRS 218A.240(7)(a).Section 7.
Data Retention. Data shall be maintained in KASPER according to the Office of Inspector General's retention schedule on file with the State Archives and Records Commission.Section 8.
Error Resolution.(1)
A patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic to whom a report has been disclosed under KRS 218A.202(9) or this administrative regulation may request that information contained in KASPER be corrected if the patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic believes that any information is inaccurate. The patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic shall:(a)
Contact the dispenser who reported the information required by Section 2(2) of this administrative regulation; and(b)
Request that the dispenser correct the information.(2)
If, upon receipt of a request from a patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic pursuant to subsection (1) of this section, the dispenser confirms that the information was reported in error, the dispenser shall:(a)
Transmit corrected information to update the KASPER database within seven (7) calendar days of the request for the correction; and(b)
Notify the patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic that the corrected information has been transmitted.(3)
If a dispenser identifies a KASPER system generated error, the dispenser shall notify the branch. Upon verification of the error, the branch shall:(a)
Correct the information in the KASPER database; and(b)
Notify the patient, patient's representative, practitioner, pharmacist, health facility, private practitioner's office or clinic within five (5) working days of the correction.Section 9.
Referrals to Licensing Boards. If the cabinet becomes aware that a prescriber or dispenser has failed to comply with the reporting requirements of KRS 218A.202 and this administrative regulation, the cabinet shall notify the licensing board or agency responsible for licensing the prescriber or dispenser.Section 10.
Disclosure of Data or Report.(1)
The cabinet shall only disclose data to the persons and entities authorized to receive that data under KRS 218A.202(7).(2)
As a condition precedent to the disclosure of data or a report pursuant to KRS 218A.202(7)(f), a hospital or long-term care facility shall maintain, and provide upon request by the cabinet, a copy of the hospital or long-term care facility's policy for the management of KASPER data and reports, which:(a)
Describes the hospital or long-term care facility's internal procedures for educating the designated employee or employees on the:1.
Proper use of the KASPER system;2.
Prohibition on the improper use or intentional disclosure of KASPER data to unauthorized individuals; and3.
Sanctions imposed for the improper use or intentional disclosure of KASPER data to unauthorized individuals, including criminal misdemeanor offenses; and(b)
Describes the hospital or long-term care facility's internal procedures for auditing the account, including:1.
The manner in which an employee is added to or removed from access to the account if the employee ends employment or is no longer designated to query KASPER; and2.
The actions taken if a designated employee with access to the employer's KASPER account intentionally misuses his or her privileges to KASPER data or a report, which shall include a report of the incident to the Office of Inspector General.(3)
(a)
An individual authorized to receive data under KRS 218A.202(7) shall not provide the data to any other entity except as provided in KRS 218A.202(9) and paragraph (b) of this subsection.(b)
In addition to the purposes authorized under KRS 218A.202(9)(e), and pursuant to KRS 218A.205(2)(a) and (6), a practitioner or pharmacist who obtains KASPER data or a report under KRS 218A.202(7)(e)1. or who in good faith believes that any person, including a patient, has violated the law in attempting to obtain a prescription for a controlled substance, may report suspected improper or illegal use of a controlled substance to law enforcement or the appropriate licensing board.(4)
A hospital or long-term care facility shall maintain and adhere to the entity's internal policy regarding the management of KASPER data and reports.Section 11.
Incorporation by Reference.(1)
The following material is incorporated by reference:(a)
"Implementation Guide, ASAP Standard for Prescription Monitoring Programs", American Society for Automation in Pharmacy, Version 4.2, September 2011; and(b)
"KASPER Report Request for Law Enforcement and Licensure Boards", Form DCB-20L, October 2017.(2)
This material may be inspected, copied, or obtained, subject to applicable copyright law, at the Drug Enforcement and Professional Practices Branch, Office of the Inspector General, Cabinet for Health and Family Services, 275 E. Main Street, Frankfort, Kentucky 40621, Monday through Friday, 8 a.m. to 4:30 p.m.HISTORY: (25 Ky.R. 966; 1367; eff. 12-16-1998; 32 Ky.R. 1927; 33 Ky.R. 120; eff. 7-24-2006; 34 Ky.R. 2609; 35 Ky.R. 283; eff. 9-5-2008; 2615; eff. 7-31-2009; 39 Ky.R. 629; 1218; 1413; 2033; eff. 3-4-2013; 44 Ky.R. 378, 1026, 1346; eff. 1-5-2018; TAm eff. 3-20-2020.)
902 KAR 55:110.Monitoring system for prescription controlled substances.
Section 1.
Definitions.(1)
"Branch" means the Drug Enforcement and Professional Practices Branch in the Division of Audits and Investigations, Office of Inspector General, Cabinet for Health and Family Services.(2)
"Cabinet personnel" means an individual who:(a)
1.
Is directly employed by the Cabinet for Health and Family Services; or2.
Is employed by an agent or contractor of the cabinet;(b)
Has undergone KASPER training; and(c)
Has been approved to use the KASPER system.(3)
"Dispenser" is defined by KRS 218A.010(11), and shall:(a)
Include a dispenser who has a DEA (Drug Enforcement Administration) number or is a pharmacist who owns or is employed by a facility that operates a pharmacy that has a DEA number; and(b)
Not include an individual licensed to practice veterinary medicine under KRS Chapter 321.(4)
"Health facility" is defined by KRS 216B.015(13).(5)
"KASPER" means Kentucky All-Schedule Prescription Electronic Reporting System.(6)
"Patient identifier" means a patient's:(a)
Full name;(b)
Address, including zip code;(c)
Date of birth; and(d)
Social Security number or an alternative identification number established pursuant to Section 5 of this administrative regulation.(7)
"Practitioner" is defined by KRS 218A.010(39).(8)
"Report" means a compilation of data concerning a patient, dispenser, practitioner, or controlled substance.(9)
"Suspected drug overdose" means an acute condition that:(a)
May include physical illness, coma, mania, or hysteria that is the result of consumption or use of a controlled substance, or another substance with which a controlled substance was combined; and(b)
Relates to injury, poisoning by, or other adverse effect of any substance corresponding to the following International Classification of Disease (ICD) version 10 (ICD-10) codes, or equivalent codes in the most recent version of the International Statistical Classification of Diseases and Related Health Problems:1.
T40;2.
T42; or3.
T43.Section 2.
Data Reporting.(1)
A dispenser or a health facility that has a DEA number shall report all dispensed Schedule II, III, IV, or V controlled substances, except during the circumstances specified in KRS 218A.202(3)(a) through (c).(2)
A dispenser of a Schedule II, III, IV, or V controlled substance shall transmit or provide the following data to the cabinet or the cabinet's agent:(a)
Patient identifier;(b)
National drug code of the drug dispensed;(c)
Metric quantity of the drug dispensed;(d)
Date of dispensing;(e)
Estimated days the supply of dispensed medication will last;(f)
Drug Enforcement Administration registration number of the prescriber;(g)
Prescription number assigned by the dispenser; and(h)
The Drug Enforcement Administration registration number of the dispenser.(3)
The data identified in subsection (2) of this section shall be transmitted no later than close of business on the business day immediately following the dispensing unless the cabinet grants an extension as provided in subsection (4) or (5) of this section.(4)
(a)
An extension may be granted if:1.
The dispenser suffers a mechanical or electronic failure; or2.
The dispenser cannot meet the deadline established by subsection (3) of this section because of reasons beyond his or her control.(b)
A dispenser shall apply to the branch in writing for an extension listed in paragraph (a) of this subsection within twenty-four (24) hours of discovery of the circumstances necessitating the request or on the next date state offices are open for business, following the discovery. An application for an extension shall state the justification for the extension and the period of time for which the extension is necessary.(5)
An extension shall be granted to a dispenser if the cabinet or its agent is unable to receive electronic reports transmitted by the dispenser.(6)
Except as provided in subsection (8) of this section, the data shall be transmitted by:(a)
An electronic device compatible with the receiving device of the cabinet or the cabinet's agent;(b)
Secure File Transfer Protocol;(c)
https protocol; or(d)
Secure Virtual Private Network connection.(7)
The data shall be transmitted in the telecommunications format for controlled substances established by the Implementation Guide,ASAP Standard for Prescription Monitoring Programs, developed by the American Society for Automation in Pharmacy, Version 4.2, or a comparable format approved by the branch.(8)
A dispenser who does not have an automated recordkeeping system capable of producing an electronic report in the telecommunications format for controlled substances established by the Implementation Guide, ASAP Standard for Prescription Monitoring Programs shall report the data identified in subsection (2) of this section using an Internet accessible web portal designated by the cabinet.(9)
To meet the reporting requirement of KRS 218A.202(4), a hospital shall report to the cabinet all positive toxicology screens ordered by the hospital's emergency department to evaluate a patient's suspected drug overdose via the Kentucky Health Information Exchange.Section 3.
Compliance. A dispenser may presume that the patient identification information established in Section 5 of this administrative regulation and provided by the patient or the patient's agent is correct.Section 4.
Request for Report.(1)
A written or electronic request shall be filed with the cabinet prior to the release of a report, except for a subpoena issued by a grand jury or an appropriate court order issued by a court of competent jurisdiction.(2)
A request for a KASPER patient report shall be made electronically at www.chfs.ky.gov/KASPER.(3)
A request for a KASPER provider report made by a peace officer authorized to receive data under KRS 218A.202, or a designated representative of a board responsible for the licensure, regulation, or discipline of prescribing practitioners shall be made by written application on the KASPER Report Request for Law Enforcement and Licensure Boards, Form DCB-20L.(4)
A medical examiner engaged in a death investigation pursuant to KRS 72.026 may query KASPER for a report on the decedent.Section 5.
Patient Identification Number.(1)
A patient or the person obtaining the controlled substance on behalf of the patient shall disclose to the dispenser the patient's Social Security number for purposes of the dispenser's mandatory reporting to KASPER.(2)
If a patient is an adult who does not have a Social Security number, the patient's driver's license number shall be disclosed.(3)
If a patient is an adult who has not been assigned a Social Security number or a driver's license number, the number 000-00-0000 shall be used in the Social Security field.(4)
If a patient is a child who does not have a Social Security number or a driver's license number, the number "000-00-0000" shall be used in the Social Security field.(5)
If a patient is an animal, the number "000-00-0000" shall be used in the Social Security number field.Section 6.
KASPER Data and Trend Reports. Cabinet personnel shall have authorized access to the data obtained from the KASPER system and trend reports in accordance with KRS 218A.240(7)(a).Section 7.
Data Retention. Data shall be maintained in KASPER according to the Office of Inspector General's retention schedule on file with the State Archives and Records Commission.Section 8.
Error Resolution.(1)
A patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic to whom a report has been disclosed under KRS 218A.202(9) or this administrative regulation may request that information contained in KASPER be corrected if the patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic believes that any information is inaccurate. The patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic shall:(a)
Contact the dispenser who reported the information required by Section 2(2) of this administrative regulation; and(b)
Request that the dispenser correct the information.(2)
If, upon receipt of a request from a patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic pursuant to subsection (1) of this section, the dispenser confirms that the information was reported in error, the dispenser shall:(a)
Transmit corrected information to update the KASPER database within seven (7) calendar days of the request for the correction; and(b)
Notify the patient, patient's representative, practitioner, pharmacist, health facility, or private practitioner's office or clinic that the corrected information has been transmitted.(3)
If a dispenser identifies a KASPER system generated error, the dispenser shall notify the branch. Upon verification of the error, the branch shall:(a)
Correct the information in the KASPER database; and(b)
Notify the patient, patient's representative, practitioner, pharmacist, health facility, private practitioner's office or clinic within five (5) working days of the correction.Section 9.
Referrals to Licensing Boards. If the cabinet becomes aware that a prescriber or dispenser has failed to comply with the reporting requirements of KRS 218A.202 and this administrative regulation, the cabinet shall notify the licensing board or agency responsible for licensing the prescriber or dispenser.Section 10.
Disclosure of Data or Report.(1)
The cabinet shall only disclose data to the persons and entities authorized to receive that data under KRS 218A.202(7).(2)
As a condition precedent to the disclosure of data or a report pursuant to KRS 218A.202(7)(f), a hospital or long-term care facility shall maintain, and provide upon request by the cabinet, a copy of the hospital or long-term care facility's policy for the management of KASPER data and reports, which:(a)
Describes the hospital or long-term care facility's internal procedures for educating the designated employee or employees on the:1.
Proper use of the KASPER system;2.
Prohibition on the improper use or intentional disclosure of KASPER data to unauthorized individuals; and3.
Sanctions imposed for the improper use or intentional disclosure of KASPER data to unauthorized individuals, including criminal misdemeanor offenses; and(b)
Describes the hospital or long-term care facility's internal procedures for auditing the account, including:1.
The manner in which an employee is added to or removed from access to the account if the employee ends employment or is no longer designated to query KASPER; and2.
The actions taken if a designated employee with access to the employer's KASPER account intentionally misuses his or her privileges to KASPER data or a report, which shall include a report of the incident to the Office of Inspector General.(3)
(a)
An individual authorized to receive data under KRS 218A.202(7) shall not provide the data to any other entity except as provided in KRS 218A.202(9) and paragraph (b) of this subsection.(b)
In addition to the purposes authorized under KRS 218A.202(9)(e), and pursuant to KRS 218A.205(2)(a) and (6), a practitioner or pharmacist who obtains KASPER data or a report under KRS 218A.202(7)(e)1. or who in good faith believes that any person, including a patient, has violated the law in attempting to obtain a prescription for a controlled substance, may report suspected improper or illegal use of a controlled substance to law enforcement or the appropriate licensing board.(4)
A hospital or long-term care facility shall maintain and adhere to the entity's internal policy regarding the management of KASPER data and reports.Section 11.
Incorporation by Reference.(1)
The following material is incorporated by reference:(a)
"Implementation Guide, ASAP Standard for Prescription Monitoring Programs", American Society for Automation in Pharmacy, Version 4.2, September 2011; and(b)
"KASPER Report Request for Law Enforcement and Licensure Boards", Form DCB-20L, October 2017.(2)
This material may be inspected, copied, or obtained, subject to applicable copyright law, at the Drug Enforcement and Professional Practices Branch, Office of the Inspector General, Cabinet for Health and Family Services, 275 E. Main Street, Frankfort, Kentucky 40621, Monday through Friday, 8 a.m. to 4:30 p.m.HISTORY: (25 Ky.R. 966; 1367; eff. 12-16-1998; 32 Ky.R. 1927; 33 Ky.R. 120; eff. 7-24-2006; 34 Ky.R. 2609; 35 Ky.R. 283; eff. 9-5-2008; 2615; eff. 7-31-2009; 39 Ky.R. 629; 1218; 1413; 2033; eff. 3-4-2013; 44 Ky.R. 378, 1026, 1346; eff. 1-5-2018; TAm eff. 3-20-2020.)