1117-0038 Support Statement 2006

10

Supporting Statement for Paperwork Reduction Act Submissions

21 CFR Part 1311

This Information Collection Request (ICR) addresses the recordkeeping and reporting requirements for acquiring and learning to use a digital certificate issued by DEA Certification Authority to sign electronic orders for Schedule I and II controlled substances.

Part A. Justification

1. Necessity of information: The Controlled Substances Act (CSA) (21 U.S.C. 801 et seq.) requires the Drug Enforcement Administration to establish a closed system of control for substances that have a potential for abuse. Section 828 of the CSA mandates that DEA provide a form to registrants to be used to purchase Schedule I and II controlled substances. No person may distribute a Schedule I and II controlled substance except in response to an order issued on the DEA-provided form. DEA’s regulations implementing section 828 are in 21 CFR part 1305.

DEA’s regulations allow registrants to issue orders for Schedule I and II controlled substances electronically provided that the electronic order is signed using a digital certificate issued by the DEA Certification Authority. A digital certificate, issued as part of a public key infrastructure (PKI), is necessary to meet the standards of authentication, nonrepudiation, and record integrity that DEA adopted to ensure that the mandated closed system of controls continues. At present, only PKI systems meet the standards. The use of digital signatures allows registrants to create, sign, transmit, and store records electronically. Reports to DEA are also electronic.

Because the CSA mandates that DEA issue the form, DEA operates the Certification Authority. The digital certificate serves as the equivalent of the Form 222 because the data that DEA preprints on the form are included as extension data on the digital certificate. Registrants or their staff who have power of attorney to sign orders are required to apply for a digital certificate, which DEA issues when it has determined that the applicant is eligible to sign orders for Schedule I and II controlled substances.

2. Needs and Uses: The application for a digital certificate is required to ensure that the person applying for the certificate is either a DEA registrant or someone who has power of attorney from a DEA registrant to sign orders for Schedule I and II substances. The DEA Certification Authority uses the information to verify the person’s identity and eligibility to hold a DEA-issued digital certificate.

3. Efforts to Minimize Burden: Because the applications must include one or more original signatures, they must be collected on paper. Most renewals of certificates will be handled electronically.

4. Efforts to Identify Duplication: Digital certificates must be provided only to eligible parties. Most of the information required on the application does not duplicate information that DEA currently collects. DEA does not have information on individuals granted power of attorney to sign orders.

5. Methods to Minimize Burden on Small Businesses: This information collection does not have a significant impact on small businesses. The move to electronic orders will reduce the burden on small entities. In addition, registrants are not required to use digital certificates or electronic orders; their use is optional.

6. Consequences of Less Frequent Collection: For the application for a digital certificate, DEA must have sufficient information to verify the identity and registration status of the applicant. Because the validity of the certificate is based on an active DEA registration, the digital certificate must expire at the same time as the registrant’s DEA registration. Most registrations expire every three years. DEA does not require resubmission of information until the third renewal of a certificate.

If the information collection is not conducted, DEA registrants would not be authorized to issue orders for Schedule I and II substances electronically. The paper-based system imposes substantial costs on the regulated community both because it requires the use of a special form and because virtually all other ordering is done electronically. The use of digital certificates makes it possible to integrate these orders into existing systems and reduce the costs of ordering.

7. Special Circumstances Influencing Collection: None of the special circumstances are applicable to this information collection.

8. Consultations with the Public: DEA meets regularly with the affected industry to discuss programs, policies, and procedures.

9. Payment or Gift to Claimants: There are no such payments or gifts to respondents.

10. Assurance of Confidentiality: Release of information concerning individual registrants is restricted under the Privacy Act of 1974.

11. Justification for Sensitive Questions: Questions of a sensitive nature are not included in reporting requirements.

12. Estimate of Hour Burden:

All hour burden estimates in this ICR are based on the Economic Impact Analysis (EIA) conducted in support of the rule for the controlled substance ordering system (70 FR 16901, April 1, 2005). Estimates of the number of certificates are based on actual certificates issued.

Regulated Entities

In the EIA, DEA estimated that if all registrants who issued orders for Schedule I and II controlled substances obtained digital certificates, DEA would issue 145,400 certificates to 97,600 registrants. The majority of registrants were expected to be pharmacies. DEA estimated that registrants would adopt digital certificates over a period of five years. For the purposes of the analysis, DEA assumed adoption rates of 20 percent in year one, 40 percent in year two, 20 percent in year three, and 10 percent in each of years four and five.

DEA began issuing certificates in August 2005. As of July 31, 2006, DEA had issued 20,727 certificates to 14,082 registrants. Approximately 43 percent of the distributors registered to handle Schedule I and II substances have obtained certificates as have about 20 percent of registered pharmacies. Table 1 shows the number of registrants issued certificates as of July 31, 2006, and the number of certificates issued.

Table 1: Number of Regulated Entities

Registrant Type	Number of Registrants	Number of Certificates
	Suppliers
Manufacturers	11	11
Distributors	195	442
Importers	0	0
Reverse Distributors	1	10
	Purchasers
Hospitals/Clinics	1077	2338
Pharmacies	12,706	17802
Teaching Institutions	0	0
Exporters	6	9
Narcotic Treatment Programs	5	10
Researchers	9	11
Chemical Analysts	0	0
Practitioners	72	97
TOTAL	14,082	20,730

The number of certificate holders is the number of people at each type of registrant who either signed the registration application or who hold power of attorney (POA) to sign orders on behalf of a registrant.

Registrants are required to appoint a Controlled Substances Ordering System (CSOS) coordinator, who is the point of contact between DEA and the registrants. The coordinator must have a digital certificate and is responsible for checking applications and submitting the application packages for all applicants from the registered location(s) which he or she coordinates. Only the coordinator application is notarized. If there is only one applicant, that person would be the CSOS coordinator. Firms may elect to have a coordinator per location or may have a coordinator for multiple locations.

Activities

This ICR covers the activities related to applying for and learning to use a digital certificate. For the three-year period covered by this ICR, DEA assumes that 30 percent of the registrants issuing orders will obtain digital certificates in the first ICR year, 30 percent in the second year, and 10 percent in the third year. By the end of the ICR period, therefore, an additional 70 percent of registrants and their authorized staff will have incurred the cost of applying for and obtaining a digital certificate. Thus, by the end of the ICR period, about 90 percent of registrants and their authorized staff will have obtained digital certificates. DEA altered its phase-in assumptions from the EIA because several large pharmacy chains have told DEA that they intend to apply for digital certificates when they next upgrade their systems. At that point they will add PKI capability to their ordering process.

The digital certificate costs include the following activities:

• Reading the subscriber manual and agreement and completing and mailing an initial application for a digital certificate.

• Generating private and public keys and completing the process of obtaining a digital certificate.

• Learning how to use a digital signature (for those who implement at the firm rather than location level).

• Renewing the digital certificate.

Applicants have to complete either a DEA CSOS Certificate Application or a DEA CSOS Coordinator Application. Both applications require basic information (name, address, social security number, phone number, e-mail address, DEA registration number and registrant name). An applicant who is not a CSOS coordinator must sign the application and have the CSOS coordinator sign it as well.

The CSOS coordinator application allows the coordinator to list multiple DEA registrations if the coordinator is responsible for multiple locations. The coordinator must also provide the organization name and address. The coordinator application must be signed by an officer of the organization, by the applicant, and by a notary. All applications must be accompanied by copies of two forms of identification, one a government-issued photographic identification. The CSOS coordinator is responsible for collecting the application packages for all applicants under his/her control and forwarding them to the DEA Certification Authority (CA) along with his/her notarized application.

The CA issues an approved applicant an access code and a password, sent by different methods (e.g., mail and e-mail). The applicant uses the codes to access the CA through the Internet and request a digital certificate. The applicant’s browser generates a public-private key pair (all recent browsers are PKI-enabled). The public key must be sent to the CA, which associates the key with the digital certificate it issues to the applicant. Each certificate holder has to learn to use the system.

Firms have to install software to PKI-enable their existing ordering systems. Software installation occurs at the firm level. Chain pharmacies, distributors, and hospital and clinic chains are assumed to install the software centrally and migrate it to each of their sites. Because software implementation includes training staff in its use, certificate holders at firms that install the software centrally are assumed to incur additional training time for certificate holders. Where software implementation occurs at each registered location (e.g., independent pharmacies, practitioners), training is assumed to be part of the implementation. The cost of software implementation and development are included in DEA’s ICR for orders [OMB control # 1117-0010].

Finally, certificates have to be renewed when the DEA registration on which the certificate is based is renewed. Dispensers (hospitals/clinics, practitioners, pharmacies, and teaching institutions) need to renew every three years. All other registrants need to renew annually. Every third renewal requires the resubmission of an application. Other renewal requests could be done electronically. A new digital certificate is issued at each renewal.

Table 2 presents the number of activities for full adoption of digital certificates.

Table 2: Number of Activities for Obtaining a Digital Certificate

Activity	Number of Respondents	Activities per Respondent	Total Number of Activities
Reading and completing the application	145,400	1	145,400
Generating keys	145,400	1	145,400
Learning to use the system	145,400	1	145,400
Renewals	130,600	1/3 years	145,400
	14,800	1/year

Burden Hours and Costs

To monetize time spent on various activities to obtain a certificate, BLS wage rates for a purchasing manager (for suppliers) and pharmacists for purchasers are inflated to 2006 dollars, loaded with fringe benefits (32 percent for pharmacist, 42 percent for wholesalers based on 2006 BLS data, and with overhead based on a survey of overhead rates for government contractors (56 percent of wages plus fringe).¹ The weighted wage rates are summarized in Table 3.

Table 3: Weighted Hourly Wage Rates

Type	Basic Activity	Hourly Rate
Supplier	Signing, Verifying	$84.30
Purchaser	Signing, Verifying	$92.62

Table 4 presents the unit hours and labor costs for obtaining a digital certificate.

Table 4: Unit Cost for Obtaining and Renewing a Digital Certificate

Task	Hours/Person	Unit Cost	Hourly Wage
Purchaser
Complete application	0.72	$66.69	$92.62
Complete application – coordinator	1.24	$114.85	$92.62
Generate keys	0.083	$7.72	$92.62
Learn to use	0.417	$38.59	$92.62
Renewal - one year	0.083	$7.72	$92.62
Renewal – 3 year-annual	0.083	$7.72	$92.62
Supplier
Complete application	0.72	$63.58	$88.30
Complete application – coordinator	1.24	$109.49	$88.30
Generate keys	0.083	$7.36	$88.30
Learn to use	0.417	$36.79	$88.30
Renewal	0.083	$7.36	$88.30

As noted above, in the first 12 months of CSOS implementation, 20,727 certificate applications were processed; these represent about 14 percent of the estimated potential total of 145,400. DEA estimates that by the end of the 18 months covered by the previous ICR, about 25,000 digital certificates will be issued. Tables 5 through 7 present the total annual burden hours and labor costs for the three years covered by this ICR, assuming that digital certificates will phase in as follows:

• In year 1, 30 percent of the registrants will apply for digital certificates.

• In year 2, 30 percent of the registrants will apply for digital certificates.

• In year 3, 10 percent of the registrants will apply for digital certificates.

Table 8 presents the total annual burden hours and labor costs for each of the three years covered by this ICR, the three-year total, and the annualized costs.

Table 5: Total Burden Hours and Labor Hours for Year 1

Activity	#	Hours	Dollars
Completing application	45,079	42,408	$3,923,115
Generating keys	45,079	3,757	$347,410
Learning system	16,423	6,843	$631,154
Renewals	9,016	316	$29,167
Total		53,324	$4,930,845

Table 6: Total Burden Hours and Labor Hours for Year 2

Activity	#	Hours	Dollars
Completing application	45,079	42,408	3,923,115
Generating keys	45,079	3,757	347,410
Learning system	16,423	6,843	631,154
Renewals	18,032	632	$58,334
Total		53,640	$4,960,012

Table 7: Total Burden Hours and Labor Hours for Year 3

Activity	#	Hours	Dollars
Completing application	15,026	14,136	1,307,705
Generating keys	15,026	1,252	115,803
Learning system	5,474	2,281	210,385
Renewals	27,048	948	87,501
Total		18,617	$1,721,393

Table 8: Total Annual and Three-Year Hours and Labor Costs

Year	Total Burden Hours	Labor
First	53,324	$4,930,845
Second	53,640	$4,960,012
Third	18,617	$1,721,393
Total	125,581	11,612,251
Annual	41,860	$3,870,750

13. Estimate of Cost Burden:

The only O&M cost attributable to initial compliance is the cost of notarizing the application package ($2.00) and the cost of mailing it to the DEA CA ($8.05 for express shipping at the least expensive rate (based on FedEx Express saver)).

Applying for a digital certificate requires only an Internet browser that is enabled for digital signatures, as all recent browsers have been. The cost of any software changes is not specifically related to digital certificates. Current Internet browsers are PKI-enabled, and orders could be digitally signed and e-mailed. Costs related to software development and installation are included in DEA’s ICR for orders.

The annual and three-year O&M costs have been estimated on the same basis as hours – that is, the electronic system phases in. Table 9 presents the three year and annual costs.

Table 9: Total Annual and Three Year O&M Costs

Year	O&M	Total
First	$192,327	$192,327
Second	$192,327	$192,327
Third	$64,109	$64,109
Total	$448,763	$448,763
Annual	$149,588	$149,588

14. Estimated Annualized Cost to Federal Government:

DEA operates, through a contractor, the Certification Authority, which does the following:

• Provides applicants with application materials.

• Verifies identities and DEA status of applicants

• Provides approved applicants with password and access codes to allow them to complete the application process.

• Maintains a directory of public keys.

• Maintains a Certificate Revocation List.

It should be noted that there will be no actual cost to the Federal Government for these activities as all costs are recovered from registrants through registration fees, as required by the Departments of Commerce, Justice, and State, the Judiciary, and Related Agencies Appropriations Act of 1993.

Table 10 presents the burden hours and costs for the application forms covered by this ICR. The three-year cost assumes the phasing in of the electronic system discussed above. CSOS also includes a form for a registrant to apply for a digital certificate. In almost all cases where a registrant applies for a certificate (practitioners, independent pharmacies, narcotic treatment programs), the registrant would be serving as the CSOS coordinator and completing that form. Because officers of companies are required to sign a registration application, it is unlikely in larger firms (manufacturers, distributors, hospitals, chain pharmacies) that the person signing a registration would also sign orders. Consequently, DEA has accounted for all applications as either POA or coordinator applications. Table 11 presents the total burden hours, labor costs, and O&M costs for this ICR.

Table 10 Total Hours and Costs for Forms

	POA Application		CSOS Coordinator Application
Year	Hours	Costs	Hours	Costs
First	18,678	$1,725,701	23,730	$2,197,415
Second	18,678	$1,725,701	71,190	$2,197,415
Third	6,226	$575,234	7,910	$732,472
Total	43,583	$4,026,635	102,829	$5,127,301
Annual	14,528	$1,342,212	34,276	$1,709,100

Table 11: Summary of Burden Hours and Costs

Year	Total Burden Hours	Labor	Other Costs	Total
First	53,324	$4,930,845	$192,327	$5,123,172
Second	53,640	$4,960,012	$192,327	$5,152,339
Third	18,617	$1,721,393	$64,109	$1,785,502
Total	125,581	11,612,251	$448,763	$12,061,013
Annual	41,860	$3,870,750	$149,588	$4,020,338

15. Reasons for Change in Burden: This ICR covers a renewal of a voluntary program that is in the process of being adopted by the regulated entities.

16. Plans for Publication: There are no plans to publish the information.

17. Expiration Date Approval: DEA is not requesting an exemption from this requirement.

18. Exceptions to the Certification Statement: There are no exceptions to the certification statement.

Part B. Statistical Methods

The Drug Enforcement Administration will not be employing statistical methods in this information collection.

1 Wage rates are from BLS, May 2005 National Industry-Specific Occupational Employment and Wage Estimates; wage inflation rates are from BLS Employment Cost Index, accessed 7/10/2006; fringe rates are from BLS, Employer Costs for Employee Compensation – March 2006; overhead load is from the 10^th Annual Grant Thornton Survey of Government Contractors.