0038 support statement 2009-10-14

9

Supporting Statement for Paperwork Reduction Act Submissions

Reporting and Recordkeeping for Digital Certificates

Information Collection 1117-0038

21 CFR Part 1311

This Information Collection Request (ICR) addresses the recordkeeping and reporting requirements for acquiring and learning to use a digital certificate issued by DEA Certification Authority to sign electronic orders for Schedule I and II controlled substances.

Part A. Justification

1. Necessity of information: The Controlled Substances Act (CSA) (21 U.S.C. 801 et seq.) requires the Drug Enforcement Administration to establish a closed system of control for substances that have a potential for abuse. Section 828 of the CSA mandates that DEA provide a form to registrants to be used to purchase Schedule I and II controlled substances. No person may distribute a Schedule I and II controlled substance except in response to an order issued on the DEA-provided form. DEA’s regulations implementing section 828 are in 21 CFR part 1305.

DEA’s regulations allow registrants to issue orders for Schedule I and II controlled substances electronically provided that the electronic order is signed using a digital certificate issued by the DEA Certification Authority. A digital certificate, issued as part of a public key infrastructure (PKI), is necessary to meet the standards of authentication, nonrepudiation, and record integrity that DEA adopted to ensure that the mandated closed system of controls continues. At present, only PKI systems meet the standards. The use of digital signatures allows registrants to create, sign, transmit, and store records electronically. Reports to DEA are also electronic.

Because the CSA mandates that DEA issue the form, DEA operates the Certification Authority. The digital certificate serves as the equivalent of the Form 222 because the data that DEA preprints on the form are included as extension data on the digital certificate. Registrants or their staff who have power of attorney to sign orders are required to apply for a digital certificate, which DEA issues when it has determined that the applicant is eligible to sign orders for Schedule I and II controlled substances.

2. Needs and Uses: The application for a digital certificate is required to ensure that the person applying for the certificate is either a DEA registrant or someone who has power of attorney from a DEA registrant to sign orders for Schedule I and II substances. The DEA Certification Authority uses the information to verify the person’s identity and eligibility to hold a DEA-issued digital certificate.

3. Efforts to Minimize Burden: Because the applications must include one or more original signatures, they must be collected on paper. Most renewals of certificates will be handled electronically.

4. Efforts to Identify Duplication: Digital certificates must be provided only to eligible parties. Most of the information required on the application does not duplicate information that DEA currently collects. DEA does not have information on individuals granted power of attorney to sign orders.

5. Methods to Minimize Burden on Small Businesses: This information collection does not have a significant impact on small businesses. The move to electronic orders will reduce the burden on small entities. In addition, registrants are not required to use digital certificates or electronic orders; their use is optional.

6. Consequences of Less Frequent Collection: For the application for a digital certificate, DEA must have sufficient information to verify the identity and registration status of the applicant. Because the validity of the certificate is based on an active DEA registration, the digital certificate must expire at the same time as the registrant’s DEA registration. Most registrations expire every three years. DEA does not require resubmission of information until the third renewal of a certificate.

If the information collection is not conducted, DEA registrants would not be authorized to issue orders for Schedule I and II substances electronically. The paper-based system imposes substantial costs on the regulated community both because it requires the use of a special form and because virtually all other ordering is done electronically. The use of digital certificates makes it possible to integrate these orders into existing systems and reduce the costs of ordering.

7. Special Circumstances Influencing Collection: None of the special circumstances are applicable to this information collection.

8. Consultations with the Public: DEA meets regularly with the affected industry to discuss programs, policies, and procedures.

9. Payment or Gift to Claimants: There are no such payments or gifts to respondents.

10. Assurance of Confidentiality: Release of information concerning individual registrants is restricted under the Privacy Act of 1974.

11. Justification for Sensitive Questions: Questions of a sensitive nature are not included in reporting requirements.

12. Estimate of Hour Burden:

All hour burden estimates in this ICR are based on the Economic Impact Analysis (EIA) conducted in support of the rule for the controlled substance ordering system (70 FR 16901, April 1, 2005). Estimates of the number of certificates are based on actual certificates issued.

Regulated Entities

DEA began issuing certificates in August 2005. As of October 8, 2009, DEA had issued 50,052 certificates that are still active to 24,968 registrants. Approximately 36 percent of the distributors registered to handle Schedule I and II substances have obtained certificates as have about 31 percent of registered pharmacies and 26 percent of the hospitals and clinics. Table 1 shows the number of CSOS registrants and active certificates as of October 8, 2009.

Table 1: Number of Regulated Entities

Registrant Type	Number of Registrants	Number of Active Certificates
Manufacturers	30	39
Distributors	165	248
Hospitals/Clinics	3,991	10,918
Pharmacies	20,274	38,062
Teaching Institutions	4	7
Exporters	2	2
Narcotic Treatment Programs	109	228
Researchers	29	29
Chemical Analysts	4	4
Practitioners	360	515
TOTAL	24,968	50,052

The number of certificate holders is the number of people at each type of registrant who either signed the registration application or who hold power of attorney (POA) to sign orders on behalf of a registrant.

Registrants are required to appoint a Controlled Substances Ordering System (CSOS) coordinator, who is the point of contact between DEA and the registrants. The coordinator must have a digital certificate and is responsible for checking applications and submitting the application packages for all applicants from the registered location(s) which he or she coordinates. Only the coordinator application is notarized. If there is only one applicant, that person would be the CSOS coordinator. Firms may elect to have a coordinator per location or may have a coordinator for multiple locations.

Activities

This ICR covers the activities related to applying for and learning to use a digital certificate. For the three-year period covered by this ICR, DEA has projected the annual number of certificates based on growth over the previous three years; registrant and certificate numbers are projected to increase by a factor of 1.21 per year. Although the number of certificates has been growing at a faster rate than the number of registrants, because many registrants obtain multiple certificates, when the larger chain pharmacies apply, as some have indicated they will, DEA expects that they will obtain certificates for relatively few people to cover all of their locations. The number of applications needed will, in these cases, be lower than the number of registered locations.

The digital certificate costs include the following activities:

• Reading the subscriber manual and agreement and completing and mailing an initial application for a digital certificate.

• Generating private and public keys and completing the process of obtaining a digital certificate.

• Learning how to use a digital signature (for those who implement at the firm rather than location level).

• Renewing the digital certificate.

Applicants have to complete either a DEA CSOS Certificate Application or a DEA CSOS Coordinator Application. Both applications require basic information (name, address, social security number, phone number, e-mail address, DEA registration number and registrant name). An applicant who is not a CSOS coordinator must sign the application and have the CSOS coordinator sign it as well.

The CSOS coordinator application allows the coordinator to list multiple DEA registrations if the coordinator is responsible for multiple locations. The coordinator must also provide the organization name and address. The coordinator application must be signed by an officer of the organization, by the applicant, and by a notary. All applications must be accompanied by copies of two forms of identification, one a government-issued photographic identification. The CSOS coordinator is responsible for collecting the application packages for all applicants under his/her control and forwarding them to the DEA Certification Authority (CA) along with his/her notarized application.

The CA issues an approved applicant an access code and a password, sent by different methods (e.g., mail and e-mail). The applicant uses the codes to access the CA through the Internet and request a digital certificate. The applicant’s browser generates a public-private key pair (all recent browsers are PKI-enabled). The public key must be sent to the CA, which associates the key with the digital certificate it issues to the applicant. Each certificate holder has to learn to use the system.

Firms have to install software to PKI-enable their existing ordering systems. Software installation occurs at the firm level. Chain pharmacies, distributors, and hospital and clinic chains are assumed to install the software centrally and migrate it to each of their sites. Because software implementation includes training staff in its use, certificate holders at firms that install the software centrally are assumed to incur additional training time for certificate holders. Where software implementation occurs at each registered location (e.g., independent pharmacies, practitioners), training is assumed to be part of the implementation. The cost of software implementation and development are included in DEA’s ICR for orders [OMB control # 1117-0010].

Finally, certificates have to be renewed when the DEA registration on which the certificate is based is renewed. Dispensers (hospitals/clinics, practitioners, pharmacies, and teaching institutions) need to renew every three years. All other registrants need to renew annually. Every third renewal requires the resubmission of an application. Other renewal requests could be done electronically. A new digital certificate is issued at each renewal.

Burden Hours and Costs

To monetize time spent on various activities to obtain a certificate, BLS wage rates for retail pharmacists are inflated to 2009 dollars, loaded with fringe benefits (33 percent for retail pharmacists based on 2009 BLS data, and with overhead based on a survey of overhead rates for government contractors (56 percent of wages plus fringe)).¹ Because purchasers hold more than 98 percent of the certificates and pharmacists at retail outlets and hospitals/clinics hold most purchaser certificates, the loaded rates for pharmacists are used as a conservative estimate (the wholesale loaded wage rate is lower). The wage rate is estimated to be $108.44. Table 2 presents the unit hours and labor costs for obtaining a digital certificate.

Table 2: Unit Hour and Cost for Obtaining and Renewing a Digital Certificate

Task	Hours/Person	Unit Cost	Hourly Wage
Complete application	0.72	$78.08	$108.44
Complete application – coordinator	1.24	$134.47	$108.44
Generate keys	0.083	$9.00	$108.44
Learn to use	0.417	$45.22	$108.44
Renewal - one year	0.083	$9.00	$108.44
Renewal – 3 year-annual	0.083	$9.00	$108.44

Existing certificates need to be renewed when the DEA registration expires. For pharmacies, hospitals, practitioners, and teaching institutions, certificates need to be renewed every 3 years; all other registrant groups must renew annually. Table 3 shows the number of new applications and renewals by year.

Table 3: Projected Responses by Year

	New Registrants	New certificates	1-Year Renewals	3-Year Renewal
Year 1	5,243	10,511	550	19,966
Year 2	6,344	12,718	666	24,159
Year 3	7,677	15,389	802	29,232

Table 4 presents the total annual burden hours and labor costs for each of the three years covered by this ICR.

Table 4: Total Burden Hours and Labor Costs by Year

Activity	#	Hours	Dollars
Completing application	10,511	10,294	$1,116,361
Generating keys	10,511	872	$94,607
Learning system	10,511	4,383	$475,315
Renewals	20,516	1,703	$184,659
Total Year 1		17,253	$1,870,942
Completing application	12,718	12,456	$1,350,796
Generating keys	12,718	1,056	$114,475
Learning system	12,718	5,303	$575,131
Renewals	24,824	2,060	$223,438
Total Year 2		20,876	$2,263,840
Completing application	15,389	15,072	$1,634,464
Generating keys	15,389	1,277	$138,514
Learning system	15,389	6,417	$695,909
Renewals	30,034	2,493	$270,334
Total Year 3		25,259	$2,739,220
Total Three Year		63,388	$6,874,003
Annualized		21,129	$2,291,334

13. Estimate of Cost Burden:

The only O&M cost attributable to initial compliance is the cost of notarizing the application package ($2.00) and the cost of mailing it to the DEA CA ($9.90 for express shipping at the least expensive rate (based on FedEx Express saver)). These costs apply to each new registrant, not to each new certificate holder because the coordinator submits a single package containing all applications for the registrant.

Applying for a digital certificate requires only an Internet browser that is enabled for digital signatures, as all recent browsers have been. The cost of any software changes is not specifically related to digital certificates. Current Internet browsers are PKI-enabled, and orders could be digitally signed and e-mailed. Costs related to software development and installation are included in DEA’s ICR for orders.

The annual and three-year O&M costs have been estimated on the same basis as hours – that is, growth is projected based on the growth over the previous three years. Table 5 presents the three year and annual costs.

Table 5: Total Annual and Three Year O&M Costs

Year	O&M
First	$62,395
Second	$75,498
Third	$91,353
Total	$229,246
Annual	$76,415

14. Estimated Annualized Cost to Federal Government:

DEA operates the Certification Authority, which does the following:

• Provides applicants with application materials.

• Verifies identities and DEA status of applicants

• Provides approved applicants with password and access codes to allow them to complete the application process.

• Maintains a directory of public keys.

• Maintains a Certificate Revocation List.

It should be noted that there will be no actual cost to the Federal Government for these activities as all costs are recovered from registrants through registration fees, as required by the Departments of Commerce, Justice, and State, the Judiciary, and Related Agencies Appropriations Act of 1993.

Table 6 presents the burden hours and costs for the application forms covered by this ICR. The three-year cost assumes the projected growth as discussed above. CSOS also includes a form for a registrant to apply for a digital certificate. In almost all cases where a registrant applies for a certificate (practitioners, independent pharmacies, narcotic treatment programs), the registrant would be serving as the CSOS coordinator and completing that form. Because officers of companies are required to sign a registration application, it is unlikely in larger firms (manufacturers, distributors, hospitals, chain pharmacies) that the person signing a registration would also sign orders. Consequently, DEA has accounted for all applications as either POA or coordinator applications. Table 7 presents the total burden hours, labor costs, and O&M costs for this ICR.

Table 6: Total Hours and Costs for Forms

	POA Application		CSOS Coordinator Application
Year	Hours	Costs	Hours	Costs
First	3,793	$411,295	6,502	$705,066
Second	4,589	$497,667	7,867	$853,129
Third	5,553	$602,177	9,519	$1,032,287
Total	13,935	$1,511,139	23,888	$2,590,482
Annual	5,553	$602,177	9,519	$1,032,287

Table 7: Summary of Burden Hours and Costs

Year	Total Burden Hours	Labor	Other Costs	Total
First	17,253	$1,870,942	$62,395	$1,933,337
Second	20,876	$2,263,840	$75,498	$2,339,338
Third	25,259	$2,739,220	$91,353	$2,830,573
Total	63,388	$6,874,003	$229,246	$7,103,249
Annual	21,129	$2,291,334	$76,415	$2,367,750

15. Reasons for Change in Burden: This ICR covers a renewal of a voluntary program that is in the process of being adopted by the regulated entities.

16. Plans for Publication: There are no plans to publish the information.

17. Expiration Date Approval: DEA is not requesting an exemption from this requirement.

18. Exceptions to the Certification Statement: There are no exceptions to the certification statement.

Part B. Statistical Methods

The Drug Enforcement Administration will not be employing statistical methods in this information collection.

1 Wage rates are from BLS, May 2008 National Industry-Specific Occupational Employment and Wage Estimates; wage inflation rates are from BLS Employment Cost Index, accessed 10/6/09; fringe rates are from BLS, Employer Costs for Employee Compensation –June 2009; overhead load is from the 10^th Annual Grant Thornton Survey of Government Contractors.