Supporting Statement for Paperwork Reduction Act Submissions
Reporting and Recordkeeping for Digital Certificates
Information Collection 1117-0038
21 CFR Part 1311
This Information Collection Request (ICR) addresses the recordkeeping and reporting requirements for acquiring and learning to use a digital certificate issued by DEA Certification Authority to sign electronic orders for Schedule I and II controlled substances.
Part A. Justification
1. Necessity of information: The Controlled Substances Act (CSA) (21 U.S.C. 801 et seq.) requires the Drug Enforcement Administration to establish a closed system of control for substances that have a potential for abuse. Section 828 of the CSA mandates that DEA provide a form to registrants to be used to purchase Schedule I and II controlled substances. No person may distribute a Schedule I and II controlled substance except in response to an order issued on the DEA-provided form. DEA’s regulations implementing section 828 are in 21 CFR part 1305.
DEA’s regulations allow registrants to issue orders for Schedule I and II controlled substances electronically provided that the electronic order is signed using a digital certificate issued by the DEA Certification Authority. A digital certificate, issued as part of a public key infrastructure (PKI), is necessary to meet the standards of authentication, nonrepudiation, and record integrity that DEA adopted to ensure that the mandated closed system of controls continues. At present, only PKI systems meet the standards. The use of digital signatures allows registrants to create, sign, transmit, and store records electronically. Reports to DEA are also electronic.
Because the CSA mandates that DEA issue the form, DEA operates the Certification Authority. The digital certificate serves as the equivalent of the Form 222 because the data that DEA preprints on the form are included as extension data on the digital certificate. Registrants or their staff who have power of attorney to sign orders are required to apply for a digital certificate, which DEA issues when it has determined that the applicant is eligible to sign orders for Schedule I and II controlled substances.
2. Needs and Uses: The application for a digital certificate is required to ensure that the person applying for the certificate is either a DEA registrant or someone who has power of attorney from a DEA registrant to sign orders for Schedule I and II substances. The DEA Certification Authority uses the information to verify the person’s identity and eligibility to hold a DEA-issued digital certificate.
3. Efforts to Minimize Burden: Because the applications must include one or more original signatures, they must be collected on paper. Most renewals of certificates will be handled electronically.
4. Efforts to Identify Duplication: Digital certificates must be provided only to eligible parties. Most of the information required on the application does not duplicate information that DEA currently collects. DEA does not have information on individuals granted power of attorney to sign orders.
5. Methods to Minimize Burden on Small Businesses: This information collection does not have a significant impact on small businesses. The move to electronic orders will reduce the burden on small entities. In addition, registrants are not required to use digital certificates or electronic orders; their use is optional.
6. Consequences of Less Frequent Collection: For the application for a digital certificate, DEA must have sufficient information to verify the identity and registration status of the applicant. Because the validity of the certificate is based on an active DEA registration, the digital certificate must expire at the same time as the registrant’s DEA registration. Most registrations expire every three years. DEA does not require resubmission of information until the third renewal of a certificate.
If the information collection is not conducted, DEA registrants would not be authorized to issue orders for Schedule I and II substances electronically. The paper-based system imposes substantial costs on the regulated community both because it requires the use of a special form and because virtually all other ordering is done electronically. The use of digital certificates makes it possible to integrate these orders into existing systems and reduce the costs of ordering.
7. Special Circumstances Influencing Collection: None of the special circumstances are applicable to this information collection.
8. Consultations with the Public: DEA meets regularly with the affected industry to discuss programs, policies, and procedures.
9. Payment or Gift to Claimants: There are no such payments or gifts to respondents.
10. Assurance of Confidentiality: Release of information concerning individual registrants is restricted under the Privacy Act of 1974.
11. Justification for Sensitive Questions: Questions of a sensitive nature are not included in reporting requirements.
12. Estimate of Hour Burden:
DEA Forms 251, 252, 253 and 254 are available to be completed and submitted in connection with this information collection.
Number of Respondents: 41,000
Frequency of Response: as needed
Total annual responses: 45,450
Average time per response: .58 hours
Total annual burden: 26,361 hours
The digital certificate costs include the following activities:
Reading the subscriber manual and agreement and completing and mailing an initial application for a digital certificate.
Generating private and public keys and completing the process of obtaining a digital certificate.
Learning how to use a digital signature (for those who implement at the firm rather than location level).
Renewing the digital certificate.
To monetize time spent on various activities to obtain a certificate, BLS wage rates for retail pharmacists is $54.51 for 2011.
Existing certificates need to be renewed when the DEA registration expires. For pharmacies, hospitals, practitioners, and teaching institutions, certificates need to be renewed every 3 years; all other registrant groups must renew annually.
Number of Responses: 45,450
Total annual burden: 26,361 hours
Total burden cost: $1,436,938
13. Estimate of Cost Burden:
The only O&M cost attributable to initial compliance is the cost of notarizing the application package ($2.00) and the cost of mailing it to the DEA CA ($9.90 for express shipping at the least expensive rate (based on FedEx Express saver)). These costs apply to each new registrant, not to each new certificate holder because the coordinator submits a single package containing all applications for the registrant.
Applying for a digital certificate requires only an Internet browser that is enabled for digital signatures, as all recent browsers have been. The cost of any software changes is not specifically related to digital certificates. Current Internet browsers are PKI-enabled, and orders could be digitally signed and e-mailed.
Estimated cost burden: $487,900
14. Estimated Annualized Cost to Federal Government:
There is no actual cost to the Federal Government for these activities as all costs are recovered from registrants through registration fees, as required by the Departments of Commerce, Justice, and State, the Judiciary, and Related Agencies Appropriations Act of 1993.
Many of the activities associated with CSOS are completed by contractors and are broken up into four categories. Network and Development refers to CSOS related contractor costs to maintain the CSOS computer network and to develop enhancements to the application. Operations cost refers to the work done by multiple contractors to process applications including reviewing, scanning, updating the database, approving, and preparing the paperwork that are sent to the CSOS applicant. The Call Center cost refers to the cost of contractors that respond to CSOS applicant questions.
Along with the Contractor costs, there is one GS 14 that works 100% of the time on CSOS.
Network: $768,936
Development: $ 38,085
Operations: $1,082,648
Call Center: $620,480
1 GS 14: $152,625
Total: $2,664,787
15. Reasons for Change in Burden: The estimates have been revised based on the responses received in the most recent years.
16. Plans for Publication: There are no plans to publish the information.
17. Expiration Date Approval: DEA is not requesting an exemption from this requirement.
18. Exceptions to the Certification Statement: There are no exceptions to the certification statement.
Part B. Statistical Methods
The Drug Enforcement Administration will not be employing statistical methods in this information collection.
| File Type | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| File Title | Supporting Statement for Paperwork Reduction Act Submissions |
| Author | Firebird User |
| File Modified | 0000-00-00 |
| File Created | 2021-01-30 |