21 Code For Federal Regulation Parts 1305, 1311 Page 19

ADVERTISEMENT

DEA believes that the system will provide cost savings to both purchasers and suppliers, but no
registrant is required to adopt electronic orders.
One vendor recommended that DEA adopt an approach more consistent with the
vendor’s technology. DEA is not dictating a particular technology or PKI implementation. Any
approved system that meets the criteria for authentication, non-repudiation, and record integrity
may be used.
Special Note regarding Certificate Extension Data
Finally, following publication of the proposed rule, DEA modified the specification for
the certificate extensions. Certain registrants had expressed concerns regarding using the
certificates for other health care purposes because their DEA registration number appeared in
plain text in the certificate, thus making it easily accessible to the recipient. To address this
concern, DEA has modified the certificate profile to allow that, in lieu of listing the plain text
DEA number, the DEA number extension will contain a hash value generated from the DEA
number and the specific certificate subject distinguished name serial number using the SHA-1
hashing algorithm. Because the DEA number will no longer be available in plain text in the
certificate, DEA is modifying the order format requirement in Section 1305.21 to require that the
purchaser include their DEA registration number in the body of the order. Further, Section
1311.55 is being amended to require that a supplier must verify that the DEA number listed in
the body of the order is the same as the DEA number associated with the certificate. The
verification is necessary to avoid circumstances where a person who has been granted POA for
multiple registered locations does not inadvertently sign an order with the wrong
certificate/private key.
19

ADVERTISEMENT

00 votes

Related Articles

Related forms

Related Categories

Parent category: Legal