Evolution and Convergence of State Laws Governing Controlled Substance Prescription Monitoring Programs, 1998-2011

Abstract

Objectives. We sought to collect and characterize all laws governing the operation of prescription monitoring programs (PMPs), state-level databases that collect patient-specific prescription information, which have been suggested as a tool for reducing prescription drug overdose fatalities.

Methods. We utilized a structured legal research protocol to systematically identify, review, and code all PMP statutes and regulations effective from 1998 through 2011. These laws were then abstracted along eleven domains, including reporting provisions, data sharing, and data access.

Results. PMP characteristics vary greatly among states and across time. We observed an increase in the types and frequency of data required to be reported, the types of individuals permitted to access PMP data, and the percentage of PMPs authorized to proactively identify outlier prescribers and patients. As of 2011, 10 states required PMPs to report suspicious activity to law enforcement, while only 3 required reporting to the patient’s physician. None required linkage to drug treatment or required all prescribers to review PMP data before prescribing. Few explicitly address data retention.

Conclusions. State PMP laws are heterogeneous and evolving. Future studies of PMP effectiveness should take these variations into account.

Prescription opioids have proven effective in providing relief from many types of moderate to severe pain.^1–5 Opioid prescriptions in the United States increased approximately 4-fold from 1999 to 2010, largely as a result of increased awareness of and efforts to address untreated pain.^6–8

Although this increase has been beneficial for many patients, it has also contributed to a dramatic rise in fatal and nonfatal opioid overdose.^9,10 Fatal poisonings, more than 90% of which are drug overdoses, have increased nearly 6-fold in the past 3 decades to become the country’s leading cause of injury death.¹¹ The rate of prescription opioid-involved deaths now exceeds the rate for heroin and cocaine combined.^6,12 There has also been a rapid increase in nonfatal opioid overdose, with emergency department visits involving nonmedical use of opioid analgesics more than doubling between 2004 and 2008.¹³

Although increased prescription opioid consumption is a key component of this rise, prescription opioid overdose is a complex phenomenon with a number of causal factors at both the prescriber and patient level.¹⁴ Providers may prescribe opioids in amounts or for durations or indications that are inconsistent with evidence-based practice, and patients may seek opioids from multiple providers because their pain is being inadequately managed or they have developed addiction or dependence.^15–17 Physician error, patient nonadherence, physical health status, poorly coordinated care, comorbidities such as substance use disorders, and a number of psychosocial factors also affect overdose risk.^14,18–21 Additionally, some unscrupulous physicians have operated “pill mills” that prescribe opioids in an indiscriminate and often illegal manner.^22,23

Prescription monitoring programs (PMPs) are state-level databases that collect patient-specific prescription information at the point of dispensing. Data are generated and transmitted to a central repository where, in most states, authorized users such as medical professionals, regulatory bodies, and law enforcement agencies may access them.

In theory, PMPs could help address many of the underlying causes of opioid overdose; they may make physicians more aware of the possible risks of prescribing a particular drug to a particular patient, help to coordinate care across providers, reduce overprescribing, assist in identifying patients who might benefit from screening for substance abuse treatment or referral to a pain medicine specialist, and permit law enforcement and regulatory agencies to detect patients and prescribers who may be engaging in illegal or unethical activities. Based on the assumption that PMPs can reduce opioid overdose, their implementation and utilization is recommended by the Centers for Disease Control and Prevention, and millions of dollars of federal funds have been earmarked to implement and upgrade them.^24,25 They are also a key component of the President’s Prescription Drug Abuse Prevention Plan, which sets the goal of decreasing unintentional opioid overdose deaths by 15% by 2016 and recommends that all states operate PMPs and require prescribers to be trained in their use.²⁶

However, no published research has shown a significant correlation between PMPs and overdose, and there is little evidence of their effect on other patient health outcomes. Existing research has largely evaluated the impact of PMPs on outcomes such as “doctor shopping,” prescribing practices, abuse and misuse, or benefits to law enforcement.^27–33 The only published analysis examining the effect of PMPs on overdose mortality found no significant difference between states with PMPs and those without them, although several limitations of that study have been noted.^34–36

This may be, in part, because nearly all studies of PMP effectiveness have used a crude binary measurement—whether the state had a PMP—as their dependent variable. This approach assumes that all PMPs can be treated homogenously regardless of their operational characteristics. This is a nontrivial assumption, which has been presented with little supporting evidence. In fact, PMPs vary greatly in ways that are likely to affect utilization and effectiveness.^37–40 There are wide variations between states and across time regarding such basic programmatic elements as the types of data required to be reported to the PMP, the frequency with which data must be sent from the dispenser to the central repository, who can access the data and in what circumstances, and where the PMP is administratively housed.

At the time previous studies were conducted, no longitudinal database of the statutes and regulations (hereafter referred to collectively as “laws”) governing PMP operational characteristics existed, making it extremely difficult to factor these variations into research designs. Using public health law research methods, we have created the first in-depth, long-term longitudinal analysis of laws governing PMP operation. This compendium covers relevant laws from 1998 to 2011 across all 50 states, and can inform future research.

METHODS

For each state, we first created a compilation of laws relevant to PMP enactment, implementation, and operation that were in effect between January 1, 1998, and December 31, 2011. The Westlaw legal database was utilized because it is accessible to most academic legal researchers, provides a historical record of all statutes and many regulations, and provides tools that permit researchers to search for existing relevant law, discover laws that cite to identified laws, and view previous versions of identified laws. Previous research has reported no differences between the laws available on Westlaw and LexisNexis, another popular legal database.⁴¹

Identification of Laws

We began the research by identifying all relevant PMP statues and regulations that were in effect at the time the research was conducted (February through July 2012) through several methods. First, we searched each state’s statutes and regulations using the string ((controlled w/1 substance!) OR (prescription!) OR (drug!)) w/1 (report! OR monitor! OR database OR repository). For statutes, we supplemented this text search with an index search, in which we searched each state’s statutory index for the terms “prescription,” “electronic database,” and “controlled substance.” All laws discovered through this process were reviewed for relevance by trained legal researchers using a rubric developed by the authors.

When these searches yielded a relevant law, the table of contents for the chapter containing the relevant law was examined to determine if any of the surrounding regulations or statutes was also relevant. Additionally, Westlaw’s “Citing References” function was utilized to review all laws that referenced the relevant laws. To minimize the possibility of missing relevant statutes or regulations, 2 researchers independently deployed this search scheme, and any law that was deemed relevant by at least 1 researcher was added to our database of relevant laws. We also added to our final set of relevant laws all statutes and regulations that had been identified by the National Alliance for Model State Drug Laws (NAMSDL), a nonprofit organization that maintains a compendium of PMP laws.⁴²

In addition to identifying all current PMP statutes and regulations, we utilized Westlaw’s History function to identify and categorize earlier versions of all laws deemed responsive to the research questions. Where earlier versions were not available through Westlaw, we utilized the Lexis database, the Hein database, and state websites and law libraries to procure them. Through this exhaustive process we were able to obtain all relevant laws for all states during the study period.

Legal Coding

For data abstraction, we created and followed a detailed protocol to ensure consistency between researchers and to permit others to review and update our results. Two researchers who were blinded to each other’s answers independently coded each of 42 variables. Each variable was coded for each state for each month of the study period. Upon completion, these answers were reviewed for divergence. Where answers differed, a final answer was reached by consensus of the research team. To calculate interrater reliability, we randomly selected 15 states by using a random number generator. Rates of divergence for all variables were recorded and calculated. The crude rate of discordance was 0.92, with most differences attributed to variations in interpretation of ambiguous laws.

The abstraction form collected data on the following 11 domains: general PMP operational characteristics, reporting provisions, outlier identification, data sharing between prescribers and dispensers, data access by researchers, patient access to data, data sharing with other PMPs, health professional access, law enforcement access, oversight, and confidentiality. The questions were developed via a comprehensive review of the literature regarding PMPs as well as input from PMP administrators, legal experts and epidemiologic researchers.

The full data set, codebook, and protocol are available at http://www.lawatlas.org.

RESULTS

In 1998, PMP legislation was present in only 13 states. By 2005 that number had nearly doubled to 25, and by the end of 2011, 46 states had passed PMP legislation (although 1, Wisconsin, had not yet enacted regulations specifying many operational characteristics; Figure 1). Although not analyzed as part of this research, an additional 3 states (Arkansas, Nebraska, and New Hampshire) passed authorizing legislation in 2012–2013, bringing the total number of states with enabling legislation to 49 as of December 31, 2013. The characteristics of these laws vary greatly among states, and in many cases have changed significantly over time.

FIGURE 1—

Growth of States enacting prescription monitoring program legislation: United States, 1998–2011.

Note. PMP = prescription monitoring program. The number of states with enabling legislation for prescription monitoring programs grew steadily from 1998 to 2011.

Operating Agency

There was a pronounced shift in the types of agencies that operate PMPs during the study period. In 1998, 6 of 13 PMPs were operated by, or in conjunction with, law enforcement agencies. Of those, 4 were housed solely in law enforcement or public safety agencies, while a fifth was operated jointly by the state law-enforcement agency and state pharmacy board, and a sixth was operated by the state attorney general. Conversely, only 2 of the 33 PMPs enacted between 1999 and 2011 are housed in law enforcement agencies. New Jersey’s PMP (authorized in 2009) is located in the Division of Consumer Affairs in the Department of Law and Public Safety, while Georgia’s (authorized in 2011) is operated by the state Drugs and Narcotics Agency “in consultation with members of the Georgia Composite Medical Board” (Ga. Code Ann. § 16-13-57).

Most recently enacted PMP laws place the PMP in either the state health department or a professional licensing agency, such as the state medical or pharmacy board. By 2011 approximately 35% of PMPs were administratively housed in health departments and 48% in professional licensing authorities.

Data Submission requirements

Time period for reporting.

During the study period, states markedly increased the frequency with which dispensers must report information to the PMP. In 1998, only 1 state required weekly reporting, and 8 (61.5%) required reports to be filed on a monthly basis. The remaining 4 states (33%) permitted reporting at a frequency less than monthly but greater than weekly. Between 2005 and 2011 requirements that data be uploaded at least weekly increased from 8.3% to 63% of states. Still, in 2011, 6 states (13%) permitted data to be uploaded at between weekly and monthly frequencies, and 9 states (19.6%) continued to permit monthly reporting. In 1998 and 2005 no states required same day reporting, but by 2011, 2 states (Oklahoma and North Dakota) required reporting within 24 hours or less.

Schedules monitored.

States, like the federal government, classify controlled substances into categories, or schedules, roughly based on their level of safety and potential for abuse. Most states follow the federal standard of 5 schedules (denoted by Roman numerals) with lower numbers indicating greater potential for harm.⁴³ Common Schedule II drugs include strong opioid analgesics such as oxycodone, methadone, and morphine, as well as stimulants prescribed for attention disorders like methylphenidate. Schedule III includes hydrocodone combination drugs, buprenorphine, anabolic steroids, and some products containing codeine (the Food and Drug Administration has recently recommended that hydrocodone combination drugs be moved to Schedule II). Schedules IV and V include benzodiazepines, the neuropathic pain agent pregabalin, and some sleep aids.

During the study period, states greatly increased the number of schedules required to be reported to PMPs (Figure 2). All state PMPs required reporting of Schedule II drugs for the entire study period. However, there was a steady increase in the proportion of states requiring Schedule III to be reported, increasing from 38.5% in 1998 to 97.8% in 2011. Schedule IV drugs followed a similar progression, increasing from 30.8% to 93.4%. Reporting requirements for Schedule V drugs saw an increase from 23.1% to 56.5% of states during the study period. Several states also require drugs not scheduled at the federal level to be reported to the PMP. For example, in 2006 Ohio became the first state to modify its law to explicitly require dispensers to report tramadol, an opioid that was not federally scheduled during the study period (in November 2013 the federal Drug Enforcement Administration issued a Notice of Proposed Rulemaking adding tramadol to Schedule IV). By 2011, 6 other states had taken the same step.

FIGURE 2—

Requirements for medicines in selected federal drug schedules to be included in state prescription monitoring programs: United States, 1998–2011.

Note. PMP = prescription monitoring program. All prescription monitoring programs required data on Schedule II medicines to be submitted during the entire study period. By 2011 nearly all states also required Schedules III and IV, but only approximately half required reporting of Schedule V medications.

Data Access

Proactive Access.

PMPs can be either proactive or reactive; they can reactively respond to external queries, or can proactively analyze data for statistically outlying prescribers, dispensers, or recipients of controlled substances. Those PMPs that are permitted to proactively analyze data are constrained by law in how they may disseminate any findings.

In 1998, 4 of 13 states (30.8%) with PMP laws were explicitly permitted to analyze submitted data, and 1 (Hawaii) was required to do so. In 2005, 10 states (41.6%) permitted the PMP to proactively analyze prescription data, while 3 (12.5%) required such analysis. By 2011, 26 states (56.5%) explicitly permitted the PMP to analyze collected data, of which 14 (30.4%) required such analysis. Of those 26 states, 10 required that individuals of concern be reported to law enforcement, 13 required reporting to the state professional licensing agency, and 3 required reporting to the prescriber or dispenser. Additionally, 8 states permitted (but did not require) reporting to law enforcement, while 7 permitted but did not require reporting to the medical professional and 5 to the state professional licensing agency.

Reactive Access.

In 1998, 12 out of 13 PMPs (92.3%) permitted law enforcement officers to access prescription data of identified individuals, while 61.5% permitted licensing boards to do so. Less than one third of states (23.1%) permitted physicians or pharmacists to access patient-identifiable data. This had changed dramatically by 2011, at which time 43 out of 46 states (93.5%) extended access to physicians and 41 (89.1%) to pharmacists. Pennsylvania was the only state that did not permit direct requests for patient data from any person or entity during the study period.

No requirements that prescribers access the PMP were in place in 1998 or 2005. By 2011, 5 states required some prescribers to access the PMP in some circumstances. Delaware requires prescribers to access the state PMP “when the prescriber has a reasonable belief that the patient may be seeking the controlled substance… for any reason other than the treatment of an existing medical condition” (Del. Code Ann. tit. 16 § 4798). Nevada employs the same standard, with the addition that the prescriber is required to access the PMP if the patient is also new to the practitioner or the practitioner has not prescribed a controlled substance to the patient in the previous 12 months. Ohio requires physicians to access the PMP if they suspect that a patient “may be abusing or diverting drugs” or when they have reason to believe that opioid therapy will be required “on a protracted basis,” and at least annually thereafter (Ohio Admin. Code § 4731-11-11). Louisiana’s requirement is limited to pain clinics, which are required to utilize the PMP “as part of the clinics’ quality assurance program” (La. Admin. Code tit. 48 § 7831). Oklahoma’s requirement is limited to practitioners who “prescribe, administer, or dispense” methadone (Okla. Stat. Ann. tit. 16 § 2-302).

The nature of access provided to law enforcement officials has changed over time. In 1998, 3 states permitted at least some law enforcement officials to access PMP data on request, with no requirement that the request be tied to an enumerated investigatory purpose or court order. Six states (46.2%) required an active investigation to be underway for some law enforcement to access identifiable PMP data. (Oklahoma appeared to permit some officers to access the database with no showing, while requiring that others be involved in an investigation.) One state permitted law enforcement access with a judicial subpoena or court order, and an additional 3 states permitted law enforcement access, but the law did not clearly specify what standard was employed.

In 2005 the same 3 states (12.5%) permitted law enforcement access without any link to an investigation, while 12 (50%) required an active investigation, 3 required a subpoena, 2 (8.3%) required probable cause, and 3 required some other showing. By 2011, the proportion of states permitting unfettered access had dropped to 11% (5 states), while 22 (47.8%) permitted access pursuant to an active investigation, 10 (21.7%) permitted access by subpoena, and 5 imposed some other requirement. Nine (19.6%) required a showing of probable cause. The law in 3 states did not appear to permit law enforcement to access PMP data. Some states permit access via multiple routes.

Data Safeguards.

Most state PMP laws contain penalties for illegal disclosure of PMP data, and the penalties have generally increased over time. In 1998, improper disclosure carried possible felony sanctions in 4 states (30.1%) and was a misdemeanor in 3 others. Six states (46.2%) had no explicit penalty for wrongful disclosure. In 2005, 13 states (52%) imposed criminal sanctions (6 at the felony level) while another 3 provided for other sanctions. Nine (37.5%) had no explicit penalty. By 2011, 28 states (60.8%) explicitly made improper disclosure of PMP data a crime (in 18 it can be charged as a felony) while 14 provided for civil or professional penalties. Only 8 states (17.3%) provided no explicit penalty for wrongful disclosure.

PMP data retention laws have evolved over time as well, but most states did not explicitly address retention of identifiable PMP data as of 2011. In 1998 the laws in 3 states (23.1%) directly addressed the question. Texas required data to be purged in 1 year or less, while 2 (Hawaii and New York) required all identifying information to be purged within 5 years. Two additional states (Maine and New York) added purging requirements by 2005. In 2011, 15 state PMP laws (32.6%) contained a requirement that data be de-identified or purged after a period of time, with most requiring data to be destroyed 5 years or less after submission.

DISCUSSION

PMP operational characteristics in most states changed dramatically between 1998 and 2011, and many attributes varied greatly between states during the same time period. We hope that the data reported here and available online will be beneficial to researchers attempting to determine the effects of PMPs, and of particular PMP characteristics, on opioid overdose and related health outcomes.

Some of these characteristics strike us as particularly worthy of focus. Most experts agree that if PMPs are to be effective, they must contain (1) timely and complete records of (2) all relevant data that can be (3) easily utilized by medical professionals and licensing agencies to guide medical decision-making and regulatory action.^44,45 This research identified positive trends in all of these areas. We found large increases in both the types of drugs required to be reported to state PMPs and the types of requesters permitted to access PMP data (as reported earlier, the proportion of state PMPs that permit physicians to directly access identifiable patient data increased from 23.1% in 1998 to 93.5% in 2011). The data also reveal substantial decreases in the amount of time permitted between when reportable drugs are dispensed and the transaction is reported to the PMP.

However, there are many areas in which PMPs fell short of expert recommendations. For example, as of 2011 only 5 states required prescribers to access the PMP, and those requirements applied only to a subset of prescribers in particular circumstances. Additionally, while as of 2011 about two thirds of states required that prescription data be reported to the PMP in 1 week or less, in 9 states (16.6%) transaction data were permitted to be as much as a month old before being reported.

Some experts have suggested that individuals identified by the PMP as receiving opioid prescriptions at an elevated rate should be referred for screening, counseling and addiction treatment as appropriate.^46,47 At the end of 2011 no states required or explicitly permitted such referrals. By contrast, 10 states required PMPs to proactively report personally identifiable suspicious prescription activity to law enforcement, while another 8 permitted such reports. Only 3 states required PMPs to report patients with statistically outlying prescription patterns to the patients’ physicians or pharmacists. By focusing on such variations in programs, researchers may be better able to discover whether the empirical evidence supports expert opinion regarding these characteristics.

The interplay between law enforcement and health professional data access seems to us a particularly promising area for further research. PMPs in nearly all states are tasked with providing data to both the medical and law enforcement communities. Law enforcement and public health goals can be complementary,^48–50 and PMPs may be capable of serving both public health and law enforcement ends. However, there is a long history of law enforcement interventions in the arena of illicit drug control contributing to negative public health outcomes,^51–55 and the possibility that some law enforcement uses of PMP data may negatively affect health is not well addressed in the existing literature.

For example, existing research typically does not differentiate between either the mechanisms by which law enforcement can access PMP data or the types of persons targeted by those data requests.^44,56 The logic model by which PMPs might be effective in reducing opioid overdose when the data are utilized by regulatory agencies and law enforcement officials to investigate grossly outlying prescribers, while unproven, seems to us to be plausible. Conversely, use of those data to facilitate the arrest, prosecution, and incarceration of patients suffering the disease of addiction might well lead to worse public health outcomes, including increased overdose deaths.^57–64 Research into this question would be extremely useful in guiding PMP law and policy.

The data presented here might also be useful in attempting to determine if PMPs or some PMP characteristics could have unintended negative consequences such as reductions in access to medically indicated pain treatment, distrust between patients and providers, and the diversion of prescription medication abusers toward street drugs such as heroin.^46,65–72 Finally, we note that, while PMPs may be an important piece of the overdose prevention puzzle, a marked reduction in opioid overdose mortality will likely only be accomplished with a multipronged approach that addresses its many correlates.^58,73–75

Limitations

This study examined state statutes and regulations explicitly regulating PMPs. It is possible that areas of law that were not examined in this research also impact PMP operation. This study did not capture operational characteristics that are not found in law, such as policy decisions made by the state PMP agency, nor did we attempt to discover whether the PMPs were operating in conformity with the law. Some relevant laws did not clearly address the study questions and were interpreted using general rules of statutory construction. Finally, our analysis is based on the date the law authorized the PMP to begin operations or modify operational characteristics, which in some cases may not match the date the PMP actually did so.

Conclusions

PMPs have been suggested as important tools in the effort to reduce the epidemic of prescription drug overdose. Research to determine whether and to what extent they are effective in that goal has been stymied in part because of a lack of a comprehensive database of PMP operational characteristics. We have created a transparent, replicable and updatable compendium of PMP laws in effect from 1998 through 2011. A review of these laws found that PMP laws changed dramatically over time, and vary greatly between states. Research into the effectiveness of PMPs should take these variations into account.