controlled substance ordering system (csos)€¢ improved security measures • order originator...
TRANSCRIPT
![Page 1: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/1.jpg)
Pharmaceutical Training Seminar Diversion Control Division
Diversion Technology Section
Chris Jewell Richmond, VA
April 25 & 27, 2017
CONTROLLED SUBSTANCES ORDERING SYSTEM (CSOS)
![Page 2: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/2.jpg)
AGENDA
PROGRAM REVIEW • CSOS History and Overview • CSOS Concept of Operations • Ongoing Program Challenges
ADMINISTRATIVE & REGULATORY • Common Registration Enrollment Issues • Common Regulatory Audit Findings
![Page 3: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/3.jpg)
CSOS HISTORY & OVERVIEW
![Page 4: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/4.jpg)
CSOS HISTORY
• DEA tasked under the Controlled Substances Act of 1970 to regulate controlled substances
• Purchasers (pharmacies and distributors) of controlled substances have historically used a controlled paper DEA Form 222 to place their orders
• Industry requested DEA provide a provision to enable electronic
orders for controlled substances to integrate with their existing electronic orders for non-controlled substances
• CSOS is an allowance to existing regulations, not a mandate
![Page 5: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/5.jpg)
5
WHAT CSOS IS…
• An ordering system which allows users to place orders in a secure electronic environment
• A Voluntary option for ordering Controlled Substances
• A replacement for the DEA Paper 222 Order Form – but may be used in conjunction with the paper order form
• 100% funded by DEA Diversion Control Fee Account
![Page 6: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/6.jpg)
6
WHAT CSOS IS…
• A PKI Technology Based Trust Framework…
That must provide the following: • Authentication: must positively verify the signer • Non-repudiation: strong and substantial evidence of the
sender’s identity • Message Integrity: must determine whether the
contents of the order have been altered in transmission
![Page 7: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/7.jpg)
7
BENEFITS & CHALLANGES
![Page 8: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/8.jpg)
8
THE BENEFITS OF CSOS
• Improved Customer Service • The Regulations provide allowances for new business
processes such as centralized ordering from a single location for all stores within a chain
• Reduced Manual Effort • Manually prepared paper order forms are replaced by
electronically generated orders • Paper order form is limited to ten line items per order;
No limit on the number of line items on electronic orders
![Page 9: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/9.jpg)
THE BENEFITS OF CSOS
• Reduced Errors • Paper order form requires handwritten product description • Electronic orders will identify the product by its National Drug
Code (NDC)
• Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity • Non-repudiation of involvement by parties to a transaction
![Page 10: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/10.jpg)
10
THE BENEFITS OF ELECTRONIC ORDERING
PAPER 222 FORM • Only CI-II allowed • Only 10 lines/form • Only one location fills • Reports each month
ELECTRONIC ORDER • Can include CI-V • Any number of lines • Multiple fill locations • Reports every two (2)
business days
![Page 11: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/11.jpg)
ONGOING PROGRAM CHALLENGES
• Educating others on CSOS’ unique role DEA has as a Credential Service Provider (CSP) to industry
• Educating Pharma Community about PKI Technology • Ensuring systems not under DEA governance are compliant
with performance standards specified in 21 CFR - DEA requires external audit of ALL third-party ordering
systems of to ensure that FIPS 140-2 (Federal Information Processing Standard) and 21 CFR requirements are met
![Page 12: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/12.jpg)
12
ONGOING PROGRAM CHALLENGES
• Certificates only used in B2B transactions between supply chain partners within a regulated industry (Third-party ordering software)
• Commercial vendors and industry require sufficient lead
time to update ordering software in accordance with changes to Regulations and / or NIST policies
![Page 13: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/13.jpg)
13
CSOS MILESTONES & CURRENT STATS
![Page 14: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/14.jpg)
CSOS MILESTONES
• Initiation Phase began 1999
• Industry Pilot conducted 2002 through 2005
• Final Rule published June 2005
• CSOS launched August 2005
![Page 15: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/15.jpg)
CURRENT RESULTS
• Over 79,000 registered DEA locations have applied to CSOS
• Over 196,000 active certificates in production
• Larger chain pharmacies have now adopted CSOS into their ordering process
Nov. 2016
![Page 16: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/16.jpg)
CSOS APPLICANTS BY BUSINESS TYPE
Pharmacy
59,466
Hospital/Clinic
9,076
Practitioner
9,547
Mid-level Practitioner
528
Manufacturer
78
Distributor
348
Researcher
137
Analytical Lab
17
Importer
1
Exporter
15
Teaching Institution
9
Narcotic Treatment Maintenance
52
Narcotic Treatment Maintenance & Detoxification
379
Narcotic Treatment Detoxification
41
Narcotic Treatment Compounder/Maintenance
1
Narcotic Treatment Compounder/Maint & Detox
24
Business Activity Registrations (DEA# Locations)
Nov. 2016
![Page 17: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/17.jpg)
1,708 12,509
26,873 37,588
109,405
196,037
0
25,000
50,000
75,000
100,000
125,000
150,000
175,000
200,000
2005 2007 2009 2011 2013 2016
CSOS Active Certificates Trending
200520072009201120132016
Nov. 2016
![Page 18: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/18.jpg)
CSOS CONCEPT OF OPERATIONS (CONOPS)
![Page 19: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/19.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
DEA / DCD Headquarters
Cert Verification
CRL
Enrollment
Reporting of Order Form Information
Check Order for Alteration
Controlled Substance Shipments
Policy
![Page 20: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/20.jpg)
20
Enrollment Process
![Page 21: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/21.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser
DEA CSOS Certification
Authority
Enrollment
![Page 22: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/22.jpg)
22
DEA CSOS ENROLLMENT ROLES
• DEA Diversion Control Division CSOS • Credentialing Service Provider (CSP)
• Provides Identity Proofing and Certificate Management
• DEA CSOS Registrant Authority (RA) • Performs applicant identity proofing
• Receives & adjudicates applications • Receives & verifies revocations requests
• DEA CSOS Certificate Authority (CA)
• Issues / Generates Certificates – Ordering & Administrative • Distributes Authorization and Reference Codes • Generates Certificate Revocation Lists (CRL’s) • Revokes Certificates
DEA CSOS Certification
Authority
![Page 23: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/23.jpg)
23
PURCHASER CSOS ENROLLMENT ROLES
• DEA Registrant • Individual who signed the most recent application for DEA
Registration • Principal Coordinator
• Serve as an organization’s primary recognized CSOS contact
• Alternate Coordinator • Serve as an organizations secondary recognized CSOS
contact • Powers of Attorney (POA)
• Individuals who hold a valid POA to obtain and sign Schedule I and II controlled substance orders
Purchaser
![Page 24: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/24.jpg)
24
PURCHASER CSOS ENROLLMENT PROCESS
• Organizations must select and enroll a CSOS Coordinator • Organizations may have more than one CSOS Coordinator
• (i.e.) primary coordinator / alternate
• Organizations CSOS Coordinators perform local identification f and authentication required to issue a digital certificate
• Due to the complexity of the enrollment process, applicants should be directed to the Help Desk or CSOS web site for assistance with enrollment forms and processes
![Page 25: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/25.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser
DEA CSOS Certification
Authority
Enrollment
CSOS Certificate Issued Upon Successful Enrollment
![Page 26: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/26.jpg)
26
Ordering Process
![Page 27: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/27.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Enrollment
![Page 28: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/28.jpg)
Electronic Orders Defined
DIGITALLY SIGNING & TRANSMITTING A PURCHASE ORDER
![Page 29: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/29.jpg)
DIGITALLY SIGNING ORDERS
Pharmacist Private Key
Digitally “signed” Order
Controlled Substance Purchase Order
Digitally Signed Controlled Substance Orders
HASH
![Page 30: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/30.jpg)
ELECTRONIC ORDER CONTENT
• Order form number in the specified “YYX123456” format must be included in order content before order is signed
• The last 6 digits of the number should be sequential to aid in tracking outstanding orders
• Order number must be unique within a single registration location
• DEA number must be included in the body of the order • Other registration information (i.e.) address, business
activity, schedules, expiration date are contained in the certificate and are therefore not required to be in the body of the order
![Page 31: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/31.jpg)
ELECTRONIC ORDER CONTENT (CONT’D)
• NDC Code may be used in lieu of product description • system for viewing orders must translate / provide product
description to viewer • Once an order number is assigned to the order and it is
digitally signed, a copy of the order must be archived by purchaser regardless of whether order is rejected, voided, or cancelled
• Order must be readily retrievable at the registered location
![Page 32: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/32.jpg)
AN ELECTRONIC ORDER MUST.....
Contain the same information as a paper order Except: • Customer Registration Information: Name, Address, Schedules, Business Activity and Expiration Date (which is contained in the digital certificate) • NDC number may be substituted for product description • Number of order lines • Be signed using a digital signature issued by the CSOS
Certification Authority (CA)
![Page 33: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/33.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Enrollment
![Page 34: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/34.jpg)
34
Certificate & Order Verification Process
![Page 35: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/35.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Cert Verification
CRL
Enrollment
Check Order for Alteration
![Page 36: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/36.jpg)
36
Certificate Verification Process
![Page 37: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/37.jpg)
VERIFYING A SIGNED ORDER
HASH
Step 1 - Signing Process (Purchaser)
Pharmacist Private Key
Digitally “signed” Order
Step 2 - Verification Process (Supplier)
Digitally “signed” Order
Pharmacist Public Key
VERIFY HASH
Controlled Substance Purchase Order
Controlled Substance Purchase Order
Cert Verification
![Page 38: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/38.jpg)
38
Certificate Revocation List
![Page 39: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/39.jpg)
WHAT IS A CERTIFICATE REVOCATION LIST (CRL)
(DEA) CRL
Version Issuer
Revoked Certificates
Issuing Distribution Point
Cert. Serial # Rev. Date CRL Entry Extensions Reason flag
• List of all revoked certificates
• Published by the CA that issued the certificate
• Includes Revocation Date
• Revocation Reason
CRL
![Page 40: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/40.jpg)
CRL REQUIREMENTS
CRL Publishing Frequency
§ Publishes Certificate Revocation List (CRL) every 24 hours - In the event the Subscriber’s key has been
compromised – or lost – the CRL must be published within 6 hours of notifying the DEA
Relying Parties § Must check each order against the most recently published CRL to ensure that the certificate has not been revoked since signed
![Page 41: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/41.jpg)
41
Order Verification Process
![Page 42: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/42.jpg)
ORDER VERIFICATION
• Sellers system must determine the order has not been altered during transmission
• Seller must invalidate any order that has been altered
• Seller must check the substances ordered against the schedules the registrant is allowed to order
• Seller must invalidate any order that includes substances the registrant is not allowed to order
Check Order for Alteration
![Page 43: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/43.jpg)
ORDER AUTHENTICATION
• Validate Signature and Subscriber certificate • Orders that do not pass authentication must be rejected • Supplier must notify the purchaser of any orders that have
been rejected • Purchaser must maintain a record of rejected orders, including
the rejection notice from the supplier • Orders that are not officially accepted, are rejected, and
otherwise not filled need not be archived by the supplier • Seller must be able to produce digitally signed order and linked
records of distribution on demand
![Page 44: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/44.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Cert Verification
CRL
Enrollment
Check Order for Alteration
![Page 45: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/45.jpg)
45
Order Shipment Process
![Page 46: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/46.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Cert Verification
CRL
Enrollment
Check Order for Alteration
Controlled Substance Shipments
![Page 47: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/47.jpg)
CONTROLLED SUBSTANCE ORDERING SHIPMENTS
When purchaser receives order: • Record of receipt must be linked to original order record • For rejected or cancelled orders (or portions of orders) the
suppliers rejection notice must be maintained and linked to the original, archived order
Controlled Substance Shipments
![Page 48: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/48.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Cert Verification
CRL
Enrollment
Check Order for Alteration
Controlled Substance Shipments
![Page 49: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/49.jpg)
49
CSOS TWO-DAY REPORTING (SELLER)
![Page 50: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/50.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
DEA / DCD Headquarters
Cert Verification
CRL
Enrollment
Reporting of Order Form Information
Check Order for Alteration
Controlled Substance Shipments
![Page 51: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/51.jpg)
SUPPLIER – CSOS REPORTING • Report of the line items shipped must be transmitted to DEA
within two business days (CSOS 2-Day Reporting) • Orders partially filled must be reported as such when
shipped • Report must consist of the orders received plus the linked
distribution records or a summary report containing the same information
• Format of report consists of Part A - 1st 80 characters standard ARCOS report of what was ordered
• Plus Part B - What was shipped; consisting of the following fields: *NDC # field (81) *Quantity field (92) *Unit field (100) *Strength field (101)
![Page 52: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/52.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
DEA / DCD Headquarters
Cert Verification
CRL
Enrollment
Reporting of Order Form Information
Check Order for Alteration
Controlled Substance Shipments
![Page 53: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/53.jpg)
CSOS CONCEPT OF OPERATIONS (CONOPS)
RECAP
![Page 54: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/54.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
DEA / DCD Headquarters
Cert Verification
CRL
Enrollment
Reporting of Order Form Information
Check Order for Alteration
Controlled Substance Shipments
Policy
![Page 55: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/55.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser
DEA CSOS Certification
Authority
Enrollment
![Page 56: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/56.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Enrollment
![Page 57: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/57.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Cert Verification
CRL
Enrollment
Check Order for Alteration
![Page 58: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/58.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
Cert Verification
CRL
Enrollment
Check Order for Alteration
Controlled Substance Shipments
![Page 59: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/59.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
DEA / DCD Headquarters
Cert Verification
CRL
Enrollment
Reporting of Order Form Information
Check Order for Alteration
Controlled Substance Shipments
![Page 60: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/60.jpg)
CSOS CONCEPT OF OPERATIONS
Controlled Substance Ordering System (CSOS)
Purchaser Seller
Digitally Signed Controlled Substance Orders
DEA CSOS Certification
Authority
DEA / DCD Headquarters
Cert Verification
CRL
Enrollment
Reporting of Order Form Information
Policy
Check Order for Alteration
Controlled Substance Shipments
![Page 61: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/61.jpg)
ADMINISTRATIVE & REGULATORY FINDINGS
![Page 62: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/62.jpg)
COMMON REGISTRATION ENROLLMENT ISSUES
![Page 63: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/63.jpg)
REGISTRATION ENROLLMENT ISSUES
Insufficient coordination of subscriber roles within organization
• Must have one Principle Coordinator per DEA registration
• Must have Principle Coordinator prior to enrolling other applicants
• Individual may only have one role per DEA registration (e.g.) Principle Coordinator, Power of Attorney
![Page 64: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/64.jpg)
REGISTRATION ENROLLMENT ISSUES
Incorrectly Filling Out Application Form • Missing signatures • Incorrect / Invalid e-mail address • Missing / Expired identification • Submitting application under an expired DEA
registration
![Page 65: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/65.jpg)
REGISTRATION ENROLLMENT ISSUES
Incomplete Applications • Initial rejection e-mail sent stating errors to correct • 45 day rejection reminder notice sent • 90 day / final rejection notice sent
No response to these notices results in application resubmission
![Page 66: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/66.jpg)
COMMON REGULATORY AUDIT FINDINGS
![Page 67: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/67.jpg)
CERTIFICATE MANAGEMENT
![Page 68: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/68.jpg)
CERTIFICATE MANAGEMENT
• Sharing certificates / passwords 21 C.F.R. § 1311.30
• Making backup copies of user certificate
21 C.F.R. § 1311.30
• Maintaining subscriber agreement 21 C.F.R. § 1311.60
![Page 69: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/69.jpg)
CERTIFICATE MANAGEMENT
• Expired DEA registration and renewing of digital certificates 21 C.F.R. § 1311.40
• DEA Registration changes and renewing digital
certificates (i.e.) name change, address change… 21 C.F.R § 1311.40
• Assignment / Maintaining of A Principle Coordinator
21 C.F.R. § 1311.20
![Page 70: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/70.jpg)
CERTIFICATE MANAGEMENT
• Maintaining a Power of Attorney Certificate Listing by Coordinator 21 C.F.R § 1311.45
![Page 71: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/71.jpg)
RECORD KEEPING
![Page 72: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/72.jpg)
RECORD KEEPING
• Readily Retrievable Records 21 C.F.R § 1311.60
• Recording Shipments / Linking of Orders
21 C.F.R § 1305.22
• Maintaining / Accessing Centralized Ordering 21 C.F.R § 1305.24
![Page 73: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/73.jpg)
RECORD KEEPING
• Independent Third- Party Software Auditing Records 21 C.F.R § 1311.55
![Page 74: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/74.jpg)
REGULATORY AUDIT FINDINGS RECAP
• Missing copy of Subscriber Agreement • Inability to electronically produce CSOS orders • Inability to identify electronic record keeping process • Sharing of CSOS certificates • Maintaining certificates of employees no longer with the
company
![Page 75: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/75.jpg)
CSOS REGISTRANT SUPPORT
1-877-DEA-ECOM (1-877-332-3266) www.deaecom.gov
![Page 76: Controlled Substance Ordering System (CSOS)€¢ Improved Security Measures • Order originator authentication through CSOS Certificate • Order content integrity •Non-repudiation](https://reader031.vdocuments.net/reader031/viewer/2022011802/5b4ab8937f8b9a403d8c683f/html5/thumbnails/76.jpg)
QUESTIONS