Electronic Ordering of Controlled Substances (Interim Guidelines)

1) Authentication and verification of orders

-The computer program must meet the requirements outlined in sections 27 of the Narcotic Control Regulations (NCR) and G.02.025 of the Controlled Drug Regulations (CDR) pertaining to the origin, authentification, safety and verification of the orders placed electronically. The intent of these sections is to prevent the loss or diversion of drugs by ensuring that only the authorized pharmacist and practitioner can operate the electronic ordering system.

2) Limitation of use to pharmacists and practitioners

Subsections 27(6) of the NCR and G.02.025 (5) of the CDR limit the use of electronic ordering to pharmacists and practitioners.

3) Tamper resistance

Paragraphs 27(6)(c) of the NCR and G.02.025 (5)(c) of the CDR require that the unique identifying code be "an integral part of the circuitry..." This requirement was specific to the RID and it may be inappropriate for current technologies. The proposed methodology and processes, however, must provide an equivalent or better level of tamper resistance than the current requirement for codes embedded in circuitry.

4) Digital signature

Paragraphs 27(8)(a) of the NCR and G.02.025 (7)(a) of the CDR states that a pharmacist or practitioner must provide a "signed receipt" to the licensed dealer confirming receipt of the drugs ordered. A digital signature would be considered an acceptable alternative for this purpose provided that:

• the signature algorithm and public key infrastructure chosen comply with an industry, national, or international standard;
• Proper security and audit procedures are followed with the chosen standard; and
• the certification authority is a trusted entity.

In addition:

• Safeguards must be put in place to prevent the unauthorized use of a pharmacist's or practitioner's digital signature;
• There must be a method for verification of the order with the pharmacist who is identified by the digital signature prior to the shipping of the drugs.

5) Audit

There is a need for the system to be able to produce hard copy reports for audit purposes. Information must be provided on the types of reports that would be available to the users of this system and the prescribed operating procedures to enable the performance of audits.