E-prescribing could be boon for biometrics
Two-factor authentication required for electronic prescription of controlled substances
17 November, 2010
category: Biometrics, Government, Health, Library
The U.S. Drug Enforcement Administration (DEA) issued a new rule requiring doctors and pharmacists to use two-factor authentication when electronically prescribing controlled substances.
The rule could mean big business for the biometrics industry, says Bill Spence, vice president of transaction systems for fingerprint biometric manufacturer Lumidigm.
Titled, “Electronic Prescriptions for Controlled Substances,” the rule became effective June 1. It does not require doctors to submit these prescriptions electronically nor does it require pharmacies to accept electronic submissions, but it does govern the process when utilized.
The doctor or pharmacist creating the prescription must authenticate, according the DEA, with two of the following: “something you know (a knowledge factor), something you have (a hard token stored separately from the computer being accessed), and something you are (biometric information). The hard token, if used, must be a cryptographic device or a one-time-password device that meets Federal Information Processing Standard 140-2 Security Level 1.”
E-prescribing enables a physician to prescribe medication via a computer or mobile device. These systems are typically integrated with electronic medical records and help prevent harmful drug interactions and incorrect dosing.
While the DEA did not specify what, if any, specific mode of biometrics would be required under the e-prescription rule, they acknowledged that they would work with the National Institute for Standards and Technology to establish guidance for the program.
There are other options for two-factor authentication besides biometrics. Tokens, complicated passwords, as well as ‘smart’ or ‘out of wallet’ questions could be used. But these options take too much time and/or require the individuals to carry around a piece of hardware, says Spence, whereas a biometrics is always with the individual and enables rapid authentication.
Ohio already has a similar rule in place. “The state adopted an approach with e-prescribing saying that you always need a second factor and they essentially have adopted biometrics as that form,” he says.
A challenge with fingerprint biometrics in this environment is that health care workers frequently wear rubber gloves. They must remove the gloves to present the biometric, and the ongoing use of the gloves can dry out the skin making it difficult to get a good fingerprint scan.
Lumidigm released a new fingerprint scanner to deal with this problem, Spence says. Its Mercury Series fingerprint sensors use Lumidigm’s multi-spectral technology that captures the fingerprint data from beneath the surface of the skin and can read fingerprint images through latex gloves.
“It’s going to be a little more expensive for the device, but it’s not always about the price, it’s about the performance,” he stresses.
Some of the scanners are already deployed in health care, Spence says, and we are fielding a lot of question from providers about the technology and how to deploy it. “It’s no longer the question of what are biometrics.”
The question now is how to turn them on.
About the E-Prescribing rule
The Electronic Prescriptions for Controlled Substances rule was issued by the U.S. Drug Enforcement Administration (DEA) as an amendment to the Comprehensive Drug Abuse Prevention and Control Act of 1970, commonly known as the Controlled Substances Act (CSA).
The CSA is designed: “to ensure an adequate supply of controlled substances for legitimate … purposes, and to deter the diversion of controlled substances to illegal purposes. The CSA mandates that DEA establish a closed system of control for manufacturing, distributing, and dispensing controlled substances. Any person who manufactures, distributes, dispenses … controlled substances must register with DEA and comply with the applicable requirements.”
In the official summary, the rule is described as follows:
“The DEA is revising its regulations to provide practitioners with the option of writing prescriptions for controlled substances electronically … The regulations provide pharmacies, hospitals, and practitioners with the ability to use modern technology for controlled substance prescriptions while maintaining the closed system of controls on controlled substances dispensing; additionally, the regulations will reduce paperwork for DEA registrants who dispense controlled substances and have the potential to reduce prescription forgery. The regulations will also have the potential to reduce the number of prescription errors caused by illegible handwriting and misunderstood oral prescriptions. Moreover, they will help both pharmacies and hospitals to integrate prescription records into other medical records more directly, which may increase efficiency, and potentially reduce the amount of time patients spend waiting to have their prescriptions filled.”
