In accordance with Chapter 25.2 (§ 54.1-2519 et seq.) of Title 54.1 of the Code of Virginia and this chapter, the Director of the Department of Health Professions shall establish and administer a program for monitoring the dispensing of covered substances, which means all controlled substances included in Schedules II, III, and IV; controlled substances included in Schedule V for which a prescription is required; naloxone; and any other drugs of concern identified by the Board of Pharmacy pursuant to § 54.1-3456.1 of the Code of Virginia. Covered substances also include cannabidiol oil or THC-A oil medical cannabis dispensed by a pharmaceutical processor in Virginia.

A. Data shall be transmitted to the department or its agent within 24 hours of dispensing or the dispenser's next business day, whichever comes later.

B. Data shall be transmitted in a file layout provided by the department and shall be transmitted by a media acceptable to the vendor contracted by the director for the program. Such transmission shall begin on a date specified by the director, no less than 90 days from notification by the director to dispensers required to report.

C. Under extraordinary circumstances, an alternative means of reporting may be approved by the director.

D. Data not accepted by the vendor due to a substantial number of errors or omissions shall be corrected and resubmitted to the vendor within five business days of receiving notification that the submitted data contained had an unacceptable number of errors or problems.

E. Required data elements shall include those listed in subsection B of § 54.1-2521 of the Code of Virginia and the following:

1. The Drug Enforcement Administration (DEA) registration number of the dispenser;

2. The National Provider Identifier of the prescriber;

3. The total number of refills ordered;

4. Whether the prescription is a new prescription or a refill;

5. Whether the prescription is a partial fill;

6. The gender code;

7. The species code;

8. The Electronic Prescription Reference Number and the Electronic Prescription Order Number if it is an electronic prescription; and

9. The date the prescription was written by the prescriber.; and

10. The date the prescription was sold or delivered by the dispenser.

A. In accordance with § 54.1-2523 C of the Code of Virginia, the director may disclose information in the program to certain persons provided the request is made in a format designated by the department.

B. The director may disclose information to:

1. The recipient of the dispensed drugs, provided the request is accompanied by a copy of a valid photo identification issued by a government agency of any jurisdiction in the United States verifying that the recipient is over the age of 18 and includes a notarized signature of the requesting party. The report shall be mailed to the street or mailing address indicated on the recipient request form.

2. The prescriber for the purpose of establishing a treatment history for a patient or prospective patient or for the purpose of obtaining a record of prescriptions issued by that prescriber, provided the request is accompanied by the prescriber's registration number with the United States Drug Enforcement Administration (DEA). and attestation that the prescriber is in compliance with patient notice requirements of 18VAC76-20-70. The prescriber may delegate the submission of a request for information, provided the delegation is in compliance with § 54.1-2523.2 of the Code of Virginia. The health care professionals to whom the prescriber has authorized access to information shall be registered with the program. Requests for information made by a delegated health care professional shall be made in his own name, using his own unique identifiers assigned by the program.

3. Another regulatory authority conducting an investigation or disciplinary proceeding or making a decision on the granting of a license or certificate, provided the request is related to an allegation of a possible controlled substance violation and that it is accompanied by the signature of the chief executive officer who is authorized to certify orders or to grant or deny licenses.

4. Governmental entities charged with the investigation and prosecution of a dispenser, prescriber, or recipient participating in the Virginia Medicaid program, provided the request is accompanied by the signature of the official within the Office of the Attorney General responsible for the investigation.

5. A dispenser for the purpose of establishing a prescription history for a specific person to assist in determining the validity of a prescription, provided the request is accompanied by the dispenser's license number issued by the relevant licensing authority. and an attestation that the dispenser is in compliance with patient notice requirements of 18VAC76-20-70. The dispenser may delegate the submission of a request for information, provided the delegation is in compliance with § 54.1-2523.2 of the Code of Virginia. The health care professionals to whom the dispenser has authorized access to information shall be registered with the program. Requests for information made by a delegated health care professional shall be made in his own name, using his own unique identifiers assigned by the program.

C. In each case, the request must be complete and provide sufficient information to ensure the correct identity of the prescriber, recipient, or dispenser.

D. Except as provided in subdivision B 1 of this section and § 54.1-2525 C of the Code of Virginia, the request form shall include an attestation that the prescription data will not be further disclosed and will only be used for the purposes stated in the request and in accordance with the law.

E. In order to request disclosure of information contained in the program, a designated employee of the Department of Medical Assistance Services or of the Office of the Chief Medical Examiner shall register with the director as an authorized agent entitled to receive reports under § 54.1-2523 C of the Code of Virginia.

1. Such request for registration shall include an attestation from the applicant's employer of the eligibility and identity of such person.

2. Registration as an agent authorized to receive reports shall expire on June 30 of each even-numbered year or at any such time as the agent leaves or alters his current employment or otherwise becomes ineligible to receive information from the program.