9.4 The Utah Controlled Substance Database (CSD)

9.4 The Utah Controlled Substance Database (CSD)

Blueprint item 3.3 specifically includes "requirements for reporting to PMP and accessing PMP data." Utah's PMP is the Controlled Substance Database (CSD), created by Title 58, Chapter 37f and administered by DOPL under R156-37f.

What must be reported

• The PIC and the pharmacist of the outlet where a controlled substance is dispensed must submit the data (§ 58-37f-203(2)). A dispensing medical practitioner takes on the pharmacist's duty.
• The data covers each controlled substance dispensed and any noncontrolled substance DOPL designates by rule (§ 58-37f-203(3)). Gabapentin was collected as a designated noncontrolled drug starting in 2019 and has been a Utah Schedule V drug since 2024. The rule also calls out butalbital (R156-37f-203(7)–(8)).
• Exception: drugs dispensed for administration to, or use by, a patient at a health care facility, including an outpatient setting at the facility, are not reported (§ 58-37f-203(3)(b)).
• Hospital and ED dispensing of controlled substances to patients leaving the facility is reported through the appropriate pharmacy (R156-17b-610.5(4); R156-17b-610.6(3)).

When and how

Required data includes the pharmacy's NPI and NCPDP or DEA number; the patient's name, address, ZIP code, and date of birth; the prescription number, date written, refills authorized, fill date, and refill number; the NDC, quantity, and days' supply; the date sold; the prescriber's DEA number; the identification of the person picking up the prescription (ID type, number, issuing state, and name); and the dispensing pharmacist (R156-37f-203(4)).

Who may access the CSD (§ 58-37f-301)

Access is limited to categories listed in statute, including:

• pharmacists with authority to dispense controlled substances, and interns and technicians under a pharmacist's general supervision, for dispensing or considering dispensing, detecting fraud, reporting, or verifying submitted data;
• prescribers, for current or prospective patients, suspected fraud, and review of their own prescribing, plus designated employees DOPL approves after a background check;
• law enforcement and prosecutors with a valid search warrant in a controlled-substance investigation of a specific person (DOPL may also give limited non-identifying information in joint investigations);
• DOPL investigators and analysts, board members monitoring a licensee on probation, UPHP staff, DHHS for authorized studies and suspected improper acquisition, the medical examiner, Medicaid integrity and fraud units, probation and parole officers supervising a specific person, and others the statute lists; and
• the patient, who may see their own records and a list of who has requested them, unless under investigation. Patients may request corrections, which DOPL decides within 30 days.

Query duties

• Prescribers must register with the CSD, completing an online tutorial and test that must be answered 100% correctly (§§ 58-37f-401, -402). They must check the database before the first time they prescribe a Schedule II or III opioid to a patient, and periodically when prescribing repeatedly (§ 58-37f-304(2)). Prescribers of high-risk prescriptions must also check for other active high-risk prescriptions (§ 58-37-305).
• Dispensers: Utah does not require a query before every fill. If a dispenser's CSD review suggests a person may be obtaining opioids in quantities or frequencies inconsistent with accepted standards, the dispenser shall reasonably attempt to contact the prescriber (§ 58-37f-304(4)).
• Section 58-37f-304 does not establish a minimum standard of care (§ 58-37f-701(2)).

Immunity and penalties

• A person who submits information to, or accesses and reviews, the database under the chapter may not be held civilly liable for doing so, or for not acting on it (§ 58-37f-701).
• Misuse: knowingly releasing database information in violation of Part 3 is a third degree felony. Negligent or reckless release is a class C misdemeanor. Obtaining information by misrepresentation, or for an unauthorized purpose, is a third degree felony. Each knowing unauthorized use or release is also subject to a civil penalty of up to $5,000 (§ 58-37f-601).
• Failure to submit: after a specific written request, or when there is a pattern of non-submission, DOPL may discipline the PIC or pharmacy and impose a civil penalty of up to $1,000 per dispensed prescription not reported (§ 58-37f-602). Failing to submit after written notice is also unprofessional conduct (R156-37-502(8)), and the PIC must ensure timely submission (R156-17b-603(3)(p)).