Code of Federal Regulations Title 21. Food and Drugs § 21.1304.06 Records and reports for electronic prescriptions

(a) As required by § 1311.120 of this chapter, a practitioner who issues electronic prescriptions for controlled substances must use an electronic prescription application that retains the following information:

(b) An institutional practitioner must retain a record of identity proofing and issuance of the two-factor authentication credential, where applicable, as required by § 1311.110 of this chapter.

(c) As required by § 1311.205 of this chapter, a pharmacy that processes electronic prescriptions for controlled substances must use an application that retains the following:

(d) A registrant and application service provider must retain a copy of any security incident report filed with the Administration pursuant to §§ 1311.150 and 1311.215 of this chapter.

(e) An electronic prescription or pharmacy application provider must retain third party audit or certification reports as required by § 1311.300 of this chapter.

(f) An application provider must retain a copy of any notification to the Administration regarding an adverse audit or certification report filed with the Administration on problems identified by the third-party audit or certification as required by § 1311.300 of this chapter.

(g) Unless otherwise specified, records and reports must be retained for two years.