E222 Working Group Meeting DEA CSOS Pilot Discussion

E-222 Working Group Meeting DEA CSOS Pilot Discussion March 18, 2002 1

Agenda n Phase I: Status n Phase I: Lessons Learned n Phase II: Goals n Phase II: Participant Requirements n Phase III: Planning Ahead n Questions… 2

Phase I: Status n 21 registered participants in Phase I n 8 digital certificates have been issued n 6 completed test plans have been received (30% return rate to-date): l Mutual Drug l Mc. Kesson Corp. l Mc. Queary Bros. Drug Company l Baxter Healthcare Corp. l Mallinckrodt Pharmaceuticals l Purdue Pharmacies LP 3

Phase I: Lessons Learned n Manual easily retrieved and read – noting some recommended changes! n A couple of screen shots need to be updated in the manual. n No problems with certificate download times or errors. Total test time is averaging about 45 minutes. n Statistics will be compiled and made available once all test plans have been received. n So far so good!!!! 4

Registration Time Breakdown 5

Browser Compatibility 6

Phase I Timeline 7

Phase II: Goals n Test forms validation process n Select registered location/POA – begin thinking about who you will select n Download forms n Notarization n Validate submission and adjudication process 8

Phase II Timeline 9

Phase II: Participant Requirements n Tester must be affiliated with actual DEA registered location n Forms must be properly notarized 10

Phase III: Planning Ahead n Identify those participants who are willing and able to commit the resources (time and infrastructure) n Transaction sets should be finalized n Workflows should be baselined 11

Phase III Target Scope – Key Areas n Order signing n Order verification n Record retention (signed order, linked data, digital certificate) 12

Phase III Part A) Signing n Order Signing l Identification of “to-be-signed” data l Activation of private key l Signature generation (supported algorithms) n Success Factors/Evaluation Criteria l Data format & technical compatibility—signing approach l Compatibility with current/planned workflow l Scalability (bulk orders, certificate management) l Performance l FIPS compliance 13

Phase III Part B) – Verification n Order Verification/Processing l Parsing of digital certificate [address, schedules] l Certificate Revocation List (CRL) access/processing l Order validation [integrity check, CRL check, certificate expiry check, date of order] n Success Factors/Evaluation Criteria l Verification logic l Compatibility with current/planned workflow l Archival compliance l Connectivity- support for LDAP through org. firewall l Performance (Internet-based l FIPS compliance 14

Phase III Part C) – Record Retention n Record Retention l l l Signed data [Order content] Certificate data [Linked certificate or attached certificate? , address from certificate] Linked data [distribution center(s), fill information, receipt information] n Success Factors/Evaluation Criteria l Readily retrievable l Integrity maintenance 15

Phase III Logistics 1. How can the group divide and conquer? 2. … or, can Pilot participation be tailored to the partner’s business category (Pharmacy, Distributor, Manufacturer) l Order Signing—Pharmacies, Distributors l Order Verification —Distributors, manufacturers 3. Can simplifications be made that ease Pilot development without eliminating lessons learned? l Order generation (existing system vs. word processor) l Order transport (existing system vs. FTP Vs. email) 4. Will software need to be developed? l If so, how can the development be shared? l If so, can a single toolkit be used? 16

Phase III Immediate Next Steps 1. Solidify Phase III Approach l Identify teams (signing, verifying) l Identify order format (EDI 850) l Identify signature approach (inside/outside) l Identify signing toolkit (EDI, Toolkit, other) 2. Estimate critical path milestones l ID estimated time to complete future workflows l ID estimated time to complete EDI 850 3. Begin exploring tech areas ID skill requirements 4. Develop more detailed Phase III project plan 17

Questions 18