(a) For purposes of the PDMP, each dispenser shall submit to the department by electronic means information regarding each prescription dispensed for a Schedule II, III, IV, or V controlled substance. The information submitted for each prescription shall include at a minimum, but shall not be limited to:

(1) DEA permit number or approved dispenser facility controlled substance identification number;

(2) Date the prescription was dispensed;

(3) Prescription serial number;

(4) If the prescription is new or a refill;

(5) National Drug Code (NDC) for drug dispensed;

(6) Quantity and strength dispensed;

(7) Number of days supply of the drug;

(8) Patient's name;

(9) Patient's address;

(10) Patient's date of birth;

(11) Patient gender;

(12) Method of payment;

(13) Approved prescriber identification number or prescriber's DEA permit number;

(14) Date the prescription was issued by the prescriber; and

(15) Other data elements consistent with standards established by the American Society for Automation in Pharmacy, if designated by regulations of the department.

(b) Each dispenser shall submit the prescription information required in subsection (a) of this Code section in accordance with transmission methods established by the department at least every 24 hours. If a dispenser is temporarily unable to comply with this subsection due to an equipment failure or other circumstances, such dispenser shall immediately notify the board and department.

(c) The department may issue a waiver to a dispenser that is unable to submit prescription information by electronic means acceptable to the department. Such waiver may permit the dispenser to submit prescription information to the department by paper form or other means, provided all information required in subsection (a) of this Code section is submitted in this alternative format and in accordance with the frequency requirements established pursuant to subsection (b) of this Code section. Requests for waivers shall be submitted in writing to the department.

(d) The department shall not revise the information required to be submitted by dispensers pursuant to subsection (a) of this Code section more frequently than annually. Any such change to the required information shall neither be effective nor applicable to dispensers until six months after the adoption of such changes.

(e) The department shall not access or allow others to access any identifying prescription information from the PDMP after two years from the date such information was originally received by the department. The department may retain prescription information that has been processed to remove personal identifiers from the health information in compliance with the standard and implementation rules of the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996, P.L. 104-191, for more than two years but shall promulgate regulations and procedures that will ensure that any identifying information the department receives from any dispenser or reporting entity that is two years old or older is deleted or destroyed on an ongoing basis in a timely and secure manner.

(f) A dispenser may apply to the department for an exemption to be excluded from compliance with this Code section if compliance would impose an undue hardship on such dispenser. The department shall provide guidelines and criteria for what constitutes an undue hardship.

(g) For purposes of this Code section, the term "dispenser" shall include any pharmacy or facility physically located in another state or foreign country that in any manner ships, mails, or delivers a dispensed controlled substance into this state.