Chapter 28. Compliance with Regulations and Regulatory Bodies

Dr. Clark is an Associate Professor in the Pharmacy Sciences Department at Creighton University School of Pharmacy and Health Professions. He earned a B.S. and an M.S. in pharmacy from the College of Pharmacy, University of Illinois at Chicago, and a Ph.D. in social and administrative sciences in pharmacy at the University of Wisconsin–Madison School of Pharmacy. Dr. Clark has practiced in a variety of community and institutional pharmacy settings and has served as professional affairs manager for the National Association of Boards of Pharmacy (NABP). His teaching and research interests include pharmacy practice management, pharmacy law, patient safety, pharmacists' work environments, and the pharmacy benefits management (PBM) industry.

After completing this chapter, readers should be able to

1. Describe the reasons for the evolution of pharmacy and drug regulation that have created the current legal environment for pharmacy practice organizations.

2. Summarize and explain the basic provisions of the major pharmacy and drug laws discussed in this chapter.

3. Describe the manager's role in monitoring a pharmacy's compliance with applicable laws and professional standards.

4. Explain the role of the manager in developing and maintaining appropriate policies for the protection of patient privacy.

5. Analyze practice-based situations where laws and/or professional standards may have been violated. In these analyses, consider the implications (statutory, regulatory, and civil) of a manager's actions in resolving any problems presented by these situations and propose appropriate courses of action for the manager.

Few examples of how much trust is put in the hands of a pharmacist and the extent to which that trust can be betrayed come close to the story of Robert Courtney, a former pharmacist from Kansas City. During the 9 years leading up to his arrest in August 2001, Courtney secretively diluted the chemotherapy drugs of over 4,200 cancer patients to increase the profits of his home infusion pharmacy business. Courtney broke the law while betraying the trust of his patients and damaging the reputation of his profession.

Patients place their trust in pharmacists to do and know things that they themselves do not understand. State and federal laws provide additional layers of protection to shield the public from dangerous and/or contaminated drugs and from dangerous and/or dishonest professionals. As with any system, though, it can be breached. Consider how Courtney accomplished his deception.

Courtney began by diluting chemotherapy drugs for patients who were near death. He started out by diluting the drugs only a bit, thinking no one would notice. Later, he became more bold and diluted medications to the point that only a trace of the prescribed dose remained. He started out cheating “just a little” and then slid down a slippery slope until he was convicted of his crimes and sentenced to 30 years in prison. As stated in a newspaper feature about his case:

“The path to hell leads one step at a time,” says Mike Ketchmark, the brash but persistent attorney who successfully litigated a $2.2 billion civil judgment against Courtney. “I think he started from the gray market and realized you could make a whole bunch of money. Then he'd get orders in from people who were on their deathbed, and he'd slice a little bit. Then he realizes he can just continue to cut it, and no one's going to notice. It's a felony once you engage in the gray market; you're then breaking down the barrier of a person's inhibition. You don't go from being John-Boy to Charles Manson overnight” (Draper, 2003).

Although the Courtney case is an extreme example of just how far someone can go in betraying their professional duties and in breaking the law, it is important to understand that Courtney's transgressions started out small and were almost undetectable. Then his moral compass drifted further, and greed became his guide. His patients no longer mattered to him. Their trust in him was betrayed. Laws were broken. Courtney's crimes provide a hideous but poignant example of just how vulnerable patients are and exactly why there are pharmacy and drug laws in the United States to protect them.

1. Do you think that statutes and regulations are necessary to protect the public from dangerous drugs and/or incompetent pharmacists? Why or why not?

2. What areas of pharmacy regulation do you find excessive and overly restrictive?

3. What areas of pharmacy practice and pharmacy operations can you identify that you think need to be regulated more closely?

4. How have standards and legal requirements for pharmacists evolved to the point where we see them today?

5. What is the significance of the current state of pharmacy and drug regulation for pharmacy managers?

The purpose of this chapter is not to present a study guide for pharmacy law, an area to which entire texts have been devoted (e.g., Abood, 2010). Instead, its purpose is to provide an orientation to the professional and operational implications of food and drug law, pharmacy law, and professional regulation for pharmacy managers. This orientation should encourage pharmacy managers to think seriously about how the legal and regulatory environment that is external to a pharmacy practice organization can exert substantial influences on both the organization and its members. This encouragement includes a strong recommendation to know, understand, and follow applicable laws and professional standards in the operation of a pharmacy.

This chapter begins with a discussion of standards for pharmacists' professional performance and their importance to a manager. The chapter continues with a brief overview of some key historical mileposts in the development of laws and regulations governing both the quality of drug products (at the federal level) and the conduct of pharmacy professionals (at the state level). The chapter concludes with an examination of how the existence of standards can affect what an organization should and/or needs to do. These concepts are then illustrated by case-study examples that apply the principles presented.

Webster's Dictionary defines a standard as “something established by authority, custom, or general consent as a model or example” and states that standard “applies to any definite rule, principle, or measure established by authority (standards of behavior)” (Webster's Online Dictionary, 2012). From a contemporary managerial perspective, standards of conduct for a pharmacist and for the operation of a pharmacy are derived both from laws and from professional standards or values. Standards for professional conduct and the operation of a pharmacy, whether stated formally in statutes and regulations or present in professional codes of ethics, are important for managers to understand and apply. Violations of these standards can affect the licensure status of a pharmacy practice site and/or its pharmacists, may result in litigation if a patient is harmed subsequent to a violation, and in the most serious cases can result in criminal prosecution. Both criminal prosecution and civil liability resulted in the case of Robert Courtney, the pharmacist discussed in the scenario. Courtney was sentenced to 30 years in prison, fined $25,000, and ordered to pay $10.4 million in restitution to the patients and families affected. These penalties were in addition to the civil judgment of $2.2 billion (Stafford, 2002).

What Are Standards and Where Do They Come from?

Before there were laws in the United States for regulating the behavior of professionals, there were standards and codes of ethics established by professional guilds and associations. These codes of ethics stated in a formal way the type and level of professional performance that a guild or association expected from its members. These expectations were derived from the kinds of expert services that society needed from members of that profession. The professional standards in codes of ethics helped to align the highest standards of a profession with society's expectations. Knowing that professionals worthy of their title and status should adhere to their profession's standards, society came to expect no less. Yet, there was and continues to be an inherent tension between the desire of professions to self-regulate and the often justified cynicism of members of the public who fear that self-regulation can lead to lax oversight and endanger the public. The result is that we see not only professional standards and codes of ethics that emanate from professional associations (e.g., the American Pharmacists Association (APhA) Code of Ethics and Oath of a Pharmacist) but also federal and state statutes and regulations designed to protect the public from dangerous products and practitioners.

Bledstein (1976) discussed the evolution of the relationship between professionals and those whom they serve and noted that in mid-Victorian America there seemed to be a prevailing sense of insecurity among some members of the population. People who were seeking to expand their cultural horizons looked to professionals even for such things as recommendations concerning what should be considered appropriate reading material.

A riot of words and a crisis of confidence alarmed a society which began placing its faith in professional persons. In mid-Victorian America, the citizen became a client whose obligation was to trust the professional. Legitimate authority now resided in special spaces, like the courtroom, the classroom and the hospital; and it resided in special words shared only by experts…. [T]he professions as we know them today were the original achievement of mid-Victorians who sought the highest form in which the middle class could pursue its primary goals of earning a good living, [and] elevating both the moral and intellectual tone of society…. Americans after 1870, but beginning after 1840, committed themselves to a culture of professionalism which over the years has established the thoughts, habits and responses most modern Americans have taken for granted (Bledstein, 1976, pp. 78–81).

The trust in the professional just mentioned came at a time in the history of American culture long before the existence of the commercial aspects of professional–client relationships sometimes seen today. This dichotomy was discussed by May:

Contract and covenant, materially considered, seem like first cousins; they both include an exchange and an agreement between parties. But, in spirit, contract and covenant are quite different. Contracts are external; covenants are internal to the parties involved. Contracts are signed to be expediently discharged. Covenants have a gratuitous, growing edge to them that springs from ontological change and are directed to the upbuilding of relationships.

There is a donative element in the upbuilding of covenant—whether it is the covenant of marriage, friendship, or professional relationship. Tit for tat characterizes a commercial transaction, but it does not exhaustively define the vitality of that relationship in which one must serve and draw upon the deeper reserves of another (May, 1988, p. 93).

Why Laws Governing Drugs and Professional Conduct Became Necessary

Despite such lofty expressions of the duties owed to society by those who served them, maximization of profits (rather than adherence to the highest standards) sometimes was the goal of those selling “medicinal” products. Philip J. Hilts (2003) describes the evolution of drug regulation in the United States beginning in the late nineteenth century through the end of the twentieth century. During the late nineteenth century and well into the middle twentieth century, laws governing the content and quality of medicinal products provided, by today's standards, little or no protection to an unknowledgeable and unsuspecting public. Members of a relatively uninformed society were left to their own devices in making decisions for the purchase and use of medications. Subsequently, it took the occurrence of sentinel events such as the Elixir Sulfanilamide tragedy of 1937 and the thalidomide disaster of 1962 to raise consumer ire and prompt government action aimed at protecting the public from dangerous drug products.

The evolution of the pharmacy profession in the United States from colonial times to the present is rather astounding. During this time, pharmacy made the transition from an unlicensed occupation that in many ways resembled a trade to its current status requiring a professional doctorate (Pharm.D.) degree to become eligible for licensure. At first, scant formal education and long periods of apprenticeship were required to attain full status as a pharmacist. During this period the American Pharmaceutical Association (now the American Pharmacists Association) was established in 1852. Contemporaneously, the more classic definitions of professions and professionals applied. Professionals were expected to be ethical and honest in their dealings with the public, and the pharmacy profession was largely self-regulating, with sanctions from within its ranks as the only punishment for violation of the profession's standards.

This section examines some of the more pivotal pieces of legislation enacted during the last century and discusses how they have evolved to provide pharmacy with the current legal and regulatory environment for the regulation of drugs, pharmacists, and pharmacies.

Regulation of Food and Drug Safety: Standards for Foods and Drugs Sold at Retail

The authority to regulate foods and drugs sold in interstate commerce is given to the federal government by the commerce clause of the US Constitution (US Constitution, Article I, Sec. 8, Clause 3). Until the beginning of the twentieth century, the only federal law regulating drugs in the United States was the Drug Importation Act of 1848, which empowered the US Customs Service to prevent the importation of adulterated (i.e., contaminated) drugs from other countries (FDA, 2002). Beginning in the early twentieth century, a series of highly publicized dramatic events provided the impetus for changes and improvements in the regulation of food, drug, and cosmetic safety.

Pure Food and Drug Act of 1906

The Pure Food and Drug Act of 1906 (59th Congress, Session I, Chap. 3915, pp. 768–772) was prompted by increased interest in the popular press concerning food safety that culminated in the publication of Upton Sinclair's exposé, The Jungle, a book that highlighted filthy and unsanitary conditions in meat packing plants. As stated in the 1906 act, the purpose of the new law was “for preventing the manufacture, sale, or transportation of adulterated or misbranded or poisonous or deleterious foods, drugs, medicines, and liquors, and for regulating traffic therein.” In essence, this law required that foods and drugs be hygienic and accurately labeled. Before this law was enacted, there was a lack of standards and “traveling medicine shows,” “patent medicines,” and other unregulated products and activities were rampant. Products such as Lydia Pinkham's Vegetable Compound were nothing more than alcohol, whereas “soothing syrups” marketed as remedies for teething babies contained undisclosed and varying amounts of opium (Hilts, 2003).

The Food, Drug and Cosmetic Act of 1938 and Amendments

Passage of the Food, Drug and Cosmetic Act of 1938 was preceded by the Elixir Sulfanilamide tragedy of 1937. The 1906 act required drugs to be pure and labeled accurately but contained no requirement that drugs be safe. As one of the first effective oral antimicrobial drugs, sulfanilamide was very popular with physicians and was used widely to treat streptococcal infections. Bitter in taste, it was not easy to administer to children. Therefore, with some difficulty, the manufacturer developed a liquid dosage form called Elixir Sulfanilamide. Sulfanilamide powder is not soluble in either water or alcohol. Chemists at the manufacturer settled on ethylene glycol—the same chemical used today as an automobile antifreeze/coolant. This sweet-tasting chemical is highly toxic, causing painful kidney failure and death with in a few days of ingestion.

In 1937, no safety testing was required prior to marketing a drug product, and no premarketing safety tests were performed on Elixir Sulfanilamide. Two hundred and forty gallons were shipped to physicians and pharmacies all over the country, and 107 children died after using the product. Despite the extreme danger that this product represented to the public, the only legal basis the Food and Drug Administration (FDA) had for removing it from the market was that the product label stated “elixir,” whereas technically it was not an elixir because it contained no alcohol and therefore was misbranded. The danger of allowing drug products to enter the market without safety testing became obvious, and the public demanded that something be done. The result was the requirement for premarketing safety testing in the Food, Drug and Cosmetic Act of 1938.

The 1938 act was strengthened subsequently by amendments. The 1951, Durham–Humphrey Amendments created separate categories for prescription-only and over-the-counter (OTC) drugs. Prior to passage of these amendments, there was no legal prohibition against selling drugs without a prescription. These 1951 amendments transformed pharmacy in ways likely unintended by their sponsors (Senator Hubert Humphrey was a pharmacist). There was a synergy between these amendments and the increased availability of finished-dosage forms in the post-World War II pharmaceutical industry boom that transformed the professional activities of neighborhood pharmacists. This transition from compounding and selling drugs at retail to “lick, stick, count, and pour” occurred simultaneously with the creation of the prescription-only market niche—a niche that only pharmacists were allowed to fill.

Next, the early 1960s saw another tragedy related to an unsafe drug product. Thalidomide was a drug marketed in Europe as a tranquilizer and used extensively to treat morning sickness in pregnant women. Although the manufacturer was eager to market this product in the United States, the efforts of FDA pharmacologist and reviewer Dr. Frances Kelsey prevented thalidomide from reaching the US market. At the time, an FDA reviewer had 60 days either to approve or reject a new drug application (NDA) from a manufacturer. However, an FDA reviewer could request further information from the manufacturer and restart the 60-day clock—a tactic that Dr. Kelsey employed several times because she was satisfied with neither the quantity nor quality of the data she had received about thalidomide's safety.

Tragedy in the United States was averted by Dr. Kelsey's efforts. Her refusal to approve the thalidomideNDA without further proof of safety occurred just as news from Europe revealed that thalidomide was responsible for a birth defect that caused infants to be born with flipper-like limbs. This near miss in the United States led to passage of the 1962 Kefauver–Harris Amendments to the 1938 act. These amendments established requirements that testing for both safety and proof of drug efficacy had to be conducted in well-controlled clinical trials before an NDA could be approved and a drug allowed to reach the market (Bren, 2001).

Establishment of State Pharmacy Practice Acts and State Boards of Pharmacy

Prior to 1870, when Rhode Island became the first in the nation to enact a state pharmacy practice act, regulation of the pharmacy profession was accomplished sporadically—generally at the local level or through the regulation of the medical profession (Green, 1979). States subsequently enacted their own pharmacy practice acts over the next several decades. The establishment of state pharmacy practice acts and the state boards of pharmacy created by these acts represents a legally binding codification of society's expectations of professional performance and a delineation of legal consequences for violation of these standards. The regulation of professional behavior by the states is pursuant to the police powers granted to the individual states by the US Constitution. The establishment of state statutes and regulations governing the practice of pharmacy and operation of a pharmacy business not only provided a new layer of safety for the public but also created a real barrier to entry into the pharmacy profession. This was a significant step in increasing both the professionalism of pharmacy and the expectations that society had of pharmacists. Prior to establishment of such standards and legal requirements, practically anyone could operate a business and call it a pharmacy.

Currently, all states have some form of pharmacy practice act (a state statute) and state board of pharmacy regulations. These laws establish legally binding standards for the conduct of pharmacists and ancillary personnel, as well as standards for the physical facilities licensed as pharmacies. These statutes and regulations are not to be taken lightly. Violations can result in penalties ranging anywhere from reprimands and fines to the loss of licensure to practice the profession or maintain operation of a given pharmacy facility. Practicing pharmacy without a license is a violation of criminal law, so it is important for pharmacy managers to have a clear understanding of their responsibilities under these statutes and regulations and to communicate these responsibilities clearly to nonpharmacist management personnel involved in operation of the pharmacy. For example, consider the situation where a pharmacy is located within a larger store that is open when the pharmacy department is closed. If the nonpharmacist store manager decides to open the pharmacy to get someone's medication during hours when the store is open but the pharmacy department is closed (and, of course, there is no pharmacist on duty), this would violate the pharmacy practice act and board of pharmacy regulations in any state. A managing pharmacist has to make clear to nonpharmacist managers what they are not allowed to do under the law. Further, a pharmacist who allows such illegal practices also has committed a violation and may be subject to both sanctions from the board of pharmacy as well as criminal prosecution.

Omnibus Budget Reconciliation Act of 1990

Until the passage of Omnibus Budget Reconciliation Act of 1990 (OBRA 1990; Public Law 101–508), federal law in the pharmacy arena had been concerned primarily with drug product safety. OBRA 90, while not explicitly usurping the police powers of the states, required that to be eligible for federal matching dollars, states participating in the Medicaid program would have to establish standards for

• Maintaining proper patient records. Pharmacies must make reasonable efforts to obtain, record, and maintain at least the following patient information: patient name, address, telephone number; age and gender; individual history (where significant), including disease state or states, known allergies and/or drug reactions, and a comprehensive list of medications and relevant devices; and the pharmacist's comments about the patient's drug therapy.
• Prospective drug use review (pro-DUR). Prior to dispensing a prescription, a pharmacist must conduct an evaluation of a patient's medication record to detect potential therapy problems, such as therapeutic duplication, drug–disease contraindications, drug–drug reactions (including serious interactions with OTC medications), incorrect drug dosage or duration of drug treatment, drug–allergy interactions, and evidence of clinical abuse/misuse.
• Patient counseling. A dispensing pharmacist must offer to counsel regarding matters that are, in the pharmacist's professional judgment, significant, which include but are not limited to name and description of the mediation, route of administration, dose, dosage form, and duration of therapy. In addition, such standards require pharmacists to discuss special precautions and directions, common severe side effects or interactions, therapeutic contraindications that may be encountered (including how to avoid them and what to do if they occur), proper storage, techniques for self-monitoring of drug therapy, what to do if a dose is missed, and refill information.

Not wanting to establish two separate legal standards of care—one for Medicaid patients and another for non-Medicaid patients—states generally adopted standards to meet the OBRA 90 criteria while extending the standards to benefit all pharmacy patients, not just Medicaid patients (Catizone et al., 1993). Implications for pharmacy management include how the manager decides to structure employee duties and the organization of work in the pharmacy. It is the managing pharmacist's duty to maintain compliance with applicable state and/or federal laws by ensuring that requirements for prospective drug use review and patient counseling are followed. From a management perspective, this means organizing work in the pharmacy and staffing the pharmacy to facilitate performance of these legal duties. Individual states may have their own requirements that may be stricter—but not more lenient—than federal law.

Health Insurance Portability and Accountability Act of 1996

This statute and its rules establish, for the first time, federal standards for protecting the privacy and security of patients' protected health information (PHI). These standards include, but are not limited to, how patient PHI must be stored, under what conditions it may be released, and to whom. This law has sweeping implications for pharmacies and pharmacists alike. The Health Insurance Portability and Accountability Act (HIPAA) privacy rules are designed to strike a balance between maintaining the flow of patients' health information among persons and entities providing health care to patients while simultaneously maintaining privacy for individuals. Essentially, this combination of statute and implementing regulations increases privacy and security for private information by establishing a “need to know” basis for who may have access to someone's PHI and to what extent they may have that access. Further, it establishes requirements for security of storage and for transmission of PHI by anyone who has access to the information. The purpose of this chapter does not include an exhaustive summary and explanation of this landmark legislation; numerous resources have been devoted to the subject.1 The rules implementing this federal statute became effective as of April 14, 2003. Suffice it to say that pharmacy managers are responsible for making sure that their staff and policies and procedures are in compliance with HIPAA.

From a pharmacy manager's perspective, it is essential to understand that HIPAA establishes transaction standards, security standards, and privacy standards for PHI. Transaction standards and security standards are concerned primarily with how data are handled and transmitted. In the day-to-day operation of pharmacy, a manager needs to understand and comply with the requirements for privacy standards. As stated in the summary of the HIPAA privacy rule:

A major goal of the Privacy Rule is to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well-being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed (DHHS, 2012b).

A pharmacy manager should know the answers to the following questions regarding these privacy standards:

1. Who is covered by the privacy rule? The privacy rule considers health plans, health care providers, and health care clearinghouses as covered entities. “Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity” (DHHS, 2012a). This definition includes pharmacies.

2. What information is protected? According to the Department of Health and Human Services Office of Civil Rights, The Privacy Rule protects all individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information protected health information (PHI). Further, the Privacy Rule states that individually identifiable health information is information, including demographic data, which relates to

   • the individual's past, present, or future physical or mental health or condition,
   • the provision of health care to the individual, or
   • the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number) (DHHS, 2012b).

3. What must the covered entity do to protect information? Every covered entity must have an individual designated as the facility's “privacy officer”—a person who is charged with the responsibility of keeping the site in compliance with HIPAA. Essentially, a covered entity may not release or disclose PHI except as allowed under the privacy rule. The following subsections summarize briefly what a pharmacy manager (a person who also may be the privacy officer) must be aware of.

Employee Training

Employees of a pharmacy should be trained in HIPAA rules and procedures as a condition of employment. Newly hired personnel should receive training before being allowed to work with PHI. This training should be documented as having been completed and repeated, if necessary, for employees who do not perform up to the standard. At a minimum, the training should include making clear to employees (1) how, to whom, to what extent, and under what circumstances PHI may be released and (2) that PHI should not be included in casual conversations with others—even in conversations with other health care providers if they are not involved in the patient's care. Also, employee access to PHI should be restricted to what is necessary in the performance of their duties.

Notice of Privacy Practices

Under the HIPAA privacy rule, all covered entities are required to provide patients with a “notice of privacy practices.” The covered entity must provide this notice to all patients, and it should be written in understandable language. The privacy officer, most likely the pharmacy manager, is responsible for documenting patient signatures acknowledging receipt of the notice and documenting the reasons for any patient refusals of the notice or any patient refusal to sign in acknowledgment of having received the notice. The covered entity must maintain records of these documents for 6 years. Again, the importance of maintaining well-organized and easily retrievable records cannot be overemphasized.

Business Associates

The HIPAA privacy rule definition of a business associate and requirements regarding business associates are as follows:

• Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information.
• Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing. Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of PHI, and where any access to PHI by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity.
• Business Associate Contract. When a covered entity uses a contractor or other nonworkforce member to perform “business associate” services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates. Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of PHI that would violate the Rule (DHHS, 2012b).

In general, a pharmacy manager and/or privacy officer (in consultation with legal counsel) should tailor the pharmacy's relationships with business associates via the business associate contract. The overarching goals in an appropriately constructed business associate contract are to minimize the business associate's exposure to PHI while clearly establishing what uses of the PHI are permitted by the business associate. The privacy officer should have a clear idea of what business associates plan to do with any PHI they obtain and should make sure that any subcontractors have similar agreements. The privacy officer should monitor the business associate for any violations of the contract. In fact, the contract should stipulate that it is the responsibility of the business associate to report unauthorized disclosures of PHI. Finally, the privacy officer is responsible for the disposition of any PHI released to the business associate and should make sure that after it has been used by the business associate, PHI is either returned, held securely, or destroyed.

Patient Authorization Required for Release of PHI

A pharmacy, as a covered entity, needs to obtain a patient's written authorization for any disclosure or use of PHI that is not for treatment, payment, or health care operations. This authorization cannot be used as a precondition for benefits eligibility, payment, or treatment. The authorization document must be written in plain and specific language, and it may allow use and disclosure of PHI by the covered entity. An example of a disclosure of PHI that would require a written authorization by a patient is disclosure of such information to a drug manufacturer for marketing purposes. All authorizations must specify what information may be disclosed and must identify the person(s) disclosing and receiving the information, must specify an expiration date for the authorization document, and must state that a patient has the right to revoke the authorization in writing. Patient authorization for the release of PHI is not required for circumstances where a pharmacist reports spousal abuse or child neglect, becomes involved in legitimate law enforcement situations (including compliance with workers' compensation laws), is avoiding a threat to health or safety, or is reporting an adverse drug reaction to the FDAMedwatch program.

Circumstances Where PHI May Be Released Without Explicit Patient Authorization

PHI may be released without explicit patient authorization under certain circumstances defined in the law and rules. These circumstances (with examples) include treatment (e.g., when a pharmacist discusses a patient's condition with the patient's physician), payment (e.g., when a claim for payment is submitted to a third-party payer), regular health care operations (e.g., the transfer of PHI among departments within a hospital), and when the information has been “de-identified.”

PHI is considered to be “de-identified” when the following data elements have been removed:

• Patient's name, Social Security Number, and telephone and/or fax numbers
• Patient's town, street address, and/or ZIP code (state of residence need not be removed)
• Any dates of service (except year)
• Medical record number, health plan number, account number, and/or prescription number
• Any vehicle identifiers (e.g., license plate number)
• Medical device identifiers and/or serial numbers
• Patient's Web site URL, computer IP address, and/or e-mail address
• Biometric identifiers (e.g., DNA, fingerprints, voice recording, body description, retinal scan, etc.)
• Photographic images (identifiable)
• Any other unique characteristic or code

Remember, though, that “de-identification” of information is not necessary between covered entities involved in a patient's care. “De-identification” is also not necessary between a covered entity and a business associate with which the covered entity has a business associate contract.

The HIPAAstatute and rules have created considerable confusion for pharmacy managers who have wondered about how these changes may affect normal operations in their pharmacies. Questions arise regarding situations such as when a neighbor is picking up a prescription for a patient. (Note: HIPAA rules allow the pharmacist to release a prescription to a patient's neighbor and counsel that neighbor as the patient's agent.) In response to these sorts of questions, the U.S. Department of Health and Human Services (DHHS) Web site has a search function that finds answers to many common questions about a wide variety of health care practice situations (DHHS, 2012c).

An Amendment to the Social Security Act Enacted as Part of HIPAA

When HIPAA was passed, a small but significant amendment to the Social Security Act [Section 1128A(a)(5)] was included. This amendment prohibits offering inducements (i.e., remuneration) for Medicare or Medicaid recipients to utilize the services of any particular provider. This provision is enforced by the Office of Inspector General (OIG) within the U.S. DHHS. The OIG interpretation of the amendment permits “Medicare or Medicaid providers to offer beneficiaries inexpensive gifts (other than cash or cash equivalents) or services without violating the statute. For enforcement purposes, inexpensive gifts or services are those that have a retail value of no more than $10 individually, or no more than $50 in the aggregate annually per patient.” (U.S. DHHS, 2002).

When a pharmacist manager works in setting with a nonpharmacist manager (e.g., a large community pharmacy or a pharmacy department in a discount or grocery store), the nonpharmacist may not be aware of this prohibition, and may want to include Medicare and Medicaid recipients in coupon offerings or discounts in the store, but outside of the pharmacy department, to keep the recipients' business. This situation provides a difficult, but absolutely necessary opportunity for the pharmacist to educate the nonpharmacist manager regarding compliance with federal law. Failure to comply with this provision can result in serious legal and financial consequences—“…a person who offers or transfers to a Medicare or Medicaid beneficiary any remuneration that the person knows or should know is likely to influence the beneficiary's selection of a particular provider, practitioner, or supplier of Medicare or Medicaid payable items or services may be liable for civil money penalties (CMPs) of up to $10,000 for each wrongful act.” (U.S. DHHS, 2002). So, as difficult and cumbersome as it may seem, a pharmacy engaged in offering small “gifts” to Medicare and Medicaid beneficiaries must limit individual gifts to a monetary value of $10 or less and must limit the annual total to $50 for each beneficiary. Actions that would likely be in violation of this statute include providing in-store gift cards or coupons that can be spent in the store just like cash as incentives to utilize a given pharmacy's services. For example, it is not difficult to imagine that someone who receives a $15 store coupon every time they get a Medicare/Medicaid prescription filled might be more likely to find ways to increase their prescription drug utilization.

Prescription Drug Marketing Act

Pharmacy managers must also comply with federal laws regulating other economic issues in pharmacy. The Prescription Drug Marketing Act of 1987 (PDMA) represents one area where some pharmacists have encountered considerable legal problems, resulting in large fines and/or prison sentences (Associated Press, 2000; Eiserer, 1999). In brief, the PDMA prohibits the diversion of prescription drug samples into the retail market sector. Pharmacies may not have in their stock any prescription drug samples, and pharmacies may not possess or sell any prescription drug samples. Further, the PDMA restricts the annual distribution of prescription drugs by pharmacies to other pharmacies to no more than 5 percent of the annual dollar value of prescription drug sales for the distributing pharmacy (e.g., one pharmacy providing prescription drugs to another pharmacy that has run out of stock of an item). Pharmacy managers must ensure compliance with the PDMA or be prepared to face stiff penalties. In a Nebraska case, a pharmacist violated the PDMA by colluding with a pharmaceutical manufacturer's sales representative to divert and profit from the sale of drug samples. In 1999, the pharmacist pled guilty to illegally selling prescription drug samples over a 15-year period (Eiserer, 1999). In 2000, the pharmacist was sentenced to 18 months in prison and ordered to pay nearly $147,000 in fines and restitution (Associated Press, 2000).

State Prescription Drug Monitoring Programs

In order to curb the practice of “doctor shopping” that is used by some patients to obtain controlled substances, a number of states have enacted a prescription drug monitoring program (PDMP). These PDMPs collect information on controlled substances and “drugs of concern” dispensed within the state and maintain an electronic database of the information. The agencies that administer and house these programs vary from state to state as do “drugs of concern”. For example, Louisiana's 2006 Prescription Monitoring Program Act empowered the state board of pharmacy to promulgate regulations to identify “drugs of concern” in addition to drugs in Schedules II through V that are now being monitored as of September 1, 2010. The Louisiana board has identified two such drugs: (1) butalbital when in combination with at least 325 milligrams of acetaminophen per dosage unit, and (2) tramadol. A useful resource for identifying whether a state has a prescription monitoring program and drugs that are monitored is the Alliance of States with Prescription Monitoring Programs (http://www.pmpalliance.org).

Information collected by PDMPs is then distributed to individuals authorized by state law to receive such information for their professional purposes. Individuals authorized to access PDMP data vary from state to state, but usually include prescribers and pharmacists. For example, in a state with a PDMP where both prescribers and pharmacists are allowed to access PDMP data, each is able to check if their patient is obtaining prescriptions for controlled substances from other prescribers and/or other pharmacies. This sharing of information can help to deter abuse and diversion of controlled substances while identifying patients who may need to be directed to drug abuse treatment programs. Also, in cases of criminal prosecution for drug diversion via falsified prescription documents, data from prescription monitoring programs would be discoverable and could be used as evidence by prosecutors.

According to the US Drug Enforcement Administration Office of Diversion Control, 37 states had operational PDMPs with the capacity to receive and distribute controlled substance prescription information to authorized users as of March 2012 (U.S. Department of Justice, 2012). States with operational programs include:

• Alabama, Arizona, California, Colorado, Connecticut, Florida, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Massachusetts, Michigan, Minnesota, Mississippi, Nevada, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, and Wyoming.
• Eleven states (Alaska, Arkansas, Delaware, Georgia, Maryland, Montana, Nebraska, New Jersey, South Dakota, Washington, and Wisconsin) and one U.S. territory (Guam) have enacted legislation to establish a PDMP, but are not fully operational as of March 2012.

Where pharmacy managers have access to PDMP data, they have a useful tool in maintaining their pharmacy in compliance with federal and state controlled substance statutes and regulations. Where PDMPs are in place and available for access by pharmacists, pharmacy managers should ensure that pharmacists practicing at their site take advantage of this resource. Failure to do so could result in board of pharmacy actions against the license of a pharmacist who did not use the PDMP tool to ascertain whether or not prescriptions for controlled substances and “drugs of concern” were valid prior to dispensing.

Civil Law and Liability Concerns

When a pharmacist or pharmacy organization is sued, the issue of negligence becomes the key to what the outcome of the lawsuit will be. Negligence theory revolves around either the failure to do something that a reasonable and prudent person would do, or doing something that a reasonable and prudent person would not do. In this case, the person is the pharmacist. The pharmacist's role has changed over time because of the evolving nature of pharmacy practice (e.g., OBRA 90 ushered in the requirement to offer patient counseling). Case law also changes pharmacy practice standards. Case law is based on precedents established by the outcomes of civil cases. For example, if the result of a lawsuit establishes that a pharmacist had a duty to warn a patient about certain dangers of a drug that was dispensed, then a new standard of behavior for pharmacists is established through case law, not by statute or regulation.

The thought of being sued for something one has done while practicing, or the thought of a pharmacy manager being sued for the actions of his or her staff, is not at all pleasant. The first thing someone might think of is, “How can I prevent that from happening to me?” This question opens the door to a field of management called risk management that deals with how to reduce and manage exposure to risk (see Chapter 27). Sound practice site design, consistent adherence to applicable law, and a well-organized work-flow system designed to detect errors before they reach the patient are all essential to minimizing exposure to risk. As with all laws governing the activities of pharmacists, managers are encouraged to become familiar with these important provisions.

1 See (1) HIPAA Privacy Standards: A Compliance Manual for Pharmacists. National Association of Chain Drug Stores, Inc., and Mintz, Levin, Cohn, Ferris, Glovsky, and Popeo, P.C., 2003; and (2) Fitzgerald WJ. 2003. The NCPA HIPAA Compliance Handbook for Community Pharmacy. Alexandria, VA: National Community Pharmacists Association.

It is important for managers to understand that statutory and regulatory standards create an environmental context for an organization, a factor critical in determining whether or not the organization prospers and grows. The manager is a person embedded within an organization that is, in turn, embedded within the environment—an environment that is constantly changing. For pharmacists and pharmacies, statutes and regulations represent society's codification of standards beyond its normative expectations—beyond the sanctions implicit in not meeting the expectations of professional peers. Statutes and regulations also provide for enforcement by way of penalties if they are violated. Regulations are standards that are derived from statutes and have legal enforcement mechanisms (i.e., potential penalties) attached to them. For example, state pharmacy practice acts create a board of pharmacy and empower that board to establish rules and/or regulations to interpret and implement the practice act. Board of pharmacy regulations carry the full force of the law and establish penalties anywhere from warnings, fines, and on to suspension and/or revocation of pharmacist's or pharmacy's licensure.

Performance Improvement versus Meeting Minimum Performance Standards

To avoid legal sanctions for practitioners and/or the pharmacy, the manager can take steps to prevent or avoid substandard practices that could lead to penalties. How should a manager approach such a task? One way some organizations approach making sure they meet minimum legal standards is by developing programs to foster performance improvement. Meeting minimum performance standards is compliance with the bare minimum legal requirement, whereas performance improvement goes beyond this and can provide additional protection in the risk prevention and risk management arenas. If a pharmacy and its pharmacists aim to establish standards for the performance of the organization that exceed the legal minimum, it is much less likely that performance quality will result in violations of the law or in performance so poor that it results in a civil lawsuit. For example, a pharmacist manager may decide to establish a policy that every patient visiting the pharmacy will receive a personal offer of counseling from a licensed pharmacist, even where state law may allow pharmacy interns or other pharmacy staff to perform this function. Further, if a lawsuit is filed against the pharmacy, it can work in a pharmacy's favor if the pharmacy has in place standards of care and policies and procedures that exceed the legal minimum and afford better protection for clients. Also, with such systems in place, it is much less likely that a pharmacy will encounter legal difficulties of either kind. Establishment of a practice environment and philosophy that are centered on doing what is best for the patient while knowing and obeying all applicable laws is essential to avoiding legal problems in either the civil or criminal realm.

Quality measurement of pharmacy professional services by groups such as the Pharmacy Quality Alliance (PQA, see http://www.pqaalliance.org/) is beginning to set standards and measures that pharmacies can use to evaluate themselves that go beyond minimum legal requirements. Other groups (including third-party payers) are also likely to develop standards to evaluate the quality of a pharmacy practice site. In the not too distant future, pharmacy managers may well need to incorporate quality measures to assure that their pharmacy is compensated for professional pharmacy services.

This chapter began by reviewing the history of and motivation for the development of standards, statutes, and regulations governing the manufacture of drugs and the practice of pharmacy. Next, within this context, some of the milestones of pharmacy and drug regulation, such as HIPAA, OBRA 90, and the PDMA, were summarized. Finally, civil law and its impact on pharmacy practice were considered. All these aspects of pharmacy and drug regulation were examined from the viewpoint of the pharmacy manager.

The chapter concludes with the following case examples for discussion of laws pertinent to the operation of a pharmacy. These cases are presented as starting points for discussion and analysis of practice-based situations a pharmacy manager is likely to encounter. Pharmacy and drug law, as well as civil law, all present managers with criteria on which to fashion their own management style in operating a pharmacy. Law, while quite explicit in its language, often can be silent on some issues and thus open to interpretation and the exercise of professional judgment. Pharmacy students reading this chapter are encouraged to work together in analyzing the situations presented here and to come up with their own plausible solutions to the problems presented.

Case Examples for Discussion of Laws Pertinent to Operating a Pharmacy

Case 29.1: Why Won't the Pharmacist Just Refill My Prescription?

A Federal Drug Law: The Controlled Substances Act of 1970

Maureen Smith, R.Ph., the pharmacist manager of ABC Drugs Community Pharmacy, encounters the following situation within 10 minutes of arriving at the pharmacy on a Tuesday morning. She finds herself dealing with a complaint from a patient, Mr. Jones, about one of the staff pharmacists. Yesterday evening, Monday, at about 8:30 p.m., Mr. Jones came to the pharmacy and presented an empty prescription vial to the pharmacist on duty and asked for a refill of his acetaminophen with codeine no. 3 tablets. Acetaminophen no. 3 is a schedule III controlled substance, and the federal Controlled Substances Act limits prescriptions for such medications to a maximum of five refills within 6 months of the time they are issued. Mr. Jones had not seen the prescribing physician in about 7 months and was now experiencing pain unrelated to the reason for his visit 7 months ago. However, the label on his vial stated that he had three refills remaining, and he wanted one right away.

Sally Howard, Pharm.D., the pharmacist who was on duty Monday evening, explained to Mr. Jones that she would need further authorization from Mr. Jones' prescriber because the prescription had been written over 6 months ago and was now no longer valid for refilling. Sally tried to reach Mr. Jones's doctor to obtain authorization but was unsuccessful in reaching the prescriber before the pharmacy closed at 9:00 p.m. Therefore, she informed Mr. Jones that the pharmacy would not be able to refill the prescription until it could reach the prescriber. Mr. Jones became angry when he heard this and remains very angry as he tells Maureen about the situation.

Discussion Questions

1. What are the essential legal issues involved?

2. How should the pharmacy manager handle this situation?

3. How might another manager deal with the problem presented by this difficult patient?

Case 29.2: The Grandmother WHO Did Not Need an Easy-Open Prescription Vial

A Federal Consumer Protection Law: The Poison Prevention Packaging Act

The (federal) Poison Prevention Packaging Act requires that prescription medications (with very few exceptions, such as sublingual nitroglycerin tablets) be dispensed in child-resistant containers. Mrs. Mabel Brown, a 79-year-old great grandmother to 2-year-old Barbara Brown, is a longstanding patient at the community pharmacy where you are the manager. You have just been informed by Mrs. Brown's great grand daughter's pediatrician that little Barbara was treated at the local hospital emergency room yesterday evening. It seems that while Barbara and her parents were visiting Mabel at her house, Barbara climbed up on the kitchen counter and grabbed Mabel's prescription vial containing propranolol 80 mg long-acting capsules. Little Barbara had only been out of her mother's sight for about 2 minutes when her mother walked into the kitchen and found Barbara sitting on the kitchen counter munching away on Mabel's medicine. Although she became a bit lethargic, luckily she did not have enough time to consume a dangerous quantity and was treated and released.

After speaking with the pediatrician, you do some checking in Mabel's patient record, and you discover that all her medications have been dispensed in nonchild-resistant containers (i.e., “easy open” flip-top containers). On further investigation, you discover that there is no request on file where Mabel or her physician actually asked for easy-open containers. While discussing this with your pharmacy staff, you learn that everyone just assumed that a 79-year-old patient would want the nonchild-resistant containers but that no one had ever asked her if she wanted them.

Discussion Questions

1. How would the pharmacy manager need to articulate and address the issues presented by this situation?

2. What are the key issues, and how should a pharmacy manager handle them with pharmacy staff?

3. What recommendations for change, if any, would be appropriate to assist the pharmacy in refining the pharmacy's policies and procedures?

4. What additional civil liability issues arise from situations like this one?

Case 29.3: The Super-Technician

A State Practice Act/Board of Pharmacy Provision

Trudy Hamilton, Pharm.D., is a licensed pharmacist and is currently the manager of a hospital pharmacy department. In the state where Dr. Hamilton is licensed, nonpharmacist personnel are prohibited by both statute (the state pharmacy practice act) and state board of pharmacy regulation from engaging in activities defined as the practice of pharmacy. The specific activities that fall within the definition of the practice of pharmacy are limited to being personally performed by licensed pharmacists only. Such activities include counseling patients about their medications and responding to drug information requests from other health care professionals (e.g., physicians and nurses).

Robert Allen recently earned his certification as a certified pharmacy technician (C.Ph.T.) and has been working as a technician in the pharmacy department for the past 3 years. Robert is rightly proud of his accomplishment and recently has expressed interest in applying for admission to pharmacy school. Today, Dr. Hamilton received a phone call from Ann Brown, D.O., an attending physician at her institution. Dr. Brown was noticeably angry. Yesterday, Dr. Brown called the pharmacy with a drug-interaction question about a drug that is new to the hospital's formulary (i.e., the list of drugs that the hospital pharmacy regularly keeps in stock). She was told by the “pharmacist” who answered the phone that the pharmacy department's computer system showed no interactions. Today, Dr. Brown's patient experienced a severe interaction between the new drug and a medication that the patient was already taking.

At a recent continuing-education seminar, Dr. Hamilton and her staff pharmacists learned of the potential for a significant interaction between the two medications in question. She was puzzled as to why one of the pharmacists would have told a physician that there are no drug interaction problems with the new drug. Dr. Hamilton and the staff pharmacists are aware that the hospital information technology department has not yet updated the pharmacy department computer system to include this interaction. As she concludes her conversation with Dr. Brown, she promises to find out what happened and take corrective action.

In Dr. Hamilton's investigation, she discovers that technician Robert Allen in fact took the phone call and answered Dr. Brown's question. Dr. Hamilton calls a meeting of the pharmacists to discuss how to prevent such problems from occurring in the future. During the meeting, she discovers that a few of the staff pharmacists have, on occasion, observed Robert stepping outside his technician role because he was trying to be helpful. They tell her that they have attempted to correct his behavior but have had little success. This is the first time Dr. Hamilton has heard of the problem.

Discussion Questions

1. How should Dr. Hamilton address this situation?

2. Are there problems with the way the department is functioning as a unit?

3. Is this situation simply a “personnel” issue confined to Robert's behavior?

4. Are there other issues or combinations of issues that should be addressed?

Case 29.4: A Recently Hired Pharmacist and the Nonpharmacist Store Manager

Federal Statutes (Social Security Act and HIPAA)

Pauline Rodgers, Pharm.D., recently started working as a staff pharmacist at Big Box Stores, Inc. right after she passed her board examinations and became licensed as a pharmacist. The pharmacy manager, Len Roberts, R.Ph., has been working for Big Box for about 20 years and has a fairly cordial relationship with Don Smith, the store manager. Mr. Smith, a business school graduate, is very pro-pharmacy and wants to do all he can to help the pharmacy department increase its business through various marketing promotions. After working at the store for a few weeks, Pauline notices that Len makes a practice of giving in-store coupons to patients who are Medicare and Medicaid beneficiaries. These coupons, each worth $10, can be used toward the purchase groceries, DVDs, clothing, and so on. Realizing that she will soon likely encounter a situation where a Medicare or Medicaid beneficiary will expect to receive a coupon from her, Pauline asks Len what recordkeeping system is in use for tracking the total annual value of coupons given to each beneficiary. Len responds with a puzzled look on his face and asks: “Why would we do that? Mr. Smith wants us to keep handing out these coupons to increase our business. When it comes to running the business, I do what Mr. Smith wants and I don't ask questions.”

Discussion Questions

1. How should Pauline respond to Len?

2. What do you think are the important legal and managerial issues here?

3. How should Pauline respond to a request for a coupon from a Medicaid beneficiary?

4. Describe how you would handle this situation if you were Pauline.

Case 29.5: The Poorly Written Prescription and the Hurried Pharmacist

Civil Liability (Tort Law)

Stuart Johnson, R.Ph., is manager of Johnson's Apothecary, a community pharmacy. When he arrived at the pharmacy today, there was a frantic voice-mail message left for him in the middle of the night while the pharmacy was closed. It seems that a staff pharmacist, Dave, made a dispensing error yesterday, and Suzie Jones, a 3-year-old child, was taken unconscious by ambulance to the local community hospital emergency room at 2:00 a.m. Suzie and her family had just moved to town about 2 weeks ago, and yesterday was their first visit to Johnson's Apothecary.

In the process of both calling the hospital and interviewing Dave, the staff pharmacist, Stuart learns the following: Somehow Dave misinterpreted a poorly written prescription that was supposed to be for glycerin suppositories (Directions: “Use as directed”) as a prescription for Glynase 5-mg tablets (a drug used to treat diabetes in adults). As a result of this error, Suzie's blood sugar dropped to dangerously low levels, and she is now in a coma. Dave was very busy when the error occurred and did not determine that the patient, Susan Jones, was in fact a 3-year-old child. He also did not speak to Suzie's mother, who brought in the prescription. Because he was very busy, he quickly checked a pharmacy technician's work and let her dispense the prescription to Mrs. Jones, an uninsured cash-paying customer. The sad truth is that the doctor had not even intended this written note to be a prescription (glycerin suppositories are available without a prescription); it just looked like one because it was on one of the doctor's prescription blanks.

Discussion Questions

1. From this case, describe violations of both state and federal law and the tort law implications (i.e., potential for being sued).

2. What is the manager's role in determining what happened internally that was out of conformance with standards, with external regulatory bodies, and with professional performance standards beyond the letter of the law?

3. How can all these be brought to bear on the pharmacy?

4. How should Stuart as the manager respond when the local TV station and newspaper want interviews?