This article is not intended as legal advice and should not be used as such. When legal questions arise, pharmacists should consult with attorneys familiar with the relevant drug and pharmacy laws.

Ned Milenkovich is chair of the Healthcare Law practice 

Ned Milenkovich, PharmD, JD

	As both federal and state legislation concerning track and trace continues to evolve, a closer look at pending federal legislation becomes increasingly appropriate. As is well settled, California’s electronic pedigree requirement will begin in 2015, absent implementation by Congress of a national prescription drug track and trace law. Proposed federal legislation would generally preempt or supplant any state legislation, including that of California.

	In June 2013, the House passed H.R. 1919, which would create a national track and trace system. The Senate passed a similar bill in the form of S. 959. Most recently, on September 25, 2013, Senate and House committee leadership agreed on bicameral legislation that would amend the Federal Food, Drug, and Cosmetic Act to address the issue of compounding pharmacies while also incorporating a national prescription-drug track and trace system. The House passed the bicameral legislation, in the form of H.R. 3204, on September 28, 2013.

	The bicameral legislation provides specific requirements for all stakeholders in the drug-distribution supply chain. This includes manufacturers, wholesalers, repackagers, and pharmacies.

	The current Senate bill requires third-party logistics providers (“3PL”) to be responsible for drug pedigrees, while the bicameral legislation does not.

	The bicameral legislation requires manufacturers to provide product identifiers on prescription-drug products produced within four years of enactment of the law, while repackagers are required to include it within five years. However, the bicameral legislation mandates that manufacturers, wholesalers and repackagers, provide and/or receive drug pedigrees by January 1, 2015, while dispensers must do so by July 1, 2015. In addition, within six years wholesalers must accept and distribute only prescription drugs containing product identifiers, and within seven years dispensers may receive only prescription drugs with product identifiers.

	The bicameral legislation also requires supply-chain distribution stakeholders to implement a system that ensures the legitimacy of a prescription drug, in order to minimize counterfeiting, adulteration, or introduction of prescription drugs into commerce by illegitimate means. If a drug product is suspected to be illegitimate, stakeholders are required to take action to eliminate it from the supply chain.

	The federal legislation allows for transmission and recordkeeping of drug pedigrees to occur by either paper or electronic means. However, an “interoperable electronic system” must be implemented within 10 years of the new law.

	The Food and Drug Administration (FDA) is very likely to issue compliance policy guides in connection with the various track and trace legislative requirements. FDA will also be tasked with establishing pilot programs in order to evaluate various methods of increasing safety and security of the prescription-drug distribution supply chain.

	Of note, the bicameral legislation contains wholesaler and 3PL licensing requirements. If states do not mandate licensing provisions, the bicameral legislation provides for the creation of national wholesaler and 3PL licenses. Fees for licensing in the states will still inure to the benefit of the states.

	In addition to the licensing requirements, beginning on January 1, 2015, a wholesaler and 3PL must submit annual reports to the FDA. The reporting requirements include: information regarding each state of wholesaler or 3PL licensure; name and address of each facility; and contact information. 

	The proposed bicameral legislation is currently bound to the compounding federal legislation. Nevertheless, it appears to have broad support from both Congressional chambers, as well as bipartisan political support. With House passage already a reality, and the Senate set to vote on it, it would appear that federal prescription-drug track and trace law is imminent. 

This article is current as of press time. Due to the fluid nature of HR 3204, it may have become law by the time the November 2013 issue of 

Articles

The bicameral legislation provides specific requirements for all stakeholders in the drug-distribution supply chain, including manufacturers, wholesalers, repackagers, and pharmacies.

Federal track and trace legislation imminent

Drug Enforcement Administration (DEA) regulations have been vague with respect to the dispensing of controlled substances on instructions from LTC facility staff after they have consulted with an authorized prescriber.  

In addition, while DEA does not oppose the use of a reminder letter containing a blank prescription template for emergency use as well as for expiring orders, DEA has taken the position that LTC pharmacies are not permitted to provide an authorized prescriber a prescription template that has been completed in whole or in part by the pharmacy. 

The DEA is affirming that the civil settlement highlights the responsibilities of pharmacists, physicians, and others when prescribing or dispensing controlled substances. The settlement resolves civil penalty claims made by the DOJ against the pharmacy that it violated the Controlled Substances Act for an extended period.  

The claims against the pharmacy included:

DEA's October 2010 guidance described under what circumstances a nurse can act as an agent of an authorized prescriber when transmitting a prescription to an LTC pharmacy.  

DEA's position is that unless a pharmacy is able to follow that guidance, LTC pharmacies are prohibited from dispensing controlled substances without a valid prescription signed by a physician ordering the medication. 

An exception would be limited "emergency" circumstances, where applicable law and regulations provide a special procedure for a prescribing practitioner to call in an oral prescription for Schedule II controlled substances directly to the pharmacy, followed up within a week by a signed written prescription.  

DEA alleged that the LTC pharmacy has routinely accepted facility medical chart orders, oral orders from facility staff, and other substitute documents and procedures as bases to dispense controlled substances, instead of requiring signed prescriptions or oral prescriptions directly from the prescribing physician. 

Under the terms of the agreement, payment of $50 million to the Office of the United States Attorney for the Northern District of Ohio was required.  

The DEA, in turn, agreed to refrain from instituting, directing, or maintaining any administrative action, including denial, suspension, or revocation of the pharmacy's DEA registration.   

This article is not intended as legal advice and should not be used as such. When legal questions arise, pharmacists should consult with attorneys familiar with relevant drug and pharmacy laws.

 is a member at McDonald Hopkins, LLC, and chairs its drug and pharmacy practice group. He is also Vice-Chairman of the Illinois State Board of Pharmacy. Contact Ned at 312-642-1480 or at 

Federal agencies have fined an LTC provider $50 million for improperly dispensing controlled substances.

DEA settles $50 million penalty with LTC pharmacy provider

In order for a physician electronic health record application vendor or pharmacy practice management application vendor to be able to connect its users to an electronic prescribing network, it must first comply with technical requirements set forth by the DEA's IFR. Thereafter, the vendor must: 

Several companies are recognized by the DEA in its EPCS IFR as being qualified to perform Part 1311 EPCS audits: SysTrust, WebTrust, SAS 70, and/or certified information system auditors. In addition, the DEA recently specifically approved InfoGard Laboratories as another company capable of conducting Part 1311 EPCS audits. Other companies may become available as well in the future.  

To date, several physician or pharmacy application vendors have completed the process of becoming certified and audited to connect to an electronic prescribing network for EPCS purposes. 

At present, only a small number of EPCS transactions have been transmitted in those states in which this is currently allowed. Although the DEA has promulgated its IFR, many states still need to align their laws and regulations in order for EPCS transactions to occur. 

To date, prescribers registered in eight states have issued DEA-compliant EPCS transactions: California, District of Columbia, Massachusetts, Maryland, Michigan, Texas, Virginia, and Washington. Although electronic prescribing networks such as Surescripts provide services in all fifty states and DC, nationwide deployment of EPCS can only occur once both the state and federal laws are aligned in all jurisdictions. 

Vendors are cautioned that in several instances, electronic prescribing networks provide that additional requirements must be met before these pathways can be used to facilitate EPCS. For example, vendors may need to prove that they have completed their Part 1311 EPCS audits as required by the DEA before being activated for EPCS transactions. Additionally, pharmacy directories in prescriber applications are required to indicate which pharmacies are enabled to receive EPCS, and prescribers are able to send EPCS only to those pharmacies, and vice versa. 

Finally, in those instances in which an EPCS transaction crosses state lines, both the transmitting prescriber and the receiving pharmacy should be in compliance with both the DEA's EPCS IFR and the controlled substance laws and regulations of the state in which the prescriber or pharmacy is located.   

This article is not intended as legal advice and should not be used as such. When legal questions arise, pharmacists should consult with attorneys familiar with the relevant drug and pharmacy laws.

 is a member at McDonald Hopkins, LLC, and chairs its drug and pharmacy practice group. He is also Vice-Chairman of the Illinois State Board of Pharmacy

DEA published its interim final rule on e-prescribing for controlled substances (EPCS) more than two years ago. While vendors work toward compliance, nationwide deployment of EPCS can only occur once both state and federal laws are aligned in all jurisdictions.

Controlled substances: Progress in technology and e-prescribing

The report indicates that 2,637 participating pharmacies (the majority of which are independent pharmacies) had shown patterns of "questionable" billing practices suggestive of fraud and abuse. 

OIG used several markers in its analysis, including: 

One example in the OIG report mentioned that although pharmacies typically bill $1,500 per beneficiary and $1,800 per prescriber on average, numerous pharmacies billed more than $4,050 per beneficiary while others billed nearly $6,000 per prescriber.  

CMS acknowledged the OIG report and responded as follows: 

The OIG recommended that CMS require sponsors to refer possible fraud and abuse incidents that may warrant further investigation to CMS and other investigative and enforcement entities.  

This recommendation was rejected by CMS. Instead, CMS responded that its regulations currently do not require self-reporting of potential fraud and abuse incidents. Nevertheless, CMS did state that it would explore the option of placing additional burdens on plan sponsors and consider assigning and sharing risk scores with plan sponsors. 

After showing that MEDICs were not aware of incidents of fraud and abuse, OIG recommended that CMS should improve MEDICs' monitoring of pharmacies and its ability to recognize pharmacies for further review.  

In response, CMS stated that the MEDIC already identifies pharmacies that present a fraud risk. Nevertheless, CMS would consider developing a high-, medium-, and low-risk stratification for pharmacies and would consider sharing that information with sponsors when appropriate.  

In light of the OIG report, pharmacies should be aware of the factors that may be used to accuse pharmacies of practicing questionable billing.  

OIG is making efforts to target pharmacies and eliminate fraud and abuse. While pharmacies should continue to conduct their standard compliance audits, they should add the markers used by OIG to determine whether they exceed the OIG thresholds and to evaluate them if present. 

Of geographic interest, the OIG report noted that Miami, Los Angeles, and Detroit were the most likely areas for questionable pharmacy billing, followed by Baltimore, New York, and Tampa. These were not exclusive areas of questionable pharmacy billing, just the most likely.    

is a member at McDonald Hopkins, LLC, and chairs its drug and pharmacy practice group. He is also Vice-Chairman of the Illinois State Board of Pharmacy

The Office of Inspector General has issued a report implicating more than 2,600 pharmacies in Medicare Part D fraud

OIG accuses more than 2,600 pharmacies of questionable billing practices

Put another way, states with their own PMP programs in place will now be able to link to those of other states across the entire country. In this way, each authorized user and/or state regulatory agency will have an expanded ability to combat drug diversion and increasing levels of drug abuse through access to the greater information resources available across an extensive multistate database. 

PMP InterConnect provides individual state PMPs with greatly enhanced information, enabling physicians and pharmacists to more easily identify patients with problems pertaining to misuse and abuse of prescription drugs, particularly in those instances in which a patient attempts to cross state lines to obtain drugs for abuse or diversion. 

Without PMP InterConnect, individual state PMP systems lack the ability to integrate and be interoperable with other states. PMP InterConnect provides states with a newfound ability to engage in data sharing with other states, making it more difficult for drug abusers and diverters to avoid detection.  

In short, more readily accessible information in the aggregate will allow for more robust intervention and will aid in the prevention of substance abuse and diversion of controlled substances. 

Healthcare providers might not be the only professionals to obtain access to information derived from PMP InterConnect; public servants might be able to make use of it as well. When authorized by state law, law enforcement and regulatory enforcement agencies will be able to obtain information that will help them to quickly identify attempts to illegally divert controlled substances across state lines. 

NABP's PMP InterConnect is maintained on a very secure communications exchange platform that allows for the transmission of PMP data across state lines to authorized users in a secure fashion.  

The system also provides safeguards such that each state's data-access rules are fully complied with. Note that PMP InterConnect will not store any data, and the system in no way inhibits the legitimate prescribing or dispensing of prescription drugs. 

PMP InterConnect is now fully operational. PMPs in several states have deployed the program to authorized users who now can securely exchange prescription data among participating states.  

Not all states have joined the PMP InterConnect network yet. NABP continues to work with other state PMPs to facilitate their participation in PMP InterConnect.  

Since March 2012, at least 20 states have agreed to participate in the program and discussions are ongoing with a number of other states. It is expected that all 50 states will soon be on board. 

NABP has launched an initiative to transfer prescription monitoring program information across state lines

NABP deploys PMP InterConnect

 The HITECH Act contains electronic health record incentives and also expands covered entity and business-associate requirements under the Health Insurance Portability and Accountability Act of 1996 as amended (HIPAA) and the supporting privacy and security rules safeguarding protected health information (PHI). 

In turn, the HITECH Act required the Department of Health and Human Services (HHS) to publish interim final regulations (rules) on notification in the case of a PHI security breach. HHS published the rules in the 

Security-breach notification obligations apply only to breaches of unsecured PHI, as defined in the rules. Upon becoming aware of an incident involving a breach of PHI, the pharmacy or business associate will need to determine whether the incident triggers the obligation to notify the affected individuals, HHS, and in some cases the media.  

The rules call for a three-step process. The first step is to determine whether there has been an impermissible use or disclosure under HIPAA provisions. The second step requires performance of a risk assessment to determine and document whether the impermissible use or disclosure compromised the privacy or security of the PHI. The third step requires a determination of whether the incident falls within one of three regulatory exceptions that will not trigger the notification obligation. 

Upon discovery of a breach of unsecured PHI, the pharmacy is required to notify each individual whose unsecured PHI has been used or disclosed as a result of the security breach, in the manner set forth by the rules. 

The rules set forth additional obligations to report to HHS and in some cases to the media. If a breach involves more than 500 residents of any state, the pharmacy will be required to notify prominent media outlets in the state. Notification may be undertaken in a variety of ways set forth in the rules. 

A business associate who discovers a breach will be required to notify the pharmacy. It is important to note that a business associate's discovery of a breach could be imputed to the pharmacy if the business associate is deemed to be an agent of the pharmacy, causing the pharmacy's notice period to begin when the business associate discovers the breach, rather than when the business associate notifies the pharmacy of the breach.  

On the other hand, if the business associate is an independent contractor and not an agent, the notice period for the pharmacy to report a breach discovered by the business associate would begin when the business associate notifies the pharmacy of the breach, unless the pharmacy had previously discovered the breach.  

Some ambiguity exists regarding whether the HITECH Act and the rules require existing HIPAA business-associate agreements to be amended. Amending such agreements to incorporate appropriate security-breach safeguards is the more cautious approach. Moreover, it will be in the interest of pharmacies to include specific security-breach provisions in their business-associate agreements. 

The rules took effect September 23, 2009. However, HHS acknowledged that it will take time to amend and implement policies, procedures, and systems needed in order to comply with the rules. Therefore, HHS indicated that it will use enforcement discretion and not impose sanctions for breaches discovered prior to February 22, 2010.  

In light of the interim nature of the rules, it is also possible that some changes could be made. Until then, however, pharmacies should make sure they are compliant with the rules.   

is a member at McDonald Hopkins LLC, where he chairs the Drug & Pharmacy Group. He is also a member of the Illinois State Board of Pharmacy. He can be reached at 312-642-1480 or by e-mail at 

The American Recovery and Reinvestment Act, signed into law on February 17, included the Health Information Technology for Economic and Clinical Health Act (HITECH), which expands covered-entity and business-associate requirements established by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).