COMMUNITY PRACTICE

Pharmacy faces new HIPAA hiccup

Just when pharmacists thought they'd survived the April 14 deadline to implement the federal patient privacy mandate, a new regulatory hiccup has been discovered that puts even more documentation burdens on pharmacies.

When state pharmacy board inspectors come to call and skim through the prescription files, pharmacies are required to document the visit and reveal that this has taken place to any patients who inquire about disclosures of their protected health information (PHI), according to the federal official in charge of enforcing the Health Insurance Portability & Accountability Act.

"We must advise that the definition of disclosure clearly encompasses the provision of access to protected health information, even when that access is only to skim the file," wrote Richard Campanelli, J.D., director of the Office of Civil Rights, U.S. Department of Health & Human Services. "The skimming of patient files by state investigators is a disclosure of protected health information, and such disclosures must be included in an accounting of disclosures if requested by a patient."

Campanelli's opinion came in response to a request for guidance by Carmen Catizone, executive director, National Association of Boards of Pharmacy. Noting that it's clear that pharmacies must account for disclosures of PHI to pharmacy board inspectors, Catizone urged the Office of Civil Rights to rule that an inspector merely leafing through Rx files doesn't count as a disclosure.

"Inspectors may skim through hundreds or even thousands of hard-copy prescriptions and/or computerized files in one inspection," Catizone wrote. "The amount of time it would take to document each viewing will add a significant amount of time to the inspection process, increasing the burden and impeding the ability of boards to conduct thorough inspections. Furthermore, such a requirement will adversely affect patient care as pharmacies divert time away from patient care activities."

In some fancy bureaucratic footwork that further muddied the HIPAA waters, Campanelli advised that the final rule doesn't require pharmacies to individually track such disclosures of PHI to pharmacy board inspectors. The pharmacy "is free to design a system that efficiently permits an accounting to be provided upon an individual's request," he wrote. "It would be sufficient to prepare a standard checklist of such disclosures, which could then be completed and provided to those individuals who request an accounting."

Phone calls to Campanelli seeking clarification of what pharmacies must do to comply with his advisory opinion were not returned.

Campanelli's proposed remedy left NABP's Catizone scratching his head. "We're not sure what he means by setting up a system to present a standard checklist and at the same time providing an individual accounting," he told Drug Topics. "We're drafting a letter to ask him to reconsider."

The Campanelli interpretation came as a surprise to Douglas Hoey, VP of practice affairs, National Community Pharmacists Association. "To ask a pharmacy and pharmacy board inspector to account for every file they've gone through is not, in my opinion, consistent with the spirit of HIPAA," he said. "It will inhibit patient care and get in the way of inspectors trying to do their job and the pharmacy trying to comply with the inspector's request. "

The National Association of Chain Drugstores did get a clarification from the HHS Office of Civil Rights, said Crystal Wright, VP of media relations. "The letter was very vague," she said. "All it said was that you don't have to account for individuals being disclosed; you just have to keep a log. So we're interpreting that to mean we will document when the pharmacy inspectors come by, and when an individual asks for an update on who has used their information, we'd disclose to them that it may or may not have been skimmed by the pharmacy inspector."

Some pharmacies have reportedly balked at letting state pharmacy board inspectors see their Rx files, mistakenly citing HIPAA privacy provisions. To short-circuit any such foot-dragging, the North Dakota pharmacy board is working with the state attorney general to draft a notice that the board can inspect all records, and pharmacies must release those records to the board, said executive director Howard Anderson Jr. He added, "We are unhappy with Mr. Campanelli, who said pharmacies must record random audit exposures of information that occur during inspections. HIPAA takes time and money away from patient care. I hope somebody finds it is worth something in the long run."

An Indiana pharmacist, who was already fed up with HIPAA taking time away from patients, commented about the latest wrinkle. "I guess that each patient might be getting a list of pharmacy inspections from the time that HIPAA took place. 'This pharmacy was inspected on days, XX, YY, ZZ, and during these inspections your scripts may have been viewed by the state pharmacy inspector. Smile and be happy!' Now that's really useful information."

Carol Ukens

 

Carol Ukens. Pharmacy faces new HIPAA hiccup. Drug Topics Jun. 2, 2003;147:34.