Key Takeaways
- HIPAA protects patient health information (PHI); pharmacy technicians must only access PHI for treatment, payment, or healthcare operations (TPO).
- HIPAA violations can result in civil penalties up to \$1.5 million per year and criminal penalties including imprisonment.
- CMEA restricts pseudoephedrine sales: 3.6g daily limit, 9g monthly (mail order: 7.5g), logbook required, behind-the-counter placement.
- Valid prescriptions must include: patient name, drug name/strength/quantity, directions, prescriber signature, date, and DEA number (if controlled).
- Mid-level practitioners (NPs, PAs) may prescribe controlled substances in most states but have varying DEA authority by state.
HIPAA, CMEA, and Prescription Requirements
Quick Answer: HIPAA protects patient health information — technicians should only access PHI when necessary for treatment, payment, or operations. CMEA limits pseudoephedrine to 3.6g/day and 9g/month with logbook requirements. Valid prescriptions must include patient name, drug details, directions, date, and prescriber signature.
HIPAA (Health Insurance Portability and Accountability Act)
HIPAA (1996) establishes national standards to protect patient health information.
Key HIPAA Terms
| Term | Definition |
|---|---|
| PHI (Protected Health Information) | Any individually identifiable health information (name, DOB, address, diagnoses, medications, etc.) |
| Covered Entity | Healthcare providers, health plans, and healthcare clearinghouses that transmit PHI electronically |
| Business Associate | Third parties that handle PHI on behalf of covered entities |
| TPO | Treatment, Payment, and Healthcare Operations — the three permitted uses of PHI without patient authorization |
| Minimum Necessary Standard | Use/disclose only the minimum PHI needed to accomplish the purpose |
HIPAA Rules
| Rule | Purpose |
|---|---|
| Privacy Rule | Establishes standards for protecting PHI |
| Security Rule | Requires administrative, physical, and technical safeguards for electronic PHI |
| Breach Notification Rule | Requires notification following a breach of unsecured PHI |
Pharmacy Technician HIPAA Responsibilities
- Access PHI only when necessary for legitimate work purposes (filling prescriptions, billing)
- Never share patient information with unauthorized individuals (including family members without consent)
- Verify identity before releasing prescriptions or discussing medications
- Protect computer screens from public view
- Dispose of PHI properly (shredding, secure containers)
- Report breaches to supervisor immediately
HIPAA Violations and Penalties
| Violation Tier | Penalty Range (per violation) |
|---|---|
| Tier 1: Unknowing | $100 - $50,000 |
| Tier 2: Reasonable cause | $1,000 - $50,000 |
| Tier 3: Willful neglect (corrected) | $10,000 - $50,000 |
| Tier 4: Willful neglect (not corrected) | $50,000+ |
Annual Cap: $1.5 million per violation category per year
Criminal Penalties:
- Knowingly obtaining/disclosing PHI: Up to 1 year imprisonment
- False pretenses: Up to 5 years imprisonment
- Intent to sell or harm: Up to 10 years imprisonment
CMEA (Combat Methamphetamine Epidemic Act)
CMEA (2005) restricts the sale of pseudoephedrine (PSE) and ephedrine products to prevent methamphetamine production.
CMEA Requirements
| Requirement | Details |
|---|---|
| Daily purchase limit | 3.6 grams of PSE base |
| 30-day purchase limit | 9 grams of PSE base (7.5g for mail order) |
| Product placement | Behind the counter or in locked cabinet |
| Purchaser requirements | Must be 18+, show valid ID, sign logbook |
| Logbook entries | Name, address, date/time, product, quantity, signature |
| Record retention | 2 years |
CMEA Logbook Requirements
The pharmacy must maintain a logbook (paper or electronic) with:
- Product name and quantity sold
- Purchaser's name and address
- Date and time of sale
- Purchaser's signature
- Type of ID presented
NPLEx: Many states use the National Precursor Log Exchange (NPLEx) — a real-time electronic system that tracks PSE purchases across pharmacies to prevent limit violations.
Prescription Requirements
Elements of a Valid Prescription
| Element | Required For |
|---|---|
| Patient name | All prescriptions |
| Date written | All prescriptions |
| Drug name, strength, dosage form | All prescriptions |
| Quantity | All prescriptions |
| Directions for use (Sig) | All prescriptions |
| Prescriber signature | All prescriptions |
| Prescriber name and address | All prescriptions |
| DEA number | Controlled substances only |
| Number of refills | Optional (0 if not specified) |
Who Can Prescribe?
| Prescriber Type | Prescribing Authority |
|---|---|
| Physicians (MD, DO) | Full prescribing authority including all controlled substances |
| Nurse Practitioners (NP) | Varies by state; most can prescribe controlled substances with limitations |
| Physician Assistants (PA) | Varies by state; most require collaborative agreement |
| Dentists (DDS, DMD) | Limited to dental-related conditions |
| Podiatrists (DPM) | Limited to foot and ankle conditions |
| Optometrists (OD) | Limited to eye conditions (varies by state) |
| Veterinarians (DVM) | Animal use only |
Corresponding Responsibility
Both the prescriber and the pharmacist share responsibility for ensuring a prescription is valid and issued for a legitimate medical purpose. This is called corresponding responsibility.
A pharmacist (and by extension, a pharmacy technician who identifies red flags) should question prescriptions that:
- Come from an unusually far distance
- Are written for maximum quantities of controlled substances
- Are paid for in cash (avoiding insurance scrutiny)
- Appear altered or forged
- Are presented by patients who exhibit drug-seeking behavior
Prescription Transfers
| Controlled Substance Schedule | Transfer Rules |
|---|---|
| Schedule II | Cannot be transferred |
| Schedules III-V | One-time transfer (or as allowed by state law/pharmacy systems) |
| Non-controlled | As allowed by state law |
A customer wants to purchase pseudoephedrine (Sudafed). Under CMEA, what is the maximum amount of pseudoephedrine base a customer can purchase in one day?
A pharmacy technician is curious about a celebrity patient's medications and accesses their profile without a work-related reason. This is a violation of:
Which of the following is NOT a required element on a prescription for a non-controlled medication?