6.3 DSCSA, HIPAA, OBRA ’90, and PPPA

Why four federal programs share one MPJE section

Quick Answer: DSCSA (FDCA § 582) requires authorized trading partners, TI/TS, product identifiers, and suspect-product investigation. FDA's August 6, 2026 letter keeps a small-dispenser exemption from certain enhanced tracing rules until November 27, 2027; baseline duties still apply. 503A is patient-specific compounding; 503B is FDA-registered CGMP office stock. HIPAA is PHI, TPO, minimum necessary, 30-day access, 60-day breach notice, overlaid by CGS §§ 20-578 and 20-626. OBRA ’90 is Medicaid prospective DUR plus an offer to counsel; CGS § 20-614 extends the offer. PPPA requires child-resistant packaging unless the patient or prescriber requests easy-open; SL nitroglycerin is exempt. CMEA: 3.6 g/day, 9 g/30-day retail.

DSCSA, HIPAA, OBRA ’90, and the PPPA look unrelated until a Saturday shift: you accept a tote from a new wholesaler, a parent asks for easy-open caps, a Medicaid patient declines counseling, and a technician photographs a fill screen. Each event has a federal floor. Connecticut may layer DCP, CGS, and RCSA rules on top. CT may be stricter; more-restrictive wins.

DSCSA (Title II of the DQSA, 2013)

The Drug Supply Chain Security Act added FDCA § 582. It applies to prescription drug product in finished dosage form for human use as it moves among authorized trading partners: manufacturers, wholesale distributors, dispensers (pharmacies), and repackagers. Patients are not trading partners. The operational core is:

• Transaction information (TI): the who/what/when of the sale (names and addresses, NDC, strength, dosage form, container size, number of containers, lot, date of transaction and shipment)
• Transaction history (TH): the paper or electronic sequence of prior TI back toward the manufacturer (the original paper-pedigree concept)
• Transaction statement (TS): the seller's attestation that it is authorized, received the product from an authorized partner, received the required transaction documentation, did not knowingly ship suspect or illegitimate product, and has systems in place
• Authorized trading partners only: do not buy or sell prescription product with a party that is not licensed or registered as required
• Product identifier: a standardized numerical identifier (NDC plus serial) plus lot and expiration, generally in human- and machine-readable form on the package
• Suspect and illegitimate product: quarantine, investigate, and notify FDA and trading partners; do not dispense

Enhanced drug distribution security—interoperable, electronic, package-level tracing under § 582(g)(1)—had a statutory effective date of November 27, 2023. FDA then issued a one-year stabilization period (enforcement discretion) through November 27, 2024 so trading partners could mature electronic systems. After that, FDA used § 582(a)(3) exemptions on a phased schedule (manufacturers, then wholesale distributors, then larger dispensers). Those phased exemptions for non-small partners have run.

What remains in effect as of August 6, 2026 is a targeted small-dispenser exemption. FDA granted qualifying small business dispensers—and, where noted, their trading partners—relief from certain § 582(g)(1) and § 582(d)(4) enhanced requirements until November 27, 2027, while FDA completes its small-dispenser assessment. A dispenser is 'small' for this exemption if, as of November 27, 2026, the owning company has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. The enhanced requirements remain in effect for everyone else. Baseline duties (authorized trading partners, product identifiers, suspect-product investigation, capturing TI/TS) were not blanketed away. FDA's dispenser-focused DSCSA inspectional observations in late 2025 underscored that ATP and identifier rules are live. Buying a cheap tote of onabotulinumtoxinA from an unlicensed Instagram seller is a DSCSA violation today, exemption or not.

503A versus 503B (DQSA Title I)

The same 2013 statute's Title I (Compounding Quality Act) restated § 503A and created § 503B outsourcing facilities.

Chapter 17 returns to USP and RCSA compounding. Here, the federal test is: patient-specific and 503A-compliant, or registered 503B. Anything else is an unapproved, adulterated, misbranded drug.

HIPAA, in the amount the MPJE grades

A pharmacy that conducts standard electronic transactions is a HIPAA covered entity. Protected health information (PHI) is individually identifiable information about a patient's health, care, or payment. 45 CFR 164.506 permits use and disclosure for treatment, payment, and health-care operations (TPO) without a separate HIPAA authorization. The minimum necessary standard (45 CFR 164.502(b)) requires reasonable effort to limit PHI, but it does not apply to treatment disclosures, disclosures to the individual, or disclosures required by law. Patients have a right of access under 45 CFR 164.524; the covered entity must act within 30 days (with one 30-day written extension). A breach of unsecured PHI (45 CFR 164.400–414) requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery, plus notice to HHS and, if 500 or more residents of a state or jurisdiction are affected, to the media.

Connecticut overlay. CGS § 20-578 is the agency-side rule. Information DCP, the Commission of Pharmacy, or the Department of Public Health receives through filed reports or inspection under Chapters 418, 420b, 420c, 420f, and §§ 20-570 to 20-630 shall not be disclosed publicly so as to identify individuals or institutions, except (1) in a proceeding involving licensure or the right to practice, and (2) in a proceeding where the Commission has voted for formal disciplinary action related to a dispensing error. The commissioner may disclose pharmacy-inspection information if it is in the interest of public health, and the commissioners may exchange investigative information with each other, the Chief State's Attorney, and sister drug-law agencies. The pharmacy-facing companion is CGS § 20-626: a pharmacist or pharmacy shall not reveal records concerning pharmaceutical services without the patient's oral or written consent, subject to listed exceptions (the patient, treating practitioners, payors/auditors, agencies with statutory authority, subpoena, and de-identified database access). If § 20-626 or HIPAA is tighter on a given disclosure, follow the tighter rule. Chapter 11 covers operational counseling and privacy.

OBRA ’90: the federal counseling floor

Section 4401 of the Omnibus Budget Reconciliation Act of 1990 (42 U.S.C. § 1396r-8(g); 42 CFR Part 456, Subpart K) required states, as a condition of Medicaid funding, to implement drug-use review. The pharmacist-facing pieces are:

• Prospective DUR before each fill (therapeutic duplication, drug-disease and drug-drug interactions, incorrect dose or duration, drug-allergy, clinical abuse/misuse)
• An offer to counsel the Medicaid patient or caregiver
• Maintenance of a patient record/profile that makes that DUR possible
• A state retrospective DUR program (not a bench task)

OBRA ’90 is a Medicaid floor, not a statement that cash-pay patients may be ignored. Connecticut already went further: CGS § 20-614(d) requires that, prior to or simultaneous with dispensing, a pharmacist or other pharmacy employee shall, whenever practicable, offer for the pharmacist to discuss the drug and counsel the patient, with a written offer (in-person or by telephone) when the person at the counter is not the patient or the pharmacist determines a written offer is appropriate. Section 20-614(e) requires a record of counseling, refusal, or inability. That Connecticut extension is Chapter 11; this chapter's job is to keep the federal floor straight so you do not pick 'Medicaid only, so I skip DUR for everyone else.'

PPPA child-resistant packaging

The Poison Prevention Packaging Act of 1970 is a CPSC statute (16 CFR Part 1700), not an FDA labeling rule. Special packaging must be significantly difficult for children under five to open within a reasonable time and not difficult for adults to use properly. Oral prescription drugs generally require child-resistant closures.

The two request rules the exam loves:

• The patient (purchaser) may request easy-open (non-child-resistant) packaging
• The prescriber may request easy-open packaging for that patient

Document the request. Easy-open is not the default. CPSC's 'one noncomplying size' exception is for certain OTC household substances sold on shelves, not a license to bag every prescription in a snap-cap.

Classic exemptions in 16 CFR 1700.14 include sublingual nitroglycerin and sublingual or chewable isosorbide dinitrate in strengths of 10 mg or less. Other listed exemptions (mnemonic-pack oral contraceptives, certain unit-dose potassium packages, specified corticosteroid pack sizes, pancrelipase, and others) are status-check items: if the product is on the exemption list, CRC is not required; if it is not, it is. Chapter 13 returns to packaging operations.

CMEA pointer (full behind-the-counter chapter is 14)

The Combat Methamphetamine Epidemic Act of 2005 (21 U.S.C. §§ 830, 844; DEA Diversion) limits scheduled listed chemical products (ephedrine, pseudoephedrine, phenylpropanolamine) at retail:

Place the product behind the counter or in a locked cabinet, check photo ID, keep a logbook (two years), and self-certify. Chapter 14 teaches the logbook and BTC workflow. Remember the grams here so a federal-foundations item does not surprise you.

Scenario: one independent pharmacy, five federal programs

An independent pharmacy in New London (22 pharmacist and technician FTEs at the owning company) buys injectable product from a properly licensed wholesaler, captures TI/TS, and keeps SL nitroglycerin in easy-open manufacturer bottles. A parent asks for snap-caps on a toddler's amoxicillin. HIPAA TPO lets the pharmacist discuss the amoxicillin with the child's pediatrician without a new authorization. OBRA prospective DUR still runs; Connecticut's § 20-614 offer still runs. The nitroglycerin exemption is lawful. The toddler's amoxicillin needs CRC unless the parent or prescriber requests otherwise—document it. The pharmacy may rely on FDA's small-dispenser exemption from certain enhanced DSCSA electronic-tracing requirements through November 27, 2027, but it may not buy from an unauthorized seller, and it may not skip product identifiers or suspect-product investigation. Connecticut Drug Control can still enforce CGS confidentiality, counseling, and compounding rules on the same facts.

CT may be stricter; more-restrictive wins.

Official anchors

• FDA DSCSA small-dispenser exemptions — August 6, 2026 letter, exemption through November 27, 2027.
• FDA 503A / 503B provisions.
• HHS Breach Notification Rule — 45 CFR 164.400–414.
• CPSC PPPA business guidance and 16 CFR 1700.14.
• DEA CMEA — 3.6 g/day and 9 g/30-day retail limits.
• CGS Chapter 400j — §§ 20-578, 20-614, 20-626.