7.1 Pharmacy Law and Regulations

Federal Pharmacy Law: The FDCA Foundation

The Federal Food, Drug, and Cosmetic Act (FDCA) of 1938 is the cornerstone of US drug regulation. It was passed after the sulfanilamide elixir tragedy killed more than 100 people, mostly children. The FDCA required, for the first time, that drugs be proven safe before marketing, and it established the New Drug Application (NDA) process through which manufacturers submit safety data to the FDA. It also authorized factory inspections, required drug labeling to be truthful and not misleading, and extended federal oversight to cosmetics and medical devices.

Major Federal Laws and Their Pharmacy Impact

Durham-Humphrey and Kefauver-Harris in Detail

The Durham-Humphrey Amendment (1951) created the legal category of legend drugs — medications that cannot be dispensed without a prescription because they are not safe for self-use. The label bears the now-familiar "Rx only" statement, which replaced the older caution legend. The Kefauver-Harris Amendment (1962) responded to the thalidomide tragedy and required efficacy data in addition to safety data. It established Good Manufacturing Practice (GMP) regulations, required informed consent for clinical trial subjects, and gave the FDA authority to withdraw approval for drugs that were not effective.

The Controlled Substances Act and DEA Schedules

The Controlled Substances Act (CSA) of 1970 is enforced by the Drug Enforcement Administration (DEA). It classifies substances into five schedules based on three criteria: (1) abuse potential, (2) accepted medical use in treatment in the United States, and (3) likelihood of physical or psychological dependence.

• Schedule I — No accepted medical use, high abuse potential (heroin, LSD, MDMA, psilocybin). These substances cannot be prescribed and may only be used in federally approved research.
• Schedule II — Accepted medical use, severe abuse potential (morphine, oxycodone, methylphenidate, fentanyl, methadone for opioid use disorder). No refills are permitted. Prescriptions may be electronic (EPCS), paper, or faxed in limited circumstances. DEA Form 222 is required for any order of a Schedule II substance by a registrant.
• Schedule III — Moderate abuse potential (codeine combinations up to 1800 mg per 100 mL or 90 mg per dosage unit, buprenorphine, ketamine, anabolic steroids). Up to 5 refills in 6 months.
• Schedule IV — Lower abuse potential (alprazolam, diazepam, tramadol, modafinil, zolpidem). Up to 5 refills in 6 months.
• Schedule V — Lowest abuse potential (cough preparations with less than 200 mg codeine per 100 mL, pregabalin at lower dosages, lacosamide oral solution). Often sold OTC in some states with logging requirements.

Dispensing Rules for Controlled Substances

A Schedule II prescription may be partially filled, and the remaining quantity must be filled within 30 days (or per stricter state law). Partial fills of Schedule III-V are treated like any other partial fill, but the total dispensed cannot exceed the total prescribed. Refills are prohibited on Schedule II prescriptions; a new prescription is required each time. Transfers of controlled substance prescriptions for refills are permitted between pharmacies for Schedules III-V, but only one transfer per refill is allowed, and the transfer must be documented on both sides. Schedule II transfers are not permitted for the purpose of dispensing a refill.

Electronic Prescribing of Controlled Substances (EPCS) is now mandated in many states for Medicaid and is the standard for Medicare Part D. Pharmacies must use DEA-certified software that supports two-factor authentication to accept EPCS. Pharmacies and prescribers must maintain a valid DEA registration and re-register every three years.

OBRA '90, HIPAA, DSCSA, Hatch-Waxman, and BPCIA

OBRA '90

The Omnibus Budget Reconciliation Act of 1990 (OBRA '90) transformed pharmacy practice by requiring pharmacists dispensing to Medicaid patients to:

1. Offer to counsel the patient (or caregiver) on each new prescription.
2. Conduct prospective Drug Utilization Review (DUR) before dispensing — screening for interactions, duplicate therapy, wrong dose, and clinical abuse or misuse.
3. Maintain patient medication profiles for Medicaid patients.

Many states extended OBRA '90 requirements to all patients, not just Medicaid.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA, 1996) Privacy Rule (effective 2003) governs use and disclosure of Protected Health Information (PHI) by covered entities such as pharmacies, health plans, and providers. The minimum necessary standard limits disclosures for treatment, payment, and operations to the least amount of PHI needed to accomplish the purpose. Disclosures for treatment are exempt from the minimum necessary limit. Patients have rights to access, amend, and request an accounting of disclosures of their PHI.

DSCSA

The Drug Supply Chain Security Act (DSCSA, 2013) requires an interoperable, electronic track-and-trace system for prescription drugs. Trading partners (manufacturers, repackagers, wholesale distributors, dispensers) must verify product identifiers, exchange transaction information and history, and investigate suspect or illegitimate products. Package-level tracing with product identifier verification at sale is now the operating model.

Hatch-Waxman and BPCIA

The Hatch-Waxman Act (1984) created the Abbreviated New Drug Application (ANDA) process, allowing generics to reference an innovator's safety and efficacy data via patent certifications (Paragraph I-IV). A Paragraph IV certification — challenging a patent — can earn the first-filer 180-day exclusivity. The FDA's Orange Book lists approved drugs and their patent and exclusivity information.

The Biologics Price Competition and Innovation Act (BPCIA, 2009) created the 351(k) biosimilar pathway. Biosimilars can be designated interchangeable if they meet additional standards, allowing pharmacy-level substitution without notifying the prescriber, subject to state law.

REMS, State Practice Acts, and USP Standards

A Risk Evaluation and Mitigation Strategy (REMS) is an FDA-required risk management plan beyond labeling. REMS may include a Medication Guide, communication plans, and Elements to Assure Safe Use (ETASU) such as prescriber certification, patient enrollment, restricted dispensing, or REMS-compliant pharmacy enrollment (e.g., isotretinoin iPledge, clozapine REMS, mifepristone REMS).

State pharmacy practice acts define scope of practice, licensure requirements, and collaborative practice agreements (CPAs) under which pharmacists may adjust therapy, initiate therapy, or manage drug regimens under a supervising physician protocol. State law cannot be less restrictive than federal law, but it can be more restrictive.

USP standards govern compounding quality: <795> for non-sterile compounding, <797> for sterile compounding (hazardous and non-hazardous preparations), and <800> for handling hazardous drugs — protecting personnel, patients, and the environment through engineering controls, personal protective equipment, and facility design.