5.4 Patient Profile Records, Confidentiality & Permitted Disclosures

5.4 Patient Profile Records, Confidentiality & Permitted Disclosures

[!NOTE] Core Legal Authorities: New Jersey State Board of Pharmacy rules on the patient profile record system and confidentiality (N.J.A.C. 13:39-7.19), copies of prescriptions and profiles (N.J.A.C. 13:39-7.7), drug utilization review (N.J.A.C. 13:39-7.20), the New Jersey Prescription Monitoring Program statute (N.J.S.A. 45:1-45 et seq.) and rules (N.J.A.C. 13:45A-35), the federal HIPAA Privacy Rule (45 CFR Parts 160 and 164), and the federal substance-use-disorder confidentiality rules at 42 CFR Part 2.

The MPJE Competency Statements devote an entire item to "protecting patient and health record confidentiality," and New Jersey tests it in a specific way: not as an abstract HIPAA quiz, but as a set of counter-scenarios in which someone standing at the counter or on the telephone wants information, and you must decide whether the law permits, compels, or forbids the disclosure.

---

The Profile Is a Clinical Record, Not a Transaction Log

N.J.A.C. 13:39-7.19 requires every New Jersey pharmacy to maintain a patient profile record system. The profile is what makes the mandatory prospective drug utilization review under 13:39-7.20 possible: on receipt of a new or refill prescription, the pharmacist examines the profile before dispensing to identify potentially significant interactions, reactions, or misutilization. A profile that contains only fill dates and NDC numbers cannot support that screen.

A usable New Jersey profile therefore captures:

That last row is the one candidates skip. The rule contemplates that a pharmacist will write in the profile — a documented intervention, a prescriber consultation, a counseling refusal. In a Board investigation, an undocumented intervention is functionally an intervention that never happened.

---

The Confidentiality Rule Itself

The operative language of N.J.A.C. 13:39-7.19 is compact and worth memorizing close to verbatim: patient records shall be kept confidential, but shall be made available to persons authorized to inspect them under State and Federal statutes and regulations.

Read as a two-part test, that sentence answers most exam scenarios:

              Someone requests patient information
                              │
              ┌───────────────┴───────────────┐
              ▼                               ▼
   Is the requester AUTHORIZED         Not authorized by any
   by a State or Federal statute       State or Federal statute
   or regulation to inspect?                    │
              │                                 ▼
              ▼                          DEFAULT: confidential.
     Disclosure permitted (and           Do not disclose. Patient
     sometimes compelled) within         authorization or a valid
     the scope of that authority.        legal process is required.

Requesters Who Are Ordinarily Authorized

• The patient, and a personal representative acting on the patient's behalf.
• Board of Pharmacy inspectors and Division of Consumer Affairs investigators, exercising the inspection authority discussed in the disciplinary chapter — an inspector does not need a warrant or the patient's consent to review dispensing records.
• Practitioners involved in the patient's care, and other pharmacists, for treatment purposes.
• DEA and other regulators acting within their statutory authority over controlled substance records.
• Payors, for payment and health care operations within the HIPAA framework.

Requesters Who Are Not

• A spouse, adult child, or parent of an adult patient who simply asks what the patient is taking. Family relationship is not authorization. HIPAA permits limited disclosure to a person involved in the patient's care where the patient does not object and the information is directly relevant to that involvement — which covers handing a prescription bag to the spouse picking it up, not reciting the patient's medication history.
• An employer verifying what an employee takes.
• Law enforcement making an informal request without a subpoena, warrant, or other legal process. The correct response is not refusal-with-attitude; it is to decline the informal request and ask for the appropriate legal process, while immediately preserving the records.

---

The Patient's Right to Copies — With a Clock

N.J.A.C. 13:39-7.7 obliges a pharmacy to comply immediately with a patient's request for copies of prescriptions and/or the patient profile, and it defines "immediately" numerically:

Two related traps live in the same rule. A copy issued directly to the patient must bear, in letters at least as large as those describing the medication, the underlined statement "COPY — FOR INFORMATION ONLY." And presenting such a copy — or simply presenting a labeled prescription container — has no legal status as a valid prescription order. A pharmacist handed a labeled vial from another pharmacy must contact the prescriber for a new prescription or arrange a transfer under 13:39-7.8; the pharmacist may not dispense from the label.

---

NJPMP Data: A Second, Stricter Regime

Program data under N.J.S.A. 45:1-45 et seq. is not ordinary pharmacy record material, and the exam treats it separately:

1. Credentials are individual. Each authorized user holds a personal registered account. Sharing a user ID or password with a colleague — even a licensed colleague who is entitled to their own account — is a violation in itself.
2. Delegates must be registered. A practitioner may delegate querying, but only to a health care delegate who holds an individual registered account with the Division of Consumer Affairs.
3. Query only within the professional relationship. Looking up a neighbor, a job applicant, or a family member is unauthorized access regardless of curiosity or good intentions, and it is auditable — the system logs every query against the querying account.
4. Unauthorized access or disclosure exposes the licensee to civil penalties, license discipline, and potential criminal liability, independent of any HIPAA exposure.

---

How the Layers Stack

The governing principle when two of these conflict is not "HIPAA wins." It is that the more protective rule controls. A candidate who answers a Part 2 or NJPMP question with a generic HIPAA treatment-disclosure rationale will get it wrong.

---

Practice Scenarios

Scenario 1 — The concerned adult child. A woman asks the pharmacist whether her 78-year-old father, a competent adult who lives independently, is still filling his warfarin. She is not his personal representative and he has never authorized disclosure. Analysis: Decline. Being an adult child is not authorization under 13:39-7.19, and HIPAA's involvement-in-care provision does not extend to reciting a medication history to a relative who is not picking up the prescription and whose involvement the patient has not acknowledged. The professional move is to offer to speak with the father directly and to invite him to authorize disclosure.

Scenario 2 — The detective at the counter. A municipal detective, in uniform and without a subpoena, asks for the dispensing history of a named patient in a diversion investigation. Analysis: An informal request is not legal process. Decline the informal request, ask for a subpoena, warrant, or other lawful authority, and preserve the records — do not alter or purge anything. This is different from a Board or Division inspection, where the inspector's statutory authority is the authorization and records must be produced.

Scenario 3 — The helpful password. A newly hired pharmacist has not finished NJPMP registration and asks the RPIC to run a query under the RPIC's account so the patient is not delayed. Analysis: Refuse. Credential sharing is a discrete NJPMP violation for both pharmacists. The lawful paths are for the RPIC to run and act on the query in their own professional capacity, or for the new pharmacist to complete registration. Convenience is never a defense to a logged access violation.