2.3 Federal Consumer Protection, HIPAA & OBRA '90

2.3 Federal Consumer Protection, HIPAA & OBRA '90

While the Food, Drug, and Cosmetic Act (FDCA) regulates drug product integrity and the Controlled Substances Act (CSA) controls abusable medications, federal consumer protection statutes govern the direct interaction between the pharmacist and the patient. In outpatient practice, three federal statutory frameworks dominate professional conduct: the Omnibus Budget Reconciliation Act of 1990 (OBRA '90), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (as strengthened by the HITECH Act), and the Poison Prevention Packaging Act of 1970 (PPPA).

---

1. Omnibus Budget Reconciliation Act of 1990 (OBRA '90)

Enacted by Congress under 42 U.S.C. § 1396r-8, OBRA '90 tied federal Medicaid reimbursement grants to state implementation of comprehensive pharmacy practice standards. While federal statutory language explicitly addressed Medicaid outpatients, virtually every state — including Tennessee via Tennessee Board of Pharmacy Rules (Tenn. Comp. R. & Regs. 1140-03) — expanded these requirements to apply to all outpatient prescriptions regardless of payor.

┌─────────────────────────────────────────────────────────────────────────────┐
│                         THE THREE PILLARS OF OBRA '90                       │
├─────────────────────────────────────────────────────────────────────────────┤
│ 1. Prospective Drug Utilization Review (ProDUR)                             │
│    └─> Pharmacist clinical screening of drug therapy prior to dispensing    │
│                                                                             │
│ 2. Patient Profile Maintenance                                              │
│    └─> Comprehensive collection of demographic, clinical, and allergy data  │
│                                                                             │
│ 3. Mandatory Offer to Counsel                                               │
│    └─> Affirmative, verbal offer extended on outpatient prescriptions       │
└─────────────────────────────────────────────────────────────────────────────┘

Pillar 1: Prospective Drug Utilization Review (ProDUR)

ProDUR requires the dispensing pharmacist to evaluate the patient's prescription order against the patient's existing medication history prior to dispensing. The statute specifies that pharmacists must screen for seven therapeutic categories:

1. Therapeutic Duplication: Patient receiving two or more concurrent medications from the same therapeutic class with no clinical rationale;
2. Drug-Disease Contraindications: Medication prescribed that is known to exacerbate an underlying disease state (e.g., non-selective beta-blockers in asthma);
3. Drug-Drug Interactions: Known adverse pharmacokinetic or pharmacodynamic interactions between co-prescribed drugs;
4. Incorrect Drug Dosage: Dosing that is supratherapeutic (overdosage) or subtherapeutic (underdosage);
5. Incorrect Duration of Therapy: Treatment duration that exceeds or falls short of recognized clinical guidelines;
6. Drug-Allergy Interactions: Cross-reactivity or known clinical allergy to the prescribed drug or chemical class;
7. Clinical Abuse / Misuse: Overutilization, underutilization, early refill patterns, or inappropriate self-medication.

Note on Retrospective DUR (RetroDUR): In contrast to ProDUR performed by individual pharmacists at the bench, RetroDUR is performed by state Medicaid DUR committees analyzing aggregate electronic claims data over time to identify macro-level prescribing trends, fraud, and clinical outliers.

Pillar 2: Patient Profile Maintenance

OBRA '90 mandates that the pharmacy make a reasonable effort to obtain, record, and maintain a comprehensive patient profile. The profile must contain at minimum:

• Patient's full legal name, address, telephone number, date of birth (or age), and gender;
• Known disease states, significant medical conditions, and physical impairments;
• Known drug allergies, idiosyncratic reactions, and chronic medical history;
• Comprehensive list of medications and relevant medical devices dispensed during the preceding period; and
• Pharmacist clinical comments regarding drug therapy.

Pillar 3: Mandatory Offer to Counsel

• Who Extends the Offer: In Tennessee, the offer to counsel may be communicated by pharmacy personnel (e.g., cashier, technician), but the actual patient counseling must be performed exclusively by a licensed pharmacist or a registered pharmacy intern practicing under direct pharmacist supervision.
• Face-to-Face vs. Delivery: In retail community pharmacies, the offer must be extended verbally and in person whenever the patient or caregiver is present. For mail-order or home-delivery prescriptions, written notice must be included with a toll-free telephone number providing direct access to a pharmacist.
• Core Counseling Elements: While pharmacists exercise professional discretion, counseling typically includes:
  • Name and description of the medication;
  • Dosage form, route of administration, dose, and duration of therapy;
  • Special directions and precautions for preparation, administration, and use;
  • Common severe side effects, adverse effects, or interactions and therapeutic contraindications;
  • Techniques for self-monitoring therapy;
  • Proper storage conditions;
  • Refill authorization information; and
  • Action to be taken in the event of a missed dose.
• Patient Right of Refusal: A patient (or caregiver) has the absolute legal right to refuse counseling. Pharmacists cannot force counseling upon an unwilling patient. However, the patient's refusal must be documented in the pharmacy record system. A generic sign on a counter stating "Questions? Ask our pharmacist" does not satisfy the statutory requirement for an affirmative verbal offer.

---

2. Health Insurance Portability and Accountability Act (HIPAA) & HITECH Act

Enacted under 45 CFR Parts 160 and 164, the HIPAA Privacy and Security Rules establish national standards to protect individuals' medical records and other personal health information. Pharmacies are statutorily classified as covered entities.

Protected Health Information (PHI)

PHI is defined as individually identifiable health information held or transmitted by a covered entity or its business associates, in any form or media (electronic, paper, or oral), relating to:

• The past, present, or future physical or mental health or condition of an individual;
• The provision of healthcare to an individual; or
• The past, present, or future payment for the provision of healthcare to an individual. De-identification requires the removal of 18 specific demographic identifiers (names, geographic subdivisions, all dates except year, telephone/fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, biometric identifiers, full-face photos).

Permitted Disclosures: Treatment, Payment & Operations (TPO)

Under 45 CFR § 164.506, pharmacies may use and disclose PHI without patient authorization for three core activities:

1. Treatment: Providing, coordinating, or managing healthcare. Examples: dispensing prescriptions, consulting with prescribers, counseling patients, conferring with nursing home staff, coordinating with home infusion agencies.
2. Payment: Obtaining reimbursement for healthcare services. Examples: submitting claims to PBMs or commercial insurers, billing Medicaid/Medicare, determining eligibility, collecting patient copays.
3. Health Care Operations: Internal administrative and quality functions. Examples: quality assurance audits, compliance reviews, training pharmacy students/interns, business planning, accreditation inspections.

The Minimum Necessary Standard & Exceptions

Under 45 CFR § 164.502(b), covered entities must make reasonable efforts to use, disclose, or request only the minimum amount of PHI necessary to accomplish the intended purpose. Crucially, the minimum necessary rule does NOT apply to:

1. Disclosures to or requests by a healthcare provider for treatment purposes (providers are entitled to all relevant clinical data);
2. Disclosures made directly to the individual patient;
3. Disclosures made pursuant to an explicit, signed patient authorization;
4. Disclosures required by law (e.g., reporting controlled substance dispensing to the Tennessee CSMD, mandatory reporting of child abuse);
5. Disclosures required for compliance with HIPAA enforcement investigations.

Notice of Privacy Practices (NPP)

• Distribution: The pharmacy must provide the NPP to the patient no later than the date of first service delivery (or as soon as reasonably practicable in an emergency).
• Good-Faith Acknowledgment: The pharmacy must make a good-faith effort to obtain a signed, written acknowledgment of receipt from the patient. If the patient refuses to sign, the pharmacist must document the good-faith effort and the reason the acknowledgment was not obtained.
• Conspicuous Posting: The NPP must be posted prominently at the practice site and published on the pharmacy's public website.
• Record Retention: Signed acknowledgments, privacy policies, and compliance documentation must be retained for at least six (6) years from the date created or last in effect (45 CFR § 164.530(j)).

Business Associate Agreements (BAAs)

A Business Associate (BA) is a third-party person or entity that performs functions involving the use or disclosure of PHI on behalf of a covered entity (e.g., pharmacy management software vendors, data collection services, collection agencies, shredding/waste disposal contractors). Covered entities must execute a written Business Associate Agreement (BAA) binding the BA to implement HIPAA security safeguards. Under the HITECH Act of 2009, business associates are directly subject to federal civil and criminal penalties for HIPAA violations.

Patient Rights Under HIPAA

• Right to Inspect and Copy PHI: Pharmacy must provide access within 30 calendar days (one 30-day extension permitted with written explanation);
• Right to Request Amendments: Pharmacy must respond within 60 calendar days;
• Right to an Accounting of Disclosures: Patients can request an accounting of disclosures made during the six (6) years prior to the request date. Critical Exam Distinction: Disclosures made for Treatment, Payment, or Operations (TPO) are statutorily EXEMPT from the accounting log! The accounting log covers only non-TPO disclosures made without authorization (e.g., public health reporting, law enforcement subpoenas);
• Right to Restrict Disclosures (Self-Pay Exception): Generally, a pharmacy is not required to agree to a patient's requested disclosure restriction. However, under HITECH, if a patient pays out-of-pocket in full (cash) for a healthcare item or service and requests that the pharmacy not disclose that PHI to their health insurance plan for payment or operations, the pharmacy must honor the restriction.

HITECH Act Breach Notification Protocol (45 CFR §§ 164.400–414)

A breach is defined as the unauthorized acquisition, access, use, or disclosure of unsecured PHI which compromises its security or privacy. Impermissible exposure is presumed to be a breach unless the covered entity demonstrates a low probability of compromise through a formal four-factor risk assessment.

• Individual Notification: Covered entity must notify each affected individual in writing without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
• Breaches Affecting Fewer Than 500 Individuals: The pharmacy must log the incidents and submit an electronic report to the Secretary of HHS no later than 60 days after the end of the calendar year.
• Breaches Affecting 500 or More Individuals: The pharmacy must notify affected individuals, notify the Secretary of HHS without unreasonable delay (and within 60 days), and issue a prominent press release to major media outlets serving the jurisdiction within 60 calendar days.

---

3. Poison Prevention Packaging Act of 1970 (PPPA)

Enacted by Congress under 15 U.S.C. § 1471 et seq. and codified in 16 CFR Part 1700, the PPPA is enforced by the Consumer Product Safety Commission (CPSC) — not the FDA! The statute protects children under five years of age from accidental poisoning caused by the ingestion of toxic household chemicals and prescription pharmaceuticals.

Child-Resistant (C-R) Packaging Standards

To qualify as child-resistant under federal CPSC testing protocols:

• Child Protection Standard: At least 80% of children under 5 years of age must be unable to open the package within a 10-minute testing session (5 minutes without demonstration, followed by 5 minutes after demonstration);
• Adult Accessibility Standard: At least 90% of adults aged 50 to 70 must be able to open and properly re-secure the package within 5 minutes (plus a 1-minute retest).

Waiver Mechanics: Patient vs. Prescriber

All oral prescription legend drugs and controlled substances must be dispensed in child-resistant packaging unless an exception or waiver applies:

┌─────────────────────────────────────────────────────────────────────────────┐
│                     PPPA PACKAGING WAIVER COMPARISON                        │
├──────────────────────────┬──────────────────────────────────────────────────┤
│ Requesting Party         │ Statutory Scope of Waiver Authority              │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Patient / Caregiver      │ Can request a waiver for a SINGLE prescription   │
│                          │ OR a BLANKET WAIVER for ALL prescriptions.       │
├──────────────────────────┼──────────────────────────────────────────────────┤
│ Prescriber               │ Can ONLY request a waiver for an INDIVIDUAL      │
│                          │ prescription (and its refills). Prescribers      │
│                          │ CANNOT issue a blanket waiver!                   │
└──────────────────────────┴──────────────────────────────────────────────────┘

• Patient Blanket Waiver: While federal law allows oral requests, pharmacies should obtain a signed, written blanket waiver to document compliance during regulatory audits.
• Prescriber Single-Order Restriction: A prescriber cannot check a box on a blank stating "Dispense all medications in easy-open containers for this patient indefinitely." Prescriber waivers are valid only for the specific prescription order on which they appear.

Container Reuse Restrictions

• Plastic Prescription Vials: Plastic vials and plastic safety caps cannot be reused upon refilling a prescription. The continuous friction of opening and closing causes plastic threading and locking lugs to fatigue, compromising child-resistance. Both the plastic bottle and plastic closure must be replaced with new packaging.
• Glass Containers: If a prescription is dispensed in a container made of glass or threaded plastic, the glass body may be reused, but the plastic child-resistant closure (cap) must always be replaced with a brand new closure.

Statutory Exemptions from Child-Resistant Packaging

Certain medications are statutorily exempt from child-resistant packaging requirements under 16 CFR § 1700.14(a) due to the need for immediate emergency access, packaging characteristics, or low toxicity: