Section 13.4: Public Health Laws (HIPAA, OBRA-90, DSCSA Drug Track and Trace)

Public Health Laws: HIPAA, OBRA-90, and the DSCSA

Pharmacies operate at the intersection of state jurisprudence and federal public health laws. Three major regulatory frameworks dictate daily operations regarding patient privacy, clinical communication, and drug supply chain integrity: the Health Insurance Portability and Accountability Act (HIPAA), the Omnibus Budget Reconciliation Act of 1990 (OBRA-90), and the Drug Supply Chain Security Act (DSCSA). In many instances, Texas state law imposes requirements that are stricter than these federal baselines.

HIPAA & the Texas Medical Records Privacy Act

While federal HIPAA regulations establish national standards for protecting Protected Health Information (PHI), pharmacists practicing in Texas must comply with the Texas Medical Records Privacy Act (TMRPA), codified in Chapter 181 of the Texas Health and Safety Code. The TMRPA is significantly broader and stricter than HIPAA in several key areas.

Broader Scope of "Covered Entity"

Under federal HIPAA, a covered entity is generally restricted to healthcare providers, health plans, and healthcare clearinghouses that conduct electronic transactions. Under the Texas TMRPA, a "covered entity" is defined as any person or organization that assembles, collects, analyzes, uses, evaluates, stores, or transmits PHI for commercial, financial, or professional reasons. This includes IT providers, lawyers, and business associates, regardless of whether they transmit transactions electronically.

Strict Employee Training Timeline

Texas law requires that all employees of a covered entity must receive documented training regarding state and federal laws governing PHI. This training must be completed within 60 days of hire (or within 60 days of a change in job duties that involves handling PHI). This is a precise timeline not specified under federal HIPAA, which only requires training within a "reasonable period."

Breach Notification Timeframes

If a pharmacy experiences a breach of unsecured PHI, both federal and state reporting requirements are triggered. Under the TMRPA, if a breach affects 250 or more Texas residents, the pharmacy must notify the Texas Attorney General via their electronic portal as soon as practicable and no later than 30 days after determining the breach occurred. This is a much tighter timeline than the federal HIPAA Breach Notification Rule, which allows up to 60 days to notify the Department of Health and Human Services (HHS). Patients must be notified of a breach within 60 days under both laws.

Record Retention

Under HIPAA, pharmacies must document compliance activities (such as signed Notice of Privacy Practices acknowledgments, privacy officer designations, and training logs) and retain these records for a minimum of 6 years from the date of creation or the date when it was last in effect.

OBRA-90 & Texas Patient Counseling Mandates

The federal Omnibus Budget Reconciliation Act of 1990 (OBRA-90) mandated that states establish standards for prospective Drug Utilization Review (DUR) and patient counseling for Medicaid recipients. Texas expanded these requirements to cover all patients receiving prescriptions, regardless of insurance status.

Prospective Drug Utilization Review

Prior to dispensing any prescription, a Texas pharmacist must review the patient's record to identify potential clinical issues, including:

• Therapeutic duplication.
• Drug-disease contraindications.
• Drug-drug interactions.
• Incorrect drug dosage or duration of treatment.
• Drug-allergy interactions.
• Clinical abuse or misuse.

Mandatory Counseling on New Prescriptions

In Texas, patient counseling is mandatory for all new prescriptions. The pharmacist must initiate the counseling.

• In-Person Pickups: If the patient or their agent picks up a new prescription in person, the pharmacist must provide verbal, face-to-face counseling. The pharmacist must discuss clinical aspects of the drug, including administration, side effects, storage, and refill information. Providing a written leaflet or sheet does not satisfy this requirement.
• Mailed or Delivered Prescriptions: If the prescription is delivered or mailed to the patient's home, the pharmacy must include a written offer to counsel. This written notice must prominently display a toll-free telephone number that allows the patient to contact a pharmacist for counseling during the pharmacy's normal business hours.
• Who Can Counsel: Only a licensed pharmacist or a pharmacist intern under the direct supervision of a pharmacist can perform counseling or clinical patient assessments. Pharmacy technicians may perform cashier and administrative duties but cannot perform counseling, nor can they initiate the counseling process by asking "do you have questions?" instead of having the pharmacist present.
• Refusal of Counseling: A patient has the right to refuse counseling. If a patient refuses, the pharmacist must document the refusal in the pharmacy's records. While a pharmacist is not required to force counseling on a refusing patient, the offer to counsel must have been actively initiated by the pharmacy staff.

Drug Supply Chain Security Act (DSCSA)

The DSCSA (codified as Title II of the Drug Quality and Security Act) establishes a national "track-and-trace" system to secure the pharmaceutical supply chain against counterfeit, contaminated, or stolen prescription drugs.

The "3 Ts" of Product Tracing

Pharmacies are prohibited from receiving prescription drug products unless the seller provides specific product tracing documentation. This documentation is collectively referred to as the "3 Ts":

1. Transaction Information (TI): Detailed information about the product, including drug name, strength, dosage form, NDC, container size, number of containers, transaction date, shipment date, and the names/addresses of the transferor and transferee.
2. Transaction History (TH): An electronic record that outlines the transaction information for each prior transfer of the product, starting from the original manufacturer.
3. Transaction Statement (TS): A statement by the entity transferring the product confirming compliance with the DSCSA (e.g., that they are an authorized partner, received the product from an authorized partner, and did not knowingly ship suspect or illegitimate products).

Recordkeeping under DSCSA

Pharmacies must maintain the 3 Ts (TI, TH, TS) for each prescription drug product received for a minimum of 6 years from the date of the transaction. These records can be kept electronically.

Suspect vs. Illegitimate Products

• Suspect Product: A product that a pharmacy has reason to believe is counterfeit, diverted, stolen, intentionally adulterated, or otherwise unfit for distribution. If a pharmacy identifies a suspect product, it must quarantine the drug and conduct an investigation to verify its legitimacy.
• Illegitimate Product: A product where there is confirmed evidence that it is counterfeit, diverted, stolen, or unfit. If a product is determined to be illegitimate, the pharmacy must notify the FDA using Form FDA 3911 and notify all immediate trading partners within 24 hours of making the determination.

Exam Traps and Legal Nuances

[!WARNING] Breach Notification Timelines: On the MPJE, look closely at who is being notified and the number of residents affected. For a breach affecting 250+ Texas residents, notice to the Texas AG is due within 30 days. Notice to patients is due within 60 days. Many candidates lose points by selecting 60 days for both.

[!CAUTION] Counseling Delegation: A common question involves a pharmacy technician handing a new prescription to a patient and asking, "Do you have any questions for the pharmacist today?" In Texas, this is illegal. The pharmacist must initiate the counseling process verbally for in-person pickups.