The HIPAA Hot Seat: What You Need to Know About the “2024 Privacy Rule” and Reproductive Health Care

The 2022 Dobbs v. Jackson Women’s Health Organization ruling, which overturned Roe V. Wade, prompted modifications to the Privacy Rule (45 CFR Parts 160 and 164). The Biden-Harris administration, partially through President Biden’s Executive Order (EO) 14076, aimed to better protect information related to reproductive health care, to bolster patient-provider confidentiality, and promote trust between patients and their health care providers. Subsequent to EO 14076, the HIPAA Privacy Rule was updated to limit the circumstances in which the use or disclosure of PHI related to reproductive health care is permitted. The final rule (“2024 Privacy Rule”) became effective June 25, 2024, with compliance enforcement effective December 23, 2024; except for the requirement to update the covered entity’s Notice of Privacy Practices which is delayed until February 16, 2026.

The 2024 Privacy Rule strengthens privacy protections by prohibiting the use or disclosure of PHI by a covered entity (e.g., pharmacy), or business associate, for either of the following activities:

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

  1. To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care.
  2. To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care.
  3. To identify any person for any purpose described in (1) or (2).

Under this rule, the prohibition applies where a covered entity or business associate has reasonably determined that one or more of the conditions exists:

  • The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided.
  • The reproductive health care is protected, required, or authorized by Federal law, including the U.S. Constitution, regardless of the state in which such health care is provided.
  • The reproductive health care was provided by a person other than the covered entity (e.g., pharmacy), or business associate, that receives the request for PHI and the presumption described below applies.

The Final Rule includes a presumption that the reproductive health care provided by a person other than the covered entity (e.g., pharmacy), or business associate, receiving the request was lawful. In such cases, the reproductive health care is presumed to be lawful under the circumstances in which it was provided unless one of the following conditions are met:

  • The covered health care provider, health plan, or clearinghouse (or business associates) has actual knowledge that the reproductive health care was not lawful under the circumstances in which it was provided.
  • The covered health care provider (e.g., pharmacy), health plan, or health care clearinghouse (or business associates) receives factual information from the person making the request for the use or disclosure of PHI that demonstrates a substantial factual basis that the reproductive health care was not lawful under the circumstances in which it was provided. (For example, a law enforcement official provides a pharmacy with evidence that the information being requested is reproductive health care that was provided by an unlicensed person where the law requires that such health care be provided by a licensed health care provider.)

To implement the prohibition, the Final Rule requires a covered entity (e.g., pharmacy), or business associate, when it receives a request for PHI potentially related to reproductive health care, to obtain a signed attestation that the use or disclosure is not for a prohibited purpose. This attestation requirement applies when the request is for PHI for any of the following:

  • Health oversight activities
  • Judicial and administrative proceedings
  • Law enforcement purposes
  • Disclosures to coroners and medical examiner

The requirement to obtain a signed attestation gives a covered entity (e.g., pharmacy), or business associate, a way of obtaining written representations from persons requesting PHI that their requests are not for a prohibited purpose. Additionally, the attestation includes language that federal law prohibits any individual from improperly obtaining PHI and that knowingly, and in violation of HIPAA, obtaining PHI under false pretenses or disclosing the PHI to another person can result in criminal penalties. A covered entity receiving a PHI request related to reproductive health care should evaluate the request and all available data and circumstances surrounding the request to make a reasonable determination to substantiate the validity of the request.

PAAS Tips:

  • PAAS Fraud, Waste & Abuse and HIPAA Compliance members can:
    • Locate the Request to Access or Release Protected Health Information Potentially Related to Reproductive Health Care form in Appendix B which has been designed to meet the requirements of the “2024 Privacy Rule”.
    • Find information about the “2024 Privacy Rule” in your Policy & Procedure Manual under Section 10.5.4 Purposed-based Prohibition Against Certain Uses and Disclosures Related to Reproductive Health Care

If you’re not a member of PAAS’ FWA/HIPAA compliance program, contact us today at (608) 873-1342 or info@paasnational.com to add the program for a discounted rate.

2024-2025 Self-Audit Series #12: Electronic Prescriptions

This month’s article will wrap up the 2024-2025 Self-Audit Series. Our focus for this article is electronic prescriptions and their potential audit risks. Electronic prescriptions have solved some problems (e.g., indecipherable handwriting), but have also created new problems. By focusing on the following tips when reviewing your electronic prescriptions, you can help prevent significant recoupments.

Be sure any clarifications are clearly documented with these four elements: date, name and title of who you spoke with, what was clarified, initials of who made the call. This information must be accessible to the auditor upon audit.

PAAS Tips:

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

  • Quantity: Unclear quantities and/or missing clear units of measure should be clarified with the prescriber’s office. Auditors look for mL, pens, boxes, or units, especially with highly targeted injectables. In addition, the quantity of “1” cannot be assumed when multiple package sizes are available.
  • NDC: The NDC reflected on an electronic prescription is considered “representative” according to NCPDP.  The Representative NDC Use in Electronic Prescribing Fact Sheet indicates “The representative NDCis not intended to infer specificity or preference to the embedded manufacturer/labeler”; therefore, determining which product to dispense cannot be solely based on the representative NDC, if present.
  • Instructions for Use
    • Ambiguous instructions should be clarified
    • Clarify when prescription appears to have two conflicting instructions
    • Check for “calculable” instructions; must be able to accurately calculate days’ supply based off instructions
    • Instructions, including clarifications, must be reflected accurately on the patient label prior to dispensing
  • Days’ Supply
    • Auditors will generally not consider the days’ supply field on electronic prescriptions
    • Pharmacy must calculate days’ supply based on quantity and instructions for use
    • Use caution with a software’s default field for days’ supply as this information is frequently incorrect
    • Day’s supply must be billed accurately, bypassing days’ supply plan limits puts claims at risk of full recoupment
  • DAW
    • Have documentation to support DAW codes billed other than “0”
    • Recommend confirming DAW 1 with prescriber when medication is new to patient
    • Check your state’s (and Medicaid’s) specific requirements for DAW 1 prescriptions
    • Brand name single source medications should not be billed with DAW 1 as this may increase audit risk
  • Notes Field
    • Conflicting information in notes field should be clarified with the prescriber’s office
    • Be sure any additional instructions from the notes field are included on the patient label
  • Failover Electronic Prescriptions
    • When electronic prescriptions fail to be transmitted, they may come through to the pharmacy’s fax machine
    • Confirm your state’s specific requirements for faxed prescriptions and call for verbal authorization, and document, when necessary

Caremark Bulk Purchase Notification

Did you make any “bulk purchases” of inventory in December 2024? If so, then you must act now to protect against a Caremark invoice audit that could happen in 2026!

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Remember that a future invoice audit from Caremark could cover purchases made between 02/01/2025 – 01/31/2026 which means that any purchases made during December 2024 will NOT be credited unless you provide notification to Caremark within 21 days after the purchase.

Section 8.05 of the Caremark Provider Manual outlines the requirement to provide notification of these bulk purchases for audit purposes – you must notify Caremark via mail or email as outlined below:

  1. Pharmacy NCPDP
  2. Contact email address
  3. Drug name
  4. NDC
  5. Total quantity purchased
  6. Name of wholesaler used

Email:   PharmacyAudit@CVSHealth.com

Mail:    

CVS Caremark
Attn: Bulk Purchase Notification, MC 020
9501 E. Shea Boulevard
Scottsdale, AZ 85260

Pharmacies do not need to include cost information when submitting. Some pharmacies have received a notification back stating that their purchase was “routine in nature” and would not be considered a bulk purchase, but PAAS would encourage pharmacies to continually inundated/notify Caremark and document these responses as they could become relevant (and useful) in an audit situation.

PAAS Tips:

  • PAAS National®® recommends keeping record of both your submission and any responses received from Caremark in the event of a future audit.
  • Watch the June 15, 2022 on-demand webinar Caremark’s Bulk Purchasing Requirements for more background information

PREP Act Extended Through 2029!

Good news! The Public Readiness and Emergency Act (PREP Act) did not expire at the end of this year, according to a declaration published on December 11, 2024, by the U.S. Health and Human Services (HHS). The declaration has extended the authority for pharmacists, pharmacy interns and pharmacy technicians to administer vaccines and test patients for COVID-19 through December 31, 2029.

Per HHS Secretary Xavier Becerra, “COVID-19 continues to present a credible risk of a future public health emergency…Continued coverage under the PREP Act, as provided in this Declaration, is intended to prepare for and mitigate the credible risk presented by COVID-19. This includes extending the time period for PREP Act coverage for licensed pharmacists, pharmacy interns, and qualified technicians, which allows for continued access by the recipient Population to Covered Countermeasures that are COVID-19 vaccines, seasonal influenza vaccines, and COVID-19 tests”.

Included in the amended Declaration, Secretary Becerra recognizes the impact that pharmacies have had in mitigating the effects of the PHE, asserting “As stated in prior amendments to this Declaration, licensed pharmacists, pharmacy interns and qualified pharmacy technicians are well positioned to provide continued access to Covered Countermeasures, particularly in certain areas or for certain populations that have too few primary-care providers or that are otherwise medically underserved. As of 2022, nearly 90 percent of Americans lived within five miles of a community pharmacy. During the COVID-19 pandemic, the majority of Americans have received their COVID-19 vaccines and tests from a pharmacy. In addition, continued access by the Population to seasonal influenza vaccines mitigates risks that seasonal influenza infections, in conjunction with COVID-19 infections, could overwhelm healthcare providers.”

For more details on the extension of the PREP Act, you can read the published declaration on the Federal Register. Due to this extension, the November 2024 Third Amendment to the PREP Act Expiring Soon! is now outdated.

PAAS Tips:

Are You Willing to Risk Recoupment for Missing DUR and SCC Documentation?

Pharmacies often work in a fast-paced environment with an increasing workload as we see stores closing, more transfer-ins, and higher patient demand. This results in an increased urgency to perform data entry faster, which can lead to the use of override codes to get the claim adjudicated quickly. PAAS National® is here to remind pharmacies to proceed with caution when handling clinical drug utilization reviews (DURs) and submission clarification codes (SCCs). Lack of proper documentation supporting the use of DURs and SCCs can result in audit recoupments.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

DUR messages are designed as a warning to avert potential patient harm and require pharmacist intervention before proceeding. These are the more obvious DURs to spot and handle. Soft DURs can be easily overlooked but still require thorough review. For example, a DUR indicating the prescription was filled at another pharmacy should generate questions regarding current therapy or possible duplicate therapies the patient may be unaware of.

SCCs might be necessary to use when a patient is requesting a refill due to an upcoming vacation, lost or stolen medication, or a change in therapy. Some PBMs are known for auditing high dollar claims with override codes, like Express Scripts and Prime Therapeutics. Auditors are looking for documentation, including rationale on the prescription, when the override codes are used, but what does this mean? Below is an example of appropriate DUR and SCC documentation.

DUR Documentation: HD/M0/1B – Verified with Dr. Jones they are aware this is a high dose/Told to fill prescription as is/Pharmacist’s initials/date

SCC Documentation: SCC 03 – Susan is going on vacation to Italy from 01/06/2025 to 01/20/2025 & requires a vacation supply of medicine/date

Simply documenting the override codes utilized does not provide the auditor with the explanation of why it was appropriate to use. When under audit, be sure to make all clinical notes visible for the auditor. Rescan hard copies into your pharmacy software system when handwriting notes if necessary; this can help ensure the notes will not be missed when under audit.

PAAS Tips:

  • A full clinical note should have four elements:
    • Date
    • Name and title of person you spoke with
    • What was discussed
    • Initials of who made the call
  • Professional service code “M0” requires consultation with the prescriber and a supporting clinical note
    • Consider other professional service codes like “MR” (Medication Review) or “R0” (Pharmacist consulted other source) if “M0” is not applicable
    • Rationale for these codes is still required to be documented
  • Vacation overrides should include documentation of where the patient will be and the dates they will be gone documented, as shown in the example above
  • If referencing a clinical note from a previous prescription, the full note should be carried over to the new prescription
  • Use professional judgement for when a follow-up with the prescriber is necessary to ensure the validity of the DUR code submitted and update when appropriate
    • It’s good practice to reconfirm at least once per year, or when there is a change in therapy or prescriber

Vaginal Creams: Why 30 Days’ Supply Is Probably Not Appropriate

Topical medications like creams and ointments are always a target for PBMs to audit, but lurking in those topicals is a bullseye that PBMs are always aiming for – vaginal creams. Estrace® and Premarin® are easy targets due to the variety of discrepancies that could be found when auditing.

The most common error PAAS National® Analysts come across when reviewing vaginal cream prescriptions is …

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

related to days’ supply issues. Do the directions on the hard copy give a calculable day supply? Are there grams per application? If not, the pharmacy should clarify with the prescriber prior to dispensing and put a clinical note on the hard copy. Directions like “one application twice weekly” or “use as directed, a pea-sized amount” would also not suffice for calculable directions, as they are not specific enough, and most PBMs will not assume “pea-sized” amount is 0.25 g. PAAS recommends communicating with the provider to clarify and adding a clinical note to the hard copy. Be sure that these clarifications (frequency and/or volume) are also reflected on an updated patient label prior to dispensing.

Once you determine the prescription contains calculable directions, the next step would be to bill the accurate day supply. Pharmacies can fall into the trap of assuming a days’ supply exceeding 90 days will surely be rejected based on historical experience; therefore, a 90 days’ supply is billed to the insurance. This places the pharmacy at risk for an invalid day supply discrepancy, as well as potential refilled too soon discrepancies on subsequent refills. Unbeknownst to many pharmacies, PBMs have begun to allow accurate [>90] days’ supplies to be billed for certain types of medications, including vaginal creams. Our recommendation is to always submit a claim with the true and accurate days’ supply first. If the plan rejects the days’ supply, PAAS recommends contacting the insurance help desk for an override. If the insurance does not have an override for the day supply, document this on the hard copy and bill for the maximum day supply allowed by insurance. To prevent accidental early refills, PAAS recommends adding a note on the pharmacy label in the directions, making both staff and patients aware of the actual day supply. The more visibility the note is, the less likely an early refill will be missed.  

PAAS Tips:

  • Reminder that a clinical note should contain four elements
    • The date/time of the call
    • The name and title of the person you spoke with at the prescriber’s office
    • The clarification
    • Your initials
  • Both products have a calibrated applicator for dosing, however each applicator is a different size
    • Estrace® is a 42.5 g tube with an applicator that can measure 1 to 4 grams in 1 g increments
    • Premarin® is a 30 g tube with an applicator that can measure 0.5 to 2 grams in 0.5 g increments
  • Avoid putting vaginal creams on automatic refill or in a medication synchronization program if the pharmacy billed an inaccurate day supply due to a plan limit
  • Review our new member benefit guidance Exceeding Days’ Supply Plan Limits for Unbreakable Packages

PBM Prescription Validation Requests – What Are They Looking At Now?

The July 2024 PAAS National® Newsline article, What’s New with Prescription Validation Requests in 2024? compared the top five drugs targeted in the first six months of 2024. The chart below shows the top drugs picked for claim reviews in the second half of 2024, and a recap of the first half of 2024.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

July-December 2024January-June 2024
Ozempic®Ozempic®
Trelegy ElliptaNurtec®
Eliquis®Mounjaro®
EpinephrineCreon®
Creon®Ubrelvy®

As you can see (and probably not a surprise), Ozempic® is the top drug reviewed through all of 2024. Additionally, you can see how the PBMs shift their focus on which drugs they select to perform claim reviews on.

The top 5 comments noted by an analyst after claim review for the second half of 2024 are the same 5 from 2023:

  1. Document the reason for the cut quantity – auditor will want to know why the pharmacy dispensed less that what was prescribed
  2. Black out acquisition cost and/or profit margin values on the backtag
  3. A clinical notation is needed and requires 4 elements: Date, who you spoke with and their title, what they confirmed, and the pharmacy employee initials
  4. Verify the quantity prescribed and make a clinical notation on the hard copy – Unit of Measure (UOM) is not specified or does not make sense for the medication ordered
  5. No backtag/sticker attached, typically requested by the PBM and helpful for PAAS to review the billing elements

PAAS Tips:

2025 PAAS Fraud, Waste & Abuse and HIPAA Compliance Program Updates

PAAS National®® continuously monitors legislative and regulatory changes that may impact your Fraud, Waste & Abuse and HIPAA Compliance Program. We keep a close eye on enforcement from the Department of Justice, Office of Inspector General, State Attorney Generals, and Office for Civil Rights to help ensure the program meets interpretative standards. Furthermore, PAAS works to keep pace with Pharmacy Benefit Managers as they continue to add credentialing requirements that can be extremely difficult, and a significant nuisance, to independent pharmacies.

PAAS has implemented changes to ensure pharmacies continue to have a robust program in place. PAAS FWA/HIPAA compliance program members can login to the member portal to view the 2025 FWAC and HIPAA Updates. This year’s updates included a procedure for CMS-10882 (Medicare Prescription Payment Plan), PHI safeguard considerations for Remote/Hybrid work, enhancements to the required HIPAA Security Risk Analysis, Pharmacy-to-Pharmacy Inventory Transfer Log, and a policy and procedure related to the 2024 Privacy Rule (request to access or release PHI potentially related to reproductive health).

Administrators should review all Compliance tasks (located in the left-hand navigation on the PAAS Member Portal) at least annually to keep the program up-to-date and in compliance. Section 2.6 Updates of Policies and Procedures of your manual contains information on maintaining open lines of communication and the distribution of changes.

If you’re not a member of PAAS’ FWA/HIPAA compliance program, contact us today at (608) 873-1342 or info@paasnational.com to add the program for a discounted rate.

Billing Ozempic® 0.25 mg Weekly as Maintenance – What PBMs Say

PAAS National® continues to see GLP-1 medications as a high audit target. Recall the FDA-approved initial dosing for Ozempic® is 0.25 mg injected subcutaneously once weekly for four weeks, followed by 0.5 mg once weekly (see section 2.2 of product labeling). However, pharmacies often see prescribers write for Ozempic® 0.25 mg weekly dose as maintenance. While …

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

calling the geriatrician to explain that 0.25 mg is subtherapeutic for the frail 91-year-old patient isn’t always time well spent, it is worth confirming that the dose prescribed was truly the maintenance dose intended (and documenting the conversation on the hardcopy accordingly).

With the duplicity of GLP-1 medications being marketed separately for Type II Diabetes Mellitus or Weight-loss, there is a heightened sense of off-label use when Ozempic® [instead of Wegovy®] is prescribed for weight loss. Likewise, Ozempic 0.25 mg could be considered “off-label use”, although PBMs seem reluctant to do anything [at least for now] to disrupt the gravy train that is GLP-1 rebates.

So, beyond validating the ongoing Ozempic 0.25 mg dosing, how should pharmacies bill the claim? There are only 6 pen needles in the box, so an argument could be made that the days’ supply should be 42. However, this would be wasting two weeks’ worth of medication, and pen needles can be dispensed and sold separately (as is the case with insulin pens).

CVS/Caremark is the only PBM with written guidance available on their Audit Tips: Injectable GLP-1 Receptor Agonist Medications resource. Caremark states that a box of Ozempic® 2 mg/3 mL giving 0.25 mg once weekly should be billed as a 56-day supply. With this billing guidance (which has not to our knowledge been spelled out before), it is likely to continue being an audit target. Caremark does state that if the plan limits the days’ supply to 34, to call the help desk to request a “Plan limitation exceeded” override and to document that information on the hard copy.

As for other PBMs, there has been no formal guidance as to the correct billing of the low-dose Ozempic®. PAAS has seen Express Scripts also indicate (per audit results) that low-dose Ozempic® at 0.25 mg once weekly ongoing as a 56-day supply. OptumRx, on the other hand, believes these directions constitute a 42 days’ supply (likely due to the limited pen needles available). PAAS considers the conservative approach to be always billing for a 56-day supply and dispensing/selling additional pen needles, as needed.

The recoupment risk for pharmacies billing a 42 days’ supply for low-dose Ozempic® is the initial dispensing will be flagged for incorrect days’ supply and subsequent refills may be deemed as refill too soon (facing full recoupment). Any refills that are dispensed prior to the PBM’s utilization threshold [based on the actual days’ supply] is easily identified by the PBM and low hanging fruit for auditors (before they even asked for prescription documentation). If the PBM wanted a 56 days’ supply and the utilization threshold is 75%, pharmacies refilling prior to 42 days could face recoupment.

PAAS Tips:

  • PAAS recommends billing Ozempic® 0.25 mg weekly as a 56-day supply to maintain consistency and avoid potential recoupment
    • Be careful of early refills if you must submit an altered day supply due to plan limitations
      • Utilization thresholds vary by plan and PBM – be judicious when allowing refills to process
    • See PAAS tool Exceeding Day’s Supply Plan Limitations for Unbreakable Packages to educate your team and develop a systematic process for handling these types of prescriptions
  • Advise patient to NOT re-use pen needles
  • Optum Rx Provider Manual states that the pharmacy should contact the help desk for an override if the days’ supply billed exceeds the plan limit, then document on the prescription hard copy
  • Ozempic® 0.25 mg weekly is not considered to be a therapeutic dose and could be considered off-label use
    • Medicare Part D and other federally funded plans will not pay for drugs for off-label use. Commercial plans can also deny payment, depending on the agreement/provider manual
  • Ensure any diagnosis code present on the prescription is approved for use of Ozempic®
  • If utilizing a coupon card, ensure it is being used in accordance with the terms and conditions listed

Compound Supplier Medisca Pays $21.75 Million Over Inflated AWPs

The Department of Justice recently announced that Medisca Inc. will pay $21.75 million to settle allegations of fraud involving inflated Average Wholesale Prices (AWPs) for two ingredients used in compound prescriptions – resveratrol and mometasone furoate. The government alleges that the scheme caused pharmacies to submit false claims to federal healthcare programs, including TRICARE and the Department of Labor’s Office of Workers’ Compensation Programs.

Medisca reported highly inflated AWPs to price listing agencies, increasing reimbursements for its customers and creating massive profit spreads. For example:

  • Resveratrol: Purchased at $0.37/gram, sold under $2/gram, but reported an AWP of $777/gram.
  • Mometasone furoate: Purchased for less than $8/gram, sold for over $1,000/gram, but reported an AWP over $7,300/gram.

These inflated prices incentivized pharmacies to use Medisca’s ingredients, over competitor products, leading to fraudulent billing that overcharged federal programs by thousands per prescription.

The case was brought under the False Claims Act (FCA) by a qui tam relator (a Texas pharmacist) who will receive $3.4 million of the settlement. The settlement underscores the government’s commitment to combating healthcare fraud and protecting taxpayer funds.

The investigation involved collaboration between the Justice Department’s Civil Division, U.S. Attorneys’ Offices in Texas, and federal investigative agencies such as the Defense Criminal Investigative Service (DCIS) and U.S. Postal Service Office of Inspector General.

The government filed similar complaints against other compound ingredient suppliers in 2019 and 2021.

PAAS Tips:

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

  • While pharmacies have no control over AWP list prices, dispensing compounds with these types of ingredients will dramatically increase audit risk and PBMs look for any reason to recoup payments
  • Pharmacies have a corresponding responsibility to detect fraud, waste, and abuse, which includes contracted business associates.