Safeguarding electronic Protected Health Information (ePHI) is as important for a big Fortune 1000 company as it is for independent pharmacies. The HIPAA Security Rule was designed to be flexible to accommodate providers of different sizes and with varying scopes of practice; therefore, the size of your pharmacy does not matter…the Security Rule still applies. That means administrative, technical and physical safeguards are all required to protect patient information.
A recent breach at PharMerica Corporation should serve as a reminder to reassess your pharmacy’s own safeguards to help decrease the risk of a successful malicious cyberattack. According to the PharMerica breach notification posted online in the Maine Attorney General Data Breach Notifications database, the breach affected over 5.1 million people. The attack occurred between March 12 and March 13, 2023 and was discovered on March 21, 2023. A sample of PharMerica’s breach notification letter explained that hackers gained access to patient records including “name, address, date of birth, Social Security number, medications, and health insurance information”. A ransomware gang claimed to be behind the attack and when PharMerica did not pay the ransom to buy back their stolen data, the information was published online.
Administrative safeguards such as firewalls, anti-virus software, log-in monitoring and password management are just several examples of methods to protect ePHI. Here are several questions to consider about your own program:
- What array of methods does your pharmacy use to safeguard your ePHI?
- Have you evaluated your vulnerabilities lately?
- Have new/different threats been identified that require consideration for additional safeguards to be implemented?
PAAS Tips:
- At least once a year, the Security Officer should perform a thorough assessment of the potential threats, vulnerabilities and the associated risks to the confidentiality, integrity and availability of ePHI
- Develop and implement policies and procedures to safeguard ePHI
- PAAS National® Fraud, Waste & Abuse and HIPAA Compliance Program members should review their Policy & Procedure Manual for additional guidance on safeguards; specifically, Section 11 – HIPAA Security and Other Administrative Simplifications and should perform a Risk Analysis at least annually
Recent DEA Rule Change – Transferring Electronic Prescriptions for Controlled Substances for Initial Fill
The DEA published a couple rule changes recently which pharmacies need to be aware of. In the September 2023 Newsline, the updated rule regarding partial fills for controlled substances was discussed. The other recent change published in the Federal Register was titled, Transfer of Electronic Prescription for Schedules II-V Controlled Substances Between Pharmacies for Initial Filling. This rule went into effect August 28, 2023, and clarified the DEA’s previous rule on the transferring of controlled substances. Pursuant to 21 CFR § 1306.08, Electronically Prescribed Controlled Substances (EPCS) can be transferred for initial filling on a one-time basis, upon the request of the patient and all authorized refills on C-III, C-IV and C-V prescriptions are transferred along with the original prescription. All the following additional requirements must also be met:
Did you know there is much more to your audit assistance membership than just help with audits? The PAAS Member Portal contains a wealth of information and resources to assist you with audits and member service questions. Below is a list of 6 pages found on the Audit Assistance section of the PAAS Member Portal to assist you and your pharmacy staff to be proactive when it comes to audits.
PAAS Tips:
[FREE PAAS Webinar] Awareness to Action: Initiating USP 800 Compliance in Community Pharmacies
Join Vice President of PAAS National®, Carmen Fusselman, PharmD as she discusses:
We will allow for some Q&A at the end of the webinar. If you would like to submit questions prior to the webinar, please click here.
PAAS Audit Assistance members will have access to a recording on the PAAS Member Portal if they are unable to attend the live event.
Auditors’ Latest Trick for Flagging “Misfilled” Prescriptions
PAAS National® analysts are noticing more prescriptions being flagged for recoupment based on “incorrect” instructions for use on the patient label. Pharmacies and PBM auditors have very different perspectives on what a “misfilled” prescription is. PBMs will look to categorize a claim as a “misfill” if the directions on the patient label do not include all instructions (including any clarifications made with prescriber). Appealing these discrepancies successfully can be a fruitless endeavor, predicated on circumstances and PBM guidelines.
Did you know there is much more to your audit assistance membership than just help with audits? The PAAS Member Portal contains a wealth of information and resources to assist you with audits and member service questions. Below is a list of 6 pages found on the Audit Assistance section of the PAAS Member Portal to assist you and your pharmacy staff to be proactive when it comes to audits.
PAAS Tips:
An Easy Procedural Change That Will Prevent Recoupments
As previously reported in an April 2023 Newsline article, Prepare Yourselves! Onsite Audits Are Coming in Strong, PAAS National® saw a 300% increase in onsite audits in just the 3rd Quarter of 2022, and we have continued to see the number of audits, as well as the information requested in these audits, increase. It is therefore pertinent that pharmacies review and enforce their FWA/HIPAA policies and procedures, such as return to stock, to prevent petty recoupments.
Return to Stock, the timeframe PBMs require prescriptions to be picked up or the claim reversed based on the fill date of a prescription, is a focus of onsite audits when the auditor inspects the Will Call bin or desk audits when a signature log is requested. If the auditor identifies the sold/received date is beyond the PBM’s Return to Stock threshold, there is risk for full recoupment of the claim.
When determining what Return to Stock window is appropriate for your pharmacy, consider the following:
Did you know there is much more to your audit assistance membership than just help with audits? The PAAS Member Portal contains a wealth of information and resources to assist you with audits and member service questions. Below is a list of 6 pages found on the Audit Assistance section of the PAAS Member Portal to assist you and your pharmacy staff to be proactive when it comes to audits.
PAAS Tips:
Utilizing the PAAS Audit Activity Tracker
While seemingly mundane, the PAAS National® Audit Activity Tracker can serve a very important purpose. While pharmacy personnel may use this tool to stay organized with various audits coming their way, this tool can also be used to defend the pharmacy should an audit go awry. It’s better to document and have a record at the onset than to think back months ago about your individual efforts on an audit. This tool provides a structure to document important information during your audit process. Utilizing this tracker can provide credible documentation of a PBM’s (or auditors) ineffectual communication during an audit. This could help support an audit manager’s review of the auditor’s conduct or provide you with information to complain to your state insurance commissioner.
Here are some recommendations to include on the Audit Activity Tracker:
Did you know there is much more to your audit assistance membership than just help with audits? The PAAS Member Portal contains a wealth of information and resources to assist you with audits and member service questions. Below is a list of 6 pages found on the Audit Assistance section of the PAAS Member Portal to assist you and your pharmacy staff to be proactive when it comes to audits.
PAAS Tips:
Podcast: A Deep Dive into LTC Audits with Trent Thiede
Trent Thiede, President of PAAS National® and host of Amplify Long-Term Care Pharmacy Podcast, Frances Nahas talk all things pharmacy audits, from transitions of care to the complicated (and necessary) role PBMs play. Tune in to learn surprising insight of LTC audits to take your long-term care program to the next level.
PAAS Defends Community Pharmacies by Engaging DME Medicare Administrative Contractor CGS
In our August Newsline Standard Written Order and Medicare Part B Audit Risks – New Guidance, we shared a few examples some of our members are having on audit results regarding their Standard Written Order (SWO). Beyond writing the Newsline, PAAS National® also reached out and engaged nurse medical reviewers with CGS about our concerns on the three topics below.
Did you know there is much more to your audit assistance membership than just help with audits? The PAAS Member Portal contains a wealth of information and resources to assist you with audits and member service questions. Below is a list of 6 pages found on the Audit Assistance section of the PAAS Member Portal to assist you and your pharmacy staff to be proactive when it comes to audits.
PAAS Tips:
Best Practices for Billing Vaginal Creams to Avoid Recoupment
PAAS National® analysts frequently receive questions regarding the proper billing of creams and ointments, an easy audit target for PBMs. This article focuses on vaginal creams due to their high cost, lack of sufficient instructions for use and plan limits that cause pharmacies problems. When a PBM auditor sees a claim for Premarin® or Estrace® vaginal cream, they see dollar signs and often take back 100% recoupment on not just one fill, but multiple refills. To help reduce the risk of an audit recoupment, please review the table and PAAS Tips below.
Did you know there is much more to your audit assistance membership than just help with audits? The PAAS Member Portal contains a wealth of information and resources to assist you with audits and member service questions. Below is a list of 6 pages found on the Audit Assistance section of the PAAS Member Portal to assist you and your pharmacy staff to be proactive when it comes to audits.
PAAS Tips:
PAAS Pit Stop: On-Demand Webinars
Over the last three years, PAAS National®’s President, Trent Thiede, has presented on-demand webinars, ranging from 15 to 45 minutes, to ensure our members gain the knowledge needed to avoid audits, stay abreast on the latest topics in the pharmacy world, and provide information on the more difficult topics in an easy-to-understand manner. During the live events, members are able to ask questions on the topics presented.
PAAS understands the busy and unpredictable nature of your day-to-day pharmacy practice, so we are happy to offer the recorded webinars on the PAAS Portal. It’s a great tool for training and developing staff, as well as keeping up with hot topics in the industry. If you have questions while watching the on-demand webinar, contact PAAS and we’ll be glad to assist.
PAAS strives to pick webinar topics that are relevant to our members, if you have suggestions, please contact us.
PAAS Webinars:
Ransomware Attacks – Is Your Data Protected?
Safeguarding electronic Protected Health Information (ePHI) is as important for a big Fortune 1000 company as it is for independent pharmacies. The HIPAA Security Rule was designed to be flexible to accommodate providers of different sizes and with varying scopes of practice; therefore, the size of your pharmacy does not matter…the Security Rule still applies. That means administrative, technical and physical safeguards are all required to protect patient information.
A recent breach at PharMerica Corporation should serve as a reminder to reassess your pharmacy’s own safeguards to help decrease the risk of a successful malicious cyberattack. According to the PharMerica breach notification posted online in the Maine Attorney General Data Breach Notifications database, the breach affected over 5.1 million people. The attack occurred between March 12 and March 13, 2023 and was discovered on March 21, 2023. A sample of PharMerica’s breach notification letter explained that hackers gained access to patient records including “name, address, date of birth, Social Security number, medications, and health insurance information”. A ransomware gang claimed to be behind the attack and when PharMerica did not pay the ransom to buy back their stolen data, the information was published online.
Administrative safeguards such as firewalls, anti-virus software, log-in monitoring and password management are just several examples of methods to protect ePHI. Here are several questions to consider about your own program:
PAAS Tips: