Why You Should Care About PBM Provider Manuals (and Where to Find Them)

Whether your pharmacy contracts directly with a PBM or the agreements are negotiated through a Pharmacy Services Administrative Organization (PSAO), the terms and conditions within the agreements are just the beginning of a pharmacy’s obligations. Additional expectations for the pharmacy are laid out in the PBM’s Provider Manual. Understanding and following the stipulations contained therein can help decrease your risk of audit recoupments and keep the pharmacy in good standing. However, these manuals vary significantly by PBM, often exceed 150 pages, and can get updated multiple times throughout the year – making it impossible for pharmacies to keep up with all the requirements. Making matters worse, PBMs do not accept a plea of ignorance and violating the provider manual can lead to claim recoupment, accusations of fraud, waste, or abuse, and even contract termination!

Through our Newsline and audit assistance, PAAS National® helps pharmacies stay abreast of these changing requirements as they relate to audits. To access the Provider Manuals directly, follow the links below: 

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

  • Caremark produces (and mails) a biennial version to all contracted pharmacies on even years and supplements on odd years. An electronic copy can also be found on the pharmacy provider website (log in required).
  • Express Scripts tends to update their manual periodically throughout the year and they post the newest version online in the Pharmacist Resource Center (log in required) along with an itemized list of updates. Reviewing the itemized updates is an efficient way to stay on top of the changes Express Scripts implements.
  • Humana publicly posts their provider manual online on the Pharmacy Manuals and Forms page of their website.
  • OptumRx updates their provider manual several times throughout the year and has a copy publicly available under the Manuals and Guides section of their Health Care Professionals website.

PAAS Tips:

  • Be proactive and read PAAS’ Newsline in its entirety each month
    • The paper Newsline only contains half the content that PAAS produces each month – be sure to log-in to the PAAS Portal to view additional articles and PAAS Tips
    • Add additional employees to the PAAS Portal to increase eNewsline readership and ensure that small details don’t get missed
  • Have questions about a specific topic and don’t know where to start? PAAS analysts can guide you through the PBM requirements and refer you to appropriate sections of the PBM’s provider manual, when applicable

OptumRx Auditing for Medical Supplies Billed Under Medicare Part D

In March 2024, PAAS National® analyst assisted nearly 100 pharmacies with desk audits from OptumRx requesting documentation related to claims for medical supplies (primarily alcohol swabs) that were processed by OptumRx under the Medicare Part D benefit. OptumRx asked pharmacies to provide copies of insulin prescriptions as well as the associated fill histories, signature logs and explanation of payment for these insulin prescriptions dispensed between July 2019 and June 2023.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Most pharmacies report dispensing no insulin to the patients in question and explained that the alcohol swabs were being used in conjunction with diabetes testing supplies (test strips, lancets) that were also billed to OptumRx. Since OptumRx covered the cost for diabetes testing supplies, it would suggest that patients were enrolled in a Medicare Advantage (MAPD) plan and OptumRx incorrectly categorized the alcohol swab claims as “Part D” when they should have categorized as “Part B”. The OptumRx audits seem to stem directly from a nationwide CMS audit of Plan Sponsors initiated in December 2023. During this audit, CMS scrutinized Part D claims for medical supplies, such as alcohol swabs, in cases where patients lacked any claim history for insulin use.

The coverage of insulin and its related supplies may vary depending on the Medicare benefit type and the intended use of the item. Specifically, insulin vials and alcohol swabs could be eligible for coverage under either Medicare Part B or Part D.

Keep in mind that Medicare patients could have prescription and medical benefits that are separate or combined.

  • Separate: standalone medical benefit Fee-for-Service (FFS), also known as “Original Medicare” + stand-alone pharmacy benefit through a Part D Plan (PDP)
  • Combined: medical and pharmacy benefit under one roof (sometimes called Medicare Part C) through Medicare Advantage (MAPD) Plan

Here is a chart to help you identify the correct payer depending on the type of Medicare benefit and the item in question.

  Pharmacy Medical Combined
Medicare Part D (PDP) Original FFS Medicare

(Part B/DMEPOS)

Medicare Advantage

(MAPD)

Insulin supplies
Insulin pen Yes No Yes
Insulin vial for self-administration Yes No Yes
Insulin vial for DURABLE pump1 No Yes Yes
Insulin vial for DISPOSABLE pump2 Yes No Yes
Insulin syringes Yes No Yes
Alcohol Swabs for Part D insulin3 Yes No Yes
Alcohol Swabs for glucose testing No Yes Yes
Alcohol Swabs for any other use No No No
Testing Supplies
Test Strips No Yes Yes
Lancets No Yes Yes

A few nuances to keep in mind:

  1. Generally, insulin used in a DURABLE pump is covered under Medicare Part B, unless patient does not meet coverage criteria. See PAAS Newsline article, Billing Insulin for a Pump is Tricky, Especially for Medicare Patients for more details.
  2. Insulin used in a DISPOSABLE pump such as V-Go® or Omnipod®
  3. Alcohol swabs are only covered under Part D when used for the injection of insulin according to Section 10.5 from Chapter 6 of the Medicare Prescription Drug Benefit Manual. Additionally, PBMs are likely to audit for high AWP alcohol swabs or when used in excess (i.e., if patient is to use both “before and after” injection). See PAAS Newsline article, Why Would Anyone Audit Alcohol Swabs? For more details.

 PAAS Tips:

  • If you are unsure about a patient’s Medicare coverage (PDP vs MAPD), then ask to see a copy of their card and look for “MAPD” or “Medicare Advantage” wording, or call the patient help desk if needed
  • If a Medicare patient presents a prescription for insulin vials, clarify if self-administered or used in a pump

Philadelphia Pharmacy Employees Charged for Drug Diversion and Fraudulent Billing Practices

A years-long investigation of the top retail pharmacy purchasing oxycodone in Pennsylvania has come to resolution.

The pharmacy engaged in reckless controlled substance dispensing, ignoring signs of diversion (i.e., accepting blatantly forged prescriptions and sizable amounts of cash payments for drugs) and dispensing opioids in extreme doses or in combination with other “cocktail” drugs.  In addition, the pharmacy took part in an extensive health care fraud scheme. The pharmacy would fraudulently bill for drugs that were not intended to be dispensed. A hallmark part of the scheme involves employees using the code “BBDF” or “Bill But Don’t Fill” in their computer system to communicate the prescriptions that were merely to be billed without dispensing medication to the patient as a means to further their profits.

The owner pled guilty and was sentenced to 42 months in prison for his role. He also plead guilty to having conspired with others to ultimately engage in this health care fraud scheme and illegally dispensing oxycodone. The owner and his business agreed to pay $4.1 million to resolve the company’s civil liability. In addition, the company will not be permitted to dispense any controlled substances in the future and will be unable to bill federally-funded programs for 22 years.

Two former employees of the pharmacy also plead guilty to charges alleging they knowingly dispensed oxycodone without a valid prescription, resulting in 3 months and 4 months in prison, respectively. In addition, they each agreed to pay the United States in order to resolve civil allegations and committed to never dispense any controlled substances going forward.

Although the pharmacy’s motives were blatant violations of the Controlled Substance Act and False Claims Act, that is not always the case. Ensure your pharmacy staff has a good grasp on proper billing habits and a policy manual for preventing, detecting and report Fraud, Waste and Abuse. See PAAS National®’s compliance program for more information or call us at 608-873-1342.

Does My Pharmacy Really Need Cultural Competency Training?

Pharmacies are no stranger to the requirements of completing annual Medicare Fraud, Waste, and Abuse training, which is a very clear requirement created by Medicare Part D and MAPD statutes. Because CMS holds PDPs and MAPDs responsible, PBMs often ask for the pharmacy’s FWA training during onsite audits. On the contrary, cultural competency training isn’t something PBMs regularly ask for. In a world where pharmacy employees are already spread thin, is completing cultural competency training truly necessary?

As of April 2021, NCPDP required pharmacies to indicate if they train their staff on cultural competency and maintain evidence of such training, when going through the pharmacy’s annual NCPDP profile credentialing. Since adding this question, PBMs have decreased the number of direct attestations required of community pharmacies. However, indicating ‘no’ in NCPDP is not without potential repercussions as PBMs may exclude you from provider listings of culturally competent care, as this was required for Medicaid managed care plan directories. Additionally, there are federal requirements that have been in place for many decades.

Through many federal laws and regulations related to discrimination and cultural competence comes the requirement that all healthcare professionals, including pharmacies, must take “reasonable steps” to provide equal access to care across all patient populations. It cannot be expected that a pharmacy would be able to meet the standards if there is a lack of knowledge on what the legal requirements are or what is expected of your pharmacy staff to meet these federal regulations. For this reason alone, training your staff on cultural competency is a must.

In addition, there have been real world examples of pharmacies being subpoenaed and sanctions being placed on pharmacies due to the Department of Justice (DOJ) determining there was a lack of “reasonable steps” being taken to ensure equal access to care, one being Rite Aid. In November 2021, the Justice Department and the U.S. Attorney’s Office for the Middle District of Pennsylvania reached a settlement agreement with Rite Aid Corporation in the matter of people with disabilities having difficulty accessing information about the COVID-19 vaccinations and booking vaccination appointments online. Specifically, Rite Aid’s COVID-19 registration portal was not compatible with screen reader software used by some patients with disabilities. In addition, those who have issues using a mouse were unable to use the tab key in its place when filling out the consent form. Therefore, it was determined there was not equal access to care and Rite Aid had 30 days to correct their online COVID-19 vaccine content to industry guidelines that allows accessibility for users with disabilities. In addition, Rite Aid was ordered to regularly test and correct any issues with its COVID-19 Registration Portal for a 30-month duration.

PAAS National® understands that your time is valuable. Therefore, we condensed more than three hours of content into (less than) one hour of training, making it practical and tailored to the independent pharmacy setting. Our efficient training covers federal requirements, including linguistically appropriate services, and concludes with a certificate of completion.

PAAS Tips:

  • Make sure your NCPDP profile is up to date! PBMs now utilize the pharmacy’s NCPDP profile to pull information in regard to cultural competency training instead of having pharmacies directly attest to each individual PBM.
    • Humana still requires a direct attestation and additional training in select states
  • Watch our On-Demand Webinar “Does My Pharmacy Really Need Cultural Competency Training?”

OptumRx Targeting Medications Requiring Dispensing in Original Containers

Recent audit results coming into PAAS National® are showing OptumRx auditors have their sights set on several medications that are required to be dispensed in the original container.

PAAS has notified members of common medications (e.g., Creon® and Linzess®) being targeted for recoupment on audits when dispensed outside manufacturer guidelines. However, several new medications have been added to their target list …

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

– numerous HIV medications, Carafate® (sucralfate) suspension, Effient® (prasugrel) and Tekturna HCT® are just some of the recent medications flagged.

Please visit the Member Portal for the most current Dispense in Original Container Chart, that is updated as information is available.

Without PBM hard stops in place at claim adjudication (which is complete malarky), the burden falls on the pharmacy to ensure FDA dispensing requirements are met. Don’t fall into the trap and face recoupment because you billed a claim that was not divisible by the package size (e.g., dispensing 28 tablets with a 30-count bottle size – only billed in multiples of 30).

Pharmacies that service long-term care and assisted living facilities, or provide special packaging for patients on a sync program, tend to be at the highest risk for billing these claims incorrectly. Often, the manufacturer has not provided any stability information that supports breaking the stock bottle, therefore this medication should not be dispensed using special packaging.

PAAS Tips:

  • Post the Dispense in Original Container for staff to utilize at data entry and filling stations
  • When receiving a prescription for a quantity less than the package size of these medications, contact the prescriber and inform them of the dispensing requirements and request authorization to increase the quantity and document with a clinical note
  • Communicate with facilities and patients, who utilize special packaging, on the requirements for dispensing full bottles with certain medications
  • Contact your pharmacy’s software vendor to see if NDCs can be flagged with alerts at data entry to ensure the quantity billed matches the package size
    • Alternatively, consider flagging inventory shelves for medications with special packaging/dispensing requirements
  • Self-audit claims on a weekly or monthly bases to ensure appropriate dispensing

2024 Self-Audit Series #3: Invoice Audits

The number of invoice audits continues to rise from Medicaid, and PBMs, across the board. This investigational audit is a way to potentially identify false or phantom claims. Auditors will reconcile the claims billed by a pharmacy during a certain timeframe, with the purchases made. This process ensures the pharmacy had inventory on hand to dispense for the claims they billed. Many PBMs, including OptumRx®, Elixir®, and Express Scripts® request pharmacies provide a full dispensing history for further reconciliation.

Some inventory audits are frequently combined with a desk audit. PBMs like Caremark request a high number of prescriptions, signature logs, and proof of copay collection. The amount of data a pharmacy is required to provide can be very overwhelming and time consuming. Performing internal, “mock audits” may help you be better prepared when receiving an invoice audit request.

Pharmacies must be diligent in following PBM requirements for purchasing. Audit recoupments can easily reach hundreds of thousands of dollars when invalid purchases are not accepted.

PAAS Tips:

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

  •  Wholesaler:
    • Keep a running list of wholesalers you are purchasing prescription and over-the-counter (OTC) items billed as prescriptions
    • Vet each wholesaler to ensure they meet PBM requirements and can provide pedigrees in accordance with FDA Track and Trace Law
    • Each wholesaler must meet state licensing requirements
  • PBM Specific:
    • OptumRx requires National Association of Boards of Pharmacy (NABP) Drug Distributer Accreditation, formerly known as VAWD
    • Caremark and Express Scripts require all diabetic supplies be purchased from an “authorized distributor”
    • Caremark requires notification and approval of any bulk purchasing the pharmacy makes
    • Caremark auditors now require original invoices for any pharmacy-to-pharmacy transfer, including MatchRx and Rxeed
    • General:
      • Keep copies of all invoices and proof of purchases for 10 years as required by Medicare Part D retention requirements
      • Adhere to Return to Stock policy and be sure claims are reversed appropriately
      • Be sure the NDC you billed is the same as the NDC you are dispensing
      • For tips on performing a self-audit, see our January 2020 Newsline, Self-Audit Series #12: Invoice Audits

2024 DMEPOS Series #3: Ostomy Supplies

Many pharmacies struggle with DMEPOS audits due to the complexity in medical billing and the onerous documentation requirements. Medicare Part B suppliers need to be able to produce all the required documentation if audited, and make sure all documentation meets Medicare Part B standards. This DMEPOS series is intended to help you understand these complexities and gather the needed documents.

In particular, you should be able to show the following if audited on ostomy supplies:

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

  • Standard Written Order (SWO)
  • Medical Records
    • Beneficiary must have a surgical created opening (stoma) to divert urine or fecal matter outside the body
    • The location, construction and skin condition surrounding the stoma must be discussed in the medical record
    • Diagnosis must be documented in the medical record as well as submitted on the claim for coverage consideration
    • Diagnosis driven by the type of ostomy the beneficiary has:
      • Colostomy – opening into the colon (large intestine)
      • Ileostomy – opening into abdominal wall (small intestine)
      • Urostomy – opening into abdominal wall that connects to urinary tract
    • Continued medical need can be verified by:
      • Initial medical need being met, the ongoing need for ostomy supplies is assumed to be met.
      • The beneficiary meeting the medical guidelines, no further documentation is required
    • Covered diagnoses can be found in the Local Coverage Determination (LCD) and Policy Article
  • Proof of Delivery
  • Proof of Refill Request and Affirmative Response
    • Required if delivered or mailed

Other considerations include:

  • Ostomy supplies are not separately payable when in a covered home health stay
  • Barrier (also known as a Wafer or Faceplate) – protects skin from stoma output and keeps the pouch in place
    • Solid barrier
    • Liquid barrier – liquid OR spray and individual wipes OR swabs may be used but not both
  • Pouches – can be one-piece or two-piece
  • Tape and adhesive – an AU (Item furnished in conjunction with a urological, ostomy, or tracheostomy supply) modifier code must be billed for tape and adhesive
  • If a continent stoma:
    • use only one type of supply per day
    • can be a stoma cap, stoma plug, stoma absorptive cover or gauze pads
  • Quantity of supplies needed depends on the type of stoma, condition of skin surface, location, and construction

PAAS Tips:

 

Audit Preparedness in Long-Term Care Claims: Implementing Proactive Measures

The practice of LTC pharmacy is different – look no farther than the dichotomy between prescriptions and orders. While state laws may be vague or unclear, resulting in pharmacists using professional judgement, PBMs have their own requirements. Do PBM Provider Manuals (and auditors) view LTC differently? The answer may surprise you—not as much as one may think and following the “LTC is different” mindset may lead to a lot of extra work (or recoupments) if you find yourself with an audit. Insufficient documentation for Long-Term Care (LTC) prescription claims is a topic PAAS National® analysts cover frequently during audit preparation consultations with members operating combo shop pharmacies and/or closed door LTC pharmacies. Our analysts are experts in understanding the documentation requirements for both retail and LTC claims and want you to be comfortable and confident in your documentation as well. One reference tool the PAAS analyst will utilize when educating pharmacies …

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

is the publicly available Humana Guidelines for LTC. As found in the Humana reference, pharmacies should be prepared to provide the following information for LTC claims (which can be applied broadly to most PBMs):

  1. Prescription hardcopy requirements
    1. Patient name
    2. Date of issuance
    3. Name of the drug
    4. Strength of the drug
    5. Dosage form of the drug (if applicable)
    6. Directions for use
    7. Documented duration of therapy (e.g., number of refills, clear start and stop dates, duration of therapy written by prescriber)
    8. Prescriber’s DEA number (if applicable)
    9. Prescriber’s printed name and signature
  2. Signature log requirements
    1. Patient name
    2. Date of service
    3. Prescription number(s)
    4. Facility name
    5. Date of delivery to facility (handwritten)
    6. Signature of individual who accepted delivery at the facility

Apart from the facility name and the small nuances with duration of therapy, the elements above should look very familiar as they are the same elements prescriptions for retail claims should have. Other similarities between retail and LTC requirements include:

  • Must dispense within the PBM’s return to stock window
  • Must not delivery prior to billing
  • Must have appropriate documentation for override codes utilized for successful claim adjudication
  • The 11-digit NDC billed must match all 11 digits of the NDC dispensed
  • Proof of copay collection (or attempts to collect) is required
  • The directions must be specific to allow for the days’ supply to be mathematically calculated and accurately billed (following the Can You Bill It as 30 Days?, where applicable)

While daily operations and workflow in a closed-door LTC pharmacy may be vastly different from that of a retail pharmacy, the pharmacy still has the same requirement to provide proof of a valid prescription, proof of dispensing, proof of copay collection, and proof of sufficient inventory. Failing to have sufficient documentation could mean claim recoupment, accusations of fraud, waste, or abuse, and (potentially) contract termination.

PAAS Tips:

V-Go® All-In-One Insulin Delivery Patch

The V-Go® all-in-one insulin delivery patch is a disposable device approved for use in patients with Type 2 diabetes. Because it is “disposable” and not “durable”, it is covered under Medicare Part D (rather than Part B). The device comes in three different strengths that deliver a basal dose of 20 units, 30 units, or 40 units of rapid acting U-100 insulin (such as Humalog® or Novolog®) per 24 hours. Additionally, each device can deliver up to 36 units of on-demand bolus insulin for mealtimes (in 2-unit increments). Prescribers will need to issue two separate prescriptions for patients – the prescription for #30 V-Go® devices to last one month and a prescription for the rapid acting U-100 insulin to put into the devices (typically 20-30 mL).

According to the instructions for patient use, patients must fill each device completely each day and each device holds slightly more than it can actually deliver. The amount of insulin each device can hold is referred to by the manufacturer as the Minimum System Daily Insulin Requirement and the amount of insulin each device can deliver is referred to as the Minimum Reservoir Dosing Capacity.

The table below summarizes each device and provides an estimated day supply to bill based on the number of vials of insulin and the amount of insulin used to fill each device.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

V-Go® Device Billing Quantity Minimum Reservoir Dosing Capacity Minimum System Daily Insulin Requirement Estimated Days’ Supply of Insulin
10 mL 20 mL 30 mL
V-Go® 20 30 EA 0.56 mL (56 units) 0.65 mL (65 units) 15 days 30 days 46 days
V-Go® 30 30 EA 0.66 mL (66 units) 0.75 mL (75 units) 13 days 26 days 40 days
V-Go® 40 30 EA 0.76 mL (76 units) 0.85 mL (85 units) 11 days 23 days 35 days

PAAS Tips:

  • Be careful to submit the correct days’ supply based on the amount of insulin each device can hold and not the amount it can deliver
  • There may be situations where billing greater than a 30 days’ supply will result in a higher copay or different pharmacy reimbursement – remember to always submit the correct days’ supply unless the PBM helpdesk advises differently (and be sure to document a clinical note)
  • See our Considerations for Billing Insulin Vials: Medicare Part B vs Part D resource for more information about disposable, and durable, pump billing

The Alarming Toll of HIPAA Breaches: Over 41 Million Individuals Affected in 2022

Each year, the Health and Human Services Office for Civil Rights (OCR) composes detailed reports on HIPAA compliance and breaches of unsecured Protected Health Information (PHI) and delivers them to Congress. The latest report is that of events from the 2022 calendar year. These reports can teach us about weaknesses in the HIPAA policies and procedures of other entities, the most common types of threats from malicious actors, and help educate staff on identifying vulnerabilities in the pharmacy’s safeguards during their next Risk Analysis.

Here are a few of the key takeaways from the 2022 Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance:

  • There was a 17% increase in the number of HIPAA complaints received from 2018 to 2022
  • There was a 107% increase in the number of large breaches reported from 2018 to 2022
  • OCR was able to resolve 87% of the complaints before initiating an investigation; pre-investigation closures could have resulted because:
    • The complaint was against an entity not covered by the HIPAA Rules
    • Allegations were about conduct that did not violate the HIPAA Rules
    • Complaints were untimely because they were not filed within 180 days of when the individual submitting the complaint knew or should have known about the act or omission that was the subject of their complaint
  • OCR completed 846 compliance reviews, of which 80% of the entities had to take corrective action or pay a civil money penalty
    • OCR may open a compliance review investigation “based on an event or incident brought to OCR’s attention, such as through the media, referrals from other agencies, or based upon patterns identified through multiple complaints alleging the same or similar violations against the same entity
    • OCR initiated 676 compliance reviews that did not arise from complaints but were instead initiated by OCR after a breach report was filed. Of that 626 of these stemmed from breach reports affecting 500 or more individuals, 2 were from breach reports affecting less than 500 individuals, and 48 were brought to OCR’s attention by other means

The 2022 Annual Report to Congress on Breaches of Unsecured Protected Health Information had several key takeaways as well:

  • OCR received 626 notifications of breaches affecting 500 or more individuals
    • The total number of individuals affected by those breaches was approximately 41.7 million
    • 68% of these breaches were from health care providers, 19% from business associates, 13% from health plans, and <1% from health care clearinghouses
    • 74% of these breaches were reportedly due to hacking/IT incident of electronic equipment or a network service, 19% from unauthorized access or disclosure of records, 4% theft, <1% from a loss of electronic media or paper records containing PHI, and <1% was from improper disposal
    • The PHI was most commonly from network servers (58%), but also from email (22%), paper records (6%), electronic medical records (6%), desktop computer (4%), other portable electronic devices (3%), laptop computer (2%), and other (<1%)
  • The largest breach in 2022 was an incident where hackers utilized ransomware to compromise the servers of a healthcare provider with PHI on them, which affected over 3.3 million individuals
  • Other hacking/IT incidents included the use of malware, phishing, and the posting of PHI to public websites
  • Remedial actions often included:
    • Implementing multi-factor authentication for remote access
    • Revising policies and procedures
    • Training/retraining staff that handle PHI
    • Adopting encryption technologies
    • Imposing sanctions on workforce members who violated policies and procedures regarding the proper handling of PHI
    • Performing a new risk analysis

According to OCR, “There is a continued need for regulated entities to improve compliance with HIPAA Rules. In particular, the Security Rule standards and implementation of specifications of risk analysis, risk management, information system activity review, audit controls, response and reporting, and person or entity authentication were areas identified as needing improvement in 2022 OCR breach investigations.”

If you are not sure where to start, contact PAAS National® (608) 873-1342 for more information on PAAS’ FWA/HIPAA Compliance Program that is easy to set-up, web-based and customized for your pharmacy.