Is Your Pharmacy Prepared for a Cyberattack?

In this episode of The Bottom Line Pharmacy Podcast, Scotty Sykes, CPA, CFP and Austin Murray sit down with Trenton Thiede, President of PAAS National®, to unpack the rising cybersecurity threats facing independent pharmacies and what owners must do to stay compliant and protected.

We dive into:

  • HIPAA compliance updates
  • AI risks, multi-factor authentication, and risk assessments
  • The growing pressure of PBM audits and the need for strong advocacy

Tune in by clicking on one of the links below:

FDA Approves First Rapid-Acting Insulin Biosimilar: MerilogTM (insulin aspart-szjj)

On February 14, 2025, the FDA approved the first rapid-acting insulin biosimilar, MerilogTM (insulin aspart-szjj) manufactured by Sanofi Aventis. MerilogTM is expected to reach the U.S. market in July 2025 and will require prescriber approval before pharmacies can substitute for other insulin aspart products such as Fiasp® or NovoLog®.

MerilogTM is the third insulin biosimilar approved by FDA (along with RezvoglarTM and Semglee®).

PAAS Tips:

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

  • Review the November 2024 article, Understanding Biologic Substitutions – New Tool Available! for a refresher on terms used to describe biologic products such as reference product, biosimilar, and interchangeable
  • Remember to document prescriber approvals for substitution with a clinical note on the prescription or in your pharmacy software

Audit and Appeal Due Dates: Stay Ahead of the Clock with These Essential Tips

Pharmacy practice often revolves around meeting tight deadlines. Prioritizing can become challenging when you’re focused on providing prompt service to waiting patients or rushing to meet inventory ordering deadlines, all while managing your daily tasks. It’s tempting to push aside a PBM audit request, or its results, to tackle more immediate responsibilities. Unfortunately, neglecting audit or appeal due dates can lead to significant, and unnecessary, financial losses to the PBMs.

One of PAAS National®’s top priorities is helping pharmacies navigate the audit process successfully from start to finish. Remember to engage PAAS early by submitting your audit notice or audit results as soon as you receive them. Discussing your audit notice or results with your assigned analyst early can help you avoid unnecessary work when putting documentation together. This can also eliminate providing unnecessary information to auditors.

A great way to begin is by establishing a workflow process when audits are received. The following tips can assist you with a more efficient and effective audit outcome.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

Step 1: Audit Notice or Audit Results Received

  • Dedicate a specific area for audit documents and inform pharmacy staff of what to do when audit notices are received
  • Send your audit notice or audit results to PAAS as soon as you receive them
  • Discuss with your PAAS analyst the appropriate documents needed for response
  • Contact an auditor/PBM as soon as possible if you feel an extension may be needed
  • Set calendar reminders for audit and appeal due dates

Step 2: Prepare your Documents

  • Gather documents and organize in order of audit request
  • Always number your pages for easier reference for you, your PAAS analyst, and the auditor
  • When signature logs are requested on a separate list, keep those separate in your documents

Prescription Documents

  • While many audits request multiple dates of fill, only one prescription hardcopy is necessary for each Rx#
  • When printing electronic images of prescriptions, be sure to include any electronic clinical notations in your system for auditor to view
  • Reminder all clinical notes should include:
    • Date
    • Name and title of agent you spoke with
    • Specific information that was provided
    • Initials of pharmacy employee that made the call
  • Include any supporting documentation for DUR or SCC overrides
  • When backtags or labels are requested, these can be added to the same page as the prescription
  • Be sure backtags or labels do not cover any prescription elements
  • Keep backtags or labels in same orientation as prescription
  • Unless otherwise indicated, redact any pricing information

Signature/Delivery Requests

  • Always confirm if audit is requesting signature/delivery logs
  • Signature/delivery logs must include:
    • Rx number
    • Date of fill (or fill number)
    • Date dispensed
    • Patient/patient representative signature
  • Redact any PHI not on audit request

Proof of Copay Collection

  • Proof of copay collection is only needed when an audit specifically requests
  • Point-of-Sale transactions, register receipts, or A/R account invoices showing how payment was made may be necessary for responses
  • When secondary payors are involved, be sure to include claims data

Step 3: Submitting your Audit

  • Audit requests provide specific instructions on how to submit your documents
  • While faxing is typically an option, sending large audits this route is generally not advisable
  • Sending via secure email or uploading to a portal are the best recommendations

Step 4: Audit Outcome

  • Keep eyes open for audit results and inform staff of what to do when results are received
  • Set calendar reminder to follow up on audit status when results are not received on a timely basis
  • Remember, checking on your audit results will not change their outcome and may prevent you from missing an appeal deadline

Audit Results and Appeal

  • Audit appeals are individualized for each PBM and discrepancy
  • Review results closely for appeal deadlines as these vary per PBM
  • Involve your PAAS analyst right away as appeal documentation may take additional time and effort to obtain
  • Sending in your appeal documentation for your analyst review can be very helpful to identify any missing or incorrect information

PAAS Tips:

  • Send your audit notice or audit results to PAAS right away
  • Follow the PAAS National® guidance for Getting Help with an Audit
  • Submit audit notice, results or documents for review by uploading to our portal, faxing or emailing
  • When sending electronically, be sure to send as one aggregated file with numbered pages
  • If you send multiple attachments via fax or email, be sure each attachment is clearly labeled
  • Consult our Call Center if you need assistance with submitting your documents
  • Keep your PAAS analyst engaged on any updates or additional requests for your audit
  • Consider training additional staff to assist with your audits as a back up

Mailing Prescriptions? How to Ensure Audit Success

While some pharmacies make mailing prescriptions a regular practice, others may only do so on a case-by-case basis. PBMs require signature logs to prove that a patient received their medication in a timely manner, but how is proof obtained when the patient is not standing in front of you at the pharmacy counter?

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

PBMs will require proof of delivery that contains information clearly showing what was in the package delivered. Most PBMs require a link between the delivery confirmation (via a tracking number) and the prescription record to show which prescription was being delivered. There should also be a patient signature or tracking detail from the carrier showing the date and location where the medication was ultimately received.

Notably, not all PBM agreements allow the mailing of prescriptions, while others may restrict mailing to a percentage. Humana and OptumRx typically prohibit mailing under retail agreements, and OptumRx further restricts delivery to within 100 miles by W-2 pharmacy employees. Caremark only allows up to 20% of their claims to be mailed.

Another consideration for pharmacies is ensuring you are licensed in any state you are mailing to. Many states have laws that require pharmacies to obtain a non-resident license to ship, mail, deliver, or dispense prescription medications into their states. Auditors look for these [expensive] claims to take advantage of well-meaning pharmacies who may not know of these requirements. Pharmacies located on state borders making deliveries into another state may also run into this problem as well.

PAAS Tips:

  • Have a system that links the tracking number to the prescription record to indicate the contents being shipped.
  • Print confirmation of delivery and keep it in a readily retrievable manner for audit – some carriers only keep tracking information for as little as 120 days, depending on the service used.
  • Before mailing/delivering prescriptions out of state, it is a good idea to check with that state’s Board of Pharmacy to see if there are any licensure requirements for doing so.
  • Be aware of your contract obligations and which PBMs do not allow mailing prescriptions to patients.
  • For all DMEPOS items and supplies billed to Medicare Part B, proof of refill request and an affirmative response is required to occur and be documented prior to shipment.
  • PAAS’ Proof of Refill Request and Affirmative Response for DMEPOS Items can be downloaded from our portal.
  • If you do not require signatures upon delivery, consider providing the patient with a copy of our Signature Log Trifold Mailer to sign, fold up, and mail back to the pharmacy.
  • Some PBMs, like Navitus Health Solutions, require a signature regardless of tracking information.
  • See the March 2025 Newsline article, Will Your Signature Logs Pass an Audit? for information on what auditors look for when patients pick up their medications or have them delivered.

Audit Considerations for Med Sync Programs

Medication synchronization (med sync) programs are common across pharmacies and yield many benefits. Patients can request it to manage medication better and reduce the number of trips needed to the pharmacy. Patient adherence increases and pharmacies can keep tighter control over inventory while having more efficient workflow.

NCPA promotes the improved adherence and quality of care through med sync programs. They call it a “once a month appointment day” for patients enrolled, saying pharmacist-patient dialogue increases with more time to focus on additional patient care services.

NCPA collaborated with the Arkansas Pharmacists Association to conduct a study measuring the impact of med sync programs on medication adherence and persistence across 82 independently owned pharmacies. The workflow tool was provided to the pharmacies by PrescribeWellness operating on 13 pharmacy management systems. Over 8,000 patients enrolled for this year-long retrospective cohort study. The key findings state that med sync patients are over 2.5 times more likely to be adherent to medications and 21% less likely to discontinue drug therapy. For more details, see the Study Overview and Full Report.

It’s a win all around – until it poses a waste or abuse issue. PBM audit algorithms are made to seek out fraud, waste, and abuse. PBMs will flag pharmacies for audit if claims are billed particularly early every month; for example, every 23 days on a 30 day’s supply.

PAAS National® recommends …

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

having patients opt in for med sync with a signature that can be produced under audit, ideally with annual reverification. This way the pharmacy has evidence to support the patient requested enrollment. This enrollment should also include guidance on how a patient may ‘opt-out’. Med sync best practices also include a phone call [preferably documented] every month to affirm the refills needed prior to dispensing. Cycling the refills at ≥ 90% utilization can also help lower your risk of audit triggers from PBM algorithms that look closer at 75% utilization. Avoid putting bulk items on med sync, such as inhalers, insulin, eye drops or topicals. Med sync also shouldn’t apply to prescriptions written for as needed purposes or controlled substances.

PAAS Tips:

  • State pharmacy regulations may prohibit automatic refill programs or require additional documentation
  • Payer restrictions may apply for programs such as Medicare Part B/D and Medicaid
  • Automatic mailing and delivery of prescriptions often have additional requirements
  • Read Getting in Sync from NCPA’s America’s Pharmacist February 2024
    • See also the Pharmacy Operations Manual for SimplifyMyMeds® from NCPA February 2018

Respiratory Syncytial Virus (RSV) – What You Need to Know

There are currently three FDA-approved Respiratory Syncytial Virus (RSV) vaccines available for individuals at risk of severe illness from a respiratory virus. Please review the chart for helpful billing tips and the additional information below as to which RSV vaccine is appropriate to give to an eligible individual.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

Trade nameManufacturerNDCNCPDP Billing UnitSuggested Days’ SupplyTime to administer
 Abrysvo®*Pfizer00069-0344-011 EACH1 day supplyUse within 4 hours after reconstitution
   Arexvy®GSK58160-0848-11
mRESVIA®**Moderna80777-0345-900.5 MLUse within 24 hours after thawed at room temperature

*Also available in 5 and 10 kit packages       **Also available in a pack of 10 pre-filled syringes

  1. Abrysvo®
    1. 60 years of age and older
    1. Pregnant women at 32 to 36 weeks gestational age
    1. 18 – 59 years of age who are at an increased risk
  2. Arexvy®
    1. 60 years of age and older
    1. 50 through 59 years of age who are at an increased risk
  3. mResvia®
    1. 60 years of age and older

The CDC recommends a single dose of any FDA licensed RSV vaccine be given to all adults ages 75 and older and adults who are between the ages of 60 and 74 who have an increased risk of severe RSV. The conditions that increase the risk of severe RSV can be found on the CDC website. The CDC also recommends pregnant women receive a dose of the maternal RSV vaccine (Abrysvo®) during weeks 32 through 36 of their pregnancy sometime between September through January.  To prevent severe RSV in infants, it is recommended that the mother receive the maternal RSV vaccination or the infant receive the vaccination with RSV monoclonal antibody.

PAAS Tips:

  • Be cautious when billing mRESVIA® as each pre-filled syringe is billed as 0.5 mL versus the Abrysvo® and Arexvy® vials which are billed as 1 EACH
  • Medicare covers RSV vaccine under Part D
  • Pharmacists play a key role in educating high-risk patients on RSV prevention
  • Eligible patients can receive the RSV vaccine at any time, but the best time to vaccinate is late summer or early fall before RSV starts to spread
  • Like all vaccines, pharmacies should maintain documentation in case of an audit:
    • Authorization to administer, which may include a patient-specific prescription or a collaborative practice agreement (CPA)/protocol
    • Signed prescription or placeholder prescription (when using a protocol or CPA)
    • Vaccine Administration Record (VAR)
    • Screening checklist
    • Vaccine Information Statement (VIS)

Medicare Part A vs Part D Billing Risks – How to Protect Your Claims

Pharmacies continue to receive PBM audit notices for claim recoupments where the [allegedly] improper Medicare coverage was billed. Medicare Part A helps cover hospital, skilled nursing facility (SNF), and hospice care stays. Medicare coverage status is typically linked to the patient’s admission and discharge dates from a Part A stay.

When a patient is covered under a Part A stay, the facility providing the stay is typically paid a per diem for the medications, supplies, and services needed during the coverage period. This means that Medicare Part D cannot (and will not) be responsible for claims billed during that time. Unfortunately, PBMs typically do not have the information at the point of sale to stop these claims from being billed inappropriately, leaving pharmacies scrambling upon retrospective review/audit.

PAAS Tips:

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

  • Work with your contracted facilities to have a process in place for them to notify you of a patient’s Medicare status change
  • Have an agreement in place, with the facilities you service, on how payments can be settled if claims were incorrectly billed to Medicare Part D and subsequently recouped
  • Medications billed to Part D but delivered to facilities when a patient is “in-patient” (under a Part A stay) should be returned to the pharmacy (or rebilled accordingly)
    • Per the Medicare Benefit Policy Manual claims can be billed once again to Part D on the day of discharge (see also SCC = 57 below)
    • Any sooner and the claim would face full recoupment – even if there is only one day of overlap
    • Stay informed for delays of patient discharge – if the patient has not left the hospital or SNF prior to their checkout time, the Part A facility may charge the beneficiary for another day of stay
  • Questions asked during medication pick up may assist pharmacies on knowing if, or when, the patient will be discharged
  • LTC patients’ medications may need to be split-billed when the patient is moved from a Medicare Part A to Part D stay
    • Using submission clarification code 19 (Split-Billing) indicates the remainder of the claim being billed is no longer eligible under Medicare Part A stay. This code should only be used in an LTC setting.
    • Using submission clarification code 57 (discharge medication) indicates the dispensed medication is for a patient’s discharge from a facility.
  • If you receive a notice from Medicare D for incorrect billing due to a Medicare Part A stay, send it to PAAS National® for guidance

Changing Pharmacy Management Software? Don’t Neglect Record Retention!

When updating or changing pharmacy management software systems, pharmacies may be presented with different options to archive the files from the software they will no longer be using. While it may not seem worth the extra cost now, ensuring that you are able to retrieve appropriate data for old claims is crucial to avoiding costly audit results in the future.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

Does the option you are selecting ensure you’ll be able to easily retrieve and provide copies of any required information? Prescriptions, claim data billed to the insurance, signature logs, proof of copay collection and invoice records are all items that a pharmacy would need to be able to access whenever needed. Not only for auditing purposes, but to stay within contractual record keeping requirements as well. Medicare Part D rules require all records to be retrievable for 10 years, plus the current contract year; while Commercial plans, Medicaid, state, and federal requirements can all range from 2 to 7 years.

If you can produce documentation from your old system – great! Will the details pass an audit? Ensuring that prescriptions and other documentation from an old system have all necessary elements and are not missing things like unit of measure, clinical notes, or the pickup date on a signature log is important and can save a pharmacy from having to appeal. This is also a consideration when acquiring another pharmacy’s records. Be aware of potential audit hazards with newly acquired records. Origin codes, state transfer requirements and clear links to original prescriptions should be considered during the acquisition process.

PAAS Tips:

  • Ensure you can readily retrieve and print all electronically archived documents in a useable format
  • Have access to technical support when using any software vendor to avoid technical difficulties
  • When acquiring records or switching to a new system, this typically requires an update to the prescription’s origin code [5], as well as having a clear reference to the original prescription (i.e., crosswalk for data migrations)

Verify Day’s Supply on CeQur Simplicity Meal-Time Insulin Patch

CeQur SimplicityTM is a meal-time insulin patch approved for use in adult patients (over the age of 21) with Type 2 Diabetes and can replace up to 12 meal-time insulin doses. The patch delivers rapid-acting insulin in 2-unit doses through a flexible cannula by depressing two buttons, one on each side of the patch.

This patch was originally cleared by the FDA for a 3-day wear time and could replace up to 9 meal-time insulin doses. According to the manufacturer’s website, the FDA cleared an extension in mid-2024, allowing the wear time to increase from three days to four.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

Product SpecificationsOld SpecificationsNew Specifications
Quantity per box10 each8 each
NDC73108-0000-0173108-0000-08
Maximum wear time3 days4 days
Unchanged Product Specifications
CeQur SimplicityTM Inserter (reusable)1 each per box; NDC 73108-0001-00
Number of priming units needed per patch20 units
Minimum fill volume100 units
Maximum fill volume200 units
Equation to calculate the amount of insulin needed per patch(daily bolus insulin use in units) x (# of days) + 20 priming units

PAAS Tips:

  • Bill one 8-count box of CeQur SimplicityTM patches as “8 EA”; the proper days’ supply will be determined by the patient’s insulin utilization and should never be more than a 32-day supply per 8 patches
    • Example: CeQur SimplicityTM, #8 + 11 refills; use with Novolog U-100 insulin up to 12 units TID; change patch every 4 days; bill #8 as a 32 days’ supply
  • Since 20 units are required to prime each patch, that leaves a maximum of 180 units of usable insulin if the patch is filled to capacity. If more than 180 units of insulin are required over the 4-day wearable period, the patch can be replaced earlier than four days
    • Example: CeQur SimplicityTM, #8 + 11 refills; use with NovoLog® U-100 insulin up to 20 units TID
      • Over 4 days, the patient could use up to 20 units x 3x/day x 4 days = 240 units
      • Since each patch has 180 units of usable insulin, the patient may run out of insulin before the 4-day wear time limit is reached and would need to change it more frequently (180 units ÷ 60 units/day = 3 days per patch)
      • Bill #8 as a 24 days’ supply
  • CeQur SimplicityTM patches are disposable and NOT durable, therefore, the patches and the insulin to be used within the patch are not covered under a patient’s Medicare Part B/DMEPOS benefit
  • When billing the insulin used inside CeQur SimplicityTM, be sure to include the 20 units of insulin required to prime each patch in the days’ supply calculation; below is an example:
    • Prescription: NovoLog® U-100, 20 mL + 11 refills; administer up to 12 units three times daily using CeQur SimplicityTM patch
    • Amount of insulin needed per patch: (12 units TID) x (4 days/patch) + 20 priming units = 164 units
    • Amount of insulin needed for the corresponding # CeQur patches: 8 patches x 164 units/patch = 1,312 units total (13.12 mL) per 32 days
    • Suggested billing: 10 mL = 24 days’ supply -OR- 20 mL = 48 days’ supply
  • Be sure the patient receives one CeQur SimplicityTM Inserter when they begin using the CeQur SimplicityTM patch; the patient should call the manufacturer if a replacement inserter is needed

Updated Form Expiration 12/31/2027 – Medicare Drug Coverage and Your Rights Notice

The CMS-10147 Form, also known as the Medicare Drug Coverage and Your Rights Notice, must be distributed to Medicare Part D beneficiaries when a prescription is not covered at the point-of-sale. This notice informs beneficiaries about their right to contact their Part D plan to request a coverage determination, including an exception. The distribution of the CMS-10147 form is a requirement for all pharmacies, including mail order, specialty and LTC. While documentation is not required confirming distribution of the CMS-10147, your pharmacy should have a policy and procedure in place addressing how and when the form is being distributed to patients. PBM field auditors have been known to ask questions about your process and may ask to see a copy of the form to ensure you have the most up-to-date version.

On 02/11/2025, CMS issued a memo to announce the availability of a renewed Medicare Drug Coverage and Your Rights (CMS-10147) “Pharmacy Notice”. While there were no major changes made to the form, the Office of Management and Budget (OMB) approved a new expiration date for OMB Control # 0938-0975. The new expiration date is 12/31/2027.

PAAS Tips:

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

Join today!

  • Pharmacies can find the updated version of the Medicare Drug Coverage and Your Rights Notice (Form CMS-10147) and instructions, including Spanish, Chinese, Korean, and Vietnamese translations in the “Downloads” section on the CMS website
    • If the form is integrated into your software system, be sure that your software vendor has uploaded the form with the new expiration date of 12/31/2027
  • PAAS FWA/HIPAA compliance members should review section 4.5 of their PAAS National® FWA/HIPAA Policy and Procedure manual
    • Beneficiaries that reside in a long-term care facility are not exempt from receiving the notice; LTC pharmacies should review our guidance in the manual
  • Look for NCPDP reject code 569 with an explanation of “Provide Notice: Medicare Drug Coverage and Your Rights”
  • The distribution must take place even if the pharmacy obtains a therapeutic alternative. Getting a prior authorization or change to alternative therapy does not waive the notification requirement
  • Pharmacies should act immediately to implement the updated CMS-10147 form with the 12/31/2027 expiration date. You will not be compliant if this is not done by 3/1/2025 as the previous expiration date is 2/28/2025