Compliance is a key aspect of operating a successful pharmacy in the United States. This is true for pharmacies that bill federal healthcare benefit programs (i.e. Medicare, Medicaid, and Tricare) as well as private payors, and it is true for all pharmacies regardless of their size, location, and the patients they serve.

What does it mean for a pharmacy to be compliant? As with pharmacy practice itself, there is no one-size-fits-all approach. While pharmacies face the same general compliance obligations based on the types of medications they dispense, pharmacy compliance programs need to be custom-tailored in order to ensure that they will be effective in terms of both (i) protecting patients and providers from mistakes; and, (ii) avoiding liability in the event of an audit, inspection, or investigation.

“For pharmacies in the U.S., compliance is increasingly presenting new and complex challenges. In order to avoid unwanted scrutiny from the DEA and their PBMs, pharmacy owners and pharmacists-in-charge must be confident that their compliance efforts are comprehensive and appropriately tailored to their pharmacy’s specific needs.” – Dr. Nick Oberheiden, Founding Attorney of Oberheiden, P.C.

Compliance for Pharmacies: A Guide for Pharmacists-in-Charge and Pharmacy Owners

There are numerous aspects to pharmacy compliance. Broadly speaking, however, these aspects can be broken down into three categories: (i) DEA compliance, (ii) federal healthcare billing compliance, and (iii) private payor/pharmacy benefit manager (PBM) compliance. This guide will address each of these categories in turn:

1. Drug Enforcement Administration (DEA) Compliance for Pharmacies

The Drug Enforcement Administration (DEA) regulates pharmacies’ acquisition, prescription, dispensing, and distribution practices. All pharmacies are required to register with the DEA, and registration subjects pharmacies to periodic audits and inspections designed to assess compliance with the federal Controlled Substances Act (CSA), the Drug Supply Chain Security Act (DSCSA), and other pertinent federal statutes. In order to avoid enhanced scrutiny from the DEA and the risk of facing civil or criminal enforcement action, pharmacies must ensure full compliance under federal law with respect to:

• Prescription Drug Ordering – Pharmacies’ compliance obligations attach at all stages of the prescription lifecycle, from ordering through dispensing. With respect to prescription drug ordering, pharmacies must consistently use the correct form (DEA Form 222) and complete it properly, and they must maintain thorough documentation of all orders placed and received. Pharmacies must ensure full compliance with the DSCSA as well.
• Prescription Drug Inventory Management – Inventory management is often a central focus of DEA audits and inspections. Among other obligations, pharmacies must maintain a complete and up-to-date inventory of their on-hand medications at all times, and they must store their inventory records for two years.
• Prescription Management and Fraud Monitoring – When filling prescriptions, the DEA takes the position that pharmacies must play an active role in preventing fraud. This means that they must have policies and procedures in place to assess the validity of income prescriptions, and they must question potentially illegitimate or unnecessary prescriptions prior to dispensing drugs to patients.
• Electronic Prescription Compliance – Electronic prescription compliance is extraordinarily complex, and it requires a devoted and detail-oriented approach. Federal regulations promulgated under the CSA address virtually all aspects of pharmacies’ handling of electronic prescriptions, from their choice of software applications to their documentation of electronic prescriptions filled.
• Prescription Drug Security (Theft Prevention) – Pharmacies are obligated to adopt physical and logical security controls in order to prevent the theft of prescription medications from their premises and during transit. Those that fail to adopt appropriate theft prevention measures may be seen as being complicit in the event that a theft occurs.
• Transfer and Disposal of Prescription Drugs – Pharmacies also face multiple specific compliance obligations with regard to the transfer and disposal of prescription drugs. Notably, while many pharmacies outsource these functions, the DEA has made clear that outsourcing does not shift accountability away from the pharmacy.
• Pharmacy Recordkeeping Practices – Pharmacies in the U.S. are subject to comprehensive recordkeeping requirements under federal law. During DEA audits and inspections, pharmacies must be prepared to quickly produce all requisite records, and they must be confident that their records are clearly and unambiguously demonstrative of compliance.
• Prescription Drug Dispensing and Diversion Control – The final primary aspect of DEA compliance for pharmacies falls in the area of prescription drug dispensing and diversion control. Prescription drug diversion is a hot-button issue for the DEA in light of the nation’s ongoing opioid epidemic, and pharmacies (and their owners, pharmacists, and technicians) can face severe penalties if accused of facilitating opioid diversion.

2. Federal Payor Compliance for Pharmacies

Now, we will turn to an entirely separate component of pharmacy compliance: Billing. For pharmacies that bill Medicare, Medicaid, Tricare, and other federal healthcare benefit programs, adhering to these programs’ rules and regulations is a key component of a comprehensive compliance program. Critically, each program’s rules and regulations are unique, so pharmacies’ compliance policies and procedures must address each program separately.

However, while each program’s requirements are unique, there are some similarities. For example, with regard to federal billing compliance under each of these programs, pharmacies must address issues such as:

• Accurate Coding of Reimbursement Requests – When billing federal payors, pharmacies must ensure that they are coding their reimbursement requests accurately. In the event of a federal compliance audit or billing fraud investigation, coding errors can lead to exposure for fines, recoupments, treble damages, and other penalties.
• Bundling and “Upcoding” Compliance – Two particular areas of coding compliance that often lead to trouble are bundling and “upcoding.” In many cases, pharmacies are required to bill related reimbursements at a reduced, bundled rate. Unbundling is considered a form of federal billing fraud, as is billing a medication at a higher rate than the one prescribed by the applicable program guidelines.
• Establishing Medical Necessity for Federally-Reimbursed Medications – Federal healthcare benefit programs only provide reimbursement for prescription drugs that are medically necessary. Each program has its own definition of medical necessity, and pharmacies must ensure that they are only submitting reimbursement requests for authorized (i.e. medically necessary) medications.
• Recordkeeping Compliance – As with DEA compliance, recordkeeping is a key aspect of federal program billing compliance as well. Pharmacies must keep comprehensive records of their program billings, and they must be able to substantiate these billings with appropriate supporting documentation.
• Double-Billing Federal Programs and Private Payors – Double-billing is a common issue in pharmacy billing fraud investigations, and evidence of double-billing will be considered a “red flag” by auditors and federal investigators alike.

Here, too, outsourcing pharmacies’ billing compliance obligations does not serve as a defense to liability for federal billing violations. As a result, for pharmacies that hire third-party billing administrators, it is imperative not only to choose carefully, but also to ensure that their billing agreements contain adequate protections.

3. Private Insurance/PBM Compliance for Pharmacies

The other side of billing compliance for pharmacies involves compliance with respect to billing private insurers through their pharmacy benefit manager (PBMs). Similar to the federal agencies that oversee Medicare, Medicaid, and Tricare, PBMs heavily scrutinize pharmacies’ billings submitted to private payors. PBMs routinely audit pharmacies for compliance; and, under the terms of most PBM contracts, pharmacies can face financial liability (in the form of “retractions”) and contract termination if they are found to have billed private insurers improperly.

In broad strokes, PBM compliance is comparable to Medicare, Medicaid, and Tricare compliance. However, as fiduciaries of their clients, PBMs have a strong incentive to take aggressive action against pharmacies that are suspected of overbilling for prescription drugs. As a result, PBM audits can be very dangerous for pharmacies, and having legal counsel on retainer and available to provide defense representation from the outset of a PBM audit can be just as important has having counsel ready to defend against a DEA or federal billing fraud audit or investigation.

Comprehensive Compliance is Essential to Risk Mitigation for All Types of Pharmacies

In addition to these areas of compliance that are relevant to essentially all pharmacies in the United States, compound pharmacies, pharmacies that dispense CBD products, and other types of specialty pharmacies face additional compliance burdens. There are comprehensive sets of federal rules and regulations that address each of these areas of pharmaceutical practice, and missteps – whether intentional, unknowing, or inadvertent – can have significant consequences. However, with a proactive and detail-oriented approach, comprehensive pharmacy compliance is very feasible, and experienced pharmacy lawyers and compliance consultants will be able to assist with putting an effective program in place.

Finally, while pharmacy owners and pharmacists-in-charge must address these high-risk areas, they must not overlook the “ordinary” compliance aspects of operating a business with employees and customers. From complying with the Americans with Disabilities Act (ADA) and the Genetic Information Nondiscrimination Act (GINA) to complying with the Federal Trade Commission (FTC) rules for consumer advertising, pharmacies face a host of compliance obligations unrelated to the nature of their business. For both new and established pharmacies, taking a comprehensive approach to compliance is extremely important, and it is essential not to overlook or give short shrift to any issues that have the potential to lead to civil liability or criminal prosecution under federal law.