Between a Rock & a Hard Spot Mayhem 2020

Between a Rock & a Hard SpotMayhem 2020

Pharmacy Law Update and Case Studies

August 2020

Ronda H. Lacey, J.D., M.S. Pharm

Thank You AllFor your dedication, sacrifice and service!

Disclosure

▪ I have no actual or potential conflict of interest in relation to this program or presentation.

Objectives

1. Recognize legal responsibilities for reporting to HHS in the event of a breach or suspected breach of PHI after a criminal event.

2. Explain and discuss the "off label” use of a prescription drug.

3. Identify professional responsibilities thru an analysis of case studies.

Legal Responsibilities

▪ August 3, 2020 Data Breach Today reported that Walgreens, CVS and Cub Pharmacies had reported breaches due to looting.▪ https://www.databreachtoday.com/breaches-

tied-to-pharmacy-looting-security-lessons-a-14757.

▪ There are most likely independent pharmacies that will have to report breaches as well.

Breach

▪ A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information.

▪ An impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:

Breach

1.The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;

2.The unauthorized person who used the protected health information or to whom the disclosure was made;

3.Whether the protected health information was actually acquired or viewed; and

4.The extent to which the risk to the protected health information has been mitigated.

The Reality

▪ The pharmacy employees did NOT ▪ Steal PHI

▪ Misappropriate PHI

▪ Leave an unencrypted laptop

▪ Give someone their password

▪ Give PHI to a reporter

▪ But the facilities still DO have an obligation to their patients and to report to HHS.

Types of Information/Items Taken During the Looting▪ Prescription records (i.e. hard copies)

▪ Including patient name, address, phone number(s), physician name and contact information, prescription numbers, medical records, insurance information, driver’s license numbers and passport numbers.

▪ Vaccination records

▪ Computers

▪ Hard Drives from computers

▪ Vaults/holding drugs & records

Legal Responsibilities - Breach

▪ Submit a notice to HHS within sixty (60) days of the discovery of the breach (if breach involves 500 or more individuals).▪ Notify the individuals and▪ Publish notice with the press▪ Notice on website for 90 days

▪ May submit the notice on an annual basis if fewer than 500 individuals. (60 days after the end of the calendar year).

▪ Comply with AL Breach Notification Rule, Code of Alabama, § 8-38-1, et. seq.

Legal Responsibilities

▪ Link for reporting breaches to HHS▪ https://www.hhs.gov/hipaa/for-professionals/breach-

notification/breach-reporting/index.html#:~:text=Submit%20a%20Notice%20for%20a%20Breach%20Affecting%20Fewer,%28OCR%29%20Content%20last%20reviewed%20on%20January%205%2C%202015.

▪ Report a breach to in-house/corporate counsel as soon as possible.

▪ If no in-house/corporate counsel: Get an experienced healthcare attorney to assist you with the breach and notification requirements.

Legal Responsibilities

▪ Keep in mind that these requirements are in addition to notifying the▪ DEA, Form 106

▪ Board of Pharmacy

▪ Law enforcement

▪ Insurance Company

Additional Reference

▪ Cases under investigation:▪ https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.

▪ Vault stolen during riots▪ https://www.foxnews.com/us/fbi-cvs-narcotics-cleveland-

george-floyd-riots.

▪ Walgreens Letter to Customers:▪ https://oag.ca.gov/system/files/BL_DL_L03.pdf.

▪ Rite Aid Breach:▪ https://www.beckershospitalreview.com/cybersecurity/rit

e-aid-pharmacy-thefts-expose-information-of-9-200-patients.html?origin=PharmacyE&utm_source=PharmacyE&utm_medium=email&oly_enc_id=0895H1308567F5O.

Question

▪ You must report a breach to HHS within sixty days of the breach if the breach involved the information of _____ individuals or more?

A. 100

B. 250

C. 500

D. 1,000

Off-Label Use of Prescription Drugs

Healing or Harm

Off Label Use of a Prescription Drug

▪ FDA information: https://www.fda.gov/patients/learn-about-expanded-access-and-other-treatment-options/understanding-unapproved-use-approved-drugs-label.

▪ Quote from FDA:▪ “From the FDA perspective, once the FDA

approves a drug, healthcare providers generally may prescribe the drug for an unapproved use when they judge that it is medically appropriate for their patient.”

Off Label Use of Prescription Drug

▪ You are required to use your professional judgment when filling the prescription.

▪ Consider asking the following questions:▪ What is the drug approved for?

▪ Are there other drugs approved to treat the condition?

▪ Are there scientific studies available?

▪ Is it likely that it will work better than an approved treatment?

▪ Benefits vs. risks

Off Label Use of Prescription Drugs

▪ Will the patient’s health insurance cover the cost of the medication?

▪ Are there any clinical trials the patient could enroll in?

▪ Have you talked with the patient’s healthcare provider?

Questions

▪ Would you fill a prescription for propranolol for essential tremor?

a) Yesb) No

▪ Would you fill a prescription for Seroquel® for insomnia?

a) Yesb) No

▪ Would you fill a prescription for hydroxychloroquine for COVID-19?

a) Yesb) No

How to encourage your staff to wear a mask

Case Studies

Presumption of Innocence

▪ When we discuss cases that are pending, please keep in mind:

▪ The charges contained in the Complaint are merely accusations, and the defendant is presumed innocent unless and until proven guilty.

United States of America vs. Richard Schirripa, “The Mask Man”

Schirripa, a licensed pharmacist (New York) has been charged with participation in 3 different criminal schemes:

1. Hoarding and price gouging involving N-95 masks in March and April 2020;

2. Lying to the DEA; and

3. False billing to Medicare and Medicaid from 2014 to 2019 (including using patient information without authorization during the health fraud)

United States of America vs. Richard Schirripa, “The Mask Man”

▪ Hoarding and price gouging violate the Defense Production Act (DPA) which was in effect when Schirripa obtained and sold the N-95 masks.

▪ Allegations state that he spent over $200K obtaining masks and charged inflated prices*.

▪ DEA states that there was a markup (in some cases) of fifty (50) percent.

▪ Bought for $10/Sold for $15

▪ Bought for $20/sold for $25

▪ Repeatedly sold masks out of his car.

United States of America vs. Richard Schirripa, “The Mask Man”

▪ Schirripa had also recently sold his pharmacy and told the DEA that he had transferred or destroyed all of the controlled substances from his store.

▪ The products were in a safe in Schirripa’s home.▪ Fentanyl

▪ Oxycodone

▪ Oxymorphone

▪ Approximately 4,000 pills/patches

United States of America vs. Richard Schirripa, “The Mask Man”

▪ Schirripa sold product to an undercover agent and also sent text messages to an undercover agent.

▪ Reported to have said “when you have something no one else has, its not a high price”.

United States of America vs. Richard Schirripa, “The Mask Man”

▪ Alleged to have billed Medicaid and Medicare for CS prescriptions.

▪ Prescriptions were filled and the CS in Schirripa’s home

▪ It should go without saying that, if the allegations are true, he used the personal information of patients without their authorization.

United States of America vs. Richard Schirripa, “The Mask Man”

▪ Potential sentences▪ 1 year for violation of DPA

▪ 5 years for false statements

▪ 20 years for healthcare fraud

▪ 2 years for aggravated identity theft

Obligations

▪ Obligation to follow the law

▪ Copy of charges:▪ https://www.justice.gov/usao-sdny/press-

release/file/1278736/download

Refusal to Fill Prescriptions

▪ CVS, Walgreens and Costco have been sued for refusing to fill opioid prescriptions.

▪ Press release August 10, 2020.

▪ https://www.beckershospitalreview.com/pharmacy/cvs-walgreens-costco-sued-for-not-filling-opioid-prescriptions.html.

Refusal to Fill Prescriptions

▪ Plaintiff alleges ▪ That she has used opioids to treat chronic

conditions for years

▪ That the prescriptions are legitimate

▪ That the defendants are violating the Americans with Disabilities Act.

▪ The defendants have not commented on the lawsuit.

Americans with Disabilities Act of 1990

▪ Also referred to as the ADA

▪ To be protected by the ADA, one must have a disability, which is defined by the ADA as a physical or mental impairment that substantially limits one or more major life activities, a person who has a history or record of such an impairment, or a person who is perceived by others as having such an impairment.

▪ The ADA does not specifically name all of the impairments that are covered.

▪ https://www.ada.gov/ada_intro.htm

Americans with Disabilities Act of 1990

▪ This claim says that the plaintiff was discriminated against because of their disability versus a typical negligence claim, such as filling a prescription incorrectly.

▪ Negligence claims are composed of the following:▪ Duty of care

▪ Breach of duty

▪ Causation

▪ Damages

Challenges for the Pharmacist

▪ The laws and your store policies may not take into consideration unique cases.

▪ Policy is more like a one size fits all scenario.

▪ Violations of law can result in fines and/or loss of your professional license.

▪ Violations of policy can result in loss of your job.

U.S. vs. Ryan Patrick

▪ Pharmacist Ryan Patrick has entered a guilty plea:▪ Obtaining drugs by fraud

▪ Using the registration number of another in the course of acquiring controlled substances.

▪ Sentencing is scheduled for August 28, 2020.

▪ Max 4 years in prison and/or

▪ Fine up to $250,000

U.S. vs. Ryan Patrick

▪ Pharmacist at Rite Aid in Saltville, Virginia.

▪ Girlfriend operated a vet clinic in Bluff City, Tennessee.

▪ Patrick was filling prescriptions in the names of their five (5) dogs and using for his own use.

▪ Prescriptions written by another vet in the clinic, not Patrick’s girlfriend.

U.S. vs. Ryan Patrick

▪ Total of 47 prescriptions

▪ DEA not able to trace the origins of the prescriptions listed in the PMP.

▪ When the veterinarian was questioned, the vet confirmed that the prescriptions had been altered and/or photocopied from previous prescriptions.

▪ Seven (7) of the prescriptions filled were for a dog that has previously been euthanized in August 2019.

Don’t Involve the Dog!

ALBOP Wellness Program

▪ Dr. Michael C. Garver, D.M.D. DirectorAlabama Board of Pharmacy Wellness ProgramBOP WELLNESS: 251-605-2883Fax: 251-252-9112BOPWELLNESS@GMAIL.COM

Case Info from This Week

▪Greg Neal told the Bristol Herald Courierhe was asked to resign as CEO of Bristol (Tenn.) Regional Medical Center after participating in a surgical procedure without a medical license.

▪Mr. Neal stepped down from the role Aug. 20. He had served as CEO of Bristol Regional since 2013 and as president of Johnson City, Tenn.-based Ballad Health's northeast market since 2018.

Case to Watch:BCBS vs CVS

▪ BCBS in six (6) states has sued CVS – case set for trial later this year.▪ Including Alabama

▪ Claiming that CVS submitted inflated prices to BCBS.▪ Prices were lower for cash patients

▪ Allegations of fraud

▪ CVS has denied the charges

Before we closeAdjusting to the challenges we have faced so far

Thank youRonda H. Lacey, J.D., M.S. Pharm

laceyrh@auburn.edu

Who Packed Your Parachute?https://www.youtube.com/watch?v=Bhx_anC8Q7I