HIPAA Question

[TigerD]

What is the name of your state (only U.S. law)? MO

Missouri recently started implementing a new law that requires pharmacists selling pseudoephedrine products to enter customer names into a state database and notify law enforcement if a person purchases or attempts to purchase products containing pseudoephedrine at multiple locations or over X volume. At the moment, I don't know what the X amount is.

My question: Does transmitting a person's medicine purchases to outside parties violate HIPAA? Can you point me to specifics I can research for an article I am writing it?

DC

 

[JessiesGirl30]

In AZ, customers are now legally required to purchase that specific medicine from the pharmacy. That med is only sold from behind the counter at the pharmacy, and it's been like that for a few years now.

IMO, I think the additional step of logging a customer's info into a database, and monitoring it, which is not currently required in AZ, will be more work for the pharmacy without the benefit of stopping the addicts/pushers as intended. Pharmacies are very overworked now, and giving them MORE work, without proof of success, doesn't seem smart.

 

[ecmst12]

Purchase of over-the-counter medicine is not an activity covered by HIPAA.

 

[SolaireSolstice]

Texas has had this law in place for a while, but honestly I thought it was federal.
Combat Methamphetamine Epidemic Act of 2005 (Title VII of the USAPATRIOT Improvement and Reauthorization Act of 2005, P.L. 109-177),2

COMBAT METHAMPHETAMINE EPIDEMIC ACT 2005

http://www.deadiversion.usdoj.gov/pubs/brochures/pseudo/cmeatrifold_060508.pdf

And I was right, but each state has it's own way of how to enforce this law. I know when I buy a cold medicine w/ psuedoephedrine, I have to buy it from the pharmacy, and I have to show ID, and I sign *something*, lord knows what I'm agreeing to there, but I'm pretty sure it says something to the effect that I know they are collecting my name, birthdate, and whatever other identifying information they need, and storing it to make sure I'm not stocking up on it.
Since I sign it, and I'm agreeing to it, it pretty much overrides any claim I might make of a HIPAA volation. If I won't sign, they won't sell it, and again, no HIPAA violation.
BTW, those pages state the amount allowed for "private use".

 

[Some Random Guy]

Purchase of over-the-counter medicine is not an activity covered by HIPAA.

Several states have mandated logs of pseudoephedrine purchases. These logs contain detailed information about the purchaser and the quantity purchased. Several states have specifically listed these logs as PHI (Protected Health Information).

I know that in Indiana the police routinely check those logs and compare them from store to store looking for smurfers.

Other states will require subpoenas/court orders to give the police access.

Does transmitting a person's medicine purchases to outside parties violate HIPAA?

Well the HIPAA privacy rules have several exceptions. These include the following exceptions listed from

http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf

Required by Law. Covered entities may use and disclose protected health
information without individual authorization as required by law (including by
OCR Privacy Rule Summary 7 Last Revised 05/03
statute, regulation, or court orders).

Judicial and Administrative Proceedings. Covered entities may disclose
protected health information in a judicial or administrative proceeding if the
request for the information is through an order from a court or administrative
tribunal. Such information may also be disclosed in response to a subpoena
or other lawful process if certain assurances regarding notice to the individual
or a protective order are provided.

Law Enforcement Purposes. Covered entities may disclose protected health
information to law enforcement officials for law enforcement purposes under
the following six circumstances, and subject to specified conditions: (1) as
required by law (including court orders, court-ordered warrants, subpoenas)
and administrative requests; (2) to identify or locate a suspect, fugitive,
material witness, or missing person; (3) in response to a law enforcement
official’s request for information about a victim or suspected victim of a
crime; (4) to alert law enforcement of a person’s death, if the covered entity
suspects that criminal activity caused the death; (5) when a covered entity
believes that protected health information is evidence of a crime that
occurred on its premises; and (6) by a covered health care provider in a
medical emergency not occurring on its premises, when necessary to inform
law enforcement about the commission and nature of a crime, the location of
the crime or crime victims, and the perpetrator of the crime."

 

[TigerD]

Thanks for the comments so far -- it gives me a starting point to look at this. I still welcome any additional thoughts.

DC

 

[Mass_Shyster]

Thanks for the comments so far -- it gives me a starting point to look at this. I still welcome any additional thoughts.

DC

Check my math, but I believe that a person is limited to 9gm per month. If you take the maximum permitted dosage you will consume 7.2gm in 30 days.

That means I cannot buy for myself and my wife, or my sick child.

This is assuming I've got a cold that lasts a month.

I still remember buying a bottle of 200 pseudoephedrine tablets. I guess those days are gone.

 

[Indiana Filer]

Check my math, but I believe that a person is limited to 9gm per month. If you take the maximum permitted dosage you will consume 7.2gm in 30 days.

That means I cannot buy for myself and my wife, or my sick child.
.

You can buy it for them. It'll just be logged.

 

[Some Random Guy]

You can buy it for them. It'll just be logged.

That is incorrect in Indiana and possibly other states. The limit is 3.6 grams per day or 9 grams during ANY 30 day period. Going over the limit is a crime.
Indiana Code 35-48-4
See section 17 in the above link

To see the results in action, see how a woman with a sick family faced a class-C misdemeanor, which carries a sentence of up to 60 days in jail and up to a $500 fine:

Wabash Valley woman didn?t realize second cold medicine purchase violated drug laws Local & Bistate News From Terre Haute, Indiana

 

[CJane]

The "new" part of this is the database, not the amount you're allowed to purchase.

For years, the limit has been 9g in 30 days. That's 300 tablets.

For years, you've had to purchase anything containing pseudoephedrine from the pharmacist rather than off the shelves.

For years, you've had to show photo id and have your info "logged" at the pharmacy.

What's new is the statewide database that will assist otherwise unconnected pharmacies in seeing that you bought 200 pills @ Walgreens yesterday, and here you are at CVS, buying another 200 pills.

However, these limits only apply if one is purchasing OTC products. If a member of your family requires higher than normal dosages, or you'd exceed the limit for another legitimate reason, most physicians will write you a prescription for the medication, and there is no limit to the amount you can purchase with a prescription.

That said, I purchase 2 boxes of 96 pills every month when I pick up my prescriptions. Not because I go through it that quickly, but because it's cheap as heck at Sam's club (I think it's less than $2 for 96 pills) and I like to have it on hand just in case. Purchasing in that quantity has never been an issue.

The database was launched in March. As of the beginning of October, the majority of the pharmacies in the state still weren't online with it. But again, this is only for tracking of repeat purchasers, it's not a change to the actual law concerning regulations/limits on purchases.

 

[TigerD]

thanks CJane.

I was a bit confused about it. Our sheriff just put out a press release and make a big about how it went online on the Monday and how it was going to impact the meth trade.

DC

 

[CJane]

thanks CJane.

I was a bit confused about it. Our sheriff just put out a press release and make a big about how it went online on the Monday and how it was going to impact the meth trade.

DC

The law that limited the purchases to 9grams was actually the Patriot Act (which I did not know).

I don't know that it will impact the meth trade... I have issues with the whole "war on drugs" thing. I think it sounds good, and is therefore excellent PR. Also, I have no idea how much sudafed one needs to make meth, or how much meth is "a lot".

 

[commentator]

It has, it did, it really does make a difference. In the Upper Cumberland area of Tennessee, they actually passed these restrictions first as city ordinances, as the state legislature was being heavily lobbied against it by the pharmaceutical industry. As seriously affected states began taking it up, it then went federal.

Unlike most other abused drugs, meth does not have to be brought in from other places or manufactured by a drug company. It can be made anywhere by a person of reasonable intelligence IF they have the meth making ingredients. Recipes are readily available on line, traded in the county jails with pride. The control of the OTC 'phedrine cold remedies and diet pills has made a huge difference in the limitation of the terrible meth crisis we had going on in this area, at least.

While I have reservations about much of the "war on drugs" especially the criminalization of marijuana, meth is particularly damaging on every level.
It is very apparent that stopping people from coming in and blatantly purchasing hundreds of boxes of these products, when everyone involved knew exactly what they were going to be used for has been a very logical step in slowing this problem.

 

[xylene]

By stopping homemade meth cooks, we are helping the mexican drug cartels turn a small regional penetration in the US Southwest into a new and lucrative nationwide drug monopoly.

That isn't the same as stopping meth.

 

[ecmst12]

Keeping the meth LABS out of the country isn't completely bad though. Those things are dangerous and toxic to everything around them. Let mexico deal with them!