64F-12.013: Prescription Drugs; Receipt, Storage and Security
PURPOSE AND EFFECT: The 2006 Florida legislature enacted session law 2006-310, amending Chapter 499, Part I, F.S., which changed requirements for prescription drug pedigrees in some instances. It is the purpose of this rule to clarify authentication of pedigree requirements, clarify who is required to verify that a prescription drug, as of the time of receipt, matches the description on the corresponding pedigree provided with the drug, as well clarifying the information that should be found on the pedigree. The Department proposes to make changes in the authentication requirements for pedigrees, as well as delete out dated language no longer relevant because of statutory changes that became effective July 1, 2007 concerning prescription drug pedigrees.
SUMMARY: The proposed rule changes will clarify that establishment and adherence to policies and procedures for random authentication of copies of pedigrees according to statistically valid standards is required in some situations. The proposed rule changes will also require establishment and adherence to policies and procedures that provide for the random verification of the authenticity of pedigrees for the purposes of establishing a wholesaler purchased prescription drugs directly from the manufacturer according to statistically valid standards, in some situations. The proposed rule adds the requirement that a repackager notify the Department of discovery of a significant loss of prescription drugs. The proposed rule requires that a chain pharmacy warehouse or person authorized to administer or dispense a prescription drug that receives a prescription drug, is required to verify that the information on the corresponding pedigree matches up with the drug received.
SUMMARY OF STATEMENT OF ESTIMATED REGULATORY COSTS: No Statement of Estimated Regulatory Cost was prepared.
Any person who wishes to provide information regarding a statement of estimated regulatory costs, or provide a proposal for a lower cost regulatory alternative must do so in writing within 21 days of this notice.
SPECIFIC AUTHORITY: 499.0121(1), 499.05 FS.
LAW IMPLEMENTED: 499.004, 499.006, 499.007, 499.0121, 499.028(6), 499.052 FS.
IF REQUESTED WITHIN 21 DAYS OF THE DATE OF THIS NOTICE, A HEARING WILL BE SCHEDULED AND ANNOUNCED IN FAW.
THE PERSON TO BE CONTACTED REGARDING THE PROPOSED RULE IS: Rebecca Poston, R.Ph., Executive Director, Board of Pharmacy-Drugs Devices and Cosmetics, 4052 Bald Cypress Way, Mail Bin C-04, Tallahassee, Florida 32399
THE FULL TEXT OF THE PROPOSED RULE IS:
64F-12.013 Prescription Drugs; Receipt, Storage and Security.
(1) Establishments in which prescription drugs are stored, manufactured, repackaged, kept, held, used, sold, stored, offered for sale, or exposed for sale, shall be secured against unauthorized entry or unauthorized access to prescription drugs when establishment personnel are not present.
(a) Establishments permitted under Chapter 499, F.S., that are authorized to take possession of prescription drugs, other than medical oxygen, must be secured by an alarm system which functionally and practically provides a deterrent to unauthorized entry to the establishment or the area where the prescription drugs are held or stored.
(b) Prescription medical oxygen may be stored outside in an area surrounded by a fenced enclosure with a lock which must be secure when authorized persons are not present. Other compressed medical gases must be stored in accordance with paragraph (a).
(2)(a) While not being used to make deliveries, a vehicle of a permittee containing prescription medical oxygen must be parked at the permitted establishment and either locked inside a fenced compound or secured by a vehicle alarm system. A vehicle containing prescription medical oxygen may only be parked at a residence temporarily while the vehicle is making deliveries or while on call for emergency deliveries.
(b) When a vehicle used for prescription drug wholesale distributions or for distributions subject to a restricted prescription drug distributors permit contains prescription drugs and is not being used to make deliveries, it must be parked inside a building secured by an alarm system.
(c) A residence cannot be used to store any prescription drug which has not been dispensed, unless a natural person residing at that residence is licensed or otherwise authorized to possess prescription drugs.
(3)(a) The storage temperature definitions in the U.S.P. are incorporated by reference herein. If no storage and temperature requirements are set forth by the manufacturer in the labeling or in the U.S.P., prescription drugs other than compressed medical gases must be stored at controlled room temperature. Compressed medical gases, unless otherwise indicated, may be stored in a manner so that they are protected from freezing and are not stored at or near excessive heat or open flame.
(b) All establishments permitted under Chapter 499, F.S., that handle prescription drugs other than medical gases, must, in the absence of electronic monitoring devices, mount two thermometers in the immediate area of the stored prescription drugs. For purposes of this provision, immediate area of the stored prescription drugs is within six (6) feet of the prescription drugs in storage. One thermometer will be mounted in the warmest area of the stored prescription drugs and the other thermometer will be mounted in the coolest immediate area of the stored prescription drugs.
(c) A record must be maintained recording the date; time; thermometer one temperature; thermometer two temperature; and the initials of the person recording the data or reviewing the data if electronically monitored. This record and temperature reading must be recorded at least five (5) days each week with the temperature readings taken between 2:00 p.m. and 4:00 p.m. E.S.T. Alternate times may be approved by the department in writing. This record must be kept on file by the facility for at least two years.
(d) Facility requirements for the storage and handling of prescription drugs.
1. An applicant for an initial prescription drug wholesaler permit must have a facility that is large enough to store the estimated quantity of prescription drugs the applicant intends to possess under its initial application to comply with the requirements of Section 499.0121(1), F.S. An applicant for renewal of a prescription drug wholesaler permit must have a facility that is large enough for the ongoing operations of the wholesale establishment based on the prior years volume of activity with prescription drugs, which may be modified for reasonable fluctuations in inventory management for the current year. These determinations will be based on the type of prescription drugs the applicant possesses, or intends to possess, considering the size of the containers as well as any other products the applicant possesses or intends to possess. Notwithstanding the contention that an applicant will distribute all prescription drugs the same day received, the facility must be large enough to accommodate prescription drugs as set forth herein in case the drugs are not distributed the same day received.
2. An applicant for an initial prescription drug wholesaler permit must have a refrigeration capacity and freezer capacity large enough to store the estimated quantity of prescription drugs that might require refrigeration or freezing that the applicant intends to possess under its initial application to comply with the requirements of Sections 499.0121(1) and (3), F.S., and this rule. An applicant for renewal of a prescription drug wholesaler permit must have a refrigeration capacity and freezer capacity that is large enough for the ongoing operations of the wholesale establishment based on the prior years volume of activity with prescription drugs that required refrigeration or freezing, which may be modified for reasonable fluctuations in inventory management for the current year, to comply with the requirements of Sections 499.0121(1) and (3), F.S., and this rule. These determinations will be based on the type of prescription drugs the applicant possesses, or intends to possess, considering the size of the containers as well as any other products the applicant possesses or intends to possess that might require refrigeration or freezing. Notwithstanding the contention that an applicant will distribute all prescription drugs the same day received, the refrigeration and freezer capacity must be large enough to accommodate prescription drugs as set forth herein in case the drugs are not distributed the same day received.
(4) Quarantine.
(a) A quarantine section shall be clearly marked and designated separate and apart from any other place where drugs are stored so that products therein shall not be confused with usable products being held for sale. Any prescription drug stored outside the quarantine area is a product held for sale or other distribution.
(b) The requirement of Section 499.0121(5)(b), F.S., that prescription drugs must be quarantined if damage has occurred to the immediate or sealed outer or sealed secondary containers means: a prescription drug must be quarantined if obvious damage, determined by a visual inspection of the exterior of the products packaging, has occurred to any part of the packaging that is or may be in direct contact with the dosage form of the drug or any additional part of the packaging which is provided to prevent adulteration of the drug in addition to containing the product.
(c) A person who handles both prescription drugs and over-the-counter drugs or medical devices may have one quarantine section; however, the storage requirements for prescription drugs must be followed.
(5) Examination of Prescription Drugs; Physical Product and Records.
(a)1. Every person receiving prescription drugs other than the consumer receiving dispensed prescription drugs pursuant to Chapter 465, F.S., has a duty to examine the product to prevent acceptance of prescription drugs that are unfit for distribution or use. The extent of the examination should be predicated on the conditions surrounding the transaction, including but not limited to any previous sales of the product, i.e., purchase and delivery is not direct from the manufacturer; the conditions of transport; and environmental conditions to which the product may have been subjected.
2. A wholesaler, chain pharmacy warehouse, or person authorized to administer or dispense a prescription drug that physically receives a prescription drug must verify that the prescription drug received matches the prescription drug identified by lot number or unique serial number, when available, on the corresponding pedigree if a prescription drug is received from a person other than the manufacturer. The corresponding pedigree document shall contain all of the required information described in Sections 499.003(31)(a) or (b), F.S., as applicable, including the information required in the forms described in subsection 64F-12.012(3), F.A.C., for those distributions that are not eligible for the use of the direct purchase pedigree.
(b) Upon receipt, each outside shipping container must be visually examined for identity and to prevent the acceptance of misbranded drugs, adulterated drugs or prescription drugs that are otherwise unfit for distribution. If visual examination of the shipping container or other conditions surrounding the transaction suggest possible misbranding or adulteration, the person has a duty to examine further the contents or conditions of sale.
(c) Prescription Drug Wholesalers must employ personnel who can perform product examinations. Once the Prescription Drug Wholesaler has inspected the shipped drugs and elected to accept them, the wholesaler is responsible for the condition of the drugs. Until that time, the shipper or manufacturer remains responsible for delivering a prescription drug product in acceptable condition, unless responsibilities are modified by contract.
(d) Authentication.
1. A prescription drug wholesaler may use any, all, or any combination of the following methods to authenticate each transaction on a pedigree paper and must maintain the corresponding documentation regarding the authentication for the method used:
a. Receipt of an invoice (or shipping document) from the seller to the purchaser, which may have the prices redacted. Documentation requirements include at a minimum a copy of the invoice or shipping document. If this method is used to authenticate a pedigree, the wholesaler must review the document received for signs of tampering, incompleteness, or inconsistency with other invoices or shipping documents from that manufacturer or wholesaler, and must randomly verify the authenticity of the invoice or shipping document with the seller or shipping point reflected on that document using one of the methods in sub-subparagraph b., c., or d. below. Each wholesaler shall should establish and adhere to policies and procedures for the random verification of the authenticity of the invoices or shipping documents according to statistically valid standards. However, more emphasis should be focused on those wholesalers in the chain with which the wholesaler performing the authentication does not have an established prescription drug vendor relationship.
b. Telephone call to the seller. Documentation requirements include a signed statement by the person placing the telephone call identifying the persons name and position title representing the seller who provides the information, the date the information was provided, and verification of the sales transaction between the parties, including verification of the date of the transaction and the quantity of prescription drugs involved in the transaction.
c. E-mail communication with the seller. Documentation requirements include a copy of the e-mail that identifies the persons name and position title representing the seller who provides the information, the date the information was provided, and verification of the sales transaction between the parties, including verification of the date of the transaction and the quantity of prescription drugs involved in the transaction.
d. Verification of the transaction per a web-based system established by the seller or an independent person that is secure from intentional or unintentional tampering or manipulation to conceal an accurate and complete history of the prescription drug transaction(s). Documentation requirements include a written representation from the seller or independent person that the seller or independent person, as applicable, is responsible for the information included on the web site and has adequate security on the information posted to prevent unauthorized tampering, manipulation, or modification of the information and a copy of the (dated) web site page that confirms the sales transaction between the parties, including the date of the transaction and the quantity of prescription drugs involved in the transaction.
e. Receipt of a legible and unaltered copy of a previous transactions pedigree paper that had been signed under oath at the time of the previous transaction to support the transaction to which the pedigree paper relates. If this method is used to authenticate a pedigree, the wholesaler must review the document received for signs of tampering, incompleteness, or inconsistency, and must randomly verify the authenticity of pedigrees using one of the methods in sub-subparagraph b., c., or d. above. Each wholesaler shall should establish and adhere to policies and procedures for the random verification of the authenticity of these copies of pedigrees according to statistically valid standards.
f. Receipt of a pedigree in an electronic form from an automated system that complies with this sub-subparagraph that was successfully opened and decrypted by an automated system that complies with this sub-subparagraph. In order to rely on receipt of an electronic pedigree without employing additional authentication methods as set forth in sub-subparagraphs a.-e.,
(I) The system used to digitally sign and electronically authenticate the electronic pedigree must at a minimum support the following digital signature standards or future revisions governed by the National Institute of Standard and Technology (NIST):
(A) FIPS 140-2 validated cryptographic module which is hereby adopted by reference,
(B) FIPS 186-2 validated digital signature system which is hereby adopted by reference,
(C) FIPS 180-2 validated hash function which is hereby adopted by reference,
(II) The system must employ controls to ensure the security and integrity of the private key so that it cannot be accessed by someone other than the certificate holder. At a minimum, the system must:
(A) Control the activation of the private key with an authentication mechanism,
(B) Employ a ten-minute inactivity time period after which the certificate holder must re-authenticate to access the private key,
(C) When the signing module is deactivated, clear the plain text private key from the system memory to prevent the unauthorized access to, or use of, the private key,
(III) The system must communicate with the Certification Authority directory, either each time authentication and validation steps in sub-subparagraph (IX) below occur or at least on a daily basis to download information to perform the authentication and validation which will occur on that day.
(IV) The system must have a time system that is within five minutes of the official NIST time source and date and time stamp any and all digital signatures.
(V) The system must archive digitally signed files unaltered, including the original hashes and reference to the public keys, in a manner that facilitates retrieval of the record consistent with the recordkeeping requirements.
(VI) The system must prevent issuance of an outgoing pedigree paper if the total quantity of prescription drugs distributed in all pedigrees exceeds the quantity of prescription drugs received in the corresponding incoming electronic pedigrees.
(VII) The system must maintain a history file of any outgoing electronic pedigree that is subsequently voided or altered and notify the recipient that the pedigree sent to it was voided or altered.
(VIII) The system must maintain a history file of any incoming notification received pursuant to sub-sub-subparagraph (VII) above that a pedigree was voided or altered and prevent the issuance of an outgoing pedigree using a pedigree that was voided or altered.
(IX) The system must verify or perform the following:
(A) Each transaction on the electronic pedigree must be digitally signed using certificates issued through a public key infrastructure system authorized by the department.
(B) The electronic pedigree must contain each prior transaction digitally signed and unaltered, including the original hash and reference to the public key, with the new transaction information appended to the new document and the entire resulting pedigree digitally signed, including the resulting hash and reference to the public key.
(C) The system must check the certificate expiration date of each signed transaction and compare it against the date and time that the transaction was signed to determine that the certificate has not or had not expired at the time the record was signed.
(D) The system must check the digital signature for each signed transaction against the Certificate Authoritys directory and the Certificate Revocation List and verify whether the certificate holder is or was authorized to sign electronic pedigrees at the time the transaction was signed.
(E) The system must decrypt each digital signature for each signed transaction in the pedigree using each senders public key and compare it against the message digest to determine that the record has not been altered since it was originally signed.
(F) The system must require that all authentication and validation steps in the preceding paragraphs are carried out prior to allowing the acceptance of the transaction. The system should not allow the further processing of any transaction that has failed to pass any authentication or validation step.
(X)(A) The manufacturer must initiate the pedigree; or, until such time as the manufacturer initiates a pedigree to the wholesaler, the wholesaler that purchased the prescription drug from the manufacturer must imbed a copy of the sales invoice or the manufacturers EDI transmission or Advance Ship Notice (ASN) that contains all required data elements for a complete audit trail as set forth in Rule 64F-12.012, F.A.C., related to that wholesalers acquisition of the prescription drug from the manufacturer. Price information related to the transaction may be redacted from the imbedded copy of the sales invoice, the EDI transmission, or the ASN.
(B) If a pedigree complies with all provisions within sub-subparagraph f. except for sub-sub-sub-subparagraph (X)(A) above, then a prescription drug wholesaler must use another method authorized by this rule to authenticate the distribution from the manufacturer to the first wholesaler. Subsequent distributions may be authenticated in accordance with sub-subparagraph f.
2.g. If a pedigree cannot be authenticated because of a clerical error, the pedigree must be corrected by the sender.
3.h. If a pedigree cannot be authenticated and the reason is other than a clerical error, or the reason cannot be satisfactorily ascertained based on preliminary investigation, the prescription drug for which the pedigree cannot be authenticated must be quarantined and the department notified within 3 business days.
2.a. Authentication of the purchase of a prescription drug directly from the manufacturer by an affiliated group member for a prescription drug that is subject to the statement in Section 499.0121(6)(e)1.a., F.S., may be documented by a written agreement between or among the affiliated group members that each affiliated group member will only transfer prescription drugs included on the specified list that were purchased directly from the manufacturer to an affiliated group member that is required to include the statement in Section 499.0121(6)(e)1.a., F.S., on its wholesale distributions to other wholesale distributors.
4.2. b. A purchasing wholesaler may use a written contract agreement between the purchasing wholesaler and its wholesale supplier, which is a primary wholesaler as defined in Section 499.012(1)(d), F.S., that requires that all prescription drugs distributed to the purchasing wholesaler by the wholesale supplier must be purchased by the wholesale supplier from the manufacturer. If this method is used to authenticate a pedigree, the purchasing wholesaler shall must establish and adhere to policies and procedures for the random verification of the authenticity of the pedigrees that disclose the supplier wholesaler purchased the prescription drug from the manufacturer according to statistically valid standards.
5.3. The following persons in
a. A licensed pharmacy, unless it is also permitted as a retail pharmacy wholesaler and will engage in the wholesale distribution of that drug, or unless it is a member of an affiliated group and will distribute a prescription drug purchased or received directly from a prescription drug wholesaler that is not also a member of its affiliated group to another member of its affiliated group;
b. A medical practitioner; or
c. A restricted prescription drug distributor health care entity.
6.4. In order to authenticate pedigrees, a manufacturer of a prescription drug that is sold or distributed in
7.5. Any wholesaler or repackager required under Chapter 499, F.S., to receive a pedigree paper must authenticate the pedigree pursuant to Section 499.0121(4), F.S., notwithstanding the absence of a pedigree paper or authentication by persons in the distribution chain not subject to the requirements of Chapter 499, F.S.
(6) Any establishment that is permitted as a prescription drug wholesaler or repackager must notify the department in writing within three working days of discovery of a significant loss or theft of prescription drugs. Whether a loss or theft is significant is to be based on the prescription drug wholesalers written policies and procedures that may take into account the actual quantity in relation to the type or size of the business; any pattern of losses or thefts; and local trends or other indicators of the diversion potential.
Notification to the Drugs, Devices and Cosmetic Program Bureau may be made by facsimile to (850)413-6982 (850)922-5367 and must include at a minimum, identification of the permitted establishment reporting the loss or theft; a complete identification of the prescription drug(s) involved, including but not limited to the name of the manufacturer or distributor reflected on the label of the products, the dosage form, strength, container size, the quantity of each, the lot numbers if known; a brief description of the circumstances surrounding the theft or loss; and a contact persons name and telephone number to provide additional information.
(7) Due Diligence Inspection. With respect to the inspection required under Section 499.0121(12)(e), F.S., a prescription drug wholesaler may rely on a due diligence inspection performed by a person that is independent of both wholesalers for purposes of the requirement in Section 499.0121(12)(e), F.S.
Specific Authority 499.0121(1), 499.05 FS. Law Implemented 499.003,(31), 499.004, 499.006, 499.007, 499.0121, 499.028(6), 499.052 FS. HistoryNew 7-8-84, Amended 1-30-85, Formerly 10D-45.535, Amended 11-26-86, 7-1-96, Formerly 10D-45.0535, Amended 1-26-99, 4-17-01, 1-1-04, 1-19-06,________.
