US Pharm. 2015;40(8):44-46.
Community pharmacists are well aware of prescription-drug diversion and the many ways in which pharmaceuticals—in particular, controlled substances—are diverted for criminal purposes. Methods employed may include doctor shopping for prescriptions, forgeries (although e-prescribing is making these increasingly difficult), robbery, and internal theft by employees. Good pharmacy security combines physical, policy, and technological approaches to safeguard pharmaceutical agents and help protect against theft and diversion. Pharmacists can perform a risk assessment by comparing their current security approaches with the strategies discussed here.
Securing the Physical Environment
A secure physical environment is the first line of defense in pharmacy security. Basic security systems in pharmacies that guard against physical loss of controlled substances and prevent theft by employees include safes and locked cabinets, camera systems, and alarms. Alarm systems with multiple panic buttons and remote triggers for staff to keep on their person should be considered.1 Alarm codes should be carefully safeguarded and changed frequently.2 Chimes or simple bells on the entrance that ring every time the door opens are helpful as well.
The use of high-resolution cameras supporting facial recognition, including video and hidden cameras, is critical for security. Video cameras must cover entrances, exits, high-risk areas such as the pharmacy counter, and dispensing areas. Cameras must be correctly positioned to record full-face views; cameras mounted near the ceiling may capture only the top of a hat.1 Data-storage devices can be housed in secured cabinets or at an off-site location. Drug safes are another critical deterrent—if a thief breaks into a pharmacy overnight, the safe may prevent theft of drugs.
In addition to security technology, the “people factor” should not be underestimated, and can prove to be surprisingly helpful in retail settings. Simply greeting a customer who enters the pharmacy creates an opportunity for staff to observe any unusual behaviors that might warrant closer attention.
Work environment habits—such as limiting direct physical access to designated dispensing areas and other critical locations and requiring strong protocol procedures for access—are tactics that can help to minimize physical security threats in pharmacies. To ensure that pharmacy staff adheres to all standard security practices, auditing tapes and recordings can be very effective when used with standard protocols that are implemented in critical locations.
All prospective employees should be screened by verifying licenses, conducting reference checks, and performing drug screening.2 Current employees can be audited by reviewing pharmacy records encompassing their work shifts, and periodically verifying license status.2 Keeping the pharmacy workspace clutter-free with minimal employee belongings, such as backpacks and other paraphernalia, will help mitigate security issues relating to the pharmacy employees themselves.2
These approaches minimally impact the financial bottom line while supporting the security of the pharmacy and the pharmaceuticals contained therein.
Ordering and Receipt of Controlled Substances
Current estimates show that controlled substances constitute 12% of all prescriptions written each year.3 These drugs have potential for abuse, dependence, and diversion. There are several critical steps to follow to support security surrounding the ordering and receipt of controlled substances.
1) Conduct a review of the order and a count by two persons (each independently verifying the count) before accepting the delivery from the shipper.2 This initial step prevents problems even before the agent is available to the pharmacy for dispensing.
2) Implement a standard approach to handle incomplete orders or discrepancies.2 To detect potential losses, counts and audits should be performed on a routine basis; this verification procedure, as well as submission of DEA form 222 (Official Order Form for Schedule I and II Controlled Substances) should involve two employees. A DEA Form 106 (Report of Theft or Loss of Controlled Substances) should be completed when a significant loss is discovered.2
3) Create a written plan for ensuring the safety and security of drugs prescribed. This can range from identification of the types of data to be captured in each pharmacy transaction to a description of the process for investigating trends and discrepancies, as well as for assigning responsibility for reporting unresolved discrepancies.
Tracking Workflows Through Technology
Much of pharmacy work is now tracked and driven by technology, such as e-prescribing and electronic health records (EHRs). These technologies can ensure that prescriptions given to a patient are in line with the patient profile and disease state. Other technologies can automate certain pharmacy tasks, such as drug tracking and accounting, to help reduce diversion; the availability of pharmacy crime data can help provide insights that can improve security practices.
EHRs: This technology can now assist in the recognition of potentially inappropriate scrips with the use of online drug profiles for patients. EHRs can reduce diversion by limiting the more common scams of filling prescriptions for the deceased, unauthorized refills, and call-in prescriptions by persons posing as healthcare professionals.2
E-prescribing: This eliminates some diversion by removing the opportunity for the paper prescription pad to be stolen, altered, or forged. Of course, e-prescribing presents its own security concerns. The DEA’s Interim Final Rule for e-prescribing of controlled substances introduced many security features into the process.4 Security built into e-prescribing allows for hard and/or soft token options with a unique pin and e-signature for each transaction. A hard token is a hardware cryptographic device such as a one-time password that is separate from the computer being used for e-prescribing. A soft token is a cryptographic procedure implemented with software. Prescribers must be positively identified before being issued their credentials (identity proofing). After an identity is confirmed, the prescriber is issued a two-factor credential. Prescribers issuing prescriptions for controlled substances are required to identify themselves electronically by using the two-factor credential.4
Pedigree Trail: Pharmacists are legally, ethically, and organizationally responsible for ensuring that any drug supplied and/or distributed is adequately controlled and that the dispensing of drugs is documented. Hence, it is critical that the security and integrity of the drugs themselves be guaranteed. The tool for tracking the integrity of drugs delivered to the pharmacy is the pedigree trail.
A pedigree is defined as a statement of drug origin that identifies each prior sale, purchase, or trade of a drug including the date of those transactions and the names and addresses of all parties involved.5 From a drug pedigree viewpoint, each person who is engaged in the wholesale distribution of a prescription drug in interstate commerce and is not the manufacturer or an authorized distributor of record for that drug must provide to the person who receives the drug a pedigree for that drug.5 This is a tracking form for security and one that documents a drug’s transaction history.
A Web-based pharmaceutical drug-pedigree document management service, such as the USMeds Pedigree System, can track and trace pharmaceutical transactions.6 This system, for example, complies with the Healthcare Distribution Management Association (HDMA) published standards for receiving and transmitting pedigree data via the advance ship notice (ASN) 856 electronic data interchange transmission. An ASN details the contents of a shipment along with other specified pertinent information such as the product description. This allows accurate transmission of pharmaceutical information from manufacturers and authorized distributors, and is designed to be compliant with the Drug Supply Chain Security Act.7
Pharmacy Automation Systems and Robots: Pharmacy automation systems also provide options for drug tracking and accounting. This proves helpful when monitoring important data, such as drug stock. Options for such monitoring and security include freestanding computer-controlled access and record keeping linked to various pharmacy information systems. Robots are an example of an automated system that supports security, allowing for storage, retrieval, tracking, and securing of narcotics. Robots are being used where once only manual verification existed—a process that often proved time-consuming and is subject to human error. RxSafe is one company that provides a range of pharmacy automation technology solutions, including the RxVault System, an automated robot for narcotics storage that can “automatically and accurately track scheduled pharmaceuticals down to the pill or package,” according to the RxSafe website.8
Policies and Procedures: Plans need to be developed that are clearly understood and specify who, in the pharmacy and elsewhere in the organization, has the responsibility for accuracy of data on drugs contained in the systems and maintenance of access codes, magnetic cards, and other positive identification methods.2 To ensure the utmost in privacy and security, the specific responsibilities and privileges of all personnel involved in operating or using any automated pharmacy system should be set forth in writing. All policies and procedures should minimize the use of temporary user and patient identifications, describe the circumstances in which these features may be used, and be audited appropriately by tracking all transactions associated with a temporary identifier.
Downtime Procedures: Another way to reinforce security in a pharmacy is by specifying downtime procedures to be used in the event of a software or hardware malfunction, power failure, or planned maintenance affecting normal operation of technologies. Specific plans need to be developed in this regard to ensure drug security with accurate documentation of dispensing.9
Crime Tracking: RxPATROL is a database and information clearinghouse initiative described as “collaborative effort between industry and law enforcement designed to collect, collate, analyze and disseminate pharmacy theft information.”10 This entity, supported by Purdue Pharma, uses pharmacy crime statistics to better understand the security threats seen in pharmacies and conveys this information to law enforcement. Pharmacies can participate in this information sharing and may benefit from RxPATROL’s pharmacy security tips and data. For example, 77% of pharmacies that experienced burglaries had no video camera; half of burglars entered through the pharmacy’s front door, lending support to the advisory that video surveillance systems for the store entrance, particularly those with a large monitor that can be seen by a potential perpetrator, are a deterrent.1 A pharmacy security checklist is available on the RxPATROL website.10
Conclusion
There are many measures that pharmacists can employ in the community setting to guard against theft and to ensure the safety and integrity of pharmaceutical agents. These range from relatively inexpensive policies and physical security methods, to more sophisticated video surveillance and technological advances such as e-prescribing, Web-based pedigree tracking, electronic monitoring, pharmacy automation, and robotics. Pharmacists should review their security procedures and select appropriate security measures for implementation based on an assessment of risks and vulnerabilities of their pharmacy practice.
REFERENCES
1. Gebhart F. How to protect your pharmacy against drug-related crime. Drug Topics. December 15, 2011. http://drugtopics.modernmedicine.com/drug-topics/news/modernmedicine/modern-medicine-feature-articles/how-protect-your-pharmacy-against-d?page=full. Accessed June 28, 2015.
2. Purdue Pharma L.P. Internal pharmacy theft. August 2012. www.rld.state.nm.us/uploads/FileLinks/a5bdc4c0017d4bf294dd2cbfea6f294e/PharmTheftBroc.pdf. Accessed July 7, 2015.
3. Wilkins TL, Gabriel M. The electronic prescribing of controlled substances is on the rise. December 31, 2014. www.healthit.gov/buzz-blog/health-information-exchange-2/electronic-prescribing-controlled-substances-rise/. Accessed June 28, 2015.
4. Figge H. Technology support for pain management: e-prescribing controlled substances. USPharm. 2013;38(6):HS6-HS9.
5. FDA. CPG Sec. 160.900 Prescription Drug Marketing Act—pedigree requirements under 21 CFR Part 203. Last updated March 20, 2015. www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm073857.htm. Accessed June 28, 2015.
6. USMeds Pedigree system. www.usmeds.com. Accessed June 28, 2015.
7. FDA. Drug Supply Chain Security Act. Last updated July 2, 2015. www.fda.gov/drugs/drugsafety/drugintegrityandsupplychainsecurity/drugsupplychainsecurityact/default.htm. Accessed June 28, 2015.
8. RxSafe. http://rxsafe.com/solutions/high-density-secure-med-storage/rx-vault-900/). Accessed June 28, 2015.
9. Drug Enforcement Administration. Pharmacist’s Manual Section IX – XIV. www.deadiversion.usdoj.gov/pubs/manuals/pharm2/pharm_content.htm. Accessed July 15, 2015.
10. RxPATROL (Pattern Analysis Tracking Robberies and Other Losses). Purdue Pharma LP. www.rxpatrol.org. Accessed June 28, 2015.
To comment on this article, contact rdavidson@uspharmacist.com.
