Starting January 1, 2023, California pharmacies will be required to have a new written policy and procedure addressing controlled substances inventory reconciliations. The amended California Code of Regulations 1715.65 now requires that pharmacies perform inventory reconciliation report:

– on all federal controlled substances;

– for federal Schedule II drugs at least once every three months;

– for products containing the followings substances in the following strengths per tablet, capsule, other unit, or specified volume, at least once every 12 months:

(A) Alprazolam, 1 milligram/unit.

(B) Alprazolam, 2 milligrams/unit.

(C) Tramadol, 50 milligrams/unit.

(D) Promethazine/codeine, 6.25 milligrams of promethazine and 10 milligrams of  codeine per 5 milliliters of product.

– for any other controlled substances no later than three months after discovery of the reportable loss of that controlled substance;

– for all controlled substances at least once every two years.

The new regulation also explains the record-keeping requirements of inventory reconciliation reports, how such reports should be prepared, and clarifies inventory requirements in hospital setting.

You can purchase this new policy and procedure customizable to your practice at our RxPolicy website. (If you are a subscriber, you should have already received this new policy and procedure from us and you will receive a revised Standard Operational Manual for 2023 – with all the updates and requirements for 2023 – in December 2022).

Under various state laws and DEA regulations, every pharmacist must resolve “red flags” before dispensing a prescription for controlled substances. Most of the pharmacy state boards have published lists of what constitutes such red flags. For example, the California State Board of Pharmacy has published the following list of red flags (other states use the same criteria):


  • Irregularities on the face of the prescription itself
  • Nervous patient demeanor
  • Age or presentation of patient (e.g., youthful patients seeking chronic pain medications)
  • Multiple patients all with the same address
  • Multiple prescribers for the same patient for duplicate therapy
  • Cash payments
  • Requests for early refills of prescriptions
  • Prescriptions written for an unusually large quantity of drugs
  • Prescriptions written for duplicative drug therapy
  • Initial prescriptions written for strong opiates
  • Long distances traveled from the patient’s home to the prescriber’s office or to the pharmacy
  • Irregularities in the prescriber’s qualifications in relation to the type of medication(s) prescribed
  • Prescriptions that are written outside of the prescriber’s medical specialty
  • Prescriptions for medications with no logical connection to an illness or condition.

If any of the above are present, the pharmacist must document how the red flags were resolved. The key word here is “document.” I cannot stress enough the importance of documentation. While representing independent pharmacies in DEA audits and investigations for many years, I have seen large monetary penalties imposed simply because there was no documentation on how pharmacists cleared red flags. For example, I recently had a case where the DEA claimed that the red flags were not resolved and was proposing a multi-million dollar settlement. After interviewing the client, I learned that the pharmacist in fact did resolve the red flags. For example, he spoke to the prescribers regarding medical necessity and to the patients to inquire why they were traveling long distances and paying cash. The pharmacist, however, failed to document these inquires and we had no evidence (besides the pharmacist’s statement) that the pharmacy performed its due diligence in filling these scripts.

Specifically, the DEA has recently been targeting pharmacies with excessive filling or ordering, suspicious drug combinations, and pattern prescribing. Some examples of such drug combinations:

– An opioid, a benzodiazepine, and a muscle relaxer for overlapping days of supply

– An opioid, a benzodiazepine, and a muscle relaxer on the same day, and all the prescriptions were written by the same prescriber

– An opioid and a benzodiazepine within 30 days of one another

– An opioid and a benzodiazepine on the same day, and both prescriptions were written by the same prescriber

In the DEA’s opinion, there is no legitimate medical reason for such combinations.

Some examples of excessive dispensing (from recent cases):

– Pharmacy dispensed two short-acting opioid drugs on the same day

– Pharmacy dispensed an opioid prescription of over 200 MME per day

– Pharmacy dispensed more than 210 “days of supply” of all opioids combined in a 6-month period.

Pattern prescribing example: an opioid was dispensed to at least 4 different patients on the same day and the opioid prescriptions were for the same base drug, strength, and dosage form and were written by the same prescriber.

Recently, the importance to resolve red flags was illustrated by a legal action against Walgreens.  The city and county of San Francisco filed a law-suit against drug manufacturers and Walgreens for contributing to the opioid epidemic in San Francisco. A crucial factor in the court’s holding for the city was its determination that Walgreens failed to document red flags.

San Francisco was able to prove that multiple opioid prescription contained red flags which were not resolved by Walgreens’ pharmacists. According to San Francisco’s expert only 5% of the prescriptions were adequately verified and red flags resolved. Walgreens was not able to present documentation on how its pharmacists resolved red flags (such as long distance, cash payment, and dangerous combination of controlled substances). As a result, Walgreens is facing a multi-million dollar settlement.

(By the way, I encourage you to read the court opinion as it goes over the history of San Francisco’s opioid crisis, discusses red flags and pressure that many chain pharmacists face).

In a nutshell: the presence of a red flag triggers a pharmacist’s duty to perform a reasonable inquiry to determine whether the prescription is legitimate before dispensing it. Pharmacists should document how they resolved such red flags. Prescriptions should not be dispensed if the red flags are not resolved and there is no documentation how the pharmacist resolved them.

Remember a guiding principle of pharmacy: “if you didn’t document it, it didn’t happen.”


Today I would like to highlight some practical aspects in appealing PBM audits. Earlier this year, a PBM denied several pharmacy audit appeals because pharmacies were not compliant with the provider manual when presenting their appeal paperwork. Namely, the additional documentation presented by the pharmacy lacked pharmacy NABP number, prescription number, and date of fill. In these specific examples, pharmacies presented patients’ and prescribers’ statements which were missing prescription numbers and pharmacy’s NCPDP.  The PBM rejected this information because under its provider manual, every document submitted during the appeal or audit process must state:

– pharmacy NABP number

– prescription number

– date of fill

– patients’ full name.

And if the pharmacy is providing a prescriber’s statement, it must be on the prescriber’s letterhead clearly indicating the origin of the document (i.e. prescriber’s fax number).

Another practical issue is many PBMs now have a provision in their manuals to hold the new owner of the pharmacy accountable for the previous owner’s audit. Before, we were able to successfully argue that the audit covered the date under the previous ownership and the new owner should not assume responsibility for such acts (especially if the new owner operates under the new NPI and NCPDP). But now most PBMs have a provision that if you continue operating under the Seller’s contract, you remain severally and jointly liable for the conduct of the past owner. This makes due diligence during the acquisition stage even more important, especially when it comes to invoice reconciliation aspect. Prior to closing a pharmacy transaction, the buyer should perform an internal invoice reconciliation to ensure no audit would reveal drug shortages.


The bottom-line is the pharmacy should be familiar with the provider manuals prior to presenting any information or argument to a PBM. Surprisingly, many pharmacies do not even have access to their PBM manuals. Most of them are available through PBM pharmacy portals, make sure you download them and familiarize with their requirements prior to submitting any audit appeal documentation.

Back in 2021, the Secretary of the federal Department of Health and Human Services authorized licensed pharmacists to independently order and administer any COVID-19 therapeutic, subject to certain conditions ( under the Ninth Amendment to Declaration Under the Public Readiness and Emergency Preparedness Act for Medical Countermeasures Against COVID-19).

Recently – on July 6, 2022 – the FDA amended the Emergency Use Authorization (EUA) for Paxlovid, an orally-administered COVID-19 therapeutic drug. The amended EUA expressly permits licensed pharmacists to independently order Paxlovid for individual patients under certain conditions.

The FDA has authorized the emergency use of PAXLOVID – an investigational medicine – for the treatment of mild-to-moderate COVID-19 symptoms in adults and children (12 years of age and older weighing at least 88 pounds) with a positive test for COVID-19, and who are at high risk for progression to severe COVID-19, including hospitalization or death.

In addition, the California State Board of Pharmacy has waived certain provisions of Business and Professions Code to the extent these provisions prohibit pharmacists from independently initiating and furnishing Paxlovid. To access Board’s waiver, click here.

In its waiver the Board lists the following requirement that must be observed by the pharmacists independently initiating and furnishing Paxlovid, such as:

(i) pharmacists must assess renal and hepatic function of the patient through health records less than 12 months old or by a consultation with the patient’s physician, and

(ii) pharmacists must obtain a comprehensive list of medications that the patient is taking to assess potential drug interaction through medical records or a consultation with the patient’s physician, and

(iii) if no sufficient information is available to determine patient’s medical history and potential drug interaction, or if the pharmacist determines that taking Paxlovid may cause adverse reaction, the pharmacist must refer the patient for clinical evaluation.

Due to potential side effects and investigational nature of Paxlovid, pharmacists initiating and furnishing Paxlovid should require an informed consent and release signed by their patients taking Paxlovid. This form should notify patients of potential side effects, drug interactions, and other information pertaining to taking Paxlovid. If you need assistance with drafting such informed consent and release, please contact our office or your healthcare attorney. We also plan to make such forms available on our website:

The United States Attorney’s Office for Southern District of Florida has recently announced a settlement with three Florida pharmacies to resolve allegations that they fraudulently used collaborative practice agreements (“CPAs”) to bill federal health care programs for unlawfully prescribed medications.

In its press release, the governments explains that “A collaborative pharmacy practice agreement is a written agreement between a physician and pharmacist that allows the pharmacist to provide specific patient care services for chronic health conditions to the physician’s patients.  Services provided by the pharmacist are outlined in the written agreement and must be in accordance with Florida law.”

The settlement explains that the pharmacies used:

– CPAs that were unlawful pursuant to Florida law because they delegated prescribing authority from a physician to a pharmacist, and

– the same CPAs to write and fill prescriptions without any physician involvement.

The complaint alleged, among other things, that the CPAs allowed pharmacists to:

– modify formulas for compounded prescriptions;

– issue initial prescriptions;

– delegate pharmacists’ tasks to technicians, who modified and billed for compounded medications.

In addition, many CPAs in the case were allegedly expired. More information on the case: United States et al. ex rel. Morales v. Habana Hospital Pharmacy, Inc. et al., No. 17-CV-80871-KAM, S.D.Fla., 2017.

This allegedly fraudulent scheme resulted in the submission of false claims to federal health care programs, including Medicare and Medicaid. To resolve the allegations, the pharmacies have settled with the government for over $831,000.

If you are using CPAs in your practice, make sure you review them on at least annual basis. It is very important that CPAs are compliant with your state laws and do not delegate more responsibilities than state law allows; and – of course – have them reviewed by your legal counsel.



While this is not a new case, it serves as a good reminder that even a small healthcare provider is subject to potential monetary penalties under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Cornell Prescription Pharmacy was a small compounding pharmacy in Denver. A complaint was filed with the Office for Civil Rights (OCR) – which is a branch of US Department of Health and Human Services with HIPAA enforcement functions  – that the pharmacy allegedly discarded hardcopies of prescriptions and dispensing records without shredding such documents. These documents – containing protected health information (PHI) of 1,610 patients – were stored in an unlocked open container on the pharmacy’s premises. The OCR conducted an investigation and confirmed that such records were jeopardized and that the pharmacy failed to implement HIPAA policies and procedures. Due to this findings and to avoid further cost of defense, the pharmacy and OCR agreed on a $125,000 settlement and a corrective action plan requiring the pharmacy to implement proper HIPAA policies and procedure, and to train its staff on compliance with HIPAA and other privacy laws.

While we have previously reported larger HIPAA settlements with chain pharmacies, this is the only case and investigation that we are aware of involving a small independent pharmacy. Our other relevant blog posts: “OCR increases HIPAA audits,” “When was the last time you trained your workforce on HIPAA? Penalties for non-compliance have increased.

We have prepared HIPAA policies and procedures specifically tailored to independent pharmacies. We also assist with training your pharmacy staff regarding HIPAA and relevant privacy laws. You can access our policies here or contact our office for custom policies and training.


Effective July 1, 2022, California pharmacies providing auto-refill services must:

  • have a written policy and procedure describing the auto-refill program listing medications that may be refilled through the program;
  • obtain patients’ written consent to auto-refills;
  • provide a written notice to the patient summarizing the program and on how to withdraw from the program (such written notices must be available in the patient’s language of choice);
  • complete a drug regimen review for each prescription refilled through the program at the time of refill;
  • provide a written notification to the patient or patient’s agent confirming that the prescription medication is being refilled through the program each time the medication is refilled;
  • allow the patient to withdraw a prescription medication from automatic refill or to disenroll entirely from the program;
  • provide a full refund to the patient, patient’s agent, or payer for any prescription medication refilled through the program if the pharmacy is notified that the patient did not want the refill, regardless of the reason, and the pharmacy had been notified of withdrawal or disenrollment from the program prior to dispensing the prescription.

Our firm has prepared policies and procedures (and patient notices) that comply with the above requirements, available for download here.

If your pharmacy is located in another state or/and operates in other states, please keep in mind that many states do not permit auto-refill programs.

As to Medicare, part D beneficiaries can be enrolled into auto-refill programs but under certain circumstances, such as notice, opt-in and opt-out options, refunds for unwanted medications, etc. Basically, California law mirrors Part D requirements.

Many Medicaid programs have similar restrictions. Ensuring compliance with Medicare and Medicaid requirements is particularly important as non-compliance can lead to potential claims and actions against the pharmacy under the False Claims Act (which is very time-consuming and expensive to defended).

PBM manuals (see a related blog post) also require similar safeguards around auto-refill programs, such as:

  • Auto-refill programs should be voluntary, on opt-in basis only;
  • Patient consent is for refills only and shall not apply to any new prescriptions (new consent must be obtained);
  • The pharmacy must provide patients with information on how to disenroll from its auto-fill program and must promptly respond to all disenrollment requests;
  • The pharmacy must confirm at least annually that the patient still wishes to participate in the auto-refill program;
  • The pharmacy must promptly discontinue automatic fill program upon notification that the patient entered a skilled nursing facility or elected hospice coverage.

Please contact our firm for any assistance with drafting or modifying policies and procedures regarding auto-refill programs.


Back in 2017, the California Department of Healthcare Services (DHCS) approved a new methodology  – National Average Drug Acquisition Cost (NADAC) –  for reimbursing pharmacies for their drug cost. NADAC prices significantly reduced pharmacy reimbursements. See a related blog post.

For technical and financial reasons, the DHCS has not implemented the new reimbursement methodology until 2019. Only in 2020, it started sending notices of recoupment to pharmacies specifying the amounts owed.  For more than 2 years, the DHCS continued to pay pharmacies through the Medi-Cal claims processing system consistent with the rate methodology used prior to the NADAC implementation. This lead to overpayments to pharmacies.

Several pharmacists and patient advocacy groups filed legal actions against the DHCS and worked with legislature to eliminate these chargebacks to pharmacies. Finally, this week, the California Pharmacists Association  (CPhA) announced that Governor Newsom signed the State Budget forgiving $142 million in medication reimbursement clawbacks that the DHCS demanded from pharmacies.

We congratulate all pharmacies working with Medi-Cal patients, CPhA, and all other groups and individuals who were working on this important issue.


Earlier this year, a client reported a very smooth scam. Someone called the pharmacy and represented to be a California Board of Pharmacy inspector who was investigating an anonymous complaint against the pharmacy. The so-called “inspector” asked the pharmacy to provide its account number with Cardinal, which the pharmacy staff did. The scammer then contacted Cardinal and placed a large order for Invokana (the cost of around $90,000). The pharmacy received the order the next day.

Now the scammers called the pharmacy and introduced themselves as representatives from Cardinal. The “representative” explained that Cardinal made an error and erroneously shipped Invokana. They apologized and stated that their driver would arrive shortly to collect the erroneous shipment. For some fortunate reasons, the owner of the pharmacy called Cardinal with a follow up question and learned that the order was placed the day before and that no one from Cardinal called to arrange the collection. The owner of the pharmacy described the “scammer” to be very believable, who definitely knew the industry. (I am still wondering why the driver was not apprehended).

I thought that this was a stand-alone incident. Last week, however, the California Board of Pharmacy issued a Fraud Alert to all pharmacies describing a similar scam scheme:

“Pharmacies, hospitals, and distributors are being warned about scammers using sophisticated techniques to obtain account numbers and other sensitive information and unlawfully divert quantities of pharmaceutical goods in transit. In some cases, scammers pretended to represent the state’s board of pharmacy or employees for a particular distributor or pharmacy.

The callers requested and obtained each pharmacy’s DEA number and account purchasing information for their principal distributor. The scammers then called each distributor – pretending to be the pharmacy – and ordered between $100,000 and $300,000 worth of products. Common products ordered included a variety of HIV medications (Descovy, Triumeq, Odefsey) and Xarelto, Otezla, and Eliquis.

Once the products were delivered, the scammers called the pharmacy – pretending to be the distributor – and advised the pharmacy the order was made in error. The scammers then arranged for a courier to pick up the diverted product.”

The Board directs the pharmacies to the Healthcare Distribution Alliance Pharmaceutical Cargo Security Coalition’s (“Coalition”) report on the issue, which discusses methods being used to divert drug shipments and tips for protecting distributors and pharmacies. We highly recommend that your staff reads the report to be able to identify similar scams.

The report describes several phishing techniques targeting pharmacies:

– scammers represent themselves as Board of Pharmacy representatives asking for wholesaler account information stating that they need it for recall purposes

– scammers may pose as a manufacturer, informing the pharmacy that certain products must be replaced and a credit will be issued through the original wholesaler. The scammer then requests the pharmacy’s account information with the wholesaler in order to issue such a credit.

– scammers may also pretend to be a wholesaler representative and request the pharmacy to update its payment method by providing a new wire account.

The report explains that scammers are often females, very believable and often speak of some urgency or with authority.

The Coalition in its report recommends the following tactics to avoid potential phishing techniques:

  • Validate anything thought to be a suspicious email address:
  • Ensure any business phone number and/or address you are provided, in any type of account or credit modification/application matches a Yellow Pages “Reverse Lookup.”
  • Ask the caller for their name and phone number, hang up and call your wholesaler, manufacturer, or the Board of Pharmacy directly, requesting authentication.
  • All staff should be instructed not to share any confidential information with anyone calling into the pharmacy. It is important to remember that a distributor/manufacturer/Board will rarely, if ever, call you to request this type of private information.
  • Verify all orders. If you see an order that you haven’t placed, then fraud is likely.
  • Confirm wire payment requests before making any payment.
  • The only person that should be permitted to pick up returns should be your  wholesaler’s driver. Call your wholesaler if anyone, other than your regular driver/company, visits your site to pick up and process any return.

This is something we (those who own or work for independent pharmacies) have been waiting for. Finally someone was bold (and brave) enough to bring an action against a PBM on DIR fees. This someone is Aids Healthcare Foundation (“AHF”), a California non-profit, which owns and operates retail pharmacies that serve HIV/AIDS patients. While many were exploring a potential legal action against PBMs on DIRs fees, all ran into a problem that pharmacies contractually agree to such fees (and we have various court precedent enforcing PBM contracts of adhesion).

A little background on the case: AHF-affiliated pharmacies used LeaderNet (PSAO) to contract with Caremark. Sometime in 2019, the pharmacies terminated their relationships with LeaderNet and began contracting directly with Caremark on their own behalf. Instead of assessing a flat network fee – as Caremark did when the contract was administered by LeaderNet – it started to charge pharmacies a variable network fee range (e.g., 3-5%) depending on performance, with the higher performing pharmacies paying the lower fee and vice-versa. Caremark assessed these performance fees after the point of sale on a trimester basis.

Caremark calculated (and still calculates) such variable fees (DIRs) per the Provider Network Performance program’s (PNP) criteria such as:

  • Renin Angiotensin System (RAS) Antagonists Adherence
  • Statin Adherence
  • Diabetes Adherence
  • Specialty Adherence
  • GAP Therapy (Statin Use in Persons with Diabetes)
  • Comprehensive Medication Review (CMR)
  • Completion Rate (MTM), and
  • Formulary Compliance.

After November 2019, Caremark scored AHF-affiliated pharmacies in the aggregate. In other words, Caremark provided one Trimester Report for the entire chain instead of providing individual reports. AHF’s DIR Fees after November 2019 equated to 2.8 mil (!) on average per trimester. Caremark recouped these fees from future reimbursement payments to AHF.

As a result of these extensive damages, AHF took the risk and brought an arbitration for a breach of contract seeking recovery of damages, a declaration of non-enforcement and prohibition of the application of DIRs going forward, and attorneys’ fees and costs.

The arbitrator was presented with the following issues:

  • Did Caremark breach the contract with its application of DIR resulting in AHF being paid less than the contract required?
  • Did Caremark breach the contract by violating the covenant of good faith and fair dealing by implementing DIRs?
  • Was the imposition of the DIR procedurally unconscionable?
  • Is Caremark’s contract with AHF’s pharmacies an unenforceable contract of adhesion?
  • Should the DIRs be enjoined going forward?
  • What, if any, damages has AHF sustained?

Nine witnesses testified at the hearing and over 690 exhibits were entered into evidence. The hearing lasted five days. After the testimony phase, the parties engaged in two rounds of simultaneous briefing.

Unsurprisingly, Caremark’s main argument during the hearing was that AHF – which is an experienced healthcare provider with substantial bargaining power – has agreed to the terms of the contract and Caremark’s manuals. The arbitrator decided otherwise holding that Caremark is one of the largest PBMs and that a pharmacy would lose out on large amounts of business if it did not sign up with Caremark. AHF had no alternative if it wanted to serve Caremark’s members. The arbitrator stated in his decision:

“The growth in the range of the variable DIR’s demonstrates the unequal bargaining power. CVS and its plan partners had no competitive check on how much they increased the variable DIR rates. There was no valid business reason presented for the escalating growth in the percentages recouped, and this growth shows unchecked economic power.”

As a result, the arbitrator found the contracts between Caremark and AHF were adhesive. On the other hand, when AHF was contracting through its PSAO, the DIRs were fixed and thus knowable at the outset and at the point of sale. The arbitrator found these contract terms were not unconscionable. Thus, the fixed rate DIRs are enforceable but the variable DIR calculations were in the discretion of CVS and therefore, unconscionable and unenforceable.

The arbitrator brought an interesting point: some PNP criteria points were not within the control of the pharmacies. For example, pharmacies cannot change prescriptions (besides changes to therapeutically equivalents) and have no control over prescribers in order to comply with the criteria set by Caremark. In addition, some of Caremark’s calculations were arbitrary, such as applying some average of other pharmacies when there was no data available for AHF pharmacies.

Having found the variable DIR provisions to be substantively unconscionable, the arbitrator chose to limit the application of the variable DIR provisions and award damages to AHF in amount of 22 million (DIR fees paid to Caremark) plus attorneys’ fees and cost of arbitration.

While arbitration decision is final and there are usually no means to appeal, Caremark nonetheless filed a motion to Vacate or Correct the Arbitration Award and AHF filed a Petition to Confirm Contractual Arbitration Award in Superior Court of California for the County of Los Angeles. We will be watching the development of this case and will publish an update whenever there is any meaningful progress on the case.