CHAPTER 117 - PRESCRIPTION INFORMATION PRIVACY ACT
Title 44 - Health
CHAPTER 117.
PRESCRIPTION INFORMATION PRIVACY ACT
ARTICLE 1.
PRESCRIPTION INFORMATION PRIVACY ACT
SECTION 44-117-10. Short title.
This chapter may be cited as the "Prescription Information Privacy Act".
SECTION 44-117-20. Definitions.
As used in this chapter:
(1) "Patient prescription drug information" means data that is conveyed by or on behalf of a practitioner in ordering a prescription drug or device before being dispensed and that identifies the patient as the recipient of the prescription drug or device. The term also includes any data concerning the dispensing of a drug or device that identifies a patient as having been the recipient of a prescription drug or device, whether this data is held by a practitioner, pharmacy, or another entity.
(2) "Practitioner" means a licensed health care professional authorized under state law to order a prescription drug or device.
(3) "Prescription drug or device" means a drug or device that is dispensed pursuant to the order of a practitioner.
SECTION 44-117-30. Prescription drug information transfer and receipt; exceptions.
No patient prescription drug information may be transferred or received by a person without the written consent of the patient or a person authorized by law to act on behalf of the patient. However, this prohibition does not apply to:
(1) the lawful transmission of a prescription drug order in accordance with all state and federal laws pertaining to the practice of pharmacy.
(2) communications among licensed practitioners, licensed pharmacists, and other health care professionals who provide or have provided medical or therapeutic treatment, pharmacy service, or medical or therapeutic consultation service for the person who received the drug or device;
(3) information gained as a result of a person requesting informational material from a prescription drug or device manufacturer or vendor;
(4) information necessary to effect the recall of a defective drug or device or other information necessary to protect the health and welfare of an individual or the public generally;
(5) information whereby the release or transfer is mandated by other state or federal laws, court order, or subpoena, or regulations including, but not limited to, accreditation or licensure requirements;
(6) information necessary to adjudicate or process payment claims for health care, whether under a health insurance benefits program or other payment system, if the recipient makes no other use or further disclosure of the information;
(7) information voluntarily disclosed by a patient to entities outside of the provider-patient relationship;
(8) information used in clinical research monitored by an institutional review board;
(9) information which does not identify patients by name, or that is encoded in a manner that information identifying a particular patient by name or address is not generally obtainable, and that is used for epidemiological studies, research, statistical analysis, medical outcomes, or pharmacoeconomic research;
(10) information transferred in connection with the sale of a business or medical practice to a successor in interest;
(11) information necessary to disclose to third parties in order to perform quality assurance programs, medical records review, internal audits, medical records maintenance, or similar programs, if the third party makes no other use or further disclosure of the information;
(12) information that may be revealed to a party who, on behalf of the patient, obtains a dispensed prescription from a pharmacy;
(13) information necessary to disclose to third parties in order for a health plan licensed by the South Carolina Department of Insurance to perform case management, utilization management, and disease management for individuals enrolled in that health plan, if the third party makes no other use or further disclosure of the information.
SECTION 44-117-40. Violations and penalties.
An individual or entity, corporate or otherwise, who knowingly violates a provision of this chapter is guilty of a misdemeanor and, upon conviction, must be fined not more than ten thousand dollars per occurrence.
SECTION 44-117-50. Application; certain laws and authority not invalidated.
This chapter does not invalidate:
(a) any other provision of law concerning medical records or patient prescription drug information, the alteration of medical records or patient prescription drug information, any interest a patient has in the information contained within the medical record or patient prescription drug information, or any civil action brought in the state or federal courts alleging negligence by a practitioner or pharmacist;
(b) the authority of a court to issue a subpoena for medical records and patient prescription drug information;
(c) the authority of a licensing or disciplinary board of this State to obtain these records as provided by law; or
(d) the authority of the Department of Health and Environmental Control to obtain medical records or patient prescription drug information as provided by state and federal law.
ARTICLE 3.
ELECTRONIC PRESCRIPTION PROCESSING
SECTION 44-117-310. Definitions.
As used in this article:
(1) "Board" means the State Board of Pharmacy.
(2) "Confidential information" has the same meaning as provided in Section 40-43-30(8).
(3) "Digital signature" means an electronic signature based upon cryptographic methods of originator authentication and computed by using a set of rules and set of parameters so that the identity of the signer and the integrity of the data can be verified.
(4) "Electronic signature" means an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.
(5) "Electronic transmission" means transmission of information by electronic means, including computer to computer, computer to facsimile machine, electronic device to computer, e-mail, or the transmission of the exact visual image of a document by way of electronic equipment.
(6) "Practitioner" means a health care professional licensed in this State who is authorized by law to issue prescription drug orders.
(7) "Prescription" or "prescription drug order" means a lawful order of a practitioner for a drug or device for a specific patient that is communicated to a pharmacist.
(8) "Routing company" means a business that electronically receives a prescription or any other confidential information from a prescriber and transmits the prescription or confidential information to or from the pharmacy specified by the patient in accordance with a contract between the routing company and the prescriber or a company that provides computer software for the management of the prescriber's practice.
SECTION 44-117-320. Electronic transmission of prescriptions; required conditions; use of routing company.
(A) A practitioner may electronically transmit a prescription to a pharmacy if all of these conditions are met:
(1) A valid practitioner/patient relationship must exist.
(2) The prescription must identify the transmitter's phone number, the time and date of transmission, and the pharmacy intended to receive the transmission and any other information required by federal or state law.
(3) The prescription must be transmitted by the authorized practitioner or the practitioner's designated agent to the pharmacy of the patient's choice, and the prescription must be received only by a pharmacy, with no intervening person or entity having access to view, read, manipulate, alter, store, or delete the electronic prescription prior to its receipt at the pharmacy.
(4) The prescription must be transmitted to the pharmacy of the patient's choice. If the pharmacy of the patient's choice is not equipped with the capability to accept an electronic prescription, the practitioner shall provide the patient with a written prescription, telephone an oral prescription, or transmit via facsimile to the pharmacy of the patient's choice.
(5) The prescription must have the practitioner's electronic or digital signature or key code.
(6) The prescription must be sent directly from the practitioner to the receiving pharmacy of the patient's choice. If an electronic prescription is printed out, it must possess an original handwritten signature before being delivered to a patient. If a prescription is a hard copy prescription drug order generated from electronic media, a prescribing practitioner's electronic or manual signature must be present. Prescriptions with electronic signatures must be applied to paper that utilizes security features that will ensure the prescription drug order is not subject to any form of copying or alteration.
(B) An electronically transmitted prescription is deemed the original prescription drug order if it meets the requirements of this article and other applicable laws and regulations.
(C)(1) Nothing in this article may be construed to prohibit a practitioner from using a routing company to transmit a prescription pursuant to this article, except that a routing company shall provide its tax identification number to the Board of Pharmacy before offering its services in this State.
(2) A routing company:
(a) may, for the purpose of verifying an audit conducted of the routing company, store any prescription or other confidential information it receives or transmits pursuant to this article in a form that is secure and ensures the confidentiality of the information in compliance with federal and state privacy law; and
(b) may not add a provision to, delete a provision from, or otherwise modify a prescription or any other confidential information that it receives or transmits pursuant to this article.
SECTION 44-117-330. Electronic equipment for receipt of prescription drug orders; security; alterations to prescription drug order data.
All electronic equipment for receipt of prescription drug orders communicated by way of electronic transmission must have adequate security and system safeguards and must be maintained so as to ensure patient confidentiality and to ensure against unauthorized access or an intervening person or entity having access to view, read, manipulate, alter, store, or delete the electronic prescription prior to its receipt by the pharmacy of the patient's choice. The pharmacist shall exercise professional judgment regarding the accuracy, validity, and authenticity of the prescription drug order consistent with existing federal or state laws and regulations. Once the drug has been dispensed, any alterations in prescription drug order data must be documented, including the identification of the pharmacist responsible for the alteration.
SECTION 44-117-340. Applicability of laws and regulations for oral prescription drug orders; records; location of facsimile machine.
(A) All laws and regulations applicable to oral prescription drug orders apply to all computer to computer, computer to facsimile machine, electronic device to computer, e-mail, or the transmission of the exact visual image of a document by way of electronic equipment prescription orders.
(B) A prescription order transmitted by computer to computer, computer to facsimile machine, electronic device to computer, e-mail, or the transmission of the exact visual image of a document by way of electronic equipment must contain all prescription information required pursuant to Section 40-43-86(E) and federal and state law.
(C) A practitioner or practitioner's agent shall note any generic substitution instructions on the electronic prescription order transmitted computer to computer, computer to facsimile machine, electronic device to computer, or e-mail. Such electronic prescription order may follow the format provided for in Section 40-43-86(H)(3) or any other format that clearly indicates the generic substitution instructions.
(D) A pharmacist may dispense prescription orders transmitted by computer to computer, computer to facsimile machine, electronic device to computer, e-mail, or the transmission of the exact visual image of a document by way of electronic equipment only when a valid patient/physician relationship exists and the prescription has been signed by the prescribing practitioner and transmitted from the practitioner or a long-term care facility in compliance with all sections of this article.
(E) The original document must be assigned the number of the prescription dispensed and maintained in the pharmacy records for at least two years.
(F) The facsimile machine receiving prescription drug orders must be in the prescription department of the pharmacy to protect confidentiality and security.
SECTION 44-117-350. Protection of confidentiality of prescription information.
(A) Prescription information and other patient health care information received by a pharmacy must be maintained in a manner that protects the integrity and confidentiality of such information as provided by the State Board of Pharmacy in regulation.
(B) A pharmacy shall provide a mechanism to prevent the disclosure of any information, confidential or otherwise, about patients that was obtained or collected by a pharmacist or pharmacy incidental to the delivery of pharmaceutical care other than as authorized in regulation.
(C) The pharmacist-in-charge shall:
(a) establish and maintain written policies and procedures for maintaining the integrity and confidentiality of prescription information and patient health care information. All employees of the pharmacy with access to this information must be required to comply with the established policies and procedures.
(b) ensure that the requirements of this section are established and implemented.
SECTION 44-117-360. Improper revealing of confidential information.
The board may refuse to issue or renew, or may suspend, revoke, restrict the license or the registration of, or fine its licensees, routing company, or other entity subject to their jurisdiction for each incident that allows the divulging or revealing of confidential information to a person other than a person authorized by this article or any other provision of law or for each incident allowing an intervening person or entity to have access to view, read, manipulate, alter, store, or delete the electronic prescription before it is received by the pharmacy. For all other licensees, the board must refer the matter to the board of appropriate jurisdiction.
SECTION 44-117-370. Pharmacist providing prescriber or health care provider with modem; hospital exception.
A pharmacist or pharmacy must not provide a computer modem or other similar electronic device to a prescriber, health care facility, or any other third party or provider entity for the purpose of providing an incentive to the practitioner, health care facility, or third party or provider entity that refers patients to a particular pharmacy or department. This does not prohibit a hospital from providing in-house equipment for the use of practitioners and the hospital pharmacy to communicate within the system.
SECTION 44-117-380. Compliance with South Carolina Pharmacy Practice Act.
Entities that offer electronic services for a pharmacist or pharmacy must comply with Section 40-43-86(F) of the South Carolina Pharmacy Practice Act.