Federal Laws Affecting Pharmacy Practice: FDCA, DSCSA, REMS, Privacy
FDCA basics
Prescription status is a federal designation; a drug is prescription-only unless it meets the statutory conditions for OTC status. Adulteration and misbranding are the two federal hooks, and labeling content, NDC identifiers, and approved indications all trace back to the Act. An unapproved new drug generally cannot be dispensed in ordinary practice except through limited pathways.
DSCSA
The Drug Supply Chain Security Act applies to dispensers, not just manufacturers and wholesalers. It requires authorized trading partners, transaction information, transaction history, and a transaction statement (the "T3"), a product identifier on packages, systems to detect and respond to suspect product and to quarantine and investigate illegitimate product, and handling of saleable returns and exceptions. Records must be retained for six years. Enhanced, serialized, interoperable exchange is the current baseline, not a future aspiration.
REMS
Risk evaluation and mitigation strategies may impose elements to assure safe use: prescriber and pharmacy certification, patient acknowledgment, laboratory monitoring, and restricted distribution. If the pharmacy or pharmacist is not certified, the drug cannot be dispensed - the prescription alone is not enough.
Privacy
HIPAA permits treatment, payment, and operations disclosures under the minimum necessary standard, requires business associate agreements, and grants patient rights to access, amendment, and an accounting of disclosures. Substance use disorder records under 42 CFR Part 2 require specific consent. HIPAA is not a blanket prohibition; questions that treat it as one are usually wrong.
Traps
- Assuming DSCSA obligations stop at the wholesaler.
- Dispensing a REMS drug while certification is pending.
- Treating HIPAA as forbidding all disclosures to family or other prescribers.
Rule of thumb: before dispensing an unusual product ask three questions - is the trading partner authorized, is the product verified, and does a REMS require something of me?
Worked example: a sealed case arrives with a broken seal and a lot number that does not match the invoice. Quarantine it, do not dispense, investigate, and notify trading partners and FDA as DSCSA requires.