A Broken Tamper Seal, 47 Missing Tablets, and an Officer Without a Warrant
Tuesday at your Albuquerque pharmacy. A distributor's tote of apixaban arrives: the DSCSA transaction information is incomplete for two of twelve bottles, and one carton's tamper seal is broken with a lot number that does not match the packing slip. That afternoon a technician reports that the perpetual inventory for oxycodone 15 mg tablets is 47 tablets short of the calculated balance, and no invoices, returns, or dispensing records explain the gap. At 4 p.m. a uniformed police officer, with no warrant, asks for the dispensing history of a patient he names; he says the patient is a suspect in a theft. The store manager wants to "just print it, we're helping the police."
1. How do you handle the apixaban shipment under DSCSA?
Read the worked answer
Both problems make the apixaban suspect product under DSCSA (21 U.S.C. 360eee-1), and suspect product is not dispensed.
Steps:
- Quarantine the affected bottles and the carton; segregate from saleable stock. Do not return them to the shelf.
- Investigate: verify lot, expiration, and NDC against the packing slip and the manufacturer; confirm that the transaction information, transaction history, and transaction statement are complete and internally consistent; contact the trading partner about the missing data.
- If the investigation establishes the product is not illegitimate - for example, a data gap the partner resolves with a corrected document - you may release it, with the investigation and correction documented.
- If you cannot establish that the product is not illegitimate, treat it as illegitimate product: notify FDA and your immediate trading partners within 24 hours, using Form 3911 or the process FDA specifies, and do not distribute it further.
- Retain the file. DSCSA records must be kept six years, and the inspector will ask for the investigation record, not for your recollection.
A broken tamper seal plus a mismatched lot number is the exact combination that must never be resolved with "it's probably fine."
2. The oxycodone count is 47 tablets short. What is your reporting and investigation obligation?
Read the worked answer
Treat the shortage as possible diversion until the audit says otherwise.
- Recount and reconcile: perpetual inventory, invoices and receipts, dispensing records, partial fills, transfers, witnessed destructions, and returns. Include the possibility of a keying error - a dispensed quantity entered incorrectly is a common cause of a phantom shortage.
- If the gap survives the audit, it is a loss. The DEA registrant must notify the local Field Division in writing and complete DEA Form 106 within one business day of discovery (21 CFR 1301.76(b)). Do not wait for the month-end count.
- Notify local law enforcement and the New Mexico Board of Pharmacy. Internal diversion is reportable, and prompt notice is what boards expect.
- Secure the remaining stock, review who has keys and system access, pull camera coverage, and consider whether any dispensed prescriptions must be corrected or patients contacted.
- Document everything. If the shortage turns out to be an accounting error, document the reconciliation rather than filing a Form 106 for a loss that did not occur.
A shortage you find and report is a compliance event; a shortage you cover up becomes a diversion scandal.
3. The officer asks for the patient's dispensing records. What do you do, and what documentation matters?
Read the worked answer
Not on this request.
- Under HIPAA (45 CFR 164.512(f)), disclosure to law enforcement requires a warrant, a court order, a grand jury subpoena, or an administrative subpoena meeting the regulation's criteria. A verbal request, a badge, and a sympathetic manager do not qualify.
- Verify the officer's identity and the authority he is actually relying on. If valid authority is presented, disclose only the minimum necessary - not the entire profile "while we're in there."
- Log the request and your response, including a denial. A written record of a lawful refusal protects the pharmacy.
- Distinguish this from a Board of Pharmacy or DEA inspection: those agencies have statutory authority to inspect controlled substance records and the premises, and refusing a valid inspection is its own violation. A police officer's records request is a different legal animal.
- Route the request to the pharmacist-in-charge and counsel before anything is copied.
"We're helping the police" is how a HIPAA breach and a Board complaint begin.