Georgia Telepharmacy Remote Dispensing Site Logs: Privacy Laws Checklist

Which Georgia telepharmacy records must remote dispensing sites maintain?

Georgia’s rules distinguish remote prescription processing from dispensing at a remote location. Under Georgia Board of Pharmacy Rule Chapter 480-36, remote prescription drug order processing means reviewing or handling prescription information away from the location where the prescription is physically received and dispensed; the remote pharmacist does not dispense the medication to the patient. The primary dispensing pharmacy remains responsible for required pharmacy records.

For each remotely processed prescription, the primary dispensing pharmacy must keep retrievable records showing each processing function, the identity of the pharmacist or pharmacy technician who performed it, and the pharmacist who checked it. Prescriptions processed by a secondary pharmacist must be separately identifiable and retrievable for inspection. These requirements supplement other applicable Georgia Board of Pharmacy telepharmacy rules and state and federal recordkeeping obligations.

Maintain the underlying prescription dispensing records and patient profiles as well as the remote-processing log. Georgia’s dispensing-record rule specifies required transaction details, and its patient-record rule requires a retrievable patient profile. Keep written policies and procedures for remote processing, including responsibilities, confidentiality and integrity safeguards, and procedures for maintaining required records.

What information should the remote dispensing site log include?

Georgia Rule 480-36-.05 specifically requires the remote-processing log to identify each function and the person who performed and checked it. A practical log can also record the prescription number, date and time, the primary pharmacy and remote location, and any correction or escalation. Those additional fields are useful documentation practices, not all separately stated fields in that rule.

Keep the required prescription dispensing details in the pharmacy’s prescription record, rather than assuming the remote-processing log replaces it. Georgia Rule 480-27-.03 requires dispensing records to include the quantity dispensed, dispensing date, prescription serial number or equivalent, identity of the responsible pharmacist, drug-product-selection documentation, and refill dates and pharmacist identification. For electronic systems, Rule 480-27-.05 lists additional information, including patient and prescriber details, drug, strength and dosage form, directions, and authorized refills.

Patient identifiers and medication information belong in the pharmacy record when required for care and documentation. A log used for audit or workflow purposes should include only the information needed for its purpose and link to the full prescription record securely when more detail is required.

How long must Georgia telepharmacy records be retained?

Georgia Rule 480-36-.05 requires remote-processing records to be readily retrievable through the primary dispensing pharmacy for at least two years. Under Rule 480-27-.03, original and refill dispensing records must generally be kept for two years; the patient-record rule sets a minimum of two years from the last entry in the profile.

Apply the retention period that governs each record type, and check whether another applicable state or federal rule, contract, or legal hold requires longer retention. HIPAA does not impose a general six-year retention period on every medical or prescription record. Rather, HIPAA requires covered entities and business associates to retain specified HIPAA compliance documentation for six years from its creation or the date it was last in effect, whichever is later, under 45 CFR § 164.316.

Who may access telepharmacy logs and patient records?

Access should be limited to personnel who need the information for their work, such as authorized pharmacists and pharmacy staff involved in processing, checking, dispensing, or patient care. Role-based access controls, unique user accounts, and periodic access reviews are sound ways to support that limitation; HIPAA’s Security Rule requires access controls and unique user identification for electronic protected health information when the pharmacy is a covered entity or business associate.

Georgia law treats information in a patient medication record or profile as confidential. Under O.C.G.A. § 26-4-80(d), it may be released to the patient or authorized representative, the prescriber or other licensed health care practitioners then caring for the patient, another licensed pharmacist, the Board or its representative, and other persons duly authorized to receive it. Other disclosures generally require the patient’s written release, a court order, or a subpoena, subject to applicable law.

The Georgia Board of Pharmacy or its representative may inspect the required remote-processing records. The rules also require prescriptions processed by a secondary pharmacist to be retrievable upon request by a Georgia Drugs and Narcotics Agency agent during inspection. Verify the requester’s authority and disclose records through approved, secure procedures.

How do HIPAA and Georgia privacy laws protect telepharmacy information?

HIPAA applies to covered entities and business associates handling protected health information. Its Privacy Rule governs permitted uses and disclosures, while the Security Rule requires safeguards for electronic protected health information. Georgia pharmacy law separately protects patient medication-record and profile information and limits who may receive it.

Where HIPAA’s minimum-necessary standard applies, covered entities must make reasonable efforts to limit use, disclosure, and requests for protected health information to what is needed for the purpose. The standard does not apply to disclosures to or requests by a health care provider for treatment purposes, among other exceptions. See the HHS guidance on the HIPAA minimum-necessary standard.

For electronic information, HIPAA’s Security Rule requires access controls, including unique user identification, and audit controls that record and examine activity in systems containing or using electronic protected health information. See 45 CFR § 164.312. These requirements work alongside Georgia’s confidentiality rules; HIPAA should not be treated as a reason to disclose patient information when Georgia law restricts the disclosure.

What procedures support secure record storage and disclosure?

Adopt and follow written procedures that identify the primary dispensing pharmacy’s and remote pharmacist’s responsibilities, authorized users, permitted disclosures, retention periods, and steps for responding to inspection requests. Georgia Rule 480-36-.04 specifically requires written procedures addressing confidentiality and integrity of patient information and maintenance of required records.

• Use unique accounts and role-based permissions; promptly update access when an employee’s duties change or employment ends.
• Keep electronic records retrievable and readable for inspection. Georgia’s electronic record rules specify retrieval and backup requirements; follow the requirements that apply to the system and record type.
• Protect paper files and devices from unauthorized access, and use secure transmission methods when sharing records.
• Document log access and disclosures, including the recipient, purpose, date, and legal basis where appropriate.
• Maintain a process for system outages, secure backups, and preserving records if a service-provider relationship ends.

In short, keep the remote-processing log distinct from required prescription dispensing records, retain each record for its applicable period, and make access and disclosure decisions under both Georgia confidentiality law and applicable HIPAA requirements.

FAQs.

Do Georgia telepharmacy sites have to maintain dispensing logs?

Georgia requires the primary dispensing pharmacy to maintain retrievable records of each remotely processed prescription, including each processing function and the identity of the person who performed it and the pharmacist who checked it. Separately, pharmacies must maintain prescription dispensing records under Rule 480-27. The applicable remote-processing rule describes processing away from the dispensing location; it does not define that remote pharmacist’s work as dispensing medication.

How long must a Georgia remote dispensing site keep pharmacy records?

Remote-processing records must be readily retrievable through the primary dispensing pharmacy for at least two years under Rule 480-36-.05. Other pharmacy records have their own requirements; for example, dispensing records generally must be kept for two years, and patient profiles for at least two years from the last entry. HIPAA’s six-year period applies to specified compliance documentation, not automatically to every pharmacy or patient record.

Can remote dispensing site logs contain patient identifiers?

Yes, when identifiers are needed for required prescription processing, dispensing documentation, patient safety, or retrieval. Georgia rules require patient information in pharmacy records and require remote prescriptions to be separately identifiable and retrievable. Protect those identifiers and limit access and disclosure according to applicable privacy requirements.

Who can inspect Georgia telepharmacy records?

The Georgia Board of Pharmacy or its representative may inspect the required remote-processing records, and a Georgia Drugs and Narcotics Agency agent may request separately identifiable records of prescriptions processed by a secondary pharmacist during an inspection. Patient information may also be disclosed to other recipients authorized by Georgia law or otherwise permitted by applicable law.