Telepharmacy Remote Dispensing Site Security Risk Assessment Guide

How to Assess Security Risks at a Remote Dispensing Site

A remote dispensing site needs a security assessment that reflects its location, layout, drug inventory, staffing, technology, and the way patients and visitors move through the site. Requirements vary by state and by telepharmacy model, so use your state board of pharmacy’s current rules as the starting point—not a one-size-fits-all checklist.

Walk through the site and document risks to the building, dispensing and drug-storage areas, equipment, records, telepharmacy systems, and patient health information confidentiality. Consider theft, diversion, unauthorized entry, tampering, equipment failure, power or network outages, and the possibility that a patient or visitor could see or hear confidential information.

For each risk, record the affected asset or activity, the likelihood and potential impact, existing safeguards, remaining gaps, and the person responsible for corrective action. Reassess when the site changes, an incident occurs, technology is upgraded, or a new threat is identified. HIPAA-regulated entities must conduct an accurate and thorough assessment of risks to electronic protected health information; see 45 CFR § 164.308.

What Surveillance Coverage and Video Retention Are Required?

Federal HIPAA physical safeguards rules require appropriate facility access controls but do not set a universal telepharmacy camera layout or video retention period. State pharmacy rules may specify surveillance coverage, recording quality, retention, or live telepharmacy supervision, so confirm the requirements for the state and type of site.

As one state-specific example, Washington requires adequate visual surveillance of the full pharmacy and high-quality recordings retained for at least 30 calendar days for pharmacies covered by its rule for dispensing and delivering drugs without an on-site pharmacist. The rule also addresses system failures. See Washington Administrative Code 246-945-430.

Texas takes a different approach for telepharmacy systems: its rule requires continuous pharmacist supervision using audio and video, still-image capture, and store-and-forward technology, but does not state a general video-surveillance retention period in that provision. See the Texas State Board of Pharmacy rules, § 291.121(c).

For your site’s video surveillance retention period, document the applicable state requirement and configure storage so recordings are available for the full required period. Set camera views to cover relevant entrances and restricted work or storage areas while avoiding unnecessary capture of patient counseling, screens, or other confidential information. Limit access to footage, protect it from alteration or deletion, and preserve relevant recordings if an incident or investigation occurs.

How Should Entry and Access Records Be Monitored?

Use electronic access control logs where practical, with unique credentials rather than shared codes or keys. The records should show who entered, which restricted area they accessed, and when; document key issuance, returns, lost credentials, visitor entry, and any emergency access as well.

Set a review schedule based on risk and applicable law. The pharmacist-in-charge should review access records for unusual timing, repeated failed attempts, access by former personnel, and entries that do not match work schedules or assigned duties. Document the review, follow-up, and any corrective action. This pharmacist-in-charge access review is a recommended control unless a specific state rule makes it mandatory.

Keep physical access monitoring distinct from electronic system audit controls. HIPAA requires covered entities and business associates to implement procedures that limit physical access to facilities and systems, and to record and examine activity in systems that contain or use electronic protected health information. See 45 CFR § 164.310 and the HHS summary of the HIPAA Security Rule.

How to Restrict Access to Dispensing Areas and Stored Drugs

Separate public and visitor areas from dispensing workspaces and drug storage. Use locked doors, cabinets, or secured automated systems; limit access to people whose roles require it; and use escorts or sign-in procedures for visitors, contractors, and maintenance workers. Revoke access promptly when a person changes roles or leaves the organization.

For controlled drug storage safeguards, use the security measures required by applicable DEA and state rules, and maintain controls that deter and help detect theft or diversion. The DEA states that registrants must provide effective controls and procedures to guard against controlled-substance theft and diversion; consult the DEA guidance on security requirements and the regulations applicable to your registration.

State telepharmacy rules can add specific access requirements. For example, Texas requires drugs at a remote dispensing site to be stored in a locked area and limits access to specified personnel designated in writing by the pharmacist-in-charge who have completed documented training. See the Texas State Board of Pharmacy rules, § 291.121(c).

How to Protect Drugs, Equipment, Records, and Patient Confidentiality

Secure inventory, equipment, and records according to their sensitivity and the consequences of loss or unauthorized access. Keep drugs in required storage conditions and locked areas, reconcile inventory as required, and use tamper-evident transport and controlled handoffs where applicable. Secure computers, cameras, network devices, and other equipment against theft or unauthorized use.

Protect patient health information confidentiality by positioning screens and printers away from public view, locking unattended workstations, securing paper records, and limiting staff access to information needed for their duties. Review how cameras, video storage, access logs, and telepharmacy communications may capture or contain patient information, and restrict those records to authorized personnel.

HIPAA’s physical safeguards require covered entities and business associates to protect facilities and equipment from unauthorized physical access, tampering, and theft, and to secure workstations and electronic media that contain electronic protected health information. See 45 CFR § 164.310. HIPAA-required security documentation generally must be retained for six years from creation or the date it was last in effect, whichever is later; that rule does not itself establish a six-year video-retention period. See 45 CFR § 164.316.

What Should Written Site Security Procedures Include?

Write procedures that staff can follow during normal operations and emergencies. At a minimum, cover:

• Who may enter the site, dispensing area, drug storage, and system-control areas, and how access is approved, changed, and removed.
• Visitor, contractor, delivery, key, badge, and electronic credential controls, including how entry and access records are reviewed.
• Camera coverage, routine system checks, video access and retention, incident preservation, and response to equipment failure, consistent with state requirements.
• Drug receipt, storage, inventory reconciliation, transport, discrepancy reporting, and safeguards against theft or diversion.
• Protection of records, workstations, equipment, telepharmacy communications, and patient health information confidentiality.
• Incident reporting, escalation, evidence preservation, corrective action, and coordination between the remote site and provider pharmacy.
• Staff responsibilities and authorized personnel training documentation, including completion of site-specific security and system training.
• Review and testing of the procedures, including who owns each action and how updates are recorded.

HIPAA-regulated organizations must maintain written security policies and required documentation, review and update documentation as needed, and retain required documentation for the period specified in the rule. State pharmacy rules may add more specific operational requirements. For example, Texas requires covered telepharmacy procedures to be reviewed at least annually and documented, and requires a written plan for recovery from interruptions to electronic pharmacist supervision. See the Texas State Board of Pharmacy rules, § 291.121(c) and 45 CFR § 164.316.

When Must Operations Stop Because Security Systems Are Unavailable?

Do not assume dispensing may continue whenever a camera, communications link, access-control system, or telepharmacy platform fails. Identify which systems are legally required for your site’s model, define what counts as a failure, and specify who has authority to suspend operations and when service may resume.

Where a failure removes a required safeguard or prevents pharmacist supervision, stop the affected dispensing activity, secure drugs and records, notify the pharmacist-in-charge, and follow the written telepharmacy system downtime procedures. Resume only when required functions are restored or an alternative operating arrangement is explicitly permitted by applicable law.

State rules illustrate why a jurisdiction-specific plan matters. Texas requires its telepharmacy recovery plan to state that prescription drugs must not be dispensed at the remote site when a pharmacist cannot electronically supervise the system and dispensing. Washington requires covered pharmacies to close to the public if surveillance or the visual-and-audio communication system malfunctions, until repairs are completed or a pharmacist is on-site to oversee operations. See the Texas State Board of Pharmacy rules, § 291.121(c) and Washington Administrative Code 246-945-430.

In short, assess site-specific risks, verify state requirements for surveillance and access, protect drugs and patient information, and define clear shutdown and recovery steps. Treat the applicable pharmacy board rules as controlling for your site, since requirements such as video retention and downtime closure are not uniform nationwide.

FAQs

How often must surveillance operate at a remote dispensing site?

There is no single federal operating schedule for remote-site surveillance that applies to every telepharmacy model. Follow the state rule for your site and the approved system’s requirements. For example, Washington requires adequate visual surveillance of the full pharmacy for sites covered by its rule, while Texas requires continuous pharmacist supervision of a telepharmacy system during open hours using specified electronic technologies. See the Washington rule and the Texas rule.

How long must security video be retained?

Retention periods depend on the applicable state rule and site type; HIPAA does not establish one universal telepharmacy video-retention period. Washington, for example, requires a minimum of 30 calendar days of high-quality recordings for pharmacies covered by its rule for dispensing and delivering drugs without an on-site pharmacist. Verify the current requirement with your state board and preserve footage longer when required for an incident or investigation.

Who may access the dispensing area and stored drugs?

Only personnel authorized under the applicable state rules and designated according to their duties should access restricted areas and stored drugs. Texas, for example, limits access at a telepharmacy remote site to specified personnel and requires authorized individuals to be designated in writing by the pharmacist-in-charge and to complete documented training. See the Texas State Board of Pharmacy rules, § 291.121(c).

Can dispensing continue if required surveillance or telepharmacy systems are not functioning?

Not if the outage makes a required safeguard or pharmacist supervision unavailable and no lawful alternative applies. Texas requires no dispensing at a telepharmacy remote site when electronic pharmacist supervision is unavailable; Washington requires covered sites to close to the public when specified surveillance or communication systems malfunction, unless a pharmacist is on-site to oversee operations. Follow your state-specific downtime plan and confirm the conditions for resuming service.