Five Privacy Habits for Clinics That Send Prescriptions to a Pharmacy

Why October is a good time to look

October is Cybersecurity Awareness Month, and most clinics spend it on passwords and phishing training. It is also a good month to look at a quieter part of the workflow: what happens to patient information when a prescription leaves your practice for an outside pharmacy.

When your clinic or platform sends a prescription to a pharmacy, patient data moves with it. The pharmacy you choose becomes part of how your organization meets its privacy obligations. None of the habits below is complicated, and each one is easier to set up before your first order than after your hundredth.

1. Send prescriptions through a secure channel, never ordinary email

The single most useful habit is also the simplest. Prescriptions and the details that come with them should travel through a channel built for protected health information, not an inbox.

ProCompounding receives prescriptions by direct API connection, e-prescribing, our provider portal or secure fax. Please do not send protected health information to us by ordinary email. If a staff member is unsure which route to use, that is a question to settle during onboarding, not on a busy afternoon.

2. Send what the prescription needs

A complete prescription, the patient's shipping address and a way to reach the patient are what a pharmacy needs to fill an order. Full chart notes, unrelated lab results and long intake histories usually are not. Sharing only what the task requires is good privacy practice, and it keeps your team's workload down too.

If our pharmacist needs more information about a prescription, we will contact your prescriber and ask for it.

3. Know who to call

Every pharmacy that handles your patients' information should be able to name its privacy contact. Ask for that name, and give the pharmacy yours, so a question or an incident goes straight to the right person.

Our Privacy Officer is Perry Ripple, Pharm.D., reachable at 423-975-0597.

4. Know where patients send their privacy requests

Patients your organization sends to a pharmacy keep the rights described in that pharmacy's Notice of Privacy Practices: to request restrictions, to ask for confidential communication, to see and copy their records, to ask for corrections, and to receive an accounting of disclosures.

Your support staff do not need to handle these requests themselves. They can point patients directly to the pharmacy. Our HIPAA Notice of Privacy Practices sets out those rights in full.

5. Settle the paperwork during onboarding

Your organization may have its own agreements and diligence questionnaires that a pharmacy partner needs to complete. Raise them early. During onboarding, our provider support team will review your agreement and confirm what we can execute before your first order.

How we handle patient data

Our page on pharmacy HIPAA compliance summarizes our practices in plain language: secure prescription intake, minimum-necessary access for staff, workforce privacy training and breach procedures. It is written for the person on your team doing the diligence.

ProCompounding is a PCAB-accredited 503A compounding pharmacy in Johnson City, Tennessee, licensed in all 50 states and the District of Columbia. To see how a program works with us, read about compounding fulfillment for telehealth clinics. When your team is ready, start clinic onboarding and send us your questionnaire.

This article is general information for clinics and is not legal advice.