Ariz. Admin. Code § R4-23-408 - Computer Records

A. Systems manual. A pharmacy permittee or pharmacist-in-charge shall:

1. Develop, implement, and comply with policies and procedures for the following operational aspects of a computer system:

a. Examples of all output documentation provided by the computer system that contains original or refill prescription order or patient profile information;

b. Steps a pharmacy employee follows when the computer system is not operational due to scheduled or unscheduled system interruption;

c. Regular and routine backup file procedure and file maintenance, including secure storage of backup files;

d. Audit procedures, personnel code assignments, and personnel responsibilities; and

e. Quality assurance mechanism for data entry validation;

2. Review biennially and, if necessary, revise the policies and procedures required under this Section;

3. Document the review required under subsection (A)(2);

4. Assemble the policies and procedures as a written manual or by another method approved by the Board or its designee; and

5. Make the policies and procedures available within the pharmacy for reference by pharmacy personnel and inspection by the Board or its designee.

B. Computer system data storage and retrieval. A pharmacy permittee or pharmacist-in-charge shall ensure the computer system is capable of:

1. Producing sight-readable information on all original and refill prescription orders and patient profiles;

2. Providing online retrieval (via CRT display or hard-copy printout) of original prescription order information required in A.R.S. § 32-1968(C), R4-23-402(A), and R4-23-407(A);

3. Providing online retrieval (via CRT display or hard-copy printout) of patient profile information required in R4-23-402(A);

4. Providing documentation identifying the pharmacist responsible for dispensing each original or refill prescription order, except a pharmacy permittee with a computer system that is in use before the effective date of this Section that cannot provide documentation identifying the dispensing pharmacist may continue to use the computer system by providing manual documentation identifying the dispensing pharmacist;

5. Producing a printout of all prescription order information, including a single-drug usage report that contains:

a. The name of the prescribing medical practitioner;

b. The name and address of the patient;

c. The quantity dispensed on each original or refill prescription order;

d. The date of dispensing for each original or refill prescription order;

e. The name or identification code of the dispensing pharmacist; and

f. The serial number of each prescription order; and

6. Providing a printout of requested prescription order information to an individual pharmacy within 72 hours of the request if prescription order information is maintained in a centralized computer record system.

C. A pharmacy permittee or pharmacist-in-charge of a pharmacy that uses a pharmacy computer system:

1. Shall notify the D.E.A. and the Board in writing that original and refill prescription order information and patient profiles are stored in a pharmacy computer system;

2. Shall comply with this Section if the pharmacy computer system's refill records are used as an alternative to the manual refill records required in R4-23-407(B);

3. Is exempt from the manual refill recordkeeping requirements of R4-23-407(B), if the pharmacy computer system complies with the requirements of this Section; and

4. Shall ensure that documentation of the accuracy of original and refill prescription order information entered into a computer system is provided by each pharmacist using the computer system and kept on file in the pharmacy for seven years from the date of the last refill. Documentation includes one of the following:

a. A hard-copy printout of each day's original and refill prescription order data that:

i. States original and refill data for prescriptions dispensed by each pharmacist is reviewed for accuracy;

ii. Includes the printed name of each dispensing pharmacist; and

iii. Is signed and initialed by each dispensing pharmacist; or

b. A log book or separate file of daily statements that:

i. States original and refill data for prescriptions dispensed by each pharmacist is reviewed for accuracy;

ii. Includes the printed name of each dispensing pharmacist; and

iii. Is signed and initialed by each dispensing pharmacist.

D. If a pharmacy computer system does not comply with the requirements of subsections (A), (B), and (F), the pharmacy permittee or pharmacist-in-charge shall bring the computer system into compliance within three months of a notice of noncompliance or violation letter. If the computer system is still noncompliant with subsection (A), (B), or (F) after three months, the pharmacy permittee or pharmacist-in-charge shall immediately comply with the manual recordkeeping requirements of R4-23-402 and R4-23-407.

E. If a pharmacy's personnel perform manual recordkeeping under subsection (D), the pharmacy's personnel shall continue manual recordkeeping until the pharmacist-in-charge sends proof, verified by a Board compliance officer, that the computer system complies with subsections (A), (B), and (F).

F. Security. To maintain the confidentiality of patient records, a pharmacy permittee or pharmacist-in-charge shall ensure:

1. The computer system has security and systems safeguards designed to prevent and detect unauthorized access, modification, or manipulation of prescription order information and patient profiles; and

2. After a prescription order is dispensed, any alteration of prescription order information is documented, including the identification of the pharmacist responsible for the alteration.

G. A computer system that does not comply with all the requirements of subsections (A), (B), and (F) may be used in a pharmacy if:

1. The computer system was in use in the pharmacy before July 11, 2001, and

2. The pharmacy complies with the manual recordkeeping requirements of R4-23-402 and R4-23-407.

H. Prescription records and retention.

1. Instead of filing the original hard-copy prescription order as required in A.R.S. § 32-1964, a pharmacy permittee or pharmacist-in-charge may use an electronic imaging recordkeeping system, if:

a. The system is capable of capturing, storing, and reproducing the exact image of a prescription order, including the reverse side of the prescription order if necessary;

b. Any notes of clarification of or alterations to a prescription order are directly associated with the electronic image of the prescription order;

c. A prescription order image and any associated notes of clarification of or alterations to the prescription order are retained for no fewer than seven years from the date the prescription order is last dispensed;

d. The original hard-copy prescription is maintained for no less than 30 days after the date dispensed;

e. d. Policies and procedures for the use of an electronic imaging recordkeeping system are developed, implemented, reviewed, and revised in the same manner described in subsection (A) and complied with; and

f. e. The prescription is not for a controlled substance.

2. If a pharmacy's computer system fields are automatically populated by an electronically transmitted prescription order, the automated record constitutes the original prescription order and a hard-copy or electronic image is not required if the computer system is capable of maintaining, printing, and providing all the prescription order information required in A.R.S. §§ 32-1968 and 36-2525 and R4-23-407(A) within 72 hours of a request by the Board, the Board's compliance officers, other authorized regulatory board agents, or authorized officers of the law.

I. A pharmacy permittee or pharmacist-in-charge shall make all prescription records available within 72 hours after a Board request.

Notes

Ariz. Admin. Code § R4-23-408

Adopted effective November 18, 1983 (Supp. 83-6). Amended by final rulemaking at 7 A.A.R. 646, effective January 11, 2001 (Supp. 01-1). Amended by final rulemaking at 9 A.A.R. 5030, effective January 3, 2004 (Supp. 03-4). Amended by final rulemaking at 11 A.A.R. 4270, effective December 6, 2005 (Supp. 05-4). Amended by final rulemaking at 12 A.A.R. 274, effective March 11, 2006 (Supp. 06-1). Amended by final rulemaking at 12 A.A.R. 3032, effective October 1, 2006 (Supp. 06-3). Amended by final rulemaking at 13 A.A.R. 440, effective April 7, 2007 (Supp. 07-1). Amended by final rulemaking at 26 A.A.R. 223, effective 3/14/2020.