| To submit a legal/professional nursing question for future consideration, write to the editor at syox@medscape.net (Include "Ask the Expert" in subject line.) |
Question
A pharmacist detects a prescription for hydrocodone, forged with a nurse practitioner's signature. Opinions differ on what action to take. Does the law help?
 |
Response from Carolyn Buppert, MSN, JD Healthcare attorney |
A Suspicious Prescription
The following scenario poses a problem that could be encountered by any pharmacist or prescriber of controlled drugs. Read it and see what you think—but be warned: the appropriate course of action is far from simple or straightforward.
A pharmacist suspected that a prescription for hydrocodone, presented by a new customer, was fake. The prescription contained the signature of a nurse practitioner. The pharmacist called the medical office and communicated his concerns. Neither the primary care physician nor the nurse practitioner had written the prescription. The patient had been seen in the practice and was on hydrocodone but was not due for a refill, and the patient usually used a different pharmacy.
The patient had a chronic pain medication contract with the practice. In the contract, the patient had agreed to use only one pharmacy. Furthermore, the patient had failed several urine toxicology tests, which were negative, suggesting that the patient was not taking hydrocodone but was supplying the drug to someone else. This also violated the patient's contract.
The nurse practitioner whose signature was used had never written a prescription for the patient, and it is unknown how the nurse practitioner's signature got onto the prescription. The physician told the patient that he would no longer be prescribing controlled drugs for him and referred him to a pain specialist. No other action was taken. The nurse practitioner whose name was used wants further investigation. The physician has declined to do so, stating that reporting the patient to the police should be done by the pharmacy. Neither the physician nor the pharmacist wants to be further involved. What can the nurse practitioner do?
If this happened to you, your inclination probably would be to call—someone. But who do you call? The answer to this question may seem simple, but I found that it is not. I cannot provide crystal-clear direction on what the nurse practitioner should do in this situation, but I will give the best recommendations I can, given the current state of the law.
These questions need answers:
What is the offense of signing a clinician's name to a prescription, when one is not the individual with prescriptive authority?
Does federal or state law require any report of forgery or alteration of a prescription? If so, by whom and to whom?
Does federal or state law allow any reporting? If so, by whom and to whom?
Does the Health Insurance Portability and Accountability Act (HIPAA) apply?
Is there a HIPAA exception that allows the nurse practitioner to report the unauthorized use of her name to law enforcement?
Forgery and Uttering
Under most states' laws, the act of signing someone else's name or altering a document is forgery. The act of offering a forged document to another when the person offering knows the document is forged is called uttering. Some state laws specifically address forging a prescription. For example, in California, it a crime to forge or alter a prescription, sign someone else's name on a prescription, or possess drugs obtained by forged prescription.[1]
Both forgery and uttering are felonies, but categorization depends on state law and on the degree of the offense. Low-level forgery may be a misdemeanor. Two things must be proven, at least in California. One is that a person has forged, uttered, or otherwise altered a prescription for a drug or drugs. The other is that the false prescription was for a drug of a narcotic nature. If convicted, both forgery and uttering call for prison time, from 6 months to 20 years.
Federal law makes it an offense to falsify prescriptions by misrepresentation, fraud, forgery, deception, or subterfuge to obtain substances not intended by the prescriber.[2]
Obviously, we are talking here about a serious crime. The person who presented the prescription may or may not have forged the nurse practitioner's signature. Someone else may have altered a legitimate prescription with the nurse practitioner's legitimate signature to obtain controlled drugs. But the person who presented the prescription to the pharmacist could be charged with uttering, at minimum, and possibly with forgery and uttering. It would be law enforcement's job to investigate and a prosecutor's job to make a specific charge.
Furthermore, one can argue that the use of the clinician's name is identity theft. According to the US Department of Justice website, "Identity theft and identity fraud are terms used to refer to all types of crime in which someone wrongfully obtains and uses another person's personal data in some way that involves fraud or deception, typically for economic gain."[3] The Department of Justice recommends reporting identity theft to the Federal Trade Commission, although that hardly seems like the correct choice for the nurse practitioner in this scenario.
To decline to report such a serious crime may encourage the individual who forged the prescription and the individual who delivered the prescription to do it again. It is possible for a clinician to find him- or herself in trouble for prescribing inappropriately when the clinician didn't even write the problematic prescriptions. So a prescriber has a personal interest in stopping unauthorized use of the prescriber's name.
Numerous government documents call on prescribers to detect and prevent drug diversion. Here is an excerpt from a Centers for Medicare & Medicaid Services document called "What Is a Prescriber's Role in Preventing the Diversion of Prescription Drugs?":
Physicians and other prescribers often have the first opportunity to identify, control, and report drug diversion. If a prescriber suspects that drug diversion has occurred, the activity should be documented and a report should be made. Notify the US Department of Health and Human Services, Office of Inspector General; local law enforcement; or local fraud alert networks of suspected drug diversion. To report theft or loss of controlled substances, notify the [Drug Enforcement Agency] DEA.[4]
How should suspected drug diversion be reported? If a prescriber suspects that drug diversion has occurred, the activity should be documented and a report should be made. The agencies that should be notified for suspected drug diversion include:
Local law enforcement and local fraud alert networks
For reporting theft or loss of controlled substances, notify the DEA Office of Diversion Control.
Health and Human Services Office of the Inspector General (HHS-OIG) national hotline, by calling 1-800-HHS-TIPS (1-800-447-8477) or TTY 1-800-377-4950 or by visiting the HHSOIG website.
For information on fraud prevention and detection compliance guidance, visit HHS-OIG.
However, in this scenario, drug diversion has not occurred, because the pharmacist didn't fill the prescription. So, what law applies here?
Federal Law on Reporting
The crimes that probably have occurred here (although still to be proven) are forgery and uttering. Surprisingly, there is no federal requirement for a pharmacist, physician, physician assistant, or nurse practitioner to report forgery or uttering to law enforcement. The DEA, on the agency's website, urges pharmacists who think that a prescription is forged to call local police. "If you believe that you have a forged, altered, or counterfeited prescription—don't dispense it—call your local police."[5] And the DEA recommends that practitioners contact the nearest DEA field office to obtain or furnish information about "suspicious prescription activities." However, the DEA does not require a report.
So the question becomes, may a pharmacist or prescriber report the forgery of one's own signature by a patient?
State Law on Reporting
A few states have laws on reporting forged prescriptions by pharmacists, and fewer states have laws on reporting by prescribers. Here are some states' laws, provided by the National Alliance for Model State Drug Laws:
Colorado: A pharmacist may disclose patient information to authorized law-enforcement personnel consistent with federal privacy regulations.
Florida: Requires a pharmacist to report to law enforcement within 24 hours any instance in which a person obtained or attempted to obtain a controlled substance through fraudulent means and further provides that failure to do so is a misdemeanor.
Kentucky: A pharmacist may seize and retain any prescription that he or she has a reasonable suspicion is forged, altered, or possessed in violation of law. Seizure and retention shall be for a reasonable period of time to allow the pharmacist to ascertain whether the prescription is actually forged, altered, or illegally possessed. If, after inquiry, the pharmacist believes that it is a forged, altered, or illegally possessed prescription, he or she must report it to law enforcement and surrender the prescription upon request.
Louisiana: A practitioner may notify law enforcement when he or she believes that an individual has obtained or attempted to obtain a fraudulent prescription for controlled substances.
Maine: A prescribing healthcare provider may notify law enforcement if he or she knows or has reasonable cause to believe that a person is committing or has committed an act of deception. Maine law states that generally information gained in the context of a patient relationship is confidential; however, a practitioner has an obligation to deal with people who use the practitioner to perpetuate illegal acts and that such acts may require the practitioner to report the patient to law enforcement.
Rhode Island: Requires pharmacists to report forgeries or attempted forgeries to law enforcement.
Tennessee: Requires a healthcare provider who has "actual knowledge" that a person has obtained or attempted to obtain controlled substances through deceit to report that information to law enforcement.
For more information, see the National Alliance for Model State Drug Laws, Duty to Report to Law Enforcement, Obligation of Pharmacists to Refuse to Fill or Refill Prescriptions, and Unsolicited Reports From Prescription Drug Monitoring Programs
HIPAA: Federal Law on Privacy
The federal privacy law—HIPAA—precludes the communication of protected patient information to individuals not involved in the patient's treatment or payment or in the healthcare operations of the practice or facility. Protected health information is information, including demographic information, that relates to the individual's past, present, or future physical or mental health condition and the provision of healthcare to the individual.[6] To report the forgery, the nurse practitioner would need to provide law enforcement with the patient's name and the prescription or information about the prescription.
Law-enforcement agencies and individuals are not involved in the patient's treatment, payment, or in healthcare operations. There are HIPAA exceptions for reporting certain things to law enforcement, under certain circumstances. However, the scenario described above does not fall into a HIPAA exception. So, again surprisingly, one can argue that a clinician cannot report to law enforcement, under HIPAA.
Here are two of the HIPAA exceptions for law enforcement[7]:
Clinicians may report protected health information to law enforcement when required by law to do so. For example, state laws commonly require healthcare providers to report incidents of gunshot or stab wounds or other violent injuries, and the rule permits disclosures of protected health information as necessary to comply with these laws.
Clinicians may report protected health information to a law-enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public.
Neither of these exceptions applies to this nurse practitioner's situation, unless state law specifically requires a nurse practitioner to report a forgery to law enforcement. In most states, there is no requirement for reporting. There is no imminent threat to anyone's health or safety. In this case, it is within HIPAA parameters for the pharmacist to contact the physician because both are involved in the care of this patient. But in most states, it is not within HIPAA parameters to report this patient's health information to law enforcement. States also have patient privacy protection laws. Whichever law—state or federal—most strictly protects a patient's privacy prevails.
Here is what one author, writing for a pain management journal, said after analyzing a similar case scenario:
Although prescription forgery is a crime, the prescriber's responsibility for reporting to law enforcement is not clear under current state and federal law. Federal laws and regulations, including...HIPAA, do not permit prescribers in all circumstances to disclose prescription fraud to law enforcement.
Under common circumstances, HIPAA may prohibit prescribers from reporting prescription forgery to law enforcement. However, collaborating with a dispensing pharmacist may offer a lawful pathway to reporting prescription forgery. State legislature may consider laws that clarify the reporting responsibilities of prescribers in cases of prescription forgery. [8]
Do government agencies, in urging clinicians to report suspicious behavior, fail to take HIPAA into account? Is there some rationale that explains why federal law does not require clinicians to report suspected forgery? Why doesn't the law protect clinicians who report unauthorized use of their prescribing information? The Singh article quoted above provides an in-depth discussion of these questions (but no answers).
Options for Action
Here are options for the nurse practitioner (or any other clinician) whose signature was used.
First, determine whether your state requires reporting of prescription forgeries, allows reporting of forgeries, or takes no stand. If there is no state law requiring reporting, you may elect to take the HIPAA risk and report the incident to local law enforcement and the DEA regional office. The clinician, if challenged, can argue that this prescription was not a valid prescription, and so the prescription is not patient care and therefore is not subject to HIPAA. A prescription, to be valid, must contain, among other things, an authorized prescriber's signature. It must be signed on the date issued. In this case, there was no valid signature.
Given that the information on the DEA website urges pharmacists to report to local police, and supposing that the pharmacist may be more protected than the nurse practitioner, ask the pharmacist to report the forgery. In this case, the pharmacist has declined, and there is nothing the nurse practitioner can do to force the pharmacist to make the report.
Try to prevent unauthorized use of one's name in the future. Here are some security controls recommended by the DEA[9]:
Keep all prescription blanks in a safe place where they cannot be stolen; minimize the number of prescription pads in use.
Write out the actual amount prescribed in addition to giving a number to discourage alterations of the prescription order.
Use prescription blanks only for writing a prescription order and not for notes.
Never sign prescription blanks in advance.
Assist pharmacists when they telephone to verify information about a prescription order; a corresponding responsibility rests with the pharmacist who dispenses the prescription order to ensure the accuracy of the prescription.
Contact the nearest DEA field office to obtain or to furnish information about suspicious prescription activities.
Use tamper-resistant prescription pads.
Here are additional recommendations (and reinforcements) from the Alabama Board of Pharmacy[10]:
Treat prescription pads like a personal checkbook.
Maintain adequate security for prescription pads.
Stock only a minimum number of prescription pads.
Keep prescription pads in your possession when you are actively using them.
Do not leave prescription pads "unattended." When not in use, place them in a locked desk or cabinet.
Store surplus prescription pads in a locked drawer or a safe, appropriate area.
Report any prescription pad theft to local pharmacies as well as the State Board of Pharmacy.
Prescribing clinicians and pharmacists are urged to discuss this problem with state and national lawmakers. I intend to do that.
The Patient-Provider Relationship
As for what to do about the clinician-patient relationship when the patient is suspected of forging, there are options in addition to what the prescriber did in this case. Here, the clinician declined to prescribe any more controlled drugs for the patient and referred the patient to a pain specialist.
The clinician could have terminated all care for the patient; that is, the clinician could have "fired" the patient from the practice. It is not necessary to ascertain that the patient has been convicted of the crime of forgery. Termination of a clinician-patient relationship can be done orally or in writing. One must not terminate a patient in the midst of an acute illness, but once the patient is stable, the clinician can end the relationship and the duty of care to the patient. It is wise to state that the relationship will end 30 days in the future, to give the patient time to find another provider. The clinician may refill prescriptions (though probably not for controlled drugs) or treat acute illnesses during the 30-day period. After the 30 days are up, all care ceases. A clinician does not need to provide or recommend another provider for a fired patient.
It is not imperative that the patient be fired. If, for example, the patient is seeing other members of the practice, the practice could decline to prescribe controlled drugs but continue to provide other forms of medical care.
Clinicians may agonize over whether to confront a patient who has abused the clinician-patient relationship. I don't want to provide advice on that issue, because I don't know the individuals and relationships and doubt that there is any safe, generalizable advice to be given. And I would not want to advise a clinician to do something that may put the clinician's safety at risk. A clinician might state, "The pharmacist thought this prescription you presented looked fake, and I never wrote it for you," and see what the patient says. However, a clinician need not take on police work. Even if the patient confesses, the clinician, in most states, isn't going to be able to report it because of privacy laws.
Finally, prescribe electronically whenever feasible. Prescribing electronically can reduce opportunities to copy a clinician's signature or alter paper prescriptions. Electronic prescribing of controlled drugs is permitted nationwide.
Medscape Nurses © 2016 WebMD, LLC
Any views expressed above are the author's own and do not necessarily reflect the views of WebMD or Medscape.
Cite this: What Should I Do About a Forged Prescription? - Medscape - Feb 22, 2016.
Comments