Titles of Regulations: 18VAC110-20. Regulations Governing the Practice of Pharmacy (amending 18VAC110-20-150).

18VAC110-21. Regulations Governing the Licensure of Pharmacists and Registration of Pharmacy Technicians (adding 18VAC110-21-46).

Statutory Authority: §§ 54.1-2400 and 54.1-3307 of the Code of Virginia.

Public Hearing Information:

December 6, 2022 - 9:05 a.m. - Department of Health Professions, Perimeter Center Conference Center, 2nd floor, Board Room 4, 9960 Mayland Drive, Henrico, Virginia

Public Comment Deadline: January 20, 2023.

Agency Contact: Caroline Juran, RPh, Executive Director, Board of Pharmacy, 9960 Mayland Drive, Suite 300, Richmond, VA 23233-1463, telephone (804) 367-4456, FAX (804) 527-4472, or email caroline.juran@dhp.virginia.gov.

Basis: Regulations are promulgated under the general authority of § 54.1-2400 of the Code of Virginia, which provides the Board of Pharmacy the authority to promulgate regulations to administer the regulatory system. Section 54.1-3303.1 of the Code of Virginia allows initiating of treatment with and dispensing and administering of controlled substances by pharmacists.

Purpose: The purpose of the regulation is to ensure that a pharmacist who initiates treatment for patients follows a protocol that would render such dispensing to be low risk for patient harm. The rules establishing protocols, appropriate notification of primary care providers, maintenance of records, and patient privacy are necessary to ensure this activity protects the health and safety of patients who receive such treatment from pharmacists.

Substance: The substantive provision is the addition of 18VAC110-21-46, which sets out the listing of drugs and devices a pharmacist is authorized to initiate under § 54.1-3303.1 of the Code of Virginia and the requirements for such initiation of treatment, including adherence to established protocols, notification to medical providers, maintenance of records, and protection of patient privacy.

Issues: The advantage to the public will be access to certain prescription drugs and devices directly from a pharmacist rather than being required to go to a health care practitioner with prescriptive authority and incur additional cost. A pharmacist who follows the protocols established for initiation of treatment would be providing drugs and devices that are considered to be low risk for any patient harm. There should be no disadvantages to the public. There are no advantages or disadvantages to this agency or the Commonwealth.

Department of Planning and Budget's Economic Impact Analysis:

The Department of Planning and Budget (DPB) has analyzed the economic impact of this proposed regulation in accordance with § 2.2-4007.04 of the Code of Virginia (Code) and Executive Order 14 (as amended, July 16, 2018). The analysis presented represents DPB's best estimate of these economic impacts.¹

Summary of the Proposed Amendments to Regulation. The Board of Pharmacy (Board) proposes to make permanent certain changes that are currently implemented through an emergency regulation, which was promulgated in response to a 2021 legislative mandate.² The proposed amendments would primarily expand the scope of treatment that pharmacists would be allowed to initiate to include (i) vaccines included on the Immunization Schedule published by the Centers for Disease Control and Prevention (CDC) or have a current emergency use authorization (EUA) from the U.S. Food and Drug Administration (FDA), (ii) tuberculin purified protein derivative for tuberculosis testing, and (iii) certain controlled substances for the prevention of human immunodeficiency virus (HIV).

Background. Chapter 731 of the 2020 Acts of Assembly allowed pharmacists to initiate treatment with opioid antagonists (such as naloxone), injectable or self-administered hormonal contraceptives, prenatal vitamins that require prescriptions, dietary fluoride supplements, and medications covered by the patient's health carrier when the patient's out-of-pocket cost is lower than the out-of-pocket cost of an over-the-counter equivalent of the same drug. The legislation included conditions that would have to be met for pharmacists to initiate treatment, including that the treatment setting comply with the Health Insurance Portability and Accountability Act (HIPAA), and directed the Board to promulgate regulations to implement the provisions of the Act within 280 days of its enactments.³

Chapter 731 also directed the Board to establish a working group to provide recommendations regarding the development of protocols for other types of treatments that pharmacists could initiate and to then submit its findings and recommendations to the Governor and the Chairs of the House Committee on Health, Welfare and Institutions and the Senate Committee on Education and Health by November 1, 2020.⁴ The report filed with the General Assembly indicates that working group members voted unanimously (or nearly unanimously) to make the following recommendations:⁵

(i) Pharmacists should be authorized to order and administer vaccines included on the immunization schedule published by the CDC for persons 18 years of age and older, to require reporting to the Virginia Immunization Information System (VIIS), and to require that pharmacists inform the patient's primary care provider of the vaccine administration.

(ii) Pharmacists should be authorized to initiate treatment with and dispense and administer tuberculin purified protein derivative for tuberculosis testing.

(iii) Pharmacists should be authorized to initiate treatment with and dispense and administer controlled substances for the prevention of HIV, including controlled substances prescribed for pre-exposure and post-exposure prophylaxis pursuant to CDC guidelines and recommendations.⁶

(iv) Pharmacists should be authorized to dispense and administer devices, controlled paraphernalia, and possibly other durable medical equipment to lower out-of-pocket expenses, for which the patient's health insurance provider requires a prescription.⁷

Subsequently, Chapter 231 of the 2021 Acts of Assembly incorporated the working group's recommendations in statute and directed the Board to promulgate regulations implementing the changes made by the Act within 280 days of its enactment. Accordingly, the following summarized proposed changes would mirror the statutory changes in the 2021 legislative mandate.⁸ In 18VAC110-20-150, physical standards for all pharmacies would be amended to require that the physical setting of a pharmacy in which a pharmacist treats with, dispenses, or administers drugs, devices, controlled paraphernalia, and other supplies and equipment comply with HIPAA. In 18VAC110-21-46, initiation of treatment by a pharmacist would be amended as follows:

Subsection A would authorize a pharmacist to initiate treatment with, dispense, or administer certain "controlled paraphernalia, and other supplies and equipment" in addition to certain drugs and devices.

Subdivision 6 would be amended to include "controlled paraphernalia and other supplies and equipment" covered by the patient's health carrier when the patient's out-of-pocket cost is lower than the out-pf-pocket cost to purchase an over-the-counter equivalent of the same controlled paraphernalia or other supplies and equipment. This provision currently only applies to "drugs and devices."

Subdivisions 7, 8, and 9 would be added to subsection A to add vaccines listed on the CDC's immunization schedule, including those that have an EUA from the US FDA, tuberculin purified protein derivative for tuberculosis testing, and controlled substances for the prevention of HIV pursuant to the CDC's guidelines and recommendations.

Subsection B would be amended to require that pharmacists follow the statewide protocol when dispensing or administering "controlled paraphernalia, and other supplies and equipment" in addition to following these requirements with the currently authorized treatment with drugs and devices. Additionally, subsection B would be amended to require that pharmacists report vaccinations to VIIS in accordance with the requirements of § 32.1-46.01 of the Code of Virginia.

Estimated Benefits and Costs. The proposed amendments would largely benefit individuals seeking vaccinations, tuberculosis testing, or HIV prophylaxis by allowing them to obtain the necessary treatment at pharmacies instead of going to a physician. Pharmacies often have extended hours of operation compared to physicians' offices, may not require advance appointments, and may be more conveniently located for some people.

The proposed amendments would also benefit individuals who need controlled paraphernalia (such as insulin pen needles, hypodermic syringes, or glucometers) that is covered by their insurance so that their out-of-pocket expenditures would be lower than if they purchased over-the-counter equivalents. These individuals could now get these controlled paraphernalia at a lower price from their local pharmacy, without having to obtain a prescription from their health care provider ex ante or trying to obtain reimbursements from their insurance carrier ex post.

Providing controlled paraphernalia and other medical supplies at a lower price to some consumers would not necessarily result in revenue losses for the pharmacies, and could lead to higher revenues. Pharmacies would likely recover some portion of the remainder of the retail price from insurers, as they currently do for drugs, and may experience a modest increase in the overall quantity sold. Thus the extent to which pharmacies' revenue may increase would depend on the dollar-value of insurance reimbursements and the increase in quantity sold as a result of lower out-of-pocket costs to some consumers.

Pharmacies would benefit from the additional revenue that would be collected as a result of pharmacists being authorized to provide an expanded range of services. Pharmacies could face some additional costs arising from ensuring HIPAA compliance of the physical location and the requirement that vaccinations be reported to VIIS. However, the proposed regulation would only authorize, not require, pharmacists to initiate treatment and provide vaccines or other drugs, devices or controlled paraphernalia. Additional revenue to pharmacies where pharmacists elect to initiate treatment would likely cover the costs associated with providing these additional services.

Businesses and Other Entities Affected. The Department of Health Professions (DHP) reports that there are 15,326 licensed pharmacists, but not all pharmacists would be directly affected.⁹ DHP also reports that pharmacists are not licensed by specialty (compounding, radiopharmaceutical, hospital, etc.), nor are they identified by work setting. Only pharmacists working in retail pharmacies, who dispense drugs directly to consumers, would be directly affected by the proposed amendments.

DHP also reports that there are 1,769 licensed pharmacies, but only pharmacies that dispense to a consumer would be directly affected by the proposed changes.¹⁰ Data provided by DHP indicates that at least 1,063 pharmacy licenses are held by retail pharmacy chains or by retail grocery chains that have pharmacies, and another 10 pharmacy licenses are held by public health centers (run by city or community services board) or student health centers at colleges and universities. Thus, at least 61% of licensed pharmacies appear to be affected by the proposed changes. The remaining 696 pharmacy licenses include 187 hospitals, including teaching hospitals, and 509 independent health centers, free clinics, and independent pharmacies. Many of these places likely dispense directly to customers, but the exact number could not be identified based on the list of licensed entities alone, and would require significantly more time to verify individually.

Some physicians' offices may be indirectly affected by the proposed changes to the extent that current and prospective patients substitute office visits with pharmacist-initiated treatment, leading to revenue losses for these entities. The changes proposed here would specifically affect physicians that prescribe controlled paraphernalia and other medical supplies, and those that provide vaccinations, tuberculosis testing, and HIV prophylactics. This could include some of the roughly 187 hospitals with pharmacy licenses mentioned previously, provided they do not already dispense directly to consumers and only to the extent that current and future patients choose to substitute physician-initiated treatment for pharmacist-initiated treatment.

The Code of Virginia requires DPB to assess whether an adverse impact may result from the proposed regulation.¹¹ An adverse impact is indicated if there is any increase in net cost or reduction in net revenue for any entity, even if the benefits exceed the costs for all entities combined. As noted, the proposed amendments do not create any new costs for pharmacies that could not be directly recouped, and would likely increase pharmacies' net revenue. However, some physicians' offices may experience a reduction in net revenue to the extent that the proposed amendments cause a substitution towards pharmacist-initiated treatment by existing and prospective patients. Thus, an adverse impact is indicated for physicians' offices.

Small Businesses¹² Affected:¹³ The proposed amendments could benefit some small businesses, such as independent pharmacies and health centers with retail pharmacies, while hurting some others, such as physicians' offices.¹⁴

Types and Estimated Number of Small Businesses Affected. As mentioned previously, there are up to 509 small, independently-operated pharmacies and health centers that would benefit to the extent that they dispense directly to consumers. The number of physicians' offices that are small businesses (without a pharmacy license) that may be adversely impacted by revenue losses is not known.

Costs and Other Effects. Physicians' offices and small for-profit hospitals, including ones with pharmacy licenses that do not dispense directly to consumers, may lose revenue to the extent that their current and prospective patients substitute physician-initiated treatment for pharmacist-initiated treatment as a result of the proposed changes. Small hospitals with pharmacy licenses that do not currently dispense directly to consumers may choose to start doing so, and may take other measures to expand their availability, in an effort to reduce or prevent revenue losses. However, they would likely incur some costs to implement such changes. Thus, an adverse economic impact¹⁵ is indicated for physicians' offices and small for-profit hospitals because there do not appear to be any offsetting direct benefits to these small businesses.

Alternative Method that Minimizes Adverse Impact. There are no clear alternative methods that both reduce adverse impact to physicians and small hospitals and meet the intended policy goals of safely expanding access for consumers by allowing pharmacist-initiated treatment.

Localities¹⁶ Affected.¹⁷ At least five pharmacy licenses appear to be held by cities or community services boards, which receive funding from local governments, specifically the City of Alexandria (two licenses), Norfolk City community services board, Bedford County and Fairfax County.¹⁸ The proposed amendments do not introduce costs for local governments. Accordingly, no additional funds would be required, and an adverse economic impact is not indicated.

Projected Impact on Employment. The proposed amendments do not appear to affect total employment in the short run. Any expansion in the scope of responsibilities for pharmacists could lead to an increase in the demand for pharmacists. Even if pharmacists are able to delegate some of their existing responsibilities to pharmacy technicians, this would lead to an increased demand for pharmacy technicians. This may induce more individuals to enter these professions and increase the pharmacist and pharmacy technician labor force in the long run. The proposed amendments are unlikely to affect physicians' offices and hospitals to a sufficient degree to adversely impact the employment of physicians, nurses, or other medical personnel.

Effects on the Use and Value of Private Property. The proposed amendments would increase the scope of services provided by privately owned pharmacies, including large retail pharmacy chains and grocery store chains that have pharmacies as well as small independent pharmacies, to the extent that they dispense directly to consumers. This is likely to increase the net revenue for these entities and could lead to a modest increase in the value of these businesses. At the same time, the proposed amendments may modestly reduce the value of some private clinics and hospitals to the extent that their revenues are reduced by patients switching to pharmacist-initiated treatment. The proposed amendments do not affect real estate development costs.

______________________

¹Section 2.2-4007.04 of the Code of Virginia requires that such economic impact analyses determine the public benefits and costs of the proposed amendments. Further the analysis should include but not be limited to: (1) the projected number of businesses or other entities to whom the proposed regulatory action would apply, (2) the identity of any localities and types of businesses or other entities particularly affected, (3) the projected number of persons and employment positions to be affected, (4) the projected costs to affected businesses or entities to implement or comply with the regulation, and (5) the impact on the use and value of private property.

²See https://townhall.virginia.gov/l/ViewStage.cfm?stageid=9452 for the Emergency/NOIRA; the emergency provisions are due to expire on June 21, 2023. See https://townhall.virginia.gov/l/viewmandate.cfm?mandateid=1202 for the legislative mandate.

³See https://townhall.virginia.gov/l/ViewAction.cfm?actionid=5604 for that regulatory action and https://townhall.virginia.gov/l/viewmandate.cfm?mandateid=1061 for the corresponding legislative mandate. The emergency provisions will remain in effect until July 2, 2022, unless extended for six months, as requested, until January 1, 2023. The proposed stage that would make those emergency provisions permanent has been completed, and received no public comments.

⁴The working group consisted of members of the Board of Pharmacy, Board of Medicine, Virginia Department of Health (VDH), Department of Medical Assistance Services, administrators and faculty members from various pharmacy schools and medical schools in Virginia, and representatives from the following organizations: Virginia Association of Health Plans, Virginia Pharmacist Association, Medical Society of Virginia, Virginia Society of Health-Systems Pharmacists, Virginia Association of Chain Drug Stores, and National Association of Chain Drug Stores.

⁵See https://rga.lis.virginia.gov/Published/2020/RD480 for the full report. A number of other conditions that had been proposed for the working group's consideration in Chapter 731 did not receive unanimous support.

⁶Working group members from VDH specifically referred to their experience working with pharmacists to perform HIV testing to indicate that a well-constructed statewide protocol could meet public need and that pre- and post-exposure prophylaxis could be built into the protocol.

⁷The working group noted that the term "drugs" as defined in law does not include "devices" such as glucometers, controlled paraphernalia such as insulin pen needles and hypodermic syringes, and possibly other durable medical equipment.

⁸Note that the proposed text intentionally duplicates changes that have been made under action 5604 (see fn 3). Thus, if the emergency provisions in that action expire without extension before the final stage has been completed, the provisions of Chapter 731 of the 2020 Acts will remain in effect until June 21, 2023 under the emergency provisions of this action (5861), and would be made permanent by the proposed stage being reviewed here. However, the economic impacts of the initial changes have been analyzed at the proposed stage for action 5604 and will not be repeated here; see https://townhall.virginia.gov/l/GetFile.cfm?File=30\5604\9242\EIA_DHP_9242_v1.pdf.

⁹See Agency Background Document (ABD) page 7: https://townhall.virginia.gov/l/GetFile.cfm?File=30\5861\9562\AgencyStatement_DHP_9562_v2.pdf.

¹⁰Ibid.

¹¹Pursuant to § 2.2-4007.04 D: In the event this economic impact analysis reveals that the proposed regulation would have an adverse economic impact on businesses or would impose a significant adverse economic impact on a locality, business, or entity particularly affected, the Department of Planning and Budget shall advise the Joint Commission on Administrative Rules, the House Committee on Appropriations, and the Senate Committee on Finance. Statute does not define "adverse impact," state whether only Virginia entities should be considered, nor indicate whether an adverse impact results from regulatory requirements mandated by legislation.

¹²Pursuant to § 2.2-4007.04, small business is defined as "a business entity, including its affiliates, that (i) is independently owned and operated and (ii) employs fewer than 500 full-time employees or has gross annual sales of less than $6 million."

¹³If the proposed regulatory action may have an adverse effect on small businesses, § 2.2-4007.04 requires that such economic impact analyses include: (1) an identification and estimate of the number of small businesses subject to the proposed regulation, (2) the projected reporting, recordkeeping, and other administrative costs required for small businesses to comply with the proposed regulation, including the type of professional skills necessary for preparing required reports and other documents, (3) a statement of the probable effect of the proposed regulation on affected small businesses, and (4) a description of any less intrusive or less costly alternative methods of achieving the purpose of the proposed regulation. Additionally, pursuant to § 2.2-4007.1 of the Code of Virginia, if there is a finding that a proposed regulation may have an adverse impact on small business, the Joint Commission on Administrative Rules shall be notified.

¹⁴Some of these small businesses include local chains with roughly two to twelve locations. They are independent in the sense that they do not belong to a national chain. The proposed amendments would also benefit a number of free clinics and other health centers that may operate as a non-profit rather than a traditional business, but would otherwise meet the criteria for small businesses as defined in footnote 12.

¹⁵Adverse impact is indicated if there is any increase in net cost or reduction in net revenue for any entity, even if the benefits exceed the costs for all entities combined.

¹⁶"Locality" can refer to either local governments or the locations in the Commonwealth where the activities relevant to the regulatory change are most likely to occur.

¹⁷Section 2.2-4007.04 defines "particularly affected" as bearing disproportionate material impact.

¹⁸There may be more locality funded pharmacies and health centers. These are difficult to identify since many health centers or pharmacies named after a county could be private entities, so only names with "health department" or "city of" were included in this estimate.

Agency's Response to Economic Impact Analysis: The Board of Pharmacy concurs with the economic impact analysis of the Department of Planning and Budget.

Summary:

Pursuant to Chapter 214 of the 2021 Acts of Assembly, the proposed amendments add drugs and devices that may be initiated by a pharmacist and the authority to dispense controlled paraphernalia or other supplies or equipment to 18VAC110-21-46, a section added by an emergency regulatory action in 2020 (37:12 VA.R. 1316-1317 September 14, 2020), which will become effective as a permanent regulation on December 21, 2022. The amendments (i) define drugs, devices, and controlled paraphernalia pursuant to applicable statute; (ii) add "other supplies and equipment available over-the-counter, covered by the patient's health carrier when the patient's out-of-pocket cost is lower than the out-of-pocket cost to purchase an over-the-counter equivalent of the same drug, device, controlled paraphernalia, or other supplies or equipment"; (iii) include on the list vaccines on the Immunization Schedule published by the Centers for Disease Control and Prevention (CDC) or that have a current emergency use authorization from the U.S. Food and Drug Administration; (iv) include on the list tuberculin purified protein derivative for tuberculosis testing; and (v) include on the list controlled substances for the prevention of human immunodeficiency virus, including controlled substances prescribed for pre-exposure and post-exposure prophylaxis pursuant to guidelines and recommendations of the CDC.

18VAC110-20-150. Physical standards for all pharmacies.

A. The prescription department shall not be less than 240 square feet. The patient waiting area or the area used for counseling, devices, cosmetics, and proprietary medicines shall not be considered a part of the minimum 240 square feet. The total area shall be consistent with the size and scope of the services provided.

B. Access to stock rooms, rest rooms, and other areas other than an office that is exclusively used by the pharmacist shall not be through the prescription department. A rest room in the prescription department, used exclusively by pharmacists and personnel assisting with dispensing functions, may be allowed provided there is another rest room outside the prescription department available to other employees and the public. This subsection shall not apply to prescription departments in existence prior to November 4, 1993.

C. The pharmacy shall be constructed of permanent and secure materials. Trailers or other moveable facilities or temporary construction shall not be permitted.

D. The entire area of the location of the pharmacy practice, including all areas where drugs are stored, shall be well lighted and well ventilated; the proper storage temperature shall be maintained to meet USP-NF specifications for drug storage.

E. The prescription department counter work space shall be used only for the compounding and dispensing of drugs and necessary recordkeeping.

F. A sink with hot and cold running water shall be within the prescription department. A pharmacy issued a limited-use permit that does not stock prescription drugs as part of its operation is exempt from this requirement.

G. Adequate refrigeration facilities equipped with a monitoring thermometer for the storage of drugs requiring cold storage temperature shall be maintained within the prescription department if the pharmacy stocks such drugs.

H. A pharmacy stocking drugs requiring cold storage temperature shall record the temperature daily and adjust the thermostat as necessary to ensure an appropriate temperature range. The record shall be maintained manually or electronically for a period of two years.

I. The physical settings of a pharmacy in which a pharmacist initiates treatment with, dispenses, or administers drugs, devices, controlled paraphernalia, and other supplies and equipment pursuant to § 54.1-3303.1 of the Code of Virginia and 18VAC110-21-46 shall protect patient confidentiality and comply with the Health Insurance Portability and Accountability Act, 42 USC § 1320d et seq.

18VAC110-21-46. Initiation of treatment by a pharmacist.

A. Pursuant to § 54.1-3303.1 of the Code of Virginia, a pharmacist may initiate treatment with, dispense, or administer the following drugs, devices, controlled paraphernalia, and other supplies and equipment to persons 18 years of age or older:

1. Naloxone or other opioid antagonist, including such controlled paraphernalia as defined in § 54.1-3466 of the Code of Virginia as may be necessary to administer such naloxone or other opioid antagonist;

2. Epinephrine;

3. Injectable or self-administered hormonal contraceptives, provided the patient completes an assessment consistent with the United States Medical Eligibility Criteria for Contraceptive Use;

4. Prenatal vitamins for which a prescription is required;

5. Dietary fluoride supplements in accordance with recommendations of the American Dental Association for prescribing of such supplements for persons whose drinking water has a fluoride content below the concentration recommended by the U.S. Department of Health and Human Services;

6. Drugs and devices as defined in § 54.1-3401 of the Code of Virginia, controlled paraphernalia as defined in § 54.1-3466 of the Code of Virginia, and other supplies and equipment available over the counter, covered by the patient's health carrier when the patient's out-of-pocket cost is lower than the out-of-pocket cost to purchase an over-the-counter equivalent of the same drug, device, controlled paraphernalia, or other supplies or equipment;

7. Vaccines included on the Immunization Schedule published by the Centers for Disease Control and Prevention or that have a current emergency use authorization from the U.S. Food and Drug Administration;

8. Tuberculin purified protein derivative for tuberculosis testing; and

9. Controlled substances for the prevention of human immunodeficiency virus, including controlled substances prescribed for pre-exposure and post-exposure prophylaxis pursuant to guidelines and recommendations of the Centers for Disease Control and Prevention.

B. Pharmacists who initiate treatment with, dispense, or administer a drug, device, controlled paraphernalia, or other supplies or equipment pursuant to subsection A of this section shall:

1. Follow the statewide protocol adopted by the board for each drug, device, controlled paraphernalia, or other supplies or equipment.

2. Notify the patient's primary health care provider that treatment has been initiated with such drug, device, controlled paraphernalia, or other supplies or equipment or that such drug, device, controlled paraphernalia, or other supplies or equipment have been dispensed or administered to the patient, provided that the patient consents to such notification. If the patient does not have a primary health care provider, the pharmacist shall counsel the patient regarding the benefits of establishing a relationship with a primary health care provider and, upon request, provide information regarding primary health care providers, including federally qualified health centers, free clinics, or local health departments serving the area in which the patient is located. If the pharmacist is initiating treatment with, dispensing, or administering injectable or self-administered hormonal contraceptives, the pharmacist shall counsel the patient regarding seeking preventative care, including (i) routine well-woman visits, (ii) testing for sexually transmitted infections, and (iii) pap smears. If the pharmacist is administering a vaccine pursuant to this section, the pharmacist shall report such administration to the Virginia Immunization Information System in accordance with the requirements of § 32.1-46.01 of the Code of Virginia.

3. Maintain a patient record for a minimum of six years following the last patient encounter with the following exceptions:

a. Records that have previously been transferred to another practitioner or health care provider or provided to the patient or the patient's personal representative; or

b. Records that are required by contractual obligation or federal law to be maintained for a longer period of time.

4. Perform the activities in a manner that protects patient confidentiality and complies with the Health Insurance Portability and Accountability Act, 42 USC § 1320d et seq.