- A state board of pharmacy inspector requests the pharmacy's Schedule III through V controlled substance purchase invoices for the past two years. The pharmacy's records cover only the past 90 days because older invoices were discarded. Which of the following best describes the pharmacy's compliance status?
Answer: The pharmacy is non-compliant because controlled substance purchase records must be retained for a minimum of two years under DEA regulations.
DEA regulations (21 CFR 1304.04) require controlled substance records -- including purchase invoices for Schedule III through V drugs -- to be maintained for a minimum of two years. Retaining only 90 days of records constitutes a clear recordkeeping violation. B is incorrect because sufficiency is defined by the legal minimum, not by inspection convenience. C is incorrect because a recordkeeping violation exists independently of whether diversion is proven. D is incorrect because purchase invoices for controlled substances are expressly required DEA records and are subject to the two-year retention minimum.
- A pharmacist decides to enter her closed retail pharmacy at 2 a.m. in response to an urgent patient need for a medication. Which of the following steps is most critical from an access-control compliance standpoint?
Answer: Document the after-hours entry, the reason for access, and any medications accessed or dispensed.
Documentation is the most appropriate action among these choices when a pharmacist enters the pharmacy after hours for a legitimate purpose. Maintaining a record of the date and time of entry, the reason for access, and any medications accessed or dispensed supports the pharmacy's access-control audit trail and satisfies most pharmacy security policies and applicable state board requirements. A is incorrect because owner approval, while advisable, is not a universally mandated legal prerequisite for after-hours access by a licensed pharmacist responding to an emergency. B is incorrect because DEA notification before after-hours entry is not required under these circumstances. D is incorrect because a second pharmacist witness is not generally required for after-hours access; documentation obligations must still be satisfied.
- A state board of pharmacy inspector informs a PIC that a newly enacted state regulation requires installation of a security camera covering the controlled substance dispensing area within 30 days. The PIC notes that no federal DEA regulation specifically requires cameras. Which of the following best describes the applicable legal standard?
Answer: The state regulation applies and the pharmacy must comply because state boards of pharmacy may impose security requirements that exceed federal minimums.
State pharmacy boards may impose security requirements that go beyond federal DEA minimums, and pharmacies must comply with the stricter standard. Federal law establishes a floor, not a ceiling; state requirements may be more stringent. A is incorrect because DEA regulations establish minimum standards and do not preempt more protective state requirements. C is incorrect because there is no conflict -- the pharmacy must comply with both the federal minimum and any more stringent state requirement simultaneously. D is incorrect because state boards of pharmacy have broad authority to establish operational and security requirements for licensed pharmacies, including camera systems.
- Under DEA security regulations, which of the following individuals is authorized to access the controlled substance storage area of a retail pharmacy?
Answer: A pharmacist employed at the pharmacy who is designated as an authorized employee under the pharmacy's access-control policy.
DEA regulations (21 CFR 1301.72) restrict access to controlled substance storage areas to authorized employees only. An employed pharmacist designated as an authorized employee under the pharmacy's access-control policies meets this standard. Individual DEA registration is a requirement for pharmacies and certain independent practitioners, but employed pharmacists do not need a personal DEA registration to access controlled substances at their employer's registered location. B is incorrect because technicians may not access controlled substance storage independently without a pharmacist on the premises supervising. C is incorrect because delivery personnel are not pharmacy employees and may not enter secured storage areas unescorted. D is incorrect because a pharmacy intern without a state intern license has not obtained the authorization required to access controlled substance storage.
- A PIC wants to establish a compliant access-control policy for the controlled substance vault at a pharmacy employing two pharmacists, four technicians, and one licensed pharmacy intern. Which of the following policies best satisfies federal security requirements?
Answer: Issue access credentials only to pharmacists and technicians with documented need, logging all entries.
DEA security regulations require that controlled substance storage be accessible only to authorized employees -- those whose job functions require access and who are designated as authorized under the pharmacy's policies and applicable law. This performance-based standard does not limit vault access to pharmacists alone; technicians and other personnel may be authorized based on role, scope, and the pharmacy's documented access-control policy. All access must be logged with identifying information to create an auditable trail. A is incorrect because state credentials alone do not determine access authorization; job function and documented need also apply. C is incorrect because internal training completion is not a substitute for proper regulatory authorization. D is incorrect because imposing a pharmacist-only restriction for after-hours access is not required by DEA regulations, which focus on authorized personnel rather than licensure category.
- A pharmacy discovers that a master key to all drug storage areas is missing and staff cannot determine when it was lost or whether it was stolen. What is the most appropriate immediate action?
Answer: Change the locks on all drug storage areas immediately and conduct an inventory to determine if any controlled substances are missing.
When a master key to drug storage areas is missing under unknown circumstances, the priority is to eliminate the ongoing security risk by rekeying all affected locks and conducting an inventory to detect any potential shortage. A is incorrect because waiting for a police investigation before securing the premises leaves the pharmacy vulnerable to unauthorized access during that period. B is incorrect because DEA Form 106 is required for theft or significant loss of controlled substances, not for a missing key alone; if the subsequent inventory reveals a shortage, Form 106 would then be required. C is incorrect because a bulletin board notice does not address the security vulnerability and is not a compliant response to a potentially compromised key.
- In a state that permits pharmacy technicians to count and prepare controlled substance prescriptions under pharmacist supervision, a pharmacist steps away from the dispensing bench to assist a patient in the waiting area. While the pharmacist is in the waiting area, a technician begins counting a Schedule III controlled substance at the dispensing bench. Which of the following best describes this situation?
Answer: The technician may perform this task as long as the pharmacist remains on the premises and is immediately accessible.
In states that authorize technicians to handle controlled substances, this activity is permitted under pharmacist supervision, which requires the pharmacist to be on the premises and immediately available -- not physically present at the same workstation. A is incorrect because technicians are permitted to handle controlled substances under appropriate supervision in states that authorize this practice. C is incorrect because technicians may not perform final verification of a prescription; that responsibility belongs to the pharmacist. D is incorrect because physical co-location is not required; on-premises availability is the standard in states that permit technician preparation of controlled substances.
- Under DEA regulations for retail pharmacies, which of the following most accurately describes the access-control requirement for controlled substance storage areas?
Answer: Access to controlled substance storage must be restricted to authorized personnel with appropriate physical security measures.
DEA regulations under 21 CFR 1301.72 require retail pharmacies to maintain physical security for controlled substances, including restricting access to authorized employees and implementing security measures commensurate with the level of risk. D accurately captures this performance-based requirement. A is incorrect because DEA regulations do not specifically mandate security cameras, though some states do. B is incorrect because posting a list of authorized employees is not a DEA requirement. C is incorrect because there is no specific DEA requirement mandating a locked separating door between the vault and the general dispensing area; the requirement is for adequate security appropriate to the pharmacy's circumstances.
- A pharmacy manager discovers that the access code for the controlled substance cabinet has been shared informally among all pharmacy staff, including technicians and front-end clerks. Which of the following best describes the compliance concern?
Answer: This is a violation of controlled substance security requirements because access must be restricted to authorized personnel only.
DEA regulations (21 CFR 1301.72) require that access to controlled substances be restricted to authorized employees. Sharing the access code with all staff -- including front-end clerks who are not authorized to handle controlled substances -- violates federal physical security requirements. A is incorrect because background checks establish employment eligibility but do not automatically authorize all employees to access controlled substance storage. B is incorrect because PIC awareness of a non-compliant practice does not convert that practice into a compliant one. C is incorrect because unrestricted access to controlled substance storage is a substantive DEA security violation with potential enforcement consequences, not a minor procedural issue.
- A pharmacy owner instructs the PIC to give a sales representative from a wholesale drug company an access code to enter the pharmacy after hours to restock OTC shelves without any staff present. The PIC objects to this arrangement. Which of the following best supports the PIC's concern?
Answer: Granting a non-employee unsupervised after-hours access to the pharmacy creates security risks for controlled substances and patient health information and conflicts with the pharmacy's access-control obligations.
Allowing a non-employee unsupervised after-hours access to a pharmacy creates serious security risks, including the potential for controlled substance diversion and unauthorized access to patient health information. The PIC bears legal responsibility for access-control compliance and is correct to object to an arrangement that violates those obligations. B is incorrect because vendor and sales representative access is not categorically prohibited -- it must be supervised and appropriately controlled. C is incorrect because access decisions are a shared governance responsibility; the PIC does not have exclusive authority, though the PIC does bear compliance accountability. D is incorrect because DEA regulations do not prohibit after-hours restocking of non-controlled OTC products.
- During a DEA inspection, an inspector finds that the pharmacy's Schedule II controlled substance records show approximately 400 dosage units reflected in DEA Form 222 purchase records that cannot be reconciled with dispensing records or current inventory counts. The PIC states he was unaware of any discrepancy. Which of the following best characterizes this situation?
Answer: This indicates a significant unresolved discrepancy, requiring DEA Form 106 filing and potential investigation due to PIC's supervisory failure.
An unresolved discrepancy between DEA Form 222 purchase records and dispensing records or inventory for Schedule II controlled substances represents a serious compliance failure with potential diversion implications. The PIC's supervisory responsibilities include ensuring that CS records are accurate and that discrepancies are identified and investigated promptly. If the investigation confirms theft or significant loss, DEA Form 106 must be filed. A correctly identifies both the compliance failure and the likely regulatory consequence. B is incorrect because a significant unreconciled shortage is a potential controlled substance loss requiring notification, not merely a recordkeeping deficiency. C is incorrect because the PIC's supervisory obligations include ensuring recordkeeping accuracy; ignorance of the failure does not eliminate accountability. D is incorrect because the DEA -- not the state board -- is the primary authority for controlled substance diversion concerns, and no universal 72-hour state board reporting requirement of this type exists under federal law.
- A technician who knew the combination to the pharmacy's controlled substance safe resigns unexpectedly. The PIC is aware of the resignation but does not change the combination for two weeks. No controlled substance discrepancies are identified during that period. Which of the following best describes the PIC's compliance status?
Answer: The PIC is non-compliant because access credentials must be changed upon an employee's departure to prevent potential unauthorized access.
Access credentials -- including safe combinations -- must be changed when an employee with that knowledge departs. Waiting two weeks to change the combination is a security violation regardless of whether any diversion occurred during that time. A is incorrect because compliance is determined by adherence to required security procedures, not by outcomes; the absence of detected diversion does not retroactively validate non-compliant conduct. B is incorrect because knowledge of the combination constitutes a genuine security risk even if the technician was not independently authorized to access the safe. C is incorrect because there is no recognized reasonable transition period exception to the requirement to revoke access credentials upon an employee's departure.
- A pharmacy's security alarm is triggered at 11 p.m. Police respond and find no signs of forced entry but discover that a rear door was left unlocked. The PIC is notified. What is the PIC's primary obligation at this point?
Answer: Conduct an immediate controlled substance inventory, secure the premises, and document the incident.
A security event -- even without confirmed unauthorized entry -- requires the PIC to immediately verify controlled substance inventory integrity, secure the pharmacy, and document the circumstances. If inventory reveals a shortage, DEA Form 106 notification would then be required. A is incorrect because DEA notification is triggered by confirmed theft or significant loss, not by an alarm event alone. B is incorrect because board notification is not automatically required for an unsecured door absent confirmed theft or diversion. D is incorrect because waiting for a police report before conducting an inventory delays detection of any shortage, increasing the pharmacy's legal exposure.
- A pharmacy in a state that requires students to hold a state intern license before performing active dispensing activities accepts a second-year pharmacy student for an introductory pharmacy practice experience (IPPE). The student has not yet obtained a state intern license. Which of the following best describes the student's permitted access to the prescription dispensing area?
Answer: The student's access should be limited to observation unless this state's pharmacy law specifically authorizes hands-on participation by unlicensed students under direct preceptor supervision.
In a state requiring intern licensure before active dispensing participation, a pharmacy student who has not obtained a license does not have the legal authority to perform active dispensing activities. Access should be restricted to observation, with hands-on participation awaiting licensure unless state law explicitly permits limited activities for unlicensed students under direct preceptor supervision. A is incorrect because educational supervision does not override state licensure and access-control requirements. B is incorrect because preceptor assumption of responsibility does not expand an unlicensed student's legal scope of practice or access rights. C is incorrect as an absolute statement -- observation access may be permitted even without a license; it is active participation that requires licensure.
- A retail pharmacy uses an electronic dispensing system that automatically generates a record of each controlled substance prescription dispensed, including the prescriber, patient, drug, quantity, and dispensing pharmacist's ID. How long must these electronic dispensing records be retained under DEA regulations?
Answer: At least two years, consistent with the DEA minimum retention period for controlled substance records.
DEA regulations (21 CFR 1304.04) require controlled substance records -- including dispensing records generated by automated pharmacy systems -- to be maintained for a minimum of two years. Electronic format does not alter the retention requirement. B is incorrect because there is no extended retention period for electronic versus paper records under DEA rules; the two-year standard applies to both. C is incorrect because one year is below the federal minimum. D is incorrect because electronic controlled substance dispensing records are expressly subject to the DEA two-year retention requirement.
- Which of the following best describes the pharmacist-in-charge's primary responsibility regarding pharmacy access control?
Answer: Establishing, implementing, and enforcing policies that restrict pharmacy access to authorized personnel in compliance with state and federal law.
The PIC bears overall legal accountability for pharmacy compliance, which includes creating and enforcing access-control policies that meet DEA and state board requirements, training staff, and ensuring ongoing adherence. A is incorrect because personally escorting every non-pharmacy visitor is one way to fulfill the obligation, but the PIC's legal duty is to establish a compliant system -- not to perform every escort personally. B is incorrect because daily log review is a sound practice but is not a legally mandated frequency. D is incorrect because pharmacies are not required to submit routine access reports to the DEA; records must be maintained on site and made available for inspection upon request.
- A health system operates a central pharmacy that remotely verifies medication orders for a satellite pharmacy under a shared-services arrangement. Which of the following access-control considerations is most important for this arrangement?
Answer: The arrangement must include controls ensuring that only authorized personnel access medication records and that all remote access is logged and auditable.
Shared-services pharmacy arrangements are recognized under most state pharmacy laws but must include robust access controls. The arrangement must ensure that only authorized users can access records, that all access is logged, and that the audit trail satisfies both DEA recordkeeping requirements and state board compliance standards. A is incorrect because remote pharmacist verification from a central pharmacy is an accepted model under many state shared-services statutes. B is incorrect because DEA registration is tied to physical locations where controlled substances are stored and dispensed, not to remote software access for order verification. D is incorrect because DEA written approval is not required for shared-services arrangements; these are governed by state pharmacy law and the DEA registration requirements for each physical location.
- In a state that licenses pharmacy interns and permits them to perform dispensing functions under pharmacist supervision, a licensed intern is working at a community pharmacy. The pharmacist on duty is temporarily in the consultation room with a patient. May the intern access the prescription dispensing area and begin preparing a non-controlled prescription while the pharmacist is in the consultation room?
Answer: Yes, because the pharmacist is on the premises and immediately available, which satisfies the supervision requirement for a licensed intern under this state's pharmacy law.
In a state that grants licensed pharmacy interns authority to perform dispensing tasks under pharmacist supervision, the supervision standard requires the pharmacist to be on the premises and immediately accessible -- not physically co-located. Because the pharmacist is on-site and reachable, the supervision requirement is met. B is incorrect because interns do not have the same independent authority as licensed pharmacists; their work must occur under supervision. C is incorrect because licensed interns in states authorizing this practice are specifically permitted to perform preparatory dispensing functions under pharmacist oversight. D is incorrect because on-premises availability -- not physical presence in the same room -- is the prevailing supervisory standard.
- A staff pharmacist reports to the PIC that the key to the narcotic cabinet checked out at the start of her shift cannot be located after an hour of searching. What is the most appropriate next step?
Answer: Conduct an immediate inventory of the narcotic cabinet and change the lock; file DEA Form 106 if the inventory reveals a controlled substance shortage.
A missing key to a controlled substance cabinet creates an immediate security risk. The required steps are to conduct an inventory to detect any shortage and to change the lock to eliminate the vulnerability. If inventory reveals missing controlled substances, DEA Form 106 must then be filed. A is incorrect because waiting 24 hours allows a potential security breach to continue unaddressed. B is incorrect because DEA Form 106 is required for confirmed theft or significant loss of controlled substances, not for a missing key alone; the inventory must come first. D is incorrect because suspending the pharmacist is a personnel action that does not address the immediate controlled substance security obligation and should not precede inventory verification.
- A building maintenance worker needs to access the pharmacy's back room to repair a plumbing fixture, and no pharmacist is currently on duty. A pharmacy technician offers to escort the worker inside. Which of the following best describes the appropriate course of action?
Answer: Reschedule the maintenance work for a time when a pharmacist can be present to supervise access to the pharmacy area.
Non-pharmacy personnel should not access the pharmacy's dispensing and storage areas unless a pharmacist is present. The pharmacist bears responsibility for access-control security, and this responsibility cannot be delegated to a technician for non-employee access to secured areas. A is incorrect because a technician's employment status does not grant authority to supervise non-employee access to controlled areas; that responsibility belongs to the pharmacist. C is incorrect because building management vetting does not satisfy the pharmacy's independent security obligations under state and federal law. D is incorrect because verbal owner authorization does not substitute for the required on-site pharmacist supervision during non-employee access.
