September is the perfect time for a mid-year training check. We are past the summer slump, new hires from the busy season are settling in, and there is still enough runway to close any gaps before year-end audits. If training documentation is the weakest part of your compliance program - and for most pharmacies, it is - this newsletter is your action plan.
Regulatory Update: CMS Strengthens FWA Training Requirements for Part D
CMS has continued to tighten compliance program requirements for Medicare Part D plan sponsors, and those requirements flow down to network pharmacies. Under current guidance, pharmacies participating in Medicare Part D must ensure that their workforce receives training on Fraud, Waste, and Abuse within 90 days of hire and annually thereafter. This is not optional, and it is not satisfied by a generic orientation session.
FWA training must cover the definition of fraud, waste, and abuse in the context of federal healthcare programs, the laws and regulations that address FWA (including the False Claims Act, the Anti-Kickback Statute, and the Stark Law as applicable), how to report suspected FWA through your internal compliance program and to external entities like the OIG and CMS, and the protections available for whistleblowers.
If you are a PSAO member, your PSAO may offer FWA training resources. But using a PSAO resource does not relieve you of the responsibility to ensure every workforce member completes the training and that completion is documented.
The Complete Pharmacy Training Requirement Checklist
Here is every training topic your pharmacy staff should be current on, broken down by requirement source.
From HIPAA: Privacy and security awareness training for all workforce members, within a reasonable time after hire and when material changes occur. Best practice is annual refresher training, documented with dates and signatures.
From DEA and state boards: Controlled substance handling, corresponding responsibility, and PDMP use. Most state boards require continuing education on controlled substance topics as part of license renewal, but your internal training should go beyond CE requirements to cover your specific pharmacy policies.
From CMS (Medicare Part D): Fraud, Waste, and Abuse training within 90 days of hire and annually. General compliance training covering your compliance program structure, code of conduct, and reporting mechanisms.
From OSHA: Bloodborne pathogen training if staff may be exposed (pharmacy-based immunization programs), hazard communication training if you handle hazardous drugs, and workplace safety orientation.
From USP (if applicable): USP 795, 797, and 800 training for pharmacies that compound. This includes initial competency assessments and ongoing training specific to the types of compounding performed.
For each topic, you need three things in your training file: the training content or materials used, the date the training was completed, and a signature or electronic acknowledgment from each employee who completed it. Missing any one of these three elements and the training is as good as undocumented.
HIPAA Training: What Actually Counts
HIPAA training requirements are more flexible than most people think, but that flexibility is not a license to cut corners. The HIPAA Privacy Rule requires training on your policies and procedures for all workforce members. The Security Rule requires security awareness training. There is no prescribed curriculum, duration, or format.
That said, effective HIPAA training for pharmacy staff should cover patient rights (access, amendment, accounting of disclosures), minimum necessary standard, proper PHI disposal, workstation security, breach identification and reporting, and your specific pharmacy policies.
Online courses work fine, but make sure the content is specific to pharmacy settings - not generic healthcare training. A 20-minute module that covers how to handle a patient who wants to pick up a prescription for their spouse is more valuable than a two-hour lecture on the history of HIPAA legislation.
Pro tip: keep a training binder at each pharmacy location with printed completion certificates, sign-in sheets, and training materials. When an auditor asks to see your training records, handing them a complete, organized binder makes a strong first impression.
Building a Training Calendar That Sticks
The biggest training problem we see is not that pharmacies refuse to train - it is that training happens sporadically, is poorly documented, and new hires fall through the cracks. Here is a simple system that works.
Create a training matrix spreadsheet with every employee name in rows and every required training topic in columns. In each cell, enter the date of the most recent completion. Color-code the cells: green for current (within 12 months), yellow for expiring within 60 days, and red for expired. Review this matrix on the first of every month.
Schedule annual training in two blocks - one in January and one in July. By splitting it into two sessions six months apart, you avoid the year-end scramble and you catch mid-year hires before they drift past their deadlines.
For new hires, build a training checklist into your onboarding process. Every new employee should complete HIPAA privacy and security training, FWA training, controlled substance policies review, and pharmacy-specific P&P orientation within their first 90 days - ideally within their first two weeks.
Track everything in one place, whether that is a shared spreadsheet, your HR system, or a compliance platform like Rxperts. The format matters less than the consistency.
Quick Hits
- Audit every employee training file for current HIPAA and FWA completion
- Verify new hires from the past 6 months completed all required training within 90 days
- Update your training matrix and identify anyone with expired or expiring certifications
- Schedule a mid-year training session for topics due for annual renewal
- Confirm USP training is current for all compounding staff
- Organize training documentation into a presentable format for auditors
Stay compliant. Stay ahead. - The Rxperts Team