hipaa
Allergies, Sudafed, HIPAA, a prescription, and the logbook/databse
<p>A few years ago I learned about the Sudafed logbook-that-is-implemented-as-a-database. I had to do my own research about it because the person at the Walmart pharmacy didn't know anything and stammered out a few things, most of which made no sense.</p>

<p>While doing research, I discovered several believable stories of people buying sudafed for allergies, yet were harassed and/or arrested by their local authorities. One particular example: http s://www.alternet.org/woman-allergies-arrested-and-imprisoned-buying-sudafed</p>

<p>Putting your name in a controlled item database increases your risk to get arrested for possessing the controlled item. Fundamentally and unarguably. I'm not interested in getting arrested, nor trying to fight a legal battle if I do. Also, I'm not interested in doing anything illegal.</p>

<p>I had thought that getting a prescription for Sudafed would solve my problem, since HIPAA should come into play. As far as I am aware of, it should, and it did (years ago I managed to get a Doctor to prescribe me some Sudafed). I stopped going to that doctor, and I think he died (old age), so I didn't get any more Sudafed, nor could I go back.</p>

<p>Recently, I talked to a nurse and a pharmacy tech involved in my treatment and they said that HIPAA would not apply and that I'd still be logged in the database.</p>

<p>Complaining about being in a database sounds kind of kooky, and people make out to be moreso than it is. However, knowing a couple things about how forensics, analytics, and the legal ramifications of how computing systems work, if you leak any information anywhere at any time, it can and will be used against you.</p>

<p>I had heard that Sudafed's replacement is not effective, so I haven't tried it yet. Due to these hurdles, I'm thinking of giving it a try to see if it works for me. I use Claritan and Flonase as well, but it seems that I have different symptoms based on different allergens, so depending on the problem I use one or all of the three.</p>

<p>Does buying OTC Sudafed enable the protections of HIPAA? Or do you and/or the pharmacy still have to record your details into the logbook/database?</p>

<p>The "logbook" is required by federal law, part of the <a href="https://www.deadiversion.usdoj.gov/meth/cma2005.htm" rel="nofollow noreferrer">Combat Methamphetamine Epidemic Act of 2005</a>.  See <a href="https://www.law.cornell.edu/uscode/text/21/830" rel="nofollow noreferrer">21 USC 830 (e) (1) (A)</a>:</p>

<blockquote>
  <p>Each regulated seller shall ensure that, subject to subparagraph (F), sales by such seller of a scheduled listed chemical product at retail are made in accordance with the following [...] (ii) The seller maintains, in accordance with criteria issued by the Attorney General, a written or electronic list of such sales that identifies the products by name, the quantity sold, the names and addresses of purchasers, and the dates and times of the sales (which list is referred to in this subsection as the “logbook”), except that such requirement does not apply to any purchase by an individual of a single sales package if that package contains not more than 60 milligrams of pseudoephedrine.</p>
</blockquote>

<p>"Scheduled listed chemical" is defined in <a href="https://www.law.cornell.edu/uscode/text/21/802" rel="nofollow noreferrer">21 USC 802 (45)</a> and includes pseudoephedrine (the active ingredient of Sudafed).</p>

<p>As you can see, no distinction is drawn between prescription and OTC purchases.</p>

<p><a href="https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act" rel="nofollow noreferrer">HIPAA</a> became law in 1996.  I'm not sure whether HIPAA would normally forbid the keeping of such a logbook (it mostly restricts how a provider can <em>disclose</em> information, not so much how it can <em>store</em> information), but even if it did, CMEA was passed later, so it would take precedence.  Thus there is no way to "enable HIPAA" to avoid CMEA's requirements.</p>

<p>(The passage quoted above does indicate a possible way to avoid the logbook: buy less than 60 mg at a time.  That seems to correspond to two standard tablets.   However, it's conceivable that a pharmacy might decide it wants to put such purchases in its logbook anyway; it's not clear to me that HIPAA or any other law would forbid them from making that a condition of purchase.)</p>

<p>There may also be specific laws in your state placing further restrictions on pseudoephedrine purchases.</p>
