(a) An entity conducting a pharmacy audit under this article shall conform to the following rules:

1. (1) Except as otherwise provided by federal or state law, an auditing entity conducting a pharmacy audit may have access to a pharmacy’s previous audit report only if the report was prepared by that auditing entity.
2. (2) Information collected during a pharmacy audit is confidential by law, except that the auditing entity conducting the pharmacy audit may share the information with the pharmacy benefits manager and with the covered entity for which a pharmacy audit is being conducted and with any regulatory agencies and law-enforcement agencies as required by law.
3. (3) The auditing entity conducting a pharmacy audit may not compensate an employee or contractor with which an auditing entity contracts to conduct a pharmacy audit solely based on the amount claimed or the actual amount recouped by the pharmacy being audited.
4. (4) The auditing entity shall provide the pharmacy being audited with at least 14 calendar days" prior written notice before conducting a pharmacy audit unless both parties agree otherwise. If a delay of the audit is requested by the pharmacy, the pharmacy shall provide notice to the pharmacy benefits manager within 72 hours of receiving notice of the audit.
5. (5) The auditing entity may not initiate or schedule a pharmacy audit without the express consent of the pharmacy during the first five business days of any month for any pharmacy that averages in excess of 600 prescriptions filled per week.
6. (6) The auditing entity shall accept paper or electronic signature logs that document the delivery of prescription or nonproprietary drugs and pharmacist services to a health plan beneficiary or the beneficiary’s caregiver or guardian.
7. (7) Prior to leaving the pharmacy after the on-site portion of the pharmacy audit, the auditing entity shall provide to the representative of the pharmacy a complete list of pharmacy records reviewed.
8. (8) A pharmacy audit that involves clinical judgment shall be conducted by, or in consultation with, a pharmacist.

9. (9) A pharmacy audit may not cover:

   1. (A) A period of more than 24 months after the date a claim was submitted by the pharmacy to the pharmacy benefits manager or covered entity unless a longer period is required by law; or
   2. (B) More than 250 prescriptions: Provided, That a refill does not constitute a separate prescription for the purposes of this subparagraph.
10. (10) The auditing entity may not use extrapolation to calculate penalties or amounts to be charged back or recouped unless otherwise required by federal requirements or federal plans.
11. (11) The auditing entity may not include dispensing fees in the calculation of overpayments unless a prescription is considered a misfill. As used in this subdivision, "misfill" means a prescription that was not dispensed, a prescription error, a prescription where the prescriber denied the authorization request, or a prescription where an extra dispensing fee was charged.

12. (12) The auditing entity conducting a pharmacy audit or person acting on behalf of the auditing entity may not seek any fee, charge-back, recoupment, or other adjustment for a dispensed product, or any portion of a dispensed product, unless one of the following has occurred:

    1. (A) Fraud or other intentional and willful misrepresentation as evidenced by a review of the claims data, statements, physical review, or other investigative methods;
    2. (B) Dispensing in excess of the benefit design, as established by the plan sponsor;
    3. (C) Prescriptions not filled in accordance with the prescriber’s order; or
    4. (D) Actual overpayment to the pharmacy.
13. (13) Any fee, charge-back, recoupment, or other adjustment is limited to the actual financial harm associated with the dispensed product, or portion of the dispensed product, or the actual underpayment or overpayment as set forth in the criteria in subdivision (12) of this subsection.

14. (14) A pharmacy may do any of the following when a pharmacy audit is performed:

    1. (A) A pharmacy may use authentic and verifiable statements or records, including, but not limited to, medication administration records of a nursing home, assisted living facility, hospital, or health care provider with prescriptive authority, to validate the pharmacy record and delivery; and
    2. (B) A pharmacy may use any valid prescription, including, but not limited to, medication administration records, facsimiles, electronic prescriptions, electronically stored images of prescriptions, electronically created annotations, or documented telephone calls from the prescribing health care provider or practitioner’s agent, to validate claims in connection with prescriptions or changes in prescriptions or refills of prescription or nonproprietary drugs. Documentation of an oral prescription order that has been verified by the prescribing health care provider shall meet the provisions of this subparagraph for the initial audit review.

(b) An auditing entity shall provide the pharmacy with a written report of the pharmacy audit and comply with the following requirements:

1. (1) A preliminary pharmacy audit report shall be delivered to the pharmacy or its corporate parent within 60 calendar days after the completion of the pharmacy audit. The preliminary report shall include contact information for the auditing entity that conducted the pharmacy audit and an appropriate and accessible point of contact, including telephone number, facsimile number, e-mail address, and auditing firm name and address so that audit results, procedures and any discrepancies can be reviewed. The preliminary pharmacy audit report shall include, but not be limited to, claim level information for any discrepancy found and total dollar amounts of claims subject to recovery.
2. (2) A pharmacy is allowed at least 30 calendar days following receipt of the preliminary audit report to respond to the findings of the preliminary report.
3. (3) A final pharmacy audit report shall be delivered to the pharmacy or its corporate parent no later than 90 calendar days after completion of the pharmacy audit. The final pharmacy audit report shall include any response provided to the auditing entity by the pharmacy or corporate parent and shall consider and address such responses.
4. (4) The final audit report may be delivered electronically.
5. (5) A pharmacy may not be subject to a charge-back or recoupment for a clerical or recordkeeping error in a required document or record, including a typographical or computer error, unless the error resulted in overpayment to the pharmacy.
6. (6) An auditing entity conducting a pharmacy audit or person acting on behalf of the entity may not charge-back, recoup, or collect penalties from a pharmacy until the time to file an appeal of a final pharmacy audit report has passed or the appeals process has been exhausted, whichever is later.
7. (7) If an identified discrepancy in a pharmacy audit exceeds $25,000, future payments to the pharmacy in excess of that amount may be withheld pending adjudication of an appeal.
8. (8) No interest accrues for any party during the audit period, beginning with the notice of the pharmacy audit and ending with the conclusion of the appeals process.
9. (9) Except for Medicare claims, approval of drug, prescriber, or patient eligibility upon adjudication of a claim may not be reversed unless the pharmacy or pharmacist obtained adjudication by fraud or misrepresentation of claims elements.