Compliance and safety considerations for running an online pharmacy
This article first appeared in Communication Journal, a publication of Pharmacists Manitoba.
Pharmacists who own or operate an online pharmacy or a website for their brick-and-mortar pharmacy must navigate a complex landscape of legal and regulatory requirements to ensure operations are both compliant and secure. Beyond obtaining the necessary licences from the relevant pharmacy regulatory authority, your online pharmacy’s success requires developing, operating and properly maintaining your online presence.
This article covers, at a high level, key issues to consider when operating an online pharmacy.
Regulatory framework in Manitoba
Pharmacies in Manitoba cannot operate only on an online basis. They must also operate a community pharmacy with a brick-and-mortar location for patients to attend for their care. To be clear, this is a requirement even if most – or virtually all – of the online pharmacy’s patients are residents outside of Manitoba.
With approval from the College of Pharmacists of Manitoba (“College”), a “distance care” component can be added to community pharmacies’ licenses to allow them to service patients not resident in Manitoba.
There are two types of distance care licensure components: (1) those for International Prescription Services (“IPS”) pharmacies that will fill prescriptions for patients who have not physically attended the pharmacy because they are resident outside of Canada; and (2) those for distance care pharmacies that will fill prescriptions for those outside Manitoba but present in Canada and who have not physically attended the pharmacy. Even if a pharmacy has a primary focus towards online retail sales, the pharmacy must:
- Be open at least 25 hours over a minimum of four days per week;
- Be able to be contacted by distant patients with reasonable ease and without charge for the contact (for example, toll-free telephone numbers);
- Have a Manitoba-licensed pharmacist available to respond to contacts from distant patients at least 37.5 hours per week; and
- Comply with all the College’s practice directions, including those regarding distance care pharmacies.
Protecting your online pharmacy operations
Pharmacies should be alert to the unique risks associated with conducting business online. Consider the following issues:
1. Website ownership:
One of the first steps is to secure ownership of all essential intellectual property (“IP”). This includes ensuring that any website development arrangements are documented and the developer transfers ownership of the website and its contents – including all underlying IP – to the pharmacy owner. This step is crucial to maintain control over your online presence and protect against potential future disputes.
2. Domain name protection:
Domain names represent your brand and identity online and are the primary method your patients have to communicate with your IPS pharmacy. Protecting your domain name will help secure the goodwill you build with patients and protect these patients from bad actors. You can protect your domain name in several ways.
First, consider registering your domain name as a trademark with the Canadian Intellectual Property Office (“CIPO”). A trademark is a word, phrase, logo or other symbol that identifies the source of goods or services for consumers. While registering your trademark with CIPO is not mandatory, doing so allows you to protect your mark across Canada and stop others from registering confusingly similar marks.
Secondly, reserve your domain name with a reputable domain name registrar that has demonstrated expertise in cybersecurity controls and processes. This is important because bad actors try to hack domain name registrars to steal and use domain names to divert web traffic to malicious sites.
Thirdly, reserve variations of your domain name to protect against bad actors who use similar domain names to benefit from your reputation or attempt to scam your patients (this is known as “typosquatting” or “cybersquatting”). Finally, conduct regular web searches of your domain names (or similarly spelled domain names) and trademarks to identify potential infringement issues and allow for timely action.
3. Terms of Use:
In addition, developing comprehensive Terms of Use for your website is essential. Terms of Use establish clear guidelines for patients, outlining the rules and expectations for using your online pharmacy platform. Terms of Use help protect your pharmacy from legal liabilities and ensure patients understand their own rights and responsibilities. For example, if you operate an IPS pharmacy that serves patients outside of Canada, there should be express provisions confirming that the transaction takes place in Manitoba and that any dispute will be governed by the laws of Manitoba (as opposed to the state or territory in which the patient resides).
4. Privacy Policy:
Developing a privacy compliance program is critical for protecting against cybersecurity threats. As part of your compliance program you will need to have a privacy officer. Additionally, you will also need to develop a Privacy Policy, which is critical for obtaining informed consent from patients. This policy should describe the types of personal information collected, the methods of collection and how personal information will be used, protected and shared. Given the sensitivity of personal health information, the Privacy Policy must comply with applicable personal health information statutes. Finally, the key to safeguarding patient information stored by your pharmacy or a third party is to implement, or contractually require, the third party to implement, technical, physical and organizational security measures.
5. Advertising restrictions:
Pharmacists and pharmacies are required by their regulators to adhere to certain advertising standards. A failure to do so can result in the regulator taking action against that pharmacy or pharmacist. For example, in Manitoba all written material regarding a pharmacy or pharmacy services must contain factual, verifiable information only, and cannot use descriptive or qualifying words like “professional,” “trusted,” “prompt,” “best,” “discounted,” “licensed,” “accurate,” “cheap” or words of a similar intent. If the pharmacy is advertising a service that all pharmacies must provide, the advertisement must state that the service is “required by law in all Manitoba pharmacies.”
Drugs that are listed in a Schedule to the Controlled Drugs and Substances Act (Canada) cannot be advertised at all. There are also stringent requirements regarding the advertisement of prices and fees. IPS pharmacies have additional advertising requirements and considerations imposed on them, including a mandatory disclaimer required on all websites.
It must be emphasized that, in addition to the considerations that have been described above, there are unique regulatory and legal considerations and risks applicable to IPS pharmacies.
It is strongly recommended that pharmacists and pharmacy owners considering or developing an online pharmacy or pharmacy website consult with legal counsel to ensure that the operations, websites and required agreements are set up in accordance with all applicable laws.
Note: This article is of a general nature only and is not exhaustive of all possible legal rights or remedies. In addition, laws may change over time and should be interpreted only in the context of particular circumstances such that these materials are not intended to be relied upon or taken as legal advice or opinion. Readers should consult a legal professional for specific advice in any particular situation.
