(1) Establishments in which prescription drugs are stored, manufactured, repackaged, kept, held, used, sold, stored, offered for sale, or exposed for sale, shall be secured against unauthorized entry or unauthorized access to prescription drugs when establishment personnel are not present.
    (a) Establishments permitted under chapter 499, F.S., that are authorized to take possession of prescription drugs, other than medical oxygen, must be secured by an alarm system which functionally and practically provides a deterrent to unauthorized entry to the establishment or the area where the prescription drugs are held or stored.
    (b) Prescription medical oxygen may be stored outside in an area surrounded by a fenced enclosure with a lock which must be secure when authorized persons are not present. Other compressed medical gases must be stored in accordance with paragraph (a).
    (2)(a) While not being used to make deliveries, a vehicle of a permittee containing prescription medical oxygen must be parked at the permitted establishment and either locked inside a fenced compound or secured by a vehicle alarm system. A vehicle containing prescription medical oxygen may only be parked at a residence temporarily while the vehicle is making deliveries or while “”on call”” for emergency deliveries.
    (b) When a vehicle used for prescription drug wholesale distributions or for distributions subject to a restricted prescription drug distributor’s permit contains prescription drugs and is not being used to make deliveries, it must be parked inside a building secured by an alarm system.
    (c) A residence cannot be used to store any prescription drug which has not been dispensed, unless a natural person residing at that residence is licensed or otherwise authorized to possess prescription drugs.
    (3)(a) The storage temperature definitions in the U.S.P. are incorporated by reference herein. If no storage and temperature requirements are set forth by the manufacturer in the labeling or in the U.S.P., prescription drugs other than compressed medical gases must be stored at controlled room temperature. Compressed medical gases, unless otherwise indicated, may be stored in a manner so that they are protected from freezing and are not stored at or near excessive heat or open flame.
    (b) All establishments permitted under chapter 499, F.S., that handle prescription drugs other than medical gases, must, in the absence of electronic monitoring devices, mount two thermometers in the immediate area of the stored prescription drugs. For purposes of this provision, immediate area of the stored prescription drugs is within six (6) feet of the prescription drugs in storage. One thermometer will be mounted in the warmest area of the stored prescription drugs and the other thermometer will be mounted in the coolest immediate area of the stored prescription drugs.
    (c) A record must be maintained recording the date; time; thermometer one temperature; thermometer two temperature; and the initials of the person recording the data or reviewing the data if electronically monitored. This record and temperature reading must be recorded at least five (5) days each week with the temperature readings taken between 2:00 p.m. and 4:00 p.m. (EST). Alternate times may be approved by the department in writing. This record must be kept on file by the facility for at least two years.
    (d) Facility requirements for the storage and handling of prescription drugs.
    1. An applicant for an initial prescription drug wholesaler permit must have a facility that is large enough to store the estimated quantity of prescription drugs the applicant intends to possess under its initial application to comply with the requirements of Florida Statutes § 499.0121(1) An applicant for renewal of a prescription drug wholesaler permit must have a facility that is large enough for the ongoing operations of the wholesale establishment based on the prior year’s volume of activity with prescription drugs, which may be modified for reasonable fluctuations in inventory management for the current year. These determinations will be based on the type of prescription drugs the applicant possesses, or intends to possess, considering the size of the containers as well as any other products the applicant possesses or intends to possess. Notwithstanding the contention that an applicant will distribute all prescription drugs the same day received, the facility must be large enough to accommodate prescription drugs as set forth herein in case the drugs are not distributed the same day received.
    2. An applicant for an initial prescription drug wholesaler permit must have a refrigeration capacity and freezer capacity large enough to store the estimated quantity of prescription drugs that might require refrigeration or freezing that the applicant intends to possess under its initial application to comply with the requirements of sections 499.0121(1) and (3), F.S., and this rule. An applicant for renewal of a prescription drug wholesaler permit must have a refrigeration capacity and freezer capacity that is large enough for the ongoing operations of the wholesale establishment based on the prior year’s volume of activity with prescription drugs that required refrigeration or freezing, which may be modified for reasonable fluctuations in inventory management for the current year, to comply with the requirements of sections 499.0121(1) and (3), F.S., and this rule. These determinations will be based on the type of prescription drugs the applicant possesses, or intends to possess, considering the size of the containers as well as any other products the applicant possesses or intends to possess that might require refrigeration or freezing. Notwithstanding the contention that an applicant will distribute all prescription drugs the same day received, the refrigeration and freezer capacity must be large enough to accommodate prescription drugs as set forth herein in case the drugs are not distributed the same day received.
    3. Prescription drugs obtained in “”limited quantities”” for research and development (“”R&D””) purposes under sections 499.01(3) and (4)(b), F.S., and Fl. Admin. Code R. 61N-1.001(2)(n), must be physically segregated from all other products intended for manufacturing, compounding, dispensing, or administration. In a manufacturer’s establishment, these drugs must also be stored and maintained in a separate and clearly designated area.
    (4) Quarantine.
    (a) A quarantine section shall be clearly marked and designated separate and apart from any other place where drugs are stored so that products therein shall not be confused with usable products being held for sale. Any prescription drug stored outside the quarantine area is a product held for sale or other distribution.
    (b) The requirement of section 499.0121(5)(b), F.S., that prescription drugs must be quarantined if damage has occurred to the immediate or sealed outer or sealed secondary containers means: a prescription drug must be quarantined if obvious damage, determined by a visual inspection of the exterior of the product’s packaging, has occurred to any part of the packaging that is or may be in direct contact with the dosage form of the drug or any additional part of the packaging which is provided to prevent adulteration of the drug in addition to “”containing”” the product.
    (c) A person who handles both prescription drugs and over-the-counter drugs or medical devices may have one quarantine section; however, the storage requirements for prescription drugs must be followed.
    (5) Examination of Prescription Drugs; Physical Product and Records.
    (a)1. Every person receiving prescription drugs other than the consumer receiving dispensed prescription drugs pursuant to chapter 465, F.S., has a duty to examine the product to prevent acceptance of prescription drugs that are unfit for distribution or use. The extent of the examination should be predicated on the conditions surrounding the transaction, including but not limited to any previous sales of the product, i.e., purchase and delivery is not direct from the manufacturer; the conditions of transport; and environmental conditions to which the product may have been subjected.
    2. A wholesaler, chain pharmacy warehouse, or person authorized to administer or dispense a prescription drug that physically receives a prescription drug must verify that the prescription drug received matches the prescription drug identified on the corresponding pedigree. The corresponding pedigree document shall contain all of the required information described in sections 499.01212(2)(a) or (b), F.S. as applicable, including the information required in the forms described in subsection 61N-1.012(3), F.A.C., for those distributions that are not eligible for the use of the direct purchase pedigree.
    (b) Upon receipt, each outside shipping container must be visually examined for identity and to prevent the acceptance of misbranded drugs, adulterated drugs or prescription drugs that are otherwise unfit for distribution. If visual examination of the shipping container or other conditions surrounding the transaction suggest possible misbranding or adulteration, the person has a duty to examine further the contents or conditions of sale.
    (c) Prescription Drug Wholesalers must employ personnel who can perform product examinations. Once the Prescription Drug Wholesaler has inspected the shipped drugs and elected to accept them, the wholesaler is responsible for the condition of the drugs. Until that time, the shipper or manufacturer remains responsible for delivering a prescription drug product in acceptable condition, unless responsibilities are modified by contract.
    (d) Authentication.
    1. A prescription drug wholesaler may use any, all, or any combination of the following methods to authenticate each transaction on a pedigree paper and must maintain the corresponding documentation regarding the authentication for the method used:
    a. Receipt of an invoice (or shipping document) from the seller to the purchaser, which may have the prices redacted. Documentation requirements include at a minimum a copy of the invoice or shipping document. If this method is used to authenticate a pedigree, the wholesaler must review the document received for signs of tampering, incompleteness, or inconsistency with other invoices or shipping documents from that manufacturer or wholesaler, and must randomly verify the authenticity of the invoice or shipping document with the seller or shipping point reflected on that document using one of the methods in sub-subparagraph b., c., or d., below. Each wholesaler shall establish and adhere to policies and procedures for the random verification of the authenticity of the invoices or shipping documents according to statistically valid standards.
    b. Telephone call to the seller. Documentation requirements include a signed statement by the person placing the telephone call identifying the person’s name and position title representing the seller who provides the information, the date the information was provided, and verification of the sales transaction between the parties, including verification of the date of the transaction and the quantity of prescription drugs involved in the transaction.
    c. Email communication with the seller. Documentation requirements include a copy of the email that identifies the person’s name and position title representing the seller who provides the information, the date the information was provided, and verification of the sales transaction between the parties, including verification of the date of the transaction and the quantity of prescription drugs involved in the transaction.
    d. Verification of the transaction per a web-based system established by the seller or an independent person that is secure from intentional or unintentional tampering or manipulation to conceal an accurate and complete history of the prescription drug transaction(s). Documentation requirements include a written representation from the seller or independent person that the seller or independent person, as applicable, is responsible for the information included on the web site and has adequate security on the information posted to prevent unauthorized tampering, manipulation, or modification of the information and a copy of the (dated) web site page that confirms the sales transaction between the parties, including the date of the transaction and the quantity of prescription drugs involved in the transaction.
    e. Receipt of a legible and unaltered copy of a previous transaction’s pedigree paper that had been signed under oath at the time of the previous transaction to support the transaction to which the pedigree paper relates. If this method is used to authenticate a pedigree, the wholesaler must review the document received for signs of tampering, incompleteness, or inconsistency, and must randomly verify the authenticity of pedigrees using one of the methods in sub-subparagraph b., c., or d., above. Each wholesaler shall establish and adhere to policies and procedures for the random verification of the authenticity of these copies of pedigrees according to statistically valid standards.
    f. Receipt of a pedigree in an electronic form from an automated system that complies with this sub-subparagraph that was successfully opened and decrypted by an automated system that complies with this sub-subparagraph. In order to rely on receipt of an electronic pedigree without employing additional authentication methods as set forth in sub-subparagraphs a.-e.,
    (I) The system used to digitally sign and electronically authenticate the electronic pedigree must at a minimum support the following digital signature standards or future revisions governed by the National Institute of Standard and Technology (NIST):
    (A) FIPS 140-2 validated cryptographic module which is hereby adopted by reference;
    (B) FIPS 186-2 validated digital signature system which is hereby adopted by reference;
    (C) FIPS 180-2 validated hash function which is hereby adopted by reference;
    (II) The system must employ controls to ensure the security and integrity of the private key so that it cannot be accessed by someone other than the certificate holder. At a minimum, the system must:
    (A) Control the activation of the private key with an authentication mechanism;
    (B) Employ a ten-minute inactivity time period after which the certificate holder must re-authenticate to access the private key;
    (C) When the signing module is deactivated, clear the plain text private key from the system memory to prevent the unauthorized access to, or use of, the private key;
    (III) The system must communicate with the Certification Authority directory, either each time authentication and validation steps in sub-subparagraph (IX) below occur or at least on a daily basis to download information to perform the authentication and validation which will occur on that day.
    (IV) The system must have a time system that is within five minutes of the official NIST time source and date and time stamp any and all digital signatures.
    (V) The system must archive digitally signed files unaltered, including the original hashes and reference to the public keys, in a manner that facilitates retrieval of the record consistent with the recordkeeping requirements.
    (VI) The system must prevent issuance of an outgoing pedigree paper if the total quantity of prescription drugs distributed in all pedigrees exceeds the quantity of prescription drugs received in the corresponding incoming electronic pedigree.
    (VII) The system must maintain a history file of any outgoing electronic pedigree that is subsequently voided or altered and notify the recipient that the pedigree sent to it was voided or altered.
    (VIII) The system must maintain a history file of any incoming notification received pursuant to sub-sub-subparagraph (VII) above that a pedigree was voided or altered and prevent the issuance of an outgoing pedigree using a pedigree that was voided or altered.
    (IX) The system must verify or perform the following:
    (A) Each transaction on the electronic pedigree must be digitally signed using certificates issued through a public key infrastructure system authorized by the department.
    (B) The electronic pedigree must contain each prior transaction digitally signed and unaltered, including the original hash and reference to the public key, with the new transaction information appended to the new document and the entire resulting pedigree digitally signed, including the resulting hash and reference to the public key.
    (C) The system must check the certificate expiration date of each signed transaction and compare it against the date and time that the transaction was signed to determine that the certificate has not or had not expired at the time the record was signed.
    (D) The system must check the digital signature for each signed transaction against the Certificate Authority’s directory and the Certificate Revocation List and verify whether the certificate holder is or was authorized to sign electronic pedigrees at the time the transaction was signed.
    (E) The system must decrypt each digital signature for each signed transaction in the pedigree using each sender’s public key and compare it against the message digest to determine that the record has not been altered since it was originally signed.
    (F) The system must require that all authentication and validation steps in the preceding paragraphs are carried out prior to allowing the acceptance of the transaction. The system should not allow the further processing of any transaction that has failed to pass any authentication or validation step.
    (X)(A) The manufacturer must initiate the pedigree; or, until such time as the manufacturer initiates a pedigree to the wholesaler, the wholesaler that purchased the prescription drug from the manufacturer must imbed a copy of the sales invoice or the manufacturer’s EDI transmission or Advance Ship Notice (ASN) that contains all required data elements for a complete audit trail as set forth in Fl. Admin. Code R. 61N-1.012, related to that wholesaler’s acquisition of the prescription drug from the manufacturer. Price information related to the transaction may be redacted from the imbedded copy of the sales invoice, the EDI transmission, or the ASN.
    (B) If a pedigree complies with all provisions within sub-subparagraph f. except for sub-sub-sub-subparagraph (X)(A), above, then a prescription drug wholesaler must use another method authorized by this rule to authenticate the distribution from the manufacturer to the first wholesaler. Subsequent distributions may be authenticated in accordance with sub-subparagraph f.
    2. If a pedigree cannot be authenticated because of a clerical error, the pedigree must be corrected by the sender.
    3. If a pedigree cannot be authenticated and the reason is other than a clerical error, or the reason cannot be satisfactorily ascertained based on preliminary investigation, the prescription drug for which the pedigree cannot be authenticated must be quarantined and the department notified within 3 business days.
    4. A purchasing wholesaler may use a written contract between the purchasing wholesaler and its wholesale supplier, which is a primary wholesaler as defined in section 499.012(1)(d), F.S., that requires that all prescription drugs distributed to the purchasing wholesaler by the wholesale supplier must be purchased by the wholesale supplier from the manufacturer. If this method is used to authenticate a pedigree, the purchasing wholesaler shall establish and adhere to policies and procedures for the random verification of the authenticity of the pedigrees that disclose the supplier wholesaler purchased the prescription drug from the manufacturer according to statistically valid standards.
    5. The following persons in Florida that are authorized to purchase or possess prescription drugs are not required to authenticate a pedigree paper received from a person authorized by law to distribute prescription drugs to that person:
    a. A licensed pharmacy, unless it is also permitted as a retail pharmacy wholesaler and will engage in the wholesale distribution of that drug, or unless it is a member of an affiliated group and will distribute a prescription drug purchased or received directly from a prescription drug wholesaler that is not also a member of its affiliated group to another member of its affiliated group;
    b. A medical practitioner; or
    c. A restricted prescription drug distributor – health care entity.
    6. In order to authenticate pedigrees, a manufacturer of a prescription drug that is sold or distributed in Florida must make available upon request information relevant to authenticating a pedigree for that drug regardless of whether the prescription drug was sold directly by the manufacturer to a person in Florida.
    7. Any wholesaler or repackager required under chapter 499, F.S., to receive a pedigree paper must authenticate the pedigree pursuant to Florida Statutes § 499.0121(4), notwithstanding the absence of a pedigree paper or authentication by persons in the distribution chain not subject to the requirements of chapter 499, F.S.
    (6) Any establishment that is permitted as a prescription drug wholesaler or repackager must notify the department in writing within three working days of discovery of a significant loss or theft of prescription drugs. Whether a loss or theft is significant is to be based on the prescription drug wholesaler’s written policies and procedures that may take into account the actual quantity in relation to the type or size of the business; any pattern of losses or thefts; and local trends or other indicators of the diversion potential. Notification to the Drugs, Devices and Cosmetic Program may be made by facsimile to (850)414-8240 and must include at a minimum, identification of the permitted establishment reporting the loss or theft; a complete identification of the prescription drug(s) involved, including but not limited to the name of the manufacturer or distributor reflected on the label of the products, the dosage form, strength, container size, the quantity of each, the lot numbers if known; a brief description of the circumstances surrounding the theft or loss; and a contact person’s name and telephone number to provide additional information.
    (7) Due Diligence Inspection. With respect to the inspection required under section 499.0121(12)(e), F.S., a prescription drug wholesaler may rely on a due diligence inspection performed by a person that is independent of both wholesalers for purposes of the requirement in section 499.0121(12)(e), F.S.
Rulemaking Authority 499.0121(1), 499.05 FS. Law Implemented 499.006, 499.007, 499.01, 499.0121, 499.028(6), 499.052 FS. History-New 7-8-84, Amended 1-30-85, Formerly 10D-45.535, Amended 11-26-86, 7-1-96, Formerly 10D-45.0535, Amended 1-26-99, 4-17-01, 1-1-04, 1-19-06, 11-18-07, Formerly 64F-12.013, Amended 11-16-15.