Compliance Policy

BorrowDrugs operates a platform that facilitates emergency drug lending between licensed healthcare facilities and providers. Because the Platform involves prescription medications — including controlled substances — all users must comply with a complex web of federal and state regulations.

This Compliance Policy summarizes the key regulatory obligations that apply to your use of the Platform. It is not a substitute for legal counsel or a comprehensive compliance program. You are responsible for maintaining your own compliance program appropriate to your facility type, size, and jurisdiction.

Transfer Between DEA Registrants (21 C.F.R. § 1307.11): A DEA registrant may transfer controlled substances to another DEA registrant for the purpose of general dispensing to patients, subject to the following conditions:

• The transfer may not exceed 5% of the total number of dosage units of all controlled substances distributed and dispensed by the registrant during the 12-month period in which the transfer occurs
• If the 5% threshold is exceeded, the transferring registrant must obtain a DEA distributor registration
• Both parties must be DEA registrants with active registrations
• Schedule II transfers require a DEA Form 222 or CSOS electronic equivalent — no exceptions
• Schedule III–V transfers require a written record including: date, names and addresses of both parties, DEA registration numbers, drug name, strength, dosage form, and quantity
• Records must be maintained for 2 years and be readily retrievable for DEA inspection

Schedule II Specific Requirements: Transfers of Schedule II controlled substances (e.g., morphine, oxycodone, fentanyl, amphetamines) require a DEA Form 222 (paper) or CSOS (Controlled Substance Ordering System) electronic order. The Platform generates supporting documentation but does NOT generate DEA Form 222 or CSOS orders — you must complete these separately.

Emergency Dispensing: In genuine emergencies, a pharmacist may dispense a Schedule II substance upon oral authorization of a prescribing practitioner, provided a written prescription is furnished within 7 days (21 C.F.R. § 1306.11(d)). This provision applies to dispensing to patients, not to facility-to-facility transfers.

DEA Registration Verification: Before completing any controlled substance transfer, you must verify that the counterparty holds a current, active DEA registration for the appropriate schedule(s). The Platform displays NPI verification status but does not independently verify DEA registration status in real time — you are responsible for confirming DEA registration currency.

The Drug Supply Chain Security Act (21 U.S.C. § 360eee et seq.) establishes a national electronic system for tracing prescription drugs through the supply chain. Key DSCSA requirements for Platform users:

• Transaction Information (TI): Each transfer must be accompanied by the drug\'s proprietary name, strength, dosage form, NDC number, container size, number of containers, lot number(s), transaction date, shipment date, and name/address/license number of each party
• Transaction History (TH): The complete prior transaction history of the product, from the manufacturer to the current transfer
• Transaction Statement (TS): A statement that the transferring party is authorized under DSCSA, acquired the product from an authorized trading partner, did not knowingly ship suspect or illegitimate product, and has systems to comply with DSCSA
• DSCSA documentation must be maintained for 6 years
• Suspect or illegitimate product must be quarantined and reported to FDA within 24 hours of determination
• Saleable returns must include original TI/TH/TS or a statement that the product was not sold or transferred after the original purchase

The Platform provides documentation fields to support DSCSA compliance. You are responsible for ensuring all required DSCSA information is complete and accurate before completing a transfer.

The Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations (45 C.F.R. Parts 160 and 164) apply to covered entities and their business associates. Key obligations for Platform users:

• Do not include Protected Health Information (PHI) — patient names, dates of birth, medical record numbers, diagnoses, or other individually identifiable health information — in any Platform field not specifically designated for PHI
• Drug lending transactions on the Platform are facility-to-facility transfers and should not reference individual patients
• If your use of the Platform involves PHI (e.g., patient-specific emergency supply), you must have a Business Associate Agreement (BAA) in place with BorrowDrugs — contact [email protected]
• Implement appropriate administrative, physical, and technical safeguards to protect any PHI accessed through the Platform
• Report any suspected breach of PHI to BorrowDrugs within 24 hours at [email protected]

Minimum Necessary Standard: Use and disclose only the minimum PHI necessary to accomplish the intended purpose. The Platform is designed for facility-level drug inventory management, not patient-level data.

Security Rule: Ensure that devices used to access the Platform comply with your organization's HIPAA Security Rule policies, including encryption, access controls, and audit logging.

Drug lending laws vary significantly by state. Before completing any transaction, you must verify compliance with the laws of both your state and the counterparty's state. Common state-specific requirements include:

• Prior authorization from the state board of pharmacy for emergency drug sharing
• Quantity limits on drugs that may be borrowed or lent within a specified period
• Restrictions on which facility types may participate (e.g., hospital-to-hospital only)
• State-specific controlled substance schedule differences (some states schedule additional substances)
• State prescription monitoring program (PMP/PDMP) reporting requirements
• State-specific recordkeeping periods (some states require longer than federal minimums)
• Pharmacist-in-Charge (PIC) authorization requirements for transactions above certain thresholds

Multi-State Transactions: When a transaction crosses state lines, the laws of both states apply. You are responsible for determining which state's law governs and ensuring compliance with both.

State Board Notifications: Some states require notification to the state board of pharmacy when emergency drug sharing occurs. Check your state's requirements before completing transactions.

Your NPI is your primary identifier on the Platform. You must:

• Maintain an active NPI in the NPPES registry at all times while your account is active
• Update your NPI information in NPPES within 30 days of any change (address, specialty, organization)
• Notify BorrowDrugs immediately if your NPI is deactivated or your license is suspended, revoked, or surrendered
• Maintain a current, active DEA registration for all schedules of controlled substances you intend to transfer
• Ensure your state pharmacy or practitioner license is current and in good standing
• Not use the Platform during any period of license suspension, probation, or restriction that would prohibit the relevant activity

Pharmacist-in-Charge (PIC): Each facility must designate a Pharmacist-in-Charge who is responsible for the facility's compliance with all applicable laws and regulations. The PIC is responsible for authorizing drug lending transactions on behalf of the facility. The Platform enforces PIC assignment for facilities.

Federal and state law impose specific recordkeeping requirements for drug transfers. At minimum, you must maintain:

Platform-generated receipts and audit logs supplement but do not replace your own recordkeeping obligations. You must maintain your own records in a readily retrievable format for DEA and state board inspection.

Drug diversion — the transfer of controlled substances from legitimate medical channels to illegal use — is a federal crime. You must implement and maintain a diversion prevention program appropriate to your facility type. Key obligations:

• Verify the identity and licensure of all counterparties before completing a controlled substance transfer
• Refuse transactions where the counterparty's credentials cannot be verified or appear suspicious
• Monitor your transaction history for unusual patterns (unusually large quantities, frequent requests for the same drug, requests from unfamiliar facilities)
• Maintain physical security controls for controlled substances consistent with DEA requirements (21 C.F.R. § 1301.71–1301.76)
• Conduct regular inventory reconciliation and investigate discrepancies promptly
• Report suspected diversion to the DEA Diversion Control Division and your state board of pharmacy

Various federal and state laws impose mandatory reporting obligations that may be triggered by Platform activities:

• DEA Form 106 — Theft/Loss: Report theft or significant loss of controlled substances within 1 business day (21 C.F.R. § 1301.76)
• DEA Form 107 — Unusual Loss: Report any unusual loss or theft of List I chemicals within 15 days
• FDA MedWatch: Report serious adverse events associated with drugs transferred through the Platform
• FDA — Suspect/Illegitimate Product: Report suspect or illegitimate product to FDA within 24 hours of determination (DSCSA)
• State PMP/PDMP: Report dispensing of Schedule II–V controlled substances to your state Prescription Monitoring Program as required by state law
• State Board of Pharmacy: Report significant drug shortages, diversion incidents, or other events as required by your state board
• HIPAA Breach Notification: Report breaches of unsecured PHI to HHS and affected individuals within 60 days of discovery (45 C.F.R. § 164.400)

The Platform automatically logs compliance flags on transactions where potential issues are detected. These flags are informational — they do not prevent transactions but create an audit record. Current flag types:

Violations of this Compliance Policy, the Terms of Use, or applicable law may result in:

• Immediate suspension or termination of your Platform account
• Reporting to the DEA Diversion Control Division
• Reporting to your state board of pharmacy
• Reporting to the HHS Office of Inspector General (OIG)
• Referral to federal or state law enforcement
• Civil liability for damages caused to BorrowDrugs or third parties

Federal penalties for controlled substance violations can include imprisonment up to 20 years (21 U.S.C. § 841), civil penalties up to $25,000 per violation, and permanent loss of DEA registration. State penalties vary but can be equally severe.

For compliance questions, to report suspected violations, or to request a Business Associate Agreement: