No products in the cart.
MODULE 27: CONSTRUCTION & COMPLIANCE CHECKLIST
Section 27.5: Policy, Procedure, and Compliance Documentation Set
Building your operational rulebook: Identifying and drafting the essential P&Ps for licensing, accreditation (URAC/ACHC), and daily operations.
SECTION 27.5
Policy, Procedure, and Compliance Documentation Set
Building Your Operational Rulebook, One Policy at a Time.
27.5.1 The “Why”: Your P&Ps as Your Master Formulation Record
In your retail career, the Policy & Procedure (P&P) manual was often a thick, dust-covered binder on a shelf, sent from corporate and rarely opened except in an emergency. It was a reference. In specialty pharmacy, this concept is dangerously wrong. Your P&P manual is not a reference; it is the single most important asset your company will create. It is, quite literally, the “Master Formulation Record” for your entire business.
This is not an exaggeration. An auditor from URAC, ACHC, The Joint Commission, or a state BOP will walk into your pharmacy and say, “Show me your P&Ps.” This is their starting point. They will not ask you “Do you have a clinical program?” They will say, “Show me your policy for clinical patient management, show me your procedure for initial assessments, and show me the documented proof that you are following it.”
Your P&P documentation set is three things simultaneously:
- Your Legal Defense: When a problem occurs, the first question in a lawsuit will be, “What was your policy?” A well-written, evidence-based policy that you can prove your employees were trained on is your strongest legal shield.
- Your Training Manual: This is how you ensure consistency. A new employee should be able to read your “Patient Intake” P&P and perform the job in the exact same, compliant way as a 10-year veteran. It is the blueprint for quality.
- Your Key to Accreditation & Payer Contracts: You cannot get URAC or ACHC accredited without a comprehensive P&P manual. Period. And you cannot get major PBM and manufacturer contracts without that accreditation. Therefore, your P&Ps are the literal key to unlocking revenue.
This section is your tutorial for building this “rulebook.” We will cover the hierarchy of the documents, the anatomy of a perfect P&P, the “master list” of P&Ps you must have, and the “lifecycle” of how to manage them.
Pharmacist Analogy: Your P&Ps as Compounding Documentation
You are already a master of this concept. Think about the documentation required for non-sterile compounding (USP <795>).
- The Policy & Procedure (P&P) is your Master Formulation Record (MFR). It is the detailed, step-by-step “recipe” that is approved by the pharmacist. It describes how to make “Magic Mouthwash” perfectly, every single time. It never changes unless it’s formally updated.
- Your Logs and Patient Records are your Compounding Record (CR). This is the proof that you followed the MFR for a specific patient, on a specific date. It includes the lot numbers, expiration dates, and the pharmacist’s signature.
An auditor doesn’t just look at one. They check both. They pull your Compounding Record (the “proof”) and lay it next to your Master Formulation Record (the “recipe”) to see if you actually did what you said you would do.
Accreditation for your entire pharmacy works the exact same way.
- Auditor: “Show me your P&P for Patient Counseling.” (This is your “MFR” for counseling).
- You: “Here it is. It says we counsel 100% of new patients.”
- Auditor: “Great. Now pull 10 new patient charts from last week.” (This is your “CR”). “Show me the documented proof in these 10 charts that your pharmacists actually counseled them.”
If your P&P is missing, you fail. If your P&P exists but your documentation is missing, you fail. You must have both. This section teaches you how to write the “Master Formulation Records” for your entire company.
27.5.2 The P&P Hierarchy: Understanding the “Rulebook” Structure
“P&P” is a term that is thrown around, but it’s really a hierarchy of three distinct document types. Understanding this structure is the key to organizing your manual.
1. The Policy
The “WHAT” and “WHY”
This is the high-level, guiding principle. It’s a short, clear statement that defines the rule and its purpose. It is not a step-by-step guide.
Example: “It is the policy of CASP Pharmacy to protect the confidentiality and integrity of all patient Protected Health Information (ePHI) in accordance with HIPAA and state privacy laws.”
2. The Procedure
The “HOW”
This is the step-by-step, “work-instruction” that executes the policy. It is a detailed, numbered or bulleted list of actions. It’s the “recipe” from our analogy.
Example: “4.1. To log off a workstation, the employee will:
4.1.1. Press the Windows key + ‘L’.
4.1.2. Ensure the screen is locked before walking away.”
3. Forms, Logs, & Attachments
The “PROOF”
This is the “Compounding Record.” It’s the physical or digital artifact that proves the procedure was followed. It’s the blank template you fill out.
Example: “Attachment A: New Employee HIPAA Training Acknowledgment Form.” or “Log B: Daily Refrigerator Temperature Log.”
27.5.3 Tutorial: The Anatomy of a Perfect P&P Template
You cannot just start writing in a Word document. Every single P&P in your manual must follow a standardized template. This is non-negotiable. It proves to an auditor that you have a formal, controlled process. When you start your P&P project, your first task is to create this master template.
Master Template: The Anatomy of an Auditor-Proof P&P
Your P&P software (or Word header/footer) must contain this information on every single page.
The Header: Controlled Document Information
| Policy Title: Patient Counseling |
Policy Number: CLIN-005 |
|
| Applies To: All Pharmacists, Interns, and Clinical Staff |
Original Effective Date: 01/01/2024 |
|
| Owner/SME: Director of Clinical Services |
Last Review Date: 10/25/2025 |
|
| Approval Signature: [Signature of PIC/CEO] |
Replaces Policy Dated: 10/20/2024 |
|
The “Replaces Policy Dated” is critical for archiving.
The Body: Standardized Sections
Every P&P must have these Roman numeral sections. This consistency is key.
- I. PURPOSE
A 1-2 sentence statement on why this policy exists. (e.g., “To ensure all patients receive comprehensive, documented counseling on all new prescriptions in accordance with OBRA ’90, state laws, and accreditation standards.”)
- II. POLICY
The high-level “what” from our hierarchy. (e.g., “It is the policy of CASP Pharmacy that all new patients will receive mandatory verbal counseling from a pharmacist. An offer to counsel will be made on all refill prescriptions.”)
- III. DEFINITIONS
Define any ambiguous terms. (e.g., “New Patient: Any individual not previously dispensed a medication by CASP Pharmacy.” “New Prescription: A medication not previously filled for the patient, or a change in dose, strength, or directions.”)
- IV. PROCEDURE
The “how.” This is the detailed, step-by-step, numbered list. (e.g., “4.1. The clinical pharmacist will contact the new patient via telephone prior to shipping the first fill. 4.2. The pharmacist will… 4.3. Documentation of counseling (or 3 refusal attempts) must be entered in the patient’s ‘Clinical Notes’ field…”)
- V. ASSOCIATED FORMS / LOGS
A list of all the “proof” documents. (e.g., “New Patient Counseling Checklist (Form CLIN-005a)”, “Patient Declination of Counseling (Form CLIN-005b)”)
- VI. REFERENCES
This is your “evidence.” Where did you get this rule from? (e.g., “1. URAC Specialty Pharmacy Standard PM 6. 2. ACHC Specialty Pharmacy Standard 2-B. 3. California Code of Regulations, Title 16, §1707.2.”)
- VII. APPROVALS & REVISION HISTORY
A log at the bottom showing who approved it and when it was changed. (e.g., “10/25/2025: Updated Section 4.3 to include text message reminders. – R. Kiser, RPh.”)
27.5.4 The “Master P&P List”: Your 7-Book Operational Rulebook
You cannot have one, 10,000-page “binder.” You must organize your P&Ps into logical “books” or “volumes,” typically by department. This makes them manageable, auditable, and easier to assign for training.
What follows is a starter set. This is the “minimum viable product” to get licensed and pass your first accreditation survey. Your manual will grow from here.
Book 1: Corporate & Administration (The Foundation)
This book defines who you are and how you function at the highest level.
| P&P Number | Policy Title | Purpose & Drafting Considerations |
|---|---|---|
| ADM-001 | Organizational Chart | Purpose: To visually define the lines of authority and reporting structure.
Drafting: This is a required document for all accreditation. It must be dated and signed. It must clearly show the PIC and the Privacy/Security Officers. |
| ADM-002 | Job Descriptions | Purpose: To define the roles, responsibilities, qualifications, and competencies for every position in the pharmacy.
Drafting: This is a massive undertaking. You need a formal, signed job description for every role, from “Patient Intake Coordinator” to “PIC” to “Delivery Driver.” Auditors will pull these. |
| ADM-003 | Code of Conduct / Ethics | Purpose: To set the professional and ethical standards for the company.
Drafting: Must include sections on conflicts of interest, anti-kickback (Stark Law), patient inducement, and professional conduct. |
| ADM-004 | Licensure Management | Purpose: To define the process for obtaining and renewing all pharmacy and pharmacist licenses (as discussed in 27.2).
Drafting: Must name a specific person/role responsible for tracking renewal dates. Must include the “Most Strict” P&P. |
| ADM-005 | Emergency Preparedness (Internal) | Purpose: To define the response to an internal, physical-plant emergency.
Drafting: Must include procedures for Fire (evacuation maps, meeting points), Severe Weather (tornado/hurricane procedures), and Active Shooter / Facility Lockdown. |
| ADM-006 | Business Continuity (External) | Purpose: To define how the pharmacy continues to care for patients if the building is unusable (e.g., burns down).
Drafting: Must include your P&P for relocating to your “hot site” or “cold site,” restoring data from backups, and communicating with patients/prescribers. |
Book 2: Human Resources & Training (The People)
This book defines how you hire, train, and manage your staff. Auditors look here to see how you create and maintain a competent workforce.
| P&P Number | Policy Title | Purpose & Drafting Considerations |
|---|---|---|
| HR-001 | Hiring & Onboarding | Purpose: To ensure a non-discriminatory and compliant hiring process.
Drafting: Must include steps for background checks (OIG/GSA exclusion checks are mandatory for Medicare), license verification, and onboarding paperwork (I-9, W-4, etc.). |
| HR-002 | Employee Training & Competency | Purpose: To define the process for initial and ongoing training and competency assessment for all roles.
Drafting: This is an auditor’s favorite. You must have a different training plan for each role. See the tutorial below. |
| HR-003 | Employee Performance & Disciplinary Action | Purpose: To define a fair, consistent, and documented process for managing performance.
Drafting: A “progressive” disciplinary policy (Verbal Warning -> Written Warning -> Final Warning -> Termination) is standard. This P&P is your legal defense in a wrongful termination suit. |
Tutorial: Building Your (Auditor-Proof) Competency P&P
You can’t just say your staff is trained. You must prove it. Your P&P must define a “Competency File” (a binder or digital folder) for every employee. An auditor will say, “Pull the Competency File for Technician Jane Doe.”
Your P&P must state that this file contains:
- 1. Job Description: Signed and dated by the employee.
- 2. Initial Training Checklist: A checklist of all P&Ps they read and were trained on during their first 90 days. Must be signed by the employee and their trainer.
- 3. Initial Competency Assessment: A “test” they took at the end of training.
- For a Tech: A test fill of 10 placebo prescriptions.
- For a Clinical Pharmacist: A mock patient counseling call.
- For an Intake Coordinator: A test case of a complex referral.
- 4. Annual Competencies: Proof that you “re-tested” them every year.
- HIPAA & Compliance Training (Annual)
- Role-Specific Competency (Annual)
- Compounding personnel: Glove-tip and media-fill testing (Biannual/Annual)
- 5. Licenses & Certifications: A copy of their current, active pharmacist/tech license.
Your P&P defines this file, and your HR/Admin team’s procedure is to build and maintain it for every single employee.
Book 3: Privacy & Security (The HIPAA Bible)
This is your most high-risk manual. It is dedicated entirely to HIPAA and state privacy laws. It will be the first thing a Health and Human Services (HHS) auditor asks for after a breach.
| P&P Number | Policy Title | Purpose & Drafting Considerations |
|---|---|---|
| HIPAA-001 | Purpose: To formally name the individuals responsible for the HIPAA program.
Drafting: This is a legal requirement. These can be the same person (in a small pharmacy) but they have different roles. The Privacy Officer handles PHI use/disclosure. The Security Officer handles ePHI and IT systems. |
|
| HIPAA-002 | Notice of Privacy Practices (NPP) | Purpose: To define the document that tells patients their rights.
Drafting: Your P&P is about how you provide the NPP (e.g., “Mailed with first fill”) and how you get their signature of acknowledgment (and what to do if they refuse to sign). |
| HIPAA-003 | Patient Rights: Access & Amendment | Purpose: To define the process for a patient to request a copy of their records or to request a correction.
Drafting: Must include the 30-day timeline to respond. Must define your fee schedule (if any) for providing copies. |
| HIPAA-004 | Patient Rights: Accounting of Disclosures | Purpose: To define the process for a patient to ask “Who did you share my data with?”
Drafting: Your P&P must define what is (and isn’t) included in this list (e.g., TPO – Treatment, Payment, Operations – is excluded). |
| HIPAA-005 | Minimum Necessary Standard | Purpose: To define the rule that employees should only access the minimum PHI necessary to do their job.
Drafting: This policy is your justification for your “Access Control” plan. (e.g., “The shipping clerk’s software profile does not permit access to the ‘Clinical Notes’ field.”). |
| HIPAA-006 | Risk Assessment & Management | Purpose: To define the mandatory annual process of performing a formal HIPAA Security Risk Assessment (SRA).
Drafting: This is a cornerstone of HIPAA. Your P&P states you will do the assessment (or hire a firm to) and create a “remediation plan” to fix any gaps. |
| HIPAA-007 | Breach Notification Protocol | Purpose: To define the exact procedure to follow when a breach is discovered.
Drafting: This is your most high-stakes policy. See the tutorial below. |
Deep Dive: Your HIPAA Breach Notification P&P (A Tutorial)
When a breach is discovered (e.g., an employee reports they mis-faxed a patient’s file to the wrong number), a 60-day legal clock starts. Your P&P must define this response perfectly.
Procedure:
- Step 1: Discover & Contain. (e.g., “Employee immediately reports the mis-fax to the Privacy Officer. The Privacy Officer immediately calls the wrong fax number and requests they destroy the fax.”).
- Step 2: Investigate. The Privacy Officer must immediately investigate. When did it happen? What PHI was involved (name, DOB, diagnosis, Rx)? How many patients?
- Step 3: Perform the 4-Factor Risk Assessment (This is mandatory). The P&P must state that the Privacy Officer will formally assess if this is a “reportable breach” using the 4-Factor Test:
- 1. The nature and extent of the PHI involved: Was it just a name, or was it a full HIV profile?
- 2. The unauthorized person who used/received the PHI: Was it another (HIPAA-covered) doctor’s office, or a random person at a gas station?
- 3. Whether the PHI was actually acquired or viewed: Did the gas station owner confirm they received it and read it, or did they just say the fax machine was jammed?
- 4. The extent to which the risk to the PHI has been mitigated: Did the doctor’s office confirm, in writing, that they received and immediately shredded the fax?
- Step 4: Make the Determination.
- Low Risk: If, after the 4-factor test, you determine there is a “low probability of compromise,” you document it internally and are done. No notification is needed.
- Breach: If you cannot prove a low probability, you must assume it is a reportable breach.
- Step 5: The 60-Day Notification (If it is a Breach). Your P&P must state you will follow the 3 required notifications:
- 1. Notify the Patient: “Without unreasonable delay” and no later than 60 calendar days from discovery. This must be a formal letter.
- 2. Notify Health & Human Services (HHS):
- If < 500 patients: Log it in the “Breach Portal” to be submitted annually.
- If > 500 patients: Notify HHS “without unreasonable delay” (i.e., immediately).
- 3. Notify the Media: If the breach affects > 500 people in one state, you must notify prominent media outlets in that state.
Book 4: Patient Management Program (The URAC/ACHC Core)
This is your “clinical” rulebook. It defines your entire patient journey. This is what URAC and ACHC audit most heavily. These P&Ps must be detailed and patient-centric.
| P&P Number | Policy Title | Purpose & Drafting Considerations |
|---|---|---|
| PM-001 | Scope of Services | Purpose: To define what you do… and what you don’t do.
Drafting: This is your “menu.” It must list your services (e.g., “Dispensing, Clinical Counseling, PA Assistance”), your hours of operation, your after-hours pharmacist availability, and your patient population/disease states served. |
| PM-002 | Purpose: To define the procedure for accepting a new patient referral.
Drafting: Must include all steps: receiving the fax, verifying all data, creating the profile, and the timeline (e.g., “All referrals will be processed within 4 business hours”). |
|
| PM-003 | Benefits Investigation & Prior Authorization | Purpose: To define the procedure for verifying benefits and obtaining PAs.
Drafting: Must include the communication steps: “The PA team will notify the prescriber of a PA requirement within 24 hours.” |
| PM-004 | Financial Assistance / Co-Pay Management | Purpose: To define how you assist patients with high co-pays.
Drafting: Must include the order of operations: “Staff will first search for manufacturer co-pay cards, then screen for foundation/grant eligibility…” |
| PM-005 | Clinical Assessment (Initial & Reassessment) | Purpose: To define the pharmacist-led clinical review.
Drafting: This is a core P&P. It must list all topics in your assessment: Current medications, allergies, comorbidities, lab values, social barriers, adherence. It must also define the frequency of reassessment (e.g., “A pharmacist will perform a clinical reassessment prior to the 3rd fill and every 6 months thereafter.”) |
| PM-006 | Patient Counseling & Education | Purpose: To define the mandatory counseling process.
Drafting: Must state that counseling is pharmacist-only, mandatory for new patients, and that education is disease-state specific. Must define how you document it. |
| PM-007 | Adherence Monitoring & Intervention | Purpose: To define your adherence program.
Drafting: How do you measure adherence? (e.g., “MPR/PDC will be calculated for all patients.”). What do you do when a patient is non-adherent? (e.g., “A pharmacist will conduct an intervention call for any patient with an MPR < 85%."). |
| PM-008 | Patient Complaints & Grievances | |
| PM-009 | Patient Rights & Responsibilities | Purpose: To define the “bill of rights” for your patients.
Drafting: This is a document you must create and provide to every patient at intake. It lists their right to complain, their right to privacy, their right to know their pharmacist, and their responsibility to provide accurate info, etc. |
Tutorial: Your “Patient Complaint & Grievance” P&P
URAC and ACHC require a formal system to track and resolve all patient dissatisfaction. Your P&P must be very clear.
Key Definitions in your P&P:
- Complaint: A minor, easily-resolved issue. (e.g., “My package was late,” “The call center rep was rude.”)
- Procedure: Any employee can receive. Must be logged. Must be resolved by a manager within 2 business days.
- Grievance: A major, formal, or clinical complaint. (e.g., “You dispensed the wrong drug,” “I am filing a formal complaint about my pharmacist,” “Your co-pay program was discriminatory.”)
- Procedure: Must be immediately escalated to the PIC or Privacy Officer. Must be investigated. A formal, written response must be sent to the patient within 14-30 days (your P&P sets the timeline).
The Log is Your Proof: Your P&P must reference a “Complaint & Grievance Log.” An auditor will ask to see this log. It must show the date, the patient, the issue, the investigation, the resolution, and the date it was closed. This log is a key input for your Quality Management program.
Book 5: Pharmacy Operations (The Dispensing Core)
This is your “traditional” pharmacy P&P manual, covering the physical handling of drugs.
| P&P Number | Policy Title | Purpose & Drafting Considerations |
|---|---|---|
| OPS-001 | Prescription Intake & Data Entry | Purpose: To define the procedure for transcribing a new Rx.
Drafting: Must include “high-alert” steps (e.g., “All chemotherapy orders must be independently verified by two pharmacists.”). |
| OPS-002 | Pharmacist Verification (Clinical) | Purpose: To define the pharmacist’s “clinical” check (DUR) before filling.
Drafting: This is your DUR P&P. It lists all checks: drug interactions, allergy, therapeutic duplication, dose appropriateness, etc. |
| OPS-003 | Dispensing & Filling Procedure | Purpose: To define the physical act of filling.
Drafting: Must include steps for “Scan-Verify” or “NDC match” to ensure the right drug is pulled. Must include your “Tech-Check-Tech” policy (or, more likely, your “100% Pharmacist Check” policy). |
| OPS-004 | Pharmacist Verification (Final) | Purpose: To define the final “product” check.
Drafting: What is the pharmacist comparing? “Pharmacist will verify the final labeled product against the original hard-copy/eRx image, not just the data-entered label.” |
| OPS-005 | Handling of Controlled Substances | Purpose: To define all DEA-compliant procedures.
Drafting: Must include: Ordering (CSOS), Receiving (pharmacist signs 222), Storing (locked vault), Dispensing, and Biennial Inventory. |
| OPS-006 | Compounding (USP <795>, <797>, <800>) | Purpose: To define your compounding procedures.
Drafting: This is not one P&P; it’s an entire manual. You must have P&Ps for: Gowning, Cleaning, Hood Certification, MFR creation, CR documentation, etc. |
| OPS-007 | Inventory Management | Purpose: To define how you handle your multi-million dollar asset.
Drafting: Must include: Receiving (checking for cold chain damage), Stocking (FIFO – First In, First Out), Cycle Counts, and Handling of Expired/Damaged/Recalled Drugs. |
Book 6: Quality Management (The Feedback Loop)
This manual defines how you get better. Accreditation is obsessed with this. They don’t just want to see that you have good policies; they want to see that you have a process for finding and fixing your own mistakes.
| P&P Number | Policy Title | Purpose & Drafting Considerations |
|---|---|---|
| QM-001 | The Quality Management (QM) Program | Purpose: To establish the QM program.
Drafting: Must define the “QM Committee” (who is on it), the “Meeting Frequency” (e.g., “Quarterly”), and the scope of the program. |
| QM-002 | Key Performance Indicators (KPIs) | Purpose: To define what you will “measure” to assess quality.
Drafting: Your P&P must list your KPIs. Examples: Dispensing Error Rate, Patient Complaint Rate, Adherence Rates, PA Turnaround Time. |
| QM-003 | Dispensing Error / Incident Reporting | Purpose: To define a non-punitive process for employees to report mistakes.
Drafting: This is critical. Staff must feel safe reporting errors. The P&P must focus on “process improvement,” not “who to blame.” |
| QM-004 | Root Cause Analysis (RCA) | Purpose: To define the procedure for investigating a major error or trend.
Drafting: This P&P defines how you investigate. See the tutorial below. |
| QM-005 | Patient Satisfaction Surveys | Purpose: To define how you gather and analyze patient feedback.
Drafting: Must define frequency (e.g., “Annual survey”) and how the data is reviewed (by the QM Committee). |
Tutorial: Your “Root Cause Analysis (RCA)” P&P
An auditor will pull your error log (QM-003) and say, “I see you dispensed the wrong strength of Humira last month. Show me your RCA.” Your P&P for RCA must define your method.
The “5 Whys” Method (A simple, effective RCA):
- The Problem: A patient received Humira 80mg instead of 40mg.
- 1. Why? Because the tech pulled the 80mg pen from the fridge.
- 2. Why? Because the 80mg pen was in the 40mg bin.
- 3. Why? Because the inventory tech who put away the order stocked it in the wrong bin.
- 4. Why? Because the bins look identical and are side-by-side.
- 5. Why? (The Root Cause): Because our process relies on human memory, and we have no engineering control (like “scan-to-stock”) to prevent this.
The Corrective Action Plan (CAP):
- NOT: “Retrain the stocking tech.” (This is a weak, non-systemic fix).
- YES: “1. Implement ‘scan-to-stock’ where the tech must scan the bin and the product. 2. Separate 80mg and 40mg bins to different refrigerators. 3. Add ‘TALL-man’ lettering (HUMIRA 80mg) to the bin labels.”
Your P&P defines this “5 Whys” process and the creation of a “CAP” to fix the system, not just the person.
Book 7: Environmental & Logistics (The Physical Plant)
This book defines how you manage your physical plant, as detailed in Section 27.4.
| P&P Number | Policy Title | Purpose & Drafting Considerations |
|---|---|---|
| ENV-001 | Environmental Monitoring | Purpose: To define the 24/7/365 monitoring of all temperature/humidity.
Drafting: Must define set ranges (2-8°C, etc.), the monitoring system, and the alarm escalation P&P (as drafted in 27.4). |
| ENV-002 | Temperature Excursion Protocol | Purpose: To define the exact 5-step process (Quarantine, Investigate, Call Manufacturer, Document, Disposition) for an internal excursion.
Drafting: This P&P must be extremely detailed and include a reference to the “Temperature Excursion Log.” |
| ENV-003 | Cold Chain Shipping | Purpose: To define the process for validating and packing shipments.
Drafting: Must include your seasonal pack-out procedures, your rules for not shipping on Fridays, and your P&P for handling a “shipping excursion” (a FedEx delay). |
| ENV-004 | Emergency Power & Relocation | Purpose: To define the response to a long-term power failure.
Drafting: Must include your generator testing log, your UPS maintenance plan, and your “Emergency Relocation” P&P, including the MOU with your hospital partner. |
27.5.5 The P&P Lifecycle: How to Manage Your “Living” Rulebook
Your P&P manual is not a “one-and-done” project. It is a living document. An auditor will be just as concerned with how you manage your P&Ps as with what’s in them. This requires a formal “P&P Lifecycle.”
The P&P for Your P&Ps
You must have a master policy (let’s call it ADM-000: “Policy on Policies”) that defines this entire lifecycle.
1. Drafting
P&Ps are not written by one person. They are drafted by the Subject Matter Expert (SME).
Example: The PIC drafts OPS-005 (Controlled Substances). The Director of Clinical Services drafts PM-007 (Adherence Monitoring). The IT Manager drafts HIPAA-006 (Risk Assessment). They use the master template.
2. Review
A draft is never final. It must be reviewed by a committee. This is often the P&P Committee or the QM Committee.
Example: The committee reviews the draft to ensure it doesn’t conflict with other P&Ps and meets all legal/accreditation standards.
3. Approval
The P&P must be formally signed and “made law” by the highest authority.
Example: The final draft is signed by the PIC and the CEO/Owner. The “Effective Date” is set.
4. Training (Critical)
This is the step everyone forgets. You must prove that your staff read and understood the new P&P.
Example: The new P&P is distributed. Every employee must sign a “Read and Acknowledge” form, which is then placed in their Competency File (HR-002).
5. The Annual Review
Your P&P must define how often P&Ps are reviewed.
Example: “All P&Ps will be reviewed annually by the SME and the QM Committee, even if no changes are made. The ‘Last Review Date’ in the header will be updated to reflect this review.”
6. Archiving
When you update a P&P, you never throw the old one away.
Example: The 10/20/2024 version of CLIN-005 is replaced by the 10/25/2025 version. The old version is moved to a digital “Archive” folder. Why? A lawsuit from last year will be judged against the policy you had last year. You must be able to produce it.
The P&P Software Solution (A “Must-Have” Investment)
Managing this lifecycle for 150+ P&Ps, 50 employees, and 50 state regulations on paper or in a “Shared Drive” is a recipe for failure. It’s a full-time job.
The “real” solution is to purchase Policy Management Software (e.g., PolicyTech, PowerDMS, PolicyStat). These are cloud-based systems that automate this entire lifecycle.
- It holds the master template.
- It routes a draft from the SME to the committee for automated review & approval.
- It electronically distributes the new P&P to all employees and tracks their “e-signature” for training.
- It automatically archives the old version.
- It sends you an email when a P&P is 30 days from its “annual review” date.
This software is your “P&P technician.” It handles the logistics, freeing you up to write the actual content. For a specialty pharmacy, this software is as critical as your dispensing software.
