Cvs Pharmacy

1 IntroductionOn October 14, 2010, the United States Attorney’s Office for the Central District of California announced that CVS Pharmacy, Inc. was fined $77 million (including $75 million civil penalty and the forfeit of $2.5 million profit) for its unlawful sales of pseudoephedrine, a regulated drug, to criminals between September 2007 and November 2008.

During that period, the company failed to comply with laws that limit the quantity of the drug sold to individual customers. The sales, according to the Attorney’s Office, directly caused an increase the production of methamphetamine in California. CVS Pharmacy, Inc (“CVS/pharmacy”) is the retail pharmacy subsidiary of CVS Caremark Corporation (hereinafter collectively referred to as “CVS”). In addition to retail pharmacy, CVS also runs pharmacy services, retail clinics, and mail-order pharmacy businesses.

In fiscal year 2010, the company had net revenues of more than $96 billion and a net profit of more than $3 billion. Selected financial data by business segments (pharmacy services, retail pharmacy, and corporate) is shown in Exhibit 1. CVS was the 18th largest company on the Fortune 500 according to its 2010 annual report and CVS/pharmacy is one of the largest retail pharmacy chains in the United States. As of December 31, 2010, it operates more than 7,100 retail pharmacy stores in the United States. Exhibit 2 shows the number of CVS/pharmacy stores in each state (as of December 31, 2009). Today’s CVS

(listed on New York Stock Exchange, ticker “CVS”, web site: http://www.cvs.com/) is the results of a series of mergers and acquisitions and expansion into new markets in the past few years. Major mergers and acquisitions during the past six years included Eckerd ($2.15 billion), Albertson’s ($4.0 billion), Caremark ($26.9 billion), and Longs Drugs ($2.6 billion).

The markets in which CVS has presence also increased from 36 states in 2004 to 44 states in 2010. A summary of CVS financial data and store statistics (2004-2010) is shown in Exhibit 3. Like other companies in the industry, CVS has to efficiently and effectively manage various risks such as completion and economic downturn in order to deliver “strong growth and returns to shareholders”. Exhibit 4 lists some risks identified by the management in the company’s 2010 annual report.

2 Legal BackgroundPseudoephedrine is one of the materials that are used to make methamphetamine, which “is a powerfully addictive drug that severely affects users’ minds and bodies, ruins lives, and endangers communities and the environment” (U.S. Department of Justice Drug Enforcement Administration, 2007).

To curb the illicit production of methamphetamine, the Combat Methamphetamine Epidemic Act of 2005 (CMEA) was signed into law effective March 9, 2006 to limit the sales of pseudoephedrine and other related materials. The CMEA sets limits of sales of pseudoephedrine by retail drugstores to individuals as follows: The quantity sold to an individual in a day should not exceed 3.6 grams, regardless the number of transactions; and 1

-For individuals, purchases in a 30-day period are limited to 9 grams

In addition, the CMEA mandates that regulated retail drugstores should implement necessary measures to control and monitor the sales of pseudoephedrine.

The required measures include: placing product such that customers do not have direct access before the sale is made (“behind the counter” placement) or in a locked cabinet that is located in an area of the facility to which customers do have direct access; delivering the product directly into the custody of the purchaser; maintaining written or electronic list (logbook) of sales, including quantity sold, names and addresses of purchasers, and date and time of the sales;

examining acceptable forms of photo identification card; requiring purchasers to sign the logbook and enter their names, addresses, and date and time of sale; and informing purchasers that entering false statements or misrepresentations in the logbook may subject them to criminal penalties according to the law.

The CMEA also requires regulated retail drugstores to provide proper training to those storefront employees who are responsible for directly dealing with customer purchases. Drugstores must ensure that these employees understandthe legal requirements and follow proper procedures. Drugstores must also self-certify to relevant authorities in their jurisdictions to demonstrate that all store-front employees have undergone the required training. In accordance with the CMEA, U.S.

Department of Justice Drug Enforcement Administration (DES) specified some specific rules (U.S. Department of Justice Drug Enforcement Administration, 2006) relating to logbooks maintained by drugstores. Paper logbooks must be bound. For electronic logbooks, the records must be readily retrievable by the store or law enforcement agencies; and an electronic signature system may be implemented to capture customers’ signatures. DEA also requires the following notice be included in all logbooks and shown to customers:

“WARNING: Section 1001 of Title 18, United States Code, states that whoever, with respect to the logbook, knowingly and willfully falsifies, conceals, or covers up by any trick, scheme, or device a material fact, or makes any materially false, fictitious, or fraudulent statement or representation, or makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry, shall be fined not more than $250,000 if an individual or $500,000 if an organization, imprisoned not more than five years, or both.”

If inclusion of the notice in the logbooks is not feasible, the notice may be displayed in the place where the customer will see it when providing relevant information to complete a purchase.

For mail-orders pharmacies, the purchase by an individual is limited to 3.6 grams per day and 7.5 grams in a 30-day period. Some requirements for retail drugstores are not applicable for mailorder pharmacies. These include “behind-the-counter” alike physical control measures and customers signing logbooks. However, the CMEA requires mail order sellers to file monthly reports with DEA and verify customer identities prior to shipping. 2

In addition the federal CMEA, state laws may also impose restrictions on sales of pseudoephedrine. According to DEA (U.S. Department of Justice Drug Enforcement Administration, 2006), state laws vary considerably from state to state. For example, 27 states impose single transaction limits; 19 states have monthly or weekly limits. As emphasized by DEA, “CMEA does not preempt those requirements under State laws/regulations that aremore stringent than the CMEA requirements… all persons subject to CMEA must comply with the CMEA and the laws in the State(s) in which they sell [pseudoephedrine].”

3 Pseudoephedrine “Smurfing”Since mid 2007, the state of California has experienced a surge of large-scale methamphetamine production (U.S. Department of Justice National Drug Intelligence Center, 2009).

According to NDIC (National Drug Intelligence Center), the surge was fueled by the organized and widespread pseudoephedrine “smurfing”, where individuals purchase pseudoephedrine in quantities at or below legal limits and then aggregate into bulk quantities for producing methamphetamine. Pseudoephedrine acquired through smurfing was also found be sent in bulk to methamphetamine producers in Mexico.

The surge of smurfing in California could be partly attributed to CVS/pharmacy’s failure to control the sales of pseudoephedrine as required by the CMEA, according to the U.S. Attorney’s Office (United States Attorneys’ Office Central District of California, 2010). During the period of more than one year from mid-2007, smurfers were able to make repeated purchases of pseudoephedrine from CVS/pharmacy stores that exceeded federal limits set by the CMEA. Sometimes smurfers were able to “cleaning out store shelves”.

4 CVS/pharmacy’s Compliance PracticesAccording to the investigation by DEA and other law enforcement agencies (United States Attorneys’ Office, 2010), CVA/pharmacy has implemented some measures in order to comply with the CMEA. These measures included physical control of pseudoephedrine, a paper-based logbook, and later on an electronic logbook (replacing the paper-based logbook).

4.1 Physical ControlTo comply with the CMEA, CVS/pharmacy moved pseudoephedrine behind cash register counters in their retail stores. The company also provided written materials to train and educate employees about the new federal requirements and the problem of diversion of pseudoephedrine to make methamphetamine.

4.2 Paper LogbookCVS/pharmacy initially implemented paper-based logbooks, which were deemed CMEAcompliant. By using the paper logbook, cashiers at each store would be able to track and prevent excessive pseudoephedrine sales. The paper logbooks recorded customer names alphabetically and past purchases the customers make. The paper logbooks had some limitations, as CVS/pharmacy suggested. The limitations included: Store clerks had to review the logbooks and make manual calculations of daily and monthly purchases by customers;

– Recording sales in the paper logbooks and verifying quantity limits caused delays at the cash register counter and caused inconvenience for customers; It caused some privacy concerns because customers would have to sign the logbook in front of others; and Each individual retail store had its own logbook and data was difficult to aggregate across stores.

4.3 Electronic LogbookIn 2007, CVS/pharmacy decided to replace the pager logbooks with a computer system called “MethCheck”1.

The system would allow CVS/pharmacy stores to track pseudoephedrine sales and provide information to law enforcement agencies when needed. The system was to be implemented at all CVS/pharmacy stores across the United States. The key feature of the MethCheck system is “Lookback”, which enables the tracking and reviewing of customer purchases of pseudoephedrine and prevents any sales that would violate federal and state limits.

Without the LookBack feature, the system would not be able to perform the aforementioned functions. The feature, however, must be turned on for all states, regardless of whether a state has any daily or monthly limits on pseudoephedrine purchases by individuals (some states, e.g. California and Nevada, do not set monthly limits). CVS/pharmacy implemented the MethCheck by disabling the Lookback features in those states that did not impose monthly limits (see Exhibit 5).

By doing so, the company would essentially be unable to prevent aggregated purchases by an individual that exceeded the daily limit of 3.6 grams imposed by the CMEA. As a result, the sales of pseudoephedrine at CVS/pharmacy stores increased significantly from late 2007 to late 2008, particularly in California and Nevada. During that time, some CVS/pharmacy employees raised concerns about excessive purchases of the drug by individuals.

The management, however, did not promptly respond and investigate the suspicious increased sales. Instead, employees were instructed to rely on the MethCheck system to determine whether or not to block a customer purchase. After the government started its investigation of the company’s compliance, CVS/pharmacy changed the configuration of the MethCheck system by enabling the Lookback feature at stores in California and Nevada in late 2008 and other states in February 2009.

5 Post-Investigation Remedial MeasuresDuring the government’s investigation, CVS/pharmacy accepted the responsibility for those unlawful sales of pseudoephedrine (United States Attorneys’ Office, 2010).

More specifically, the company acknowledged some unlawful conduct in the California and Nevada: 1) employees at certain CVS/pharmacy stores knowingly sold the drug over legal limits; 2) the stores that oversold the drug had reasonable knowledge that the drug would be used to make methamphetamine; and 3) the company’s distribution center was in a position to monitor and report the excessive sales of pseudoephedrine but failed to do so.

The MethCheck system is designed and marketed by Aprriss, Inc., http://www.appriss.com/. A brief description of the system can be found on the software vendor’s website: http://www.appriss.com/sitedocs/MethCheckWhitePaper.pdf (accessed October 20, 2010).

In response to the government’s investigation, CVS/pharmacy implemented some internal control measures to ensure its compliance. The measures included: Monitoring the sales of pseudoephedrine products and reducing the threshold amount that can be ordered by each store; Reducing inventory level that can be held at each store and requiring the return of excessive inventory;

Establishing an advisory committee to ensure compliance with the CMEA and relevant state laws; Updating store operation manual and training materials that include additional information about pseudoephedrine and related policies and procedures; and Moving pseudoephedrine drugs from the retail counter to the pharmacy counter.

As part of the non-prosecution agreement with the government, CVS/pharmacy would establish and maintain a Compliance and Ethics Program that requires the company to exercise due diligence to prevent criminal conduct, promote and encourage ethical conduct, and maintain procedures for an anonymous reporting mechanism and discipline employees who violate compliance policies.

6 CVS/pharmacy’s Reflections on CMEA ComplianceIn a statement (CVS Caremark Corporation, 2010) after the settlement with the government, Thomas M. Ryan, then CEO of CVS Caremark, acknowledge that “the lapse…was unacceptable breach of the company’s policies and was totally inconsistent with [the company’s] values. CVS/pharmacy is unwavering in its support of the measures taken by the federal government and the states to prevent drug abuse.”

To prevent the non-compliance from happening again in the future, Ryan argued, the company has “strengthened … internal controls and compliance measures and made substantial investments on improve [the company’s] handling and monitoring of PSE by implementing enhance technology and making other improvements in … stores and distribution centers.”

7 Other Recent Law Suits and InvestigationsCVS has been involved in some other law suits and investigations by the government. On April 15, 2011, CVS/pharmacy agreed to pay the United States and 10 states $17.5 million to settle False Claims allegations.

The company was alleged to have inflated prescription claims to the government by billing the Medicaid programs in the 10 states for more than what the company was owed (U.S. Department of Justice, 2011). On January 16, 2009, CVS/pharmacy and the U.S. Department of Health & Human Services (HHS) reached an agreement to settle the company’s potential violations of the HIPAA Privacy Rule (U.S. Department of Health & Human Services, 2009).

The investigation by HHS indicated the company: 1) failed to implement adequate policies and procedures to reasonably safeguard health information during its disposal process; 2) did not adequately train employees; and 3) did not implement corporate policy to enforce employee compliance with its disposal procedures. CVS/pharmacy agreed to pay $2.25 to settle the allegations. 5

On March 18, 2008, it was announced that CVS Caremark Corporation has agreed to pay $36.7 million to settle Medicaid fraud claims filed again the company (U.S. Department of Justice, 2008). CVS allegedly switched Medicaid patients from the cheaper tablet form of a medicine (Ranitidine) to the more expensive capsule version solely to increase its reimbursement rate during the period from April 2000 to December 2006. The company did not admit any wrongdoings in the settlement.

8 Case RequirementsAnalyze the regulatory compliance risk and IT risk of CVS/pharmacy by using the COSO Enterprise Risk Management – Integrated Framework and the COBIT framework, respectively.

Exhibit 1 – Selected Financial Data by Business Segment of Fiscal Year 20102 In $ millions Net Revenues Gross profit Operating expenses Operating profit Other expenses (2) Net income Pharmacy Services 47,780 3,353 964 2,389 Retail Pharmacy 57,345 17,039 12,502 4,537 Corporate 626 (626) Intersegment Eliminations (1) (8,712) (135) (135) Total 96,413 20,257 14,092 6,165 2,741 3,424

(1) Refer to eliminations of inter-segment sales and profits (2) Other expenses include net interest expenses, taxes, and net loss (gain) from discontinued operations. The amount of other expenses is inferred from otherinformation available in the company’s annual report.

Exhibit 2 – Number of CVS/pharmacy Stores3

2 3

Source: the 2010 annual report of CVS Caremark Corporation. Source: the 2009 annual report of CVS Caremark Corporation.

Exhibit 3 – Selected Financial Data and Store Statistics of CVS Caremark (2004-2010)4 2004 CVS Caremark Revenues ($ million) Net Income ($ million) Market Capitalization at Year End ($ million) Retail Pharmacy Net Revenue Growth (% Over the Previous Year) Same-Store Revenue Growth (% Over the Previous Year) CVS/pharmacy Stores Major Markets (States) 30,594 919 18,071 2005 37,006 1,225 21,514 2006 43,814 1,369 25,456 2007 76,329 2,637 58,706 2008 87,472 3,212 41,301 2009 98,729 3,696 44,841 2010 96,413 3,427 47,423

15.1% 5.5% 5,375 36

21.0% 6.5% 5,420 34

18.40% 8.20% 6,150 43

11.90% 5.30% 6,245 40

8.70% 4.50% 6,923 41

13.0% 5.0% 7,025 41

3.6% 2.1% 7,182 41

Source CVS Caremark Corporation annual reports from 2004 to 2010.

Exhibit 4 – Business Risks5 • The business is affected by the economy in general including changes in consumer purchasing power, preferences and/or spending patterns. Interest rate fluctuations, changes in capital market conditions and regulatory changes may affect the company’s ability to obtain necessary financing on acceptable terms; The ability to realize the anticipated long-term strategic benefits from the company’s integrated pharmacy services model;

The ability to realize the planned benefits associated with acquisitions; The continued efforts of health maintenance organizations, managed care organizations, pharmacy benefit management companies and other third party payors to reduce prescription drug costs and pharmacy reimbursement rates;

The possibility of client loss and/or the failure to win new client business; Risks related to the frequency and rate of the introduction of generic drugs and brand name prescription products; The effect of a declining margin environment attributable to increased competition in the pharmacy benefit management industry;

The inability to earn and retain purchase discounts and/or rebates from pharmaceutical manufacturers and to earn and retain retail network “differential” or “spread”;; Increased competition from other drugstore chains, supermarkets, discount retailers, membership clubs and Internet companies; Changes in consumer preferences or loyalties;

Risks related to PPACA and other health care reform laws and the regulations promulgated under those laws; Litigation, legislative and regulatory risks associated with the company’s business or the retail pharmacy business, retail clinic operations and/or pharmacy benefit management industry generally; The risks relating to changes in laws and regulations, including changes in accounting standards and taxation requirements; and The risks relating to adverse developments in the health care or pharmaceutical industry generally.

Source: the 2010 annual report of CVS Caremark Corporation

Exhibit 5 – List of States in Which CVS/pharmacy Implemented MethCheck Without the “Lookback” Feature STATE Alabama Arizona California Colorado Connecticut District of Columbia Florida Georgia Kansas Maine Maryland Massachusetts Michigan Nevada New Hampshire New Jersey New York North Dakota Ohio Pennsylvania Rhode Island South Carolina Texas Virginia Vermont

ReferencesCVS Caremark Corporation. (2010). CVS/pharmacy Announces Agreements With U.S. Drug Enforcement Administration and U.S. Attorneys’ Offices Retrieved October 20, 2010, from http://phx.corporate-ir.net/phoenix.zhtml?c=99533&p=irolnewsArticle&ID=1482916&highlight= U.S. Department of Health & Human Services. (2009).

CVS Pays $2.25 Million & Toughens Disposal Practices to Settle HIPAA Privacy Case Retrieved April 22, 2011, from http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/cvsresolutionagreement.html U.S. Department of Justice. (2008). CVS Caremark Corp. To Pay $36.7 Million to United States, 23 States, and the District of Columbia To Settle Medicaid Prescription Drug Fraud Allegations. U.S. Department of Justice. (2011). CVS Pharmacy Inc.

Agrees to Pay $17.5 Million to Resolve False Prescription Billing Case Retrieved April 22, 2011, from http://www.justice.gov/opa/pr/2011/April/11-civ-485.html U.S. Department of Justice Drug Enforcement Administration. (2006).

Rules: Retail Sales of Scheduled Listed Chemical Products; Self- Certification of Regulated Sellers of Scheduled Listed Chemical Products Retrieved October 20, 2010, from http://www.deadiversion.usdoj.gov/fed_regs/rules/2006/fr0926.htm U.S. Department of Justice Drug Enforcement Administration. (2007). Procedures for Establishment of Individual Import, Manufacturing, and Procurement