Your pharmacy partner is part of your application

Clinics tend to think of the dispensing pharmacy as a vendor. The certification review does not. It treats the pharmacy as part of the model being certified, because from a patient's perspective the medicine arriving in the post is the product, and who prepared it, under what registration, is a material fact about what was sold.

This catches out clinics that negotiated a fulfilment relationship on price and turnaround and never asked the diligence questions.

What the reviewer will want to establish

Identity and registration. Which pharmacy, operating under which registration, licensed in which states. Not the marketing name of a fulfilment platform: the actual dispensing entity.

What it is permitted to do. A 503A pharmacy compounds for an identified individual patient pursuant to a prescription. A 503B outsourcing facility is registered with the FDA and may produce in bulk without patient-specific prescriptions, subject to current good manufacturing practice requirements. These are different registrations with different permissions, and a clinic that describes its partner as one when it is the other has introduced an inconsistency into its own file. The difference between them is worth getting right before you file, not during.

Interstate coverage. A pharmacy needs non-resident licensure in the states it ships into. If you market in states your pharmacy is not licensed to ship into, that gap is visible.

What is actually being compounded. Whether the preparation is one the pharmacy may lawfully make, whether the ingredients are permitted, and whether the product is being presented as something it is not.

The chain of custody. How a prescription reaches the pharmacy, how the pharmacy verifies it, how the product reaches the patient, and what happens when something goes wrong.

The questions to ask before you sign

Most clinics run this diligence after a certification reviewer asks. Running it first is cheaper, and it also improves the partnership.

• Which legal entity dispenses, and under which registration type?
• Which states is it licensed to ship into, and can we see the list?
• Which of our products does it consider within its permitted scope, and on what basis?
• Has it received regulatory correspondence in the last three years, and what came of it?
• Who at the pharmacy signs off on the claims we make about the products it prepares?
• What happens to our patients if this relationship ends?

That last one is not a compliance question, it is a business continuity question, and it becomes a compliance question the moment you swap partners mid-certification without telling anybody.

The claims problem is shared and nobody owns it

Here is the pattern that produces enforcement letters. The pharmacy prepares the product and takes the position that it does not control the clinic's marketing. The clinic writes the marketing and takes the position that the pharmacy is the expert on the product. Nobody reads the landing page against what the product actually is.

Our index of FDA warning letters over compounded GLP-1 marketing carries the current count and codes each letter by what it cites: misbranding throughout, alongside claims that a compounded drug was FDA-approved and comparisons to the brand-name product. Those letters went to telehealth companies and to compounders alike, which is the point: the exposure sits on both sides of the relationship and the failure is a sentence on a website that neither party owned.

Fix that by naming an owner. Somebody has to read the claims against the product before the page ships, and it works better when that somebody has a line to the pharmacy.

Changing partners while certified

Pharmacy relationships change. Capacity, pricing, geography, a partner deciding to exit a category. The certification does not forbid that. What it expects is that a material change to how your product is prepared and dispensed is disclosed rather than discovered.

Practically: treat a partner change like a change of address. Tell the certifier, update the disclosures on your site, and make sure the new partner's state coverage still matches where you market. A quiet swap that leaves your site describing the old arrangement is a discrepancy sitting in plain sight on your own website.

What this looks like in the file

For each pharmacy relationship, the file should carry the entity name and registration, the state licensure list, the scope of what it prepares for you, and a copy of the agreement. Supplied up front, that is a section of the application. Requested during review, it is a round trip and a delay, and the rework loop is what makes those round trips expensive.

The state coverage matrix

Build this before you file, because it is the single artefact that answers the most questions at once, and because building it is how most clinics discover a gap they did not know they had.

Three columns. States you market in, from your advertising targeting and your checkout rather than from your intentions. States your prescribers are licensed in. States your pharmacy may ship into.

Any row where the first column has an entry and either of the others does not is a problem you would rather find yourself. The usual causes are mundane: advertising targeting that was set to national on day one and never revisited, a prescriber whose licence lapsed in one state, or a pharmacy partner whose non-resident licensure covers less territory than the sales page implies.

The fix is usually to narrow the marketing rather than to widen the licensing, at least in the short term, and narrowing marketing is a change you can make this week.

Questions your pharmacy partner should be asking you

A good partner runs diligence in the other direction, and it is a useful signal if they do not.

Expect to be asked who prescribes and under what licences, what your intake actually screens for, what claims you make about the preparations they prepare, how you handle a patient who reports an adverse event, and what happens to prescriptions in flight if the relationship ends.

A partner who asks none of those has a compliance function you are relying on that may not exist, and that reliance shows up in your certification file rather than in theirs.