Opening your pharmacy doors before your compliance documentation is in order is one of the riskiest things you can do. State board inspectors, DEA investigators, and Medicare auditors can walk in on any day after you open — and if your documentation isn't in place, the consequences range from citations and fines to permit suspension. This checklist covers the key compliance requirements every independent pharmacy must have completed before opening day.
Before we get into the checklist itself, an important framing point: compliance is not a one-time event. It is an ongoing operational requirement. The items below represent what must be in place before you dispense your first prescription — but maintaining, updating, and auditing your compliance posture is a permanent part of running a pharmacy. Build it right from the start and the ongoing maintenance is manageable. Skip the foundation and you will be playing catch-up under pressure.
Licenses & Registrations
- State Pharmacy Permit — posted, current, unrestricted
- DEA Registration Certificate — posted at dispensing location
- NPI registered and active (Type 1 for PIC, Type 2 for pharmacy)
- NCPDP/NABP number active
- Medicare Part B enrollment approved (PTAN issued)
- Medicare Part D credentialing confirmed through PSAO
- All third-party PBM contracts active
- State controlled substance license (if separate from DEA in your state)
DEA & Controlled Substance Compliance
- DEA security requirements met (vault/safe, alarm)
- Biennial DEA controlled substance inventory documented
- DEA Form 222 or e-ARCOS access established for Schedule II ordering
- Controlled substance disposal process documented
- PDMP (Prescription Drug Monitoring Program) access registered
- Controlled substance dispensing log system in place
Policies & Procedures Documentation
- Dispensing policies and procedures manual completed
- Controlled substance handling policies documented
- Patient counseling policy documented and signed by PIC
- Prescription error detection and reporting procedure documented
- Drug recall and returns policy documented
- Patient privacy and HIPAA policy documented
- Employee grievance and reporting policy documented
- After-hours emergency contact policy documented
Medicare Compliance
- Medicare Compliance Officer designated and documented
- Medicare compliance policies and procedures written and signed
- Employee compliance training completed and documented
- Compliance hotline or reporting mechanism established
- Surety bond active and on file
- Medicare Standards of Conduct distributed to all staff
Staff & Licensing
- PIC license verified current and unrestricted in state
- All pharmacist licenses verified
- All pharmacy technicians registered with state board (if required)
- Pharmacy intern permits current (if applicable)
- Staff background checks completed per state requirements
- Employee files complete with required documentation
Physical Space & Signage
- State Pharmacy Permit posted in visible location
- DEA Certificate posted at dispensing location
- Patient counseling area designated per state board requirements
- HIPAA Notice of Privacy Practices posted and available
- Pharmacy hours posted
- Licensed pharmacist on duty signage posted
- Emergency contact information posted
Technology & Systems
- Pharmacy management software installed and tested
- All PBM billing connections tested and verified
- Wholesaler electronic ordering system active
- POS system integrated and tested
- Network security in place (firewall, encrypted connections)
- Backup system documented and tested
- PDMP software access tested
Why Each Category Matters
Licenses & Registrations
This seems obvious, but incomplete license documentation is more common than you'd think. Every license must be physically present, posted where required, and current. A state board inspector who finds an expired technician license or a DEA certificate that isn't posted at the dispensing location can issue a citation even if the renewal is pending. Know the status of every license in your pharmacy at all times.
DEA & Controlled Substance Compliance
This is the highest-risk compliance area for independent pharmacies. DEA violations can result in registration suspension, civil penalties, and in egregious cases, criminal prosecution. The non-negotiables: your controlled substance storage must meet DEA physical security requirements, your staff must understand the documentation requirements for Schedule II dispensing, and you must have PDMP access established and actively used at the point of dispensing as required by your state. Pennsylvania, New Jersey, and Delaware all have mandatory PDMP query requirements — failure to query before dispensing certain controlled substances is a state board violation as well as a potential DEA compliance issue.
Policies & Procedures
Written policies and procedures are not just a bureaucratic formality — they are your legal protection. If an error occurs, if an employee reports misconduct, or if a state board or DEA investigator asks how your pharmacy handles a specific situation, your written P&Ps are what demonstrates that you have a functioning compliance system. They must be written, reviewed by your PIC, stored accessibly, and updated at least annually. Every employee must be documented as having received and reviewed them.
Medicare Compliance
Medicare compliance goes beyond just having your enrollment paperwork in order. CMS expects enrolled pharmacies to have a functioning Corporate Compliance Program — a designated compliance officer, written policies, training, and a mechanism for employees to report concerns without retaliation. For a small independent pharmacy, this doesn't require a full-time compliance department, but it does require documented structure. We create complete Medicare compliance programs for every pharmacy we open.
Staff Licensing
In Pennsylvania, New Jersey, and Delaware, pharmacy technicians must be registered with the state board and meet continuing education requirements. Allowing an unregistered technician to perform regulated activities is a state board violation — even if unintentional. Before you open, verify every team member's license or registration status directly through the state board's public verification system, not just by asking the employee.
Building a Compliance Calendar
Once you've checked all the opening-day boxes, the next step is establishing a compliance calendar — a schedule of recurring compliance tasks throughout the year. This includes:
- Annual license renewal deadlines for pharmacy permit, DEA, and staff licenses
- Annual Medicare compliance training completion deadline
- Annual P&P review and update
- Biennial DEA controlled substance inventory
- Quarterly PBM audit readiness self-audits
- State board continuing education requirements for all pharmacists
Missing a renewal deadline doesn't just create an administrative problem — it creates a gap in your legal authorization to operate. State board permit lapses, expired DEA certificates, and lapsed Medicare enrollment can all force a temporary closure or restrict your ability to bill certain patients. A simple calendar reminder system can prevent all of these.
The Cost of Non-Compliance
Independent pharmacy owners sometimes view compliance as overhead — a cost without a direct return. That framing is dangerously wrong. The cost of a state board citation ranges from a minor fine to permit suspension. A DEA compliance failure can result in registration revocation — meaning you can't dispense controlled substances, which for most pharmacies means you can't operate. A Medicare audit finding can result in retroactive repayment demands that, in extreme cases, reach six figures. And the legal fees involved in fighting any of these outcomes dwarf the cost of getting it right upfront.
Getting compliance right before opening day is not just the law — it's one of the smartest financial decisions you can make for your pharmacy.
We build complete compliance programs for every pharmacy we open.
Policies, procedures, Medicare compliance officer setup, staff documentation — all of it handled so you open fully compliant from day one. Schedule a consultation to learn more.