How to check a pharmacy or clinician license

Check a license with the state board that issued it. For a pharmacy, that is the board of pharmacy. For a clinician, it is the board for their profession, often the medical or nursing board. The FDA encourages anyone using an online pharmacy or telehealth service, including one that sells compounded drugs, to research the pharmacy first. Compounding generally means mixing or altering ingredients to make a drug for an individual patient. The FDA warns that online buyers may not know who compounded a drug, or whether that compounder meets quality standards and is appropriately licensed.^1,2,3,4,5

The checks, in order

Pharmacy licenses

Federal law requires your prescription label to show the dispenser’s name and address, which is usually the pharmacy, and the prescriber’s name.⁶

The FDA says it is aware of fraudulent compounded semaglutide and tirzepatide, two drugs that act on the GLP-1 (glucagon-like peptide-1) receptor. Some labels named pharmacies that do not exist. Others named licensed pharmacies that, according to information the FDA gathered, did not make the product. On March 3, 2026, the FDA announced warning letters to 30 telehealth companies over false or misleading claims about compounded GLP-1 drugs. A main problem it named was branding drugs with the telehealth company’s name in a way that implied the company was the compounder.^14,15

State boards of pharmacy generally oversee pharmacies day to day. Each board keeps a database or list of the pharmacies it licenses. BeSafeRx, the FDA’s campaign on buying medicine online, links to every state’s database. The National Association of Boards of Pharmacy (NABP), whose members are the state boards, links to each board.^4,16,1,17,18

The FDA’s tips for spotting a safe online pharmacy include requiring a prescription and having a state-licensed pharmacist available for questions. They also include a license in your state and in the state where the pharmacy operates. California, for one, requires this by law: any pharmacy outside the state that ships prescription drugs in needs a California license.^7,9

Injected medicines must be sterile, and contamination can cause deadly infections. In 2012, contaminated injectable drugs from a Massachusetts compounding pharmacy caused a deadly fungal meningitis outbreak in 20 states. Some states require a separate license for sterile compounding. California and Florida, for example, require one before a pharmacy in another state ships compounded sterile drugs in, and California’s board inspects the pharmacy first.^{14,19,20,9,21}

The FDA publishes a page of compounding inspections and actions since 2019, for state-licensed pharmacies and outsourcing facilities. It lists inspectors’ observation forms (Form FDA 483s), warning letters and letters referring a pharmacy to its state board. The FDA says it does not inspect the vast majority of state-licensed pharmacies unless, for example, it gets a complaint. A pharmacy missing from the page may never have had an FDA inspection, or its FDA record may predate 2019.^10,20

Outsourcing facilities

An outsourcing facility is a compounder registered with the FDA under section 503B of the Federal Food, Drug, and Cosmetic Act. The FDA inspects these facilities on a schedule based on risk. Their drugs must meet federal manufacturing quality rules (current good manufacturing practice, or CGMP). Those rules do not apply under section 503A, which covers compounding in state-licensed pharmacies and by physicians. Federal rules against unsanitary conditions apply to both.^4,19

Registration is not approval. Outsourcing facilities make compounded drugs, which the FDA says are not FDA-approved: it does not verify their safety, effectiveness or quality before they are sold. The FDA also says it does not approve or license any facility. It calls a claim that a compounded drug comes from an “FDA-approved” or “FDA-licensed” pharmacy or outsourcing facility false or misleading.^4,22

The FDA keeps a public list of registered outsourcing facilities and updates it weekly. For each facility, it gives the date of its last inspection. In the version checked, dated November 6, 2026, 43 of the 100 facilities listed had not yet been inspected.¹¹

For the last inspection, the list shows whether inspectors issued a Form FDA 483, whether a recall followed and any FDA action based on it. A Form 483 is not a final agency finding that a law was broken, the FDA says.¹¹

Registration must be renewed every year, or the facility comes off the list on January 1. The list leaves out state board actions; the FDA says to check those with the board of pharmacy in the facility’s state. Pharmacies that compound under section 503A never appear on it, because only outsourcing facilities register.^11,4

Clinician licenses

A clinician generally needs a license in the state where the patient is at the time of care. The Interstate Medical Licensure Compact, an agreement its member states have each passed into law, calls this the prevailing standard. It says medicine is practiced where the patient is located, which puts the physician under that state’s medical board. Nurses, too, must be licensed where the patient is, for in-person and telehealth care alike.^2,23

Florida lets a clinician licensed in another state treat patients there by telehealth after registering with the state, without a Florida license. The state’s Department of Health publishes a list of registrants, with each one’s out-of-state license number and five-year disciplinary history. A registrant’s website must link to it.^24,25

Nurse practitioners, one kind of advanced practice registered nurse (APRN), need an APRN license in each state where they practice. Nursys, a database run by the National Council of State Boards of Nursing, holds license and discipline records for registered and practical nurses and APRNs from participating boards. Its QuickConfirm search is free.^26,3

The right board depends on the clinician’s profession, and it is not always the medical or nursing board. California, for example, licenses osteopathic physicians (DOs) and physician assistants through separate boards, each with its own license search.^27,28,29

A National Provider Identifier (NPI) is a 10-digit number that identifies a health care provider. The NPI Registry, run by the Centers for Medicare & Medicaid Services (CMS), is a free directory showing a provider’s name, specialty and practice address. A record can also list a license number, but providers or people acting for them supply those details, CMS says. The registry warns that issuing an NPI does not ensure or validate that a provider is licensed or credentialed.^30,31

Prescribing controlled substances

Federal law sorts controlled substances into five schedules. Testosterone, as an anabolic steroid, is in Schedule III: drugs with an accepted medical use and less potential for abuse than those in Schedules I and II. Under Drug Enforcement Administration (DEA) rules, a clinician may prescribe a controlled substance only with authority from the state where they are licensed. They also need a DEA registration unless they are exempt.^32,33,34

The DEA counts nurse practitioners and physician assistants as mid-level practitioners when the state where they practice authorizes them to dispense controlled substances. In federal law, dispensing includes prescribing. Patients cannot use the DEA’s tools for verifying a registration, which are restricted to DEA registrants such as pharmacies. But a controlled-substance prescription must carry the prescriber’s DEA registration number, and the pharmacist who fills it shares responsibility for it with the prescriber.^{35,36,12,37,38}

In 22 states, plus the District of Columbia, Guam and Puerto Rico, the DEA lists a second requirement. Prescribers there also need a state controlled-substance license or registration. Unlike a DEA registration, a state’s controlled-substance registration may be open to public search.^13,39

Under the Ryan Haight Act of 2008, a clinician generally must evaluate a patient in person at least once before prescribing a controlled substance remotely. A temporary rule from the DEA and the Department of Health and Human Services waives that visit for DEA-registered clinicians through December 31, 2026. Under that rule, the prescription must follow a live, two-way conversation with the clinician, normally by video. An online questionnaire or written messages do not meet that condition.^40,41

Neither a permanent rule nor a further extension had been published by November 13, 2026. If the temporary rule lapses with nothing in its place, the in-person requirement comes back, the agencies have said.^42,40

Accreditation

Accreditation is a review by an outside organization, and it is not a license. NABP’s Digital Pharmacy Accreditation is voluntary and lasts three years. Only pharmacies with current, active licenses in every state where they do business can apply. NABP publishes a list of the pharmacies it has accredited.^43,44

Quality standards for compounding

Section 503A sets rules for bulk drug substances, the raw active ingredients that pharmacies compound from. They must “comply with an applicable United States Pharmacopeia (USP) or National Formulary (NF) monograph if one exists, and the USP chapter on pharmacy compounding,” the FDA says. A monograph is the standard these books publish for one substance, including tests it should pass. These ingredients must also come from a manufacturer registered with the FDA.^52,53

The FDA’s guidance on section 503A says the USP moved that chapter to chapter 795 and added chapter 797 on sterile compounding. Chapter 795 now covers nonsterile preparations, and 797 sterile ones, which include injections.^55,9

In an August 2026 notice, the FDA reported reactions such as fever and signs of shock in at least 30 patients given compounded glutathione into a vein. Some were hospitalized. Glutathione is also sold for use in dietary supplements, and the pharmacies that compounded it had all used one lot labeled dietary supplement grade. The FDA said compounders should not use dietary-supplement-grade ingredients in injectable drugs, or rely on testing alone to ensure quality.^54,53

For any compounded injection, a customer can ask whether the active ingredient came from an FDA-registered manufacturer and is not supplement grade. They can also ask whether the compounder follows chapter 797 or, for an outsourcing facility, CGMP.^{54,52,53,55,19}

If something doesn’t check out

Report side effects, or a medicine that seems wrong, to MedWatch, the FDA’s program for reports of serious reactions, product quality problems and errors in using a product. Patients can report online, on the consumer form (Form FDA 3500B), or by calling 1-888-INFO-FDA (1-888-463-6332) and pressing 2. You can file the report yourself: your health care provider is not required to report to the FDA. The FDA also takes reports of websites that appear to sell medicine illegally.^45,16

The FDA wants reports about compounded drugs too; if you are unsure whether a drug was compounded, it says to ask your clinician. Outsourcing facilities must report serious, unexpected side effects to the FDA within 15 calendar days of learning of them. Federal law does not require this of pharmacies that compound under section 503A, and the FDA says side effects of compounded semaglutide and tirzepatide are likely underreported as a result.^46,47,14

Complaints about a clinician generally go to the licensing board in the state where you were when you received care. Report a nurse’s conduct to the nursing board where it occurred, not to the National Council of State Boards of Nursing.^2,24,48

Complaints about a pharmacy go to a board of pharmacy that licenses it, such as the one in your state. California’s board, for example, takes complaints online and can discipline the out-of-state pharmacies it licenses.^7,9,49,50

For a controlled substance such as testosterone, the DEA also takes tips online about suspected illegal internet sales and about illegal sales or distribution by doctors and pharmacies.⁵¹