HIPAA Compliance Checklist for Pharmacies

Last updated: 2026-07-06 — ComplianceStack Editorial Team

16 items

Pharmacies HIPAA Compliance Checklist

0 of 16 items reviewed

1

Designate a HIPAA Privacy Officer and Security Officer

Critical 1 day

For independent pharmacies, the pharmacist-in-charge often fills both roles. Chain pharmacies must designate officers at the corporate level. Document the appointment and ensure the officer has authority to implement policy changes.

45 CFR 164.530(a)(1); 45 CFR 164.308(a)(2)
2

Conduct a Security Risk Assessment covering pharmacy systems

Critical 2-4 days

Include your pharmacy management system (PMS), e-prescribing platform (Surescripts), point-of-sale system, automated dispensing cabinets, and any patient-facing kiosks. Document every system that touches ePHI.

45 CFR 164.308(a)(1)(ii)(A)
3

Review and negotiate PBM data-sharing agreements for HIPAA compliance

Critical 3-5 days

Pharmacy Benefit Managers (PBMs) require extensive claims data, but HIPAA's minimum necessary standard still applies. Ensure your PBM contract includes a BAA, limits data use to permitted purposes, and does not grant the PBM blanket rights to re-disclose patient information for marketing.

45 CFR 164.502(b) (Minimum Necessary); 45 CFR 164.504(e) (BAA requirements)
4

Implement access controls in the pharmacy management system

Critical 1 day

Every technician, pharmacist, and clerk needs a unique login. Role-based access should restrict technicians from modifying clinical notes and limit clerk access to pickup/point-of-sale functions. No shared credentials.

45 CFR 164.312(a)(2)(i) (Unique User Identification); 45 CFR 164.312(a)(1)
5

Secure the interface between DEA-required records and HIPAA-protected PHI

Critical 1-2 days

DEA Schedule II-V records must be maintained per 21 CFR 1304, but the patient information in those records is still PHI under HIPAA. Ensure controlled substance logs are accessible only to authorized personnel and stored with the same encryption and access controls as other ePHI.

21 CFR 1304.04 (DEA recordkeeping); 45 CFR 164.312(a)(1) (HIPAA access controls)
6

Design the counseling area to prevent incidental disclosure

High Varies (physical modifications)

HIPAA does not prohibit pharmacy counseling at the counter, but reasonable safeguards are required. Install privacy screens or partitions, use lower voices, and position counseling stations away from the waiting area. Many OCR complaints originate from overheard conversations.

45 CFR 164.530(c)(1) (Safeguards); OCR FAQ on Incidental Disclosures
7

Encrypt all e-prescribing transmissions and stored prescription data

High 1-2 days

E-prescribing via Surescripts must use encrypted connections. Stored prescription records in your PMS must be encrypted at rest. Backup tapes and portable media containing prescription data require AES-128 or stronger encryption.

45 CFR 164.312(a)(2)(iv); 45 CFR 164.312(e)(1)
8

Train all staff on HIPAA and pharmacy-specific scenarios annually

High 1 day per year

Cover: handling prescription pickup by someone other than the patient, phone verification procedures, refusing to confirm whether a patient has a prescription to unauthorized callers, and proper handling of prescription label waste.

45 CFR 164.530(b)(1); 45 CFR 164.308(a)(5)
9

Establish a prescription label and paperwork disposal protocol

High Ongoing

Prescription labels, patient information leaflets, pharmacy bags with labels, and voided prescriptions contain PHI. Cross-cut shred all paper containing patient information. Ensure the same standard applies to pharmacy bag labels that do not get picked up.

45 CFR 164.310(d)(2)(i-ii) (Disposal); 45 CFR 164.530(c) (Safeguards)
10

Execute BAAs with delivery services, compounding partners, and IT vendors

High 2-3 days

If you use a delivery service that sees patient names and addresses on packages, that service may be a Business Associate. Compounding pharmacies receiving prescriptions are Business Associates. IT support with database access needs a BAA.

45 CFR 164.502(e); 45 CFR 164.504(e)
11

Implement automatic logoff on all pharmacy workstations

High Half day

Pharmacy workstations are often shared among technicians across shifts. Configure automatic screen lock after 2 minutes of inactivity to prevent unauthorized access to open patient records.

45 CFR 164.312(a)(2)(iii)
12

Document patient counseling records with PHI access logging

Medium 1 day

Many states require pharmacists to document patient counseling. These records are PHI and must be included in your security risk assessment. Ensure counseling documentation in the PMS generates an audit trail.

45 CFR 164.312(b) (Audit Controls); state pharmacy practice acts
13

Create a breach notification procedure specific to pharmacy data

Medium 2 days

Pharmacy breaches often involve large patient populations. Define escalation thresholds, notification templates, and your process for the 500+ patient threshold that requires HHS and media notification.

45 CFR 164.400-414
14

Establish patient rights procedures: access, amendment, accounting

Medium 2 days

Patients have the right to receive copies of their prescription records within 30 days. Many pharmacies are slow to respond to patient record requests. Document your intake process, fees (if any, per state law), and response timeline.

45 CFR 164.524 (Access); 45 CFR 164.526 (Amendment); 45 CFR 164.528 (Accounting of Disclosures)
15

Develop a contingency plan for pharmacy system downtime

Medium 2 days

If your PMS goes down, you still need to fill prescriptions safely. Document manual dispensing procedures, backup prescription verification processes, and data recovery steps. Test the plan at least annually.

45 CFR 164.308(a)(7)(ii)(A-D)
16

Review all HIPAA policies annually and after any security incident

Ongoing 1-2 days per year

Assign an annual review date. Check for regulatory updates (HIPAA, DEA, state pharmacy board), update policies to reflect operational changes, re-train staff, and document everything. Retain policies for six years.

45 CFR 164.530(j); 45 CFR 164.316(b)(2)(iii)

Common Mistakes to Avoid

Leaving prescription bags with visible labels on the pickup counter
Other customers can read patient names and medications. This is the most common pharmacy HIPAA complaint to OCR.
Granting PBMs unrestricted access to patient data beyond claims processing
PBMs that use patient data for marketing or formulary steering without proper authorization violate the minimum necessary standard. The pharmacy bears co-responsibility if the BAA is inadequate.
Not treating automated dispensing cabinet logs as ePHI
Dispensing cabinets record patient names, medications, and dispensing times. These logs are ePHI and must be secured under the HIPAA Security Rule.
Confirming a patient's prescription to an unauthorized caller
Pharmacy staff must verify the identity and authority of anyone requesting prescription information by phone. Disclosing to an unauthorized person is a HIPAA violation.
Failing to shred voided or unclaimed prescription labels
Prescription labels contain patient name, medication, dosage, and prescriber — a concentrated package of PHI. Tossing them in regular trash is a breach.

Frequently Asked Questions

Does HIPAA apply to independent pharmacies the same way it applies to chains?

Yes. Every pharmacy that transmits health information electronically — including insurance claims, e-prescriptions, or electronic prior authorizations — is a covered entity under HIPAA (45 CFR §160.103) with identical compliance obligations regardless of size, whether independent or part of a chain. Small independent pharmacies must maintain written HIPAA Privacy policies, conduct an annual Security Rule risk analysis (45 CFR §164.308(a)(1)), and designate a Privacy Officer (45 CFR §164.530(a)).

How do DEA recordkeeping requirements interact with HIPAA?

DEA requires pharmacies to maintain records of controlled substance dispensing under 21 CFR 1304. Those records contain patient PHI, so HIPAA's Privacy and Security Rules apply to them simultaneously. You must satisfy both DEA's recordkeeping mandates and HIPAA's access, encryption, and audit requirements for the same records.

Can a pharmacy share patient medication history with a PBM without patient authorization?

Pharmacies can share claims data with PBMs for treatment, payment, and healthcare operations without individual patient authorization, provided a BAA is in place and the data shared is limited to what is needed for the stated purpose (minimum necessary standard). However, if the PBM uses data for marketing or non-covered purposes, separate patient authorization is required.

Get This Checklist Emailed to You

No account needed. We'll email you the full checklist + any updates to compliance requirements.

Related Checklists