From drug safety and efficacy to controlled substance handling and Medicare or Medicaid billing, today’s hospital pharmacies must navigate a maze of pharmacy regulations. Whether it’s the DEA, the FDA, the USP, the CMS, or any other of the various regulatory bodies overseeing pharmacies, when these rules and protocols are not met, a pharmacy can face consequences ranging from fines and violations to loss of accreditation, reimbursement denials, or even suspension of operations.
Compliance is more than a regulatory checkbox; it is crucial to patient safety, the integrity of your hospital pharmacy, and financial stability. That’s why staying cognizant of evolving standards from these agencies mentioned above requires regular vigilance, staff training, and reliable internal systems to ensure every process, from billing to medication storage, meets the highest standards.
At CompleteRx, we understand the complexity of this landscape and partner with hospitals and health systems to implement effective compliance and quality management systems, including pharmacy audits and inspections, that help assess risk and improve operational performance. The following is an overview of the new or updated hospital pharmacy compliance and quality management regulations that hospital executives need to be keenly aware of in 2025 and beyond.
Drug Supply Chain Security Act
The Drug Supply Chain Security Act (DSCSA) ensures hospital pharmacy compliance and quality by mandating a system to track prescription drugs as they move through the supply chain. This enables the verification of a product’s legitimacy and facilitates a rapid response should illegitimate drugs be identified. Ultimately, the DSCSA aims to protect patients from contaminated or counterfeit medications.
The DSCSA is a comprehensive act encompassing several critical components to strengthen the pharmaceutical supply chain. The key aspects include:
- Product Serialization
- Traceability Requirements
- Verification Obligations
- Authorized Trading Partners (ATD)
- Enhanced Security Measures
Most recently, a crucial aspect of the DSCSA has been the implementation of full electronic, interoperable traceability for prescription drugs. This permits end-to-end tracking from manufacturing to dispensing. This system enhances the ability to detect and respond to illegitimate drugs, thereby minimizing risks associated with counterfeit or compromised medications in the healthcare system.
To meet these requirements, hospital leaders should work closely with their pharmacy team to implement a hospital pharmacy compliance program that ensures all traceability processes are in place and functioning effectively. This recently revised compliance mandate requires hospitals with 26 or more full-time employees to comply by November 27, 2025. Small dispensers, which are defined as entities with 25 or fewer full-time employees licensed as either qualified pharmacies or pharmacy technicians, have been granted an extension until November 27, 2026.
Sterile Compounding-USP 797
United States Pharmacopeia (USP) Chapter 797 establishes strict quality and safety standards to ensure compounded sterile preparations (CSPs) are free from contamination and safe for patient administration. These standards apply to all healthcare facilities that compound sterile drugs, requiring adherence to cleanroom environments, personnel training, and environmental monitoring. Sterile compounding, as outlined in 797 hospital guidelines, is particularly important in hospital settings, where high-risk patients are more susceptible to infection. Compliance ensures that CSPs are prepared to meet patient safety standards and minimize microbial contamination.
Immediate-Use Compounding Exemptions
USP 797 permits immediate-use compounding exemptions in urgent clinical situations where patient care could be compromised by waiting for complete sterile compounding procedures. However, strict conditions must be met to handle the compounded preparation appropriately. These exemptions still fall under the broader legal requirements for hospital pharmacies, which require strict adherence to safety, documentation, and aseptic standards, even in time-sensitive scenarios.
Immediate-use compounding is exempt from Category 1, 2, or 3 sterile compounding requirements, provided the following conditions are met. Adhering to these conditions is an essential aspect of hospital pharmacy compliance, ensuring that even urgent or time-sensitive compounding practices meet established safety and regulatory standards:
- Documented Personnel Competency: Personnel must demonstrate proficiency in aseptic techniques and proper medication handling through training and validation.
- Limited Number of Ingredients: No more than three different sterile products can be used in a single preparation.
- Single-Use Containers: Medications must only be prepared using single-use containers for one patient to prevent cross-contamination.
- Immediate Discarding of Unused Content: Any remaining drug product must be discarded immediately after preparation to eliminate the risk of microbial growth.
- Proper Labeling: All CSPs must be clearly labeled to ensure correct patient identification and medication administration.
- Tight Administration Timeline: The compounded preparation must be administered within four hours from the start of preparation to prevent bacterial contamination.
Implementing immediate-use compounding requires identifying the targeted audience responsible for its administration. This typically includes personnel from nursing, surgery, Anesthesiology, and the ICU.
Additionally, to maintain compliance, hospital leaders should work with facilities to develop and implement standard operating procedures (SOPs) that outline the following:
- The step-by-step aseptic technique for immediate-use compounding
- The documentation requirements for medication handling and administration.
- Training and competency assessments to ensure personnel remain proficient in safe compounding practices.
- Regular competency evaluations are necessary to ensure that all personnel understand risk mitigation strategies and comply with USP 797 guidelines.
Managing Cleanroom Excursions and Environmental Risks
Although immediate-use compounding does not require an ISO-classified cleanroom, cleanroom excursions in standard sterile compounding areas must still be addressed to ensure overall facility compliance. Several environmental risks must be closely observed and documented in SOPs, including:
- Pressure fluctuations that could affect air quality.
- Temperature or humidity failures that could impact drug sterility and stability
- HEPA Filter Malfunctions lead to compromised air filtration.
- Microbial Contamination may increase patient risk.
Proper environmental testing and response protocols must be documented in Standard Operating Procedures (SOPs) to guide corrective actions when necessary. Regular monitoring ensures deviations from the required environmental conditions are identified and resolved before compromising sterility.
Similarly, flooding events or unexpected power failures can compromise the sterility of compounding areas. Emergency response procedures must be established for pharmacies and healthcare facilities to address risks associated with document excursion contamination, and corrective actions must be in place to maintain compliance with USP 797.
DEA Regulations For Controlled Substances Management
Effective controlled substance management is essential to achieving DEA pharmacy compliance. Hospital leaders must ensure their pharmacies are proactively inspection-ready, ensuring adherence to record-keeping, reporting requirements, and accountability audits to prevent drug diversion and unauthorized access. Staying compliant with pharmacy regulations in hospital settings is critical to maintaining operational integrity and avoiding costly penalties.
Keys to Being Inspection-Ready for DEA Inspection
Record Keeping and Reporting
Maintaining accurate and complete records is a fundamental requirement for the DEA pharmacy
compliance. Inspection folders or binders should always be organized and up-to-date, containing all necessary paperwork for quick access during an inspection. This includes inventory logs, dispensing reports, disposal, and ordering records. Controlled substance transactions must be thoroughly documented, including orders, receipts, administration records, and inventory logs. The inability to provide these records promptly can lead to compliance citations, legal findings, and fines, and, in a worst-case scenario, a revocation of DEA registration.
Facilities must also adhere to DEA reporting requirements for significant loss events or diversion. Any theft, loss, or suspected diversion of controlled substances must be reported to the DEA field office within one business day of identification. It must be reported using DEA Form 106 within 45 days. Timely reporting ensures regulatory compliance and helps mitigate the risks associated with drug diversion, particularly in hospital pharmacy compliance protocols.
Theft and Diversion Security Controls
To prevent unauthorized access to controlled substances, hospital leaders must ensure their facilities are equipped with security controls that adhere to DEA regulations. These measures include:
- Alarm Systems
- Motion Detectors
- Surveillance Cameras
Regular security assessments and audits ensure that all controls remain effective, assisting in identifying risks within the system to defend against the misuse or theft of controlled substances.
Accountability Audits
CompleteRx recommends regular accountability audits to ensure that all controlled substances are accounted for and any discrepancies are quickly investigated. For more guidance on how to prepare for an accountability audit and ensure DEA Audit preparedness, check out our complete Pharmacy Audit Checklist.
DEA Controlled Substance Ordering System (CSOS)
Starting this year, the DEA’s Controlled Substance Ordering Systems (CSOS) have been upgraded to version 2.0, known as CSOS 2.0 pharmacy. This move required all registrants (hospital administrators/authorizing agents) and authorized pharmacy staff ordering schedule I and II controlled substances to have active logins and always maintain up-to-date information within the DEA CSOS program.
The key requirements for compliance include the following:
- Hospital administrators must grant access to ensure all authorized personnel are correctly registered in the CSOS 2.0 pharmacy platform and revoke access if necessary.
- To access the online ordering platform, all pharmacy staff must maintain updated login credentials to gain access.
- Failure to update registrant information may result in order delays or refusal, violating DEA pharmacy compliance standards.
Centers for Medicare and Medicaid Services (CMS) Updates
In February 2024, the CMS proposed a new rule to strengthen oversight of Accreditation Organizations (AOs) by requiring more frequent follow-up visits after conducting surveys. This measure enhances reviewer independence and ensures standards are consistently met. In line with updated CMS pharmacy regulations, it also emphasized the importance of unannounced surveys and the need for AOs to avoid conflicts of interest during accreditation proactively.
Some of the more common findings under the CMS Conditions of Participation (COPs) for pharmacy services include the improper dating of opened multi-dose vials (MDVs) and storage of medications in patient care areas. Other findings include medication kits, also known as tackle boxes, that are left unsecured in operating rooms and are not actively in use. Organizations are encouraged to thoroughly assess the storage and security of medications within their facilities to identify and address infractions. With the USP 797 having been reviewed in 2024, organizations have faced challenges in implementing sterile compounding programs and providing training.
CompleteRx: Ensuring Compliance in Hospital Pharmacy Operations
Navigating the intricate landscape of hospital pharmacy compliance—from DEA inspections and CSOS 2.0 pharmacy requirements to CMS pharmacy regulations, sterile compounding standards (USP 797), and the DSCSA—is no simple undertaking.
Yet, maintaining compliance isn’t optional—it’s critical for ensuring patient safety, protecting your organization from legal and financial penalties, and securing continued accreditation and reimbursement.
Staying ahead of ever-changing pharmacy regulations in hospitals requires more than policies on paper. It demands comprehensive training, reliable audit trails, digital infrastructure for real-time tracking, and a dedicated partner who understands every regulatory nuance.
At CompleteRx, we provide the tools, expertise, and hands-on support your hospital pharmacy needs to implement sustainable compliance solutions.
Let’s discuss how CompleteRx can elevate your pharmacy’s compliance and quality programs. Contact us today for a consultation.
