Where a drug came from matters as much as what its label says. In April 2024, FDA warned that counterfeit Botox had turned up in multiple states and that the products appeared to have been bought from unlicensed sources. FDA used the alert to remind providers that federal law requires anyone who dispenses or administers prescription drugs to buy them only from authorized sources.
Here's what "authorized" means in practice, and what to check before you place an order.
Start with the license
Every legitimate supplier in the prescription drug chain holds a license or registration you can look up yourself. Which one depends on who they are.
- Wholesale distributors. Federal law requires a wholesale distributor to be licensed by the state it ships from and, for interstate shipments, by the state it ships into if that state requires it. Distributors must also report their licenses to FDA each year. FDA's advice: check the state licensing website first, then FDA's annual reporting database.
- Pharmacies. Check the license with the board of pharmacy in the pharmacy's home state and in the state the drug is going to. New York, for example, requires out-of-state pharmacies, manufacturers and wholesalers that ship prescription drugs into New York to register there.
- 503B outsourcing facilities. Confirm the facility is on FDA's registered outsourcing facility list and review its inspection history there. Some states license them too; California requires a nonresident outsourcing license.
- Manufacturers and repackagers. Under the Drug Supply Chain Security Act (DSCSA), these are authorized when they hold a valid FDA registration. FDA's Drug Establishments Current Registration Site lists currently registered establishments. It doesn't cover outsourcing facilities, wholesale distributors or third-party logistics providers.
Some distributors also hold NABP's Drug Distributor Accreditation, a voluntary three-year accreditation that some states may require for licensure. Treat it as a plus, not a substitute for checking licenses yourself.
On MedGrid, vendors file their licenses and compliance documents, which MedGrid marks verified; clinicians' NPI is checked against the federal NPPES registry at signup, and a verified DEA registration is required before any controlled-substance order. Keep copies of whatever you rely on in your own files.
DSCSA basics for clinics
DSCSA, enacted in 2013, aims to create an interoperable, electronic way to identify and trace certain prescription drugs at the package level. The points that matter most for a clinic:
- What it covers. Prescription drugs in finished dosage form. Drugs compounded in compliance with section 503A or 503B are excluded from the section 582 requirements.
- You're a dispenser. The statute defines a dispenser to include any person authorized by law to dispense or administer prescription drugs. Since January 1, 2015, a dispenser's trading partners may be only authorized (properly licensed or registered) trading partners. Wholesale distributors face the same rule on their side.
- Transaction documents. Sellers provide transaction information (TI) and a transaction statement (TS). The transaction history requirement effectively ended on November 27, 2023. Dispensers subject to the tracing rules must keep TI and TS for at least six years.
- The practitioner exception. Section 582(d)(5) says the dispenser tracing and verification requirements don't apply to licensed practitioners, or licensed individuals they supervise, who dispense or administer product in the usual course of professional practice. The authorized-trading-partner requirement isn't part of that exception. How it applies to your clinic's structure is a question for counsel. Either way, keeping the TI and TS your supplier sends costs little and helps in a recall.
- Suspect product. Dispensers subject to the verification rules must quarantine suspect product, investigate it, and notify FDA and affected trading partners within 24 hours of determining a product is illegitimate.
- Recent change. On August 6, 2026, FDA extended exemptions from certain enhanced (electronic, package-level) requirements for small business dispensers until November 27, 2027. FDA defines these as dispensers whose owning entity has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. Other section 582 requirements still apply.
Controlled substances: check DEA registration too
- A vendor selling you controlled substances needs its own DEA registration. DEA registrants can check another registrant's status through DEA's Registration Validation toolset.
- You need a separate DEA registration for each principal place of business or professional practice where controlled substances are dispensed.
- Schedule II orders require DEA Form 222 or a digitally signed electronic order.
- Anabolic steroids, a category that includes testosterone, are Schedule III. So is ketamine.
- DEA-required records must be kept for at least two years.
Certificates of analysis: what they prove
A certificate of analysis (CoA) reports test results for a specific lot. Its value depends on what was tested.
- Bulk ingredients. Section 503A requires bulk drug substances used by 503A compounders to come from an FDA-registered establishment with a valid CoA. That CoA describes the ingredient, not the finished preparation you receive.
- Finished 503B products. Outsourcing facilities are held to cGMP, which requires appropriate lab testing of each batch of drug product that is supposed to be sterile or pyrogen-free, and testing of incoming components. A supplier's report of analysis can stand in for component testing only with at least one identity test and periodic validation of the supplier's results.
- What to check on any CoA. The lot number matches your product. The testing lab is named. Specifications and results are stated for identity and strength and, for sterile injectables, sterility and pyrogens (endotoxins). Results fall within specification.
Ingredient sourcing is under scrutiny. In September 2025, FDA launched a "green list" import alert for GLP-1 active ingredients: API from facilities FDA hasn't inspected or evaluated as appearing compliant is subject to detention on import. If you prescribe compounded GLP-1s, ask the pharmacy where its API comes from.
Cold chain and receiving
- Know the labeled storage conditions before you order. 503B labels must include storage and handling instructions.
- Ask how shipments are packed and monitored in transit, and what the vendor does after a temperature excursion.
- Federal minimum standards for state wholesale distributor licensing require storage according to the drug's labeling or compendial requirements, temperature and humidity recording equipment or logs, and visual examination of every incoming shipping container for damage or contamination. Apply the same discipline at your receiving desk.
- Quarantine anything damaged, out of temperature or otherwise questionable until it's cleared or returned.
Red flags
- Deep discounts and aggressive marketing. FDA says these may indicate stolen, counterfeit, substandard or unapproved product.
- Packaging that doesn't match. FDA's warning signs include labels not in English, packaging that looks slightly different from the FDA-approved product, a different product name, unfamiliar dosing, missing safety information, or a different dosage form. The 2024 counterfeit Botox carried non-English text and a 150-unit strength the manufacturer doesn't make.
- "For research purposes" or "not for human consumption." FDA has warned companies selling unapproved GLP-1 drugs labeled this way.
- Unverifiable licenses. A vendor that won't give you license numbers you can check, or won't provide DSCSA documentation for prescription drugs.
- Compounding shortcuts. Non-patient-specific stock offered from a 503A pharmacy, or anyone reselling 503B product. 503B drugs may be sold or transferred only by the facility that made them.
- No questions about you. Distributors may trade only with authorized trading partners, so a legitimate one has reason to check your license before selling.
Records to keep
- Copies of each vendor's licenses and registrations, with the date you verified them and where.
- Invoices, TI and TS for prescription drug purchases.
- Lot-specific CoAs and any temperature data that came with shipments.
- Receiving logs: date, product, lot, expiration, condition on arrival, and who received it.
- Lot numbers in patient administration records, so you can find affected patients in a recall.
- Compounded-drug prescriptions and office-stock orders, including any clinical-difference notes.
- DEA records for controlled substances.
- Suspect-product investigations and how they were resolved.
Report adverse events and product problems to FDA's MedWatch program; 503B container labels list how to reach it.
This article is general information, not legal advice. Rules vary by state; confirm specifics with your counsel and your state boards.
Sources
- FDA, Counterfeit Version of Botox Found in Multiple States
- FDA, FDA Issues Letters to Doctors Who May Have Purchased Counterfeit or Unapproved Prescription Drugs
- FDA, Know Your Source: Protecting Patients from Unsafe Drugs
- FDA, Beware of Offers Too Good to be True (flyer)
- FDA, Caution! Check the Signs (flyer)
- FDA, Check Licensure of Wholesale Drug Distributors and Third-Party Logistics Providers
- FDA, Annual Licensure Reporting by Wholesale Drug Distributors and Third-Party Logistics Providers
- 21 U.S.C. § 353 (FD&C Act § 503), including wholesale distributor licensure
- 21 U.S.C. § 360eee (FD&C Act § 581), DSCSA definitions
- 21 U.S.C. § 360eee-1 (FD&C Act § 582), DSCSA requirements
- FDA, Drug Supply Chain Security Act (DSCSA)
- FDA, DSCSA Exemptions for Small Business Dispensers Until November 27, 2027 (August 6, 2026)
- FDA, Registered Outsourcing Facilities
- FDA, Drug Establishments Current Registration Site (DECRS)
- NABP, Drug Distributor Accreditation
- New York State Education Department, Office of the Professions: Out-of-State Pharmacy Establishments
- California Business and Professions Code § 4129.2, Nonresident outsourcing facilities
- 21 U.S.C. § 353a (FD&C Act § 503A)
- 21 U.S.C. § 353b (FD&C Act § 503B)
- 21 CFR 211.84, Testing and approval or rejection of components
- 21 CFR 211.167, Special testing requirements
- 21 CFR 205.50, Minimum requirements for the storage and handling of prescription drugs
- DEA Diversion Control Division, Multi-Factor Authentication Added to the Registration Validation Toolset
- 21 CFR 1301.12, Separate registrations for separate locations
- 21 CFR 1305.03, Distributions requiring a Form 222 or a digitally signed electronic order
- 21 CFR 1308.13, Schedule III
- 21 U.S.C. § 802, Definitions (anabolic steroid)
- 21 CFR 1304.04, Maintenance of records and inventories
- FDA, FDA Launches Green List to Protect Americans from Illegal Imported GLP-1 Drug Ingredients (September 5, 2025)
- FDA, FDA's Concerns with Unapproved GLP-1 Drugs Used for Weight Loss
- FDA, MedWatch: The FDA Safety Information and Adverse Event Reporting Program
