chevron-down Created with Sketch Beta.
April 22, 2022

Toward a Single Point of Care

Ensuring Compliance for Medical Offices With In-House Pharmacies

Henry Norwood, Esq.

For medical offices, increasing revenues while improving quality of care can go hand in hand. Bringing pharmacy services into the medical office can open an additional stream of income, improve care coordination between the provider and pharmacist, and provide patients greater convenience. This nationwide trend is particularly prevalent among medical offices in states with larger, aging patient populations.

The in-office pharmacy does, however, carry legal challenges of which counsel for medical offices and pharmacies need to be aware. The addition of pharmacies into existing medical offices implicates several federal laws, as well as state laws, regulations, and professional rules.

The Stark Law

The Stark law (also referred to as the Physician Self-Referral Law), prohibits physicians from making patient referrals for certain medical services (referred to as “designated health services”) to providers with whom the physician (or immediate family member) has a financial relationship. If a financial relationship exists and a referral is made when no exception applies, the provider performing the services is prohibited from submitting a claim for the services provided to Medicare or Medicaid. If a provider discovers a Stark violation on its own, the provider must repay the government for the claims submitted under the violative arrangement.

Civil monetary penalties (CMPs) may be imposed on entities that violate the Stark Law if it is demonstrated that the provider committed the violation knowingly. There is a maximum CMP limit of $15,000 for each submitted claim that knowingly violates the Stark law, in addition to up to three times the amount of the claims submitted. Outpatient prescription medications generally fall within the Stark law’s reach.

There are exceptions to the Stark law whereby a physician may refer to a provider with whom the physician has a financial relationship. The most pertinent exception to the Stark law which may allow a physician to refer a patient to an in-office pharmacy is the In-Office Ancillary Services exception. To fall under this exception, the pharmacy services must be provided by the physician making the referral, another physician in the same group practice as that physician, or by another individual supervised by either the referring physician or a physician in the same group practice as the referring physician. Further, the pharmacy services must be provided in the same building as that used by the physician to provide services or in a centralized building used exclusively for the provision of services covered by the Stark law. Prescription medications must be billed by the physician providing or supervising the services provided, by the group practice, or by a separate entity that is entirely owned by either the providing physician or the group practice.

The Anti-Kickback Statute

The federal Anti-Kickback Statute restricts any individual from knowingly or willfully offering, receiving, or soliciting anything of value in exchange for referrals for any services or products covered under a federal healthcare program. “Knowingly,” under the Anti-Kickback Statute, refers to actual knowledge or constructive knowledge, which is defined as: “a person, with respect to information” either “acts in deliberate ignorance of the truth or falsity of the information” or “acts in reckless disregard of the truth or falsity of the information.”

Each violation of the statute is punishable by a fine of up to $25,000, possible imprisonment of up to five years, and exclusion from participating in federal healthcare programs for at least five years in the event of a criminal prosecution. The statute allows for an exception to the mandatory exclusion upon conviction provision, which is discretionary and provides that under circumstances where the provider at issue is the sole provider of certain medical services in a community, the exclusion provision may be waived upon request.

The Anti-Kickback Statute includes a CMP provision of up to $50,000 as well as a "three-strikes-you're-out" provision, which requires permanent exclusion from any federal healthcare program for a provider who has been convicted of three offenses related to the submission of healthcare claims. Providers who have been convicted of two healthcare-related offenses will face a required 10-year exclusion from participation in federal healthcare programs.

Like the Stark law, there are exceptions to the Anti-Kickback Statute, called “safe harbors,” and medical practices should fall under one of them in order to operate a compliant in-house pharmacy dispensary. The two most pertinent safe harbors are the Bona Fide Employment safe harbor and the Personal Services and Management Agreement safe harbor. The Bona Fide Employment safe harbor requires that the individual providing a service or product covered by a federal healthcare law act as an employer and pay the referral source as an employee. The Personal Services and Management Agreement safe harbor is similar to the Bona Fide Employment safe harbor, but instead of creating an employer-employee relationship between the medical office and staff in the pharmacy, this safe harbor creates what is essentially an independent contractor relationship. The Personal Services and Management Agreement safe harbor requires a written, signed agreement between the provider of services/products under a federal healthcare program and the referring physician, which will last for at least one year and covers all of the services the pharmacy provider will perform.

The Drug Supply Chain Security Act

The Drug Supply Chain Security Act (DSCSA) provides for several measures intended to protect the U.S. supply of pharmaceuticals. Pharmacies, referred to as “dispensers” by the DSCSA, are covered by and subject to several requirements under the law. Pharmacies must first confirm the status of any party in the chain of pharmaceutical distribution with which the pharmacy does business, to ensure the party is registered and licensed through the U.S. Food and Drug Administration (FDA) as well as through any appropriate state-based authority. Pharmacies must also ensure they only receive pharmaceuticals bearing transaction information, transaction history, and a transaction statement. This information must be stored by the pharmacy. Further, pharmacies are required to maintain policies regarding the investigation of illegitimate pharmaceuticals that may have been involved with criminal activity or adulteration.  Penalties for violations include fines, suspension or revocation of licenses, and/or criminal imprisonment.

Medical offices seeking to bring a pharmacy in-house will need to adopt policies to ensure compliance with the DSCSA, as well as any state regulations regarding the storage, maintenance, and security of pharmaceuticals.

The Controlled Substances Act

The Federal Comprehensive Drug Abuse Prevention and Control Act of 1970, also known as the “Controlled Substances Act” (CSA), regulates the sale and distribution of controlled substances, including pharmaceuticals. Controlled substances may only be dispensed upon receipt by the pharmacy of a prescription authored by an authorized healthcare provider. Furthermore, the CSA subjects both pharmacists and physicians to penalties for failure to issue a prescription with “a legitimate medical purpose by an individual practitioner acting in the usual course of his professional practice.” Controlled substances dispensed by pharmacies must bear labels including instructions for use, the names of the pharmacy, prescriber, and recipient, and the serial number of the prescription. Pharmacies are required to keep detailed records and maintain a regular inventory of the controlled substances in their possession. Further, pharmacies are required to notify the Drug Enforcement Administration (DEA) and local law enforcement regarding any significant theft or loss of any controlled substance in the possession of the pharmacy.

Under what is commonly referred to as the “five percent rule,” a pharmacy is permitted to distribute a controlled substance to another health practitioner for the purpose of dispensing the substance to a patient without the need to register as a distributor under the CSA as long as: (1) the healthcare practitioner to whom the pharmacy dispenses the controlled substance is registered under the CSA; (2) the distribution is properly recorded by the pharmacy and by the receiving health practitioner; (3) a specific order form is required to be completed if the controlled substance distributed is designated as either a Schedule I or II substance;  and (4) the total amount of dosage units of all controlled substances distributed by the pharmacy annually is not greater than five percent of the total amount of dosage units of all controlled substances distributed by the pharmacy during the same calendar year.

The failure to comply with the requirements of the CSA can result in significant penalties imposed by the DEA, which enforces the CSA. Violation of the CSA may rise to the level of a criminal offense if it is determined that the violation was committed knowingly. The severity of the penalties imposed are discretionary, but can include fines up to $500,000 per offense. Medical offices should be well-versed in the CSA’s requirements for pharmacies brought in-house to avoid such penalties and ensure compliance when dealing with controlled substances.

The Resource Conservation and Recovery Act

The Resource Conservation and Recovery Act (RCRA) is an Environmental Protection Agency (EPA)-regulated law governing, in relevant part, the disposal of pharmaceutical waste. Not all pharmaceutical waste is necessarily governed by RCRA;  only pharmaceutical waste that is corrosive, toxic, or ignitable falls under the provisions of RCRA. RCRA designates facilities as Large Quantity Generators (LQGs), Small Quantity Generators (SQGs), or Conditionally Exempt Small Quantity Generators (CESQGs), based on the amount of waste they generate monthly and the amount of waste stored on site. These categories determine the applicable regulatory requirements.

There are several penalty provisions of RCRA depending on the violation involved, including violations involving the handling of hazardous waste without a permit and transportation of hazardous waste to an unpermitted facility. If a person knowingly disposes of, treats, or stores hazardous waste products without a permit, RCRA provides for a maximum penalty of five years imprisonment and $50,000 per day for the duration of the violation. If an individual knowingly transports or directs the transport of hazardous waste to an unpermitted facility, RCRA also provides for a maximum penalty of five years imprisonment and $50,000 per day for the duration of the violation.

Generally, pharmacies are required to catalogue the identity and weight of any hazardous weight product it produces, contacting the EPA to notify it of the hazardous materials. RCRA provides for various technical requirements regarding the storage and maintenance of hazardous materials on-site by the pharmacy. Finally, pharmacies are required to track their hazardous materials while they are transported to an authorized facility for disposal.

Medical offices with in-house pharmacies will need to incorporate hazardous material disposal requirements into their operations. It should be noted, however, that many pharmacies employ the services of “reverse distributors,” which are organizations registered with the DEA to properly dispose of controlled substances. Delegating the responsibility of substance disposal to reverse distributors simplifies the compliance process for the in-house pharmacies and the medical practice housing the pharmacy.

State Laws and Professional Rules

In addition to these federal laws, physicians and in-house pharmacy service providers should be aware of state laws regulating pharmacies. For instance, many states have their own version of Stark and Anti-Kickback laws; states also have specific laws and regulations regarding controlled substances which may impose stricter requirements than the CSA.

Physicians should also be aware of applicable professional rules regulating the practices of medicine and pharmacy.  American Medical Association (AMA) Code of Medical Ethics Opinion 8.06 provides ethical restraints on the abilities of a physician to refer patients to pharmacies with which the physician has financial ties. Opinion 8.06(3) prohibits a physician from referring patients to a pharmacy that the physician either owns or operates unless the referral is based on objective medical criteria, steps are taken to mitigate the conflict of interest, the financial benefit to the physician is disclosed to the patient, and the referral does not violate state or federal law and furthers the health interests of the patient. Further, Opinion 8.06(4) provides that a patient’s freedom to choose the pharmacist of his/her choosing should always be respected. Many state medical ethics codes have comparable opinions to AMA Code of Medical Ethics Opinion 8.06, which require compliance within that jurisdiction.

State laws and professional opinions such as these can impact in-house pharmacies and must be considered by medical offices while structuring their in-house pharmacies.


Bringing pharmacy services in-house is an achievable undertaking for medical offices. Such an undertaking should be initiated with a clear legal compliance strategy ensuring that the relationship between the pharmacy and medical office is consistent with federal and state law.

Henry Norwood

The Herman Law Firm, Brookline, MA

Henry Norwood is an attorney with the Herman Law Firm, practicing law in the areas of healthcare litigation and compliance. Mr. Norwood is a graduate of the University of Maine (B.A.) and of the Nova Southeastern University Shepard Broad College of Law (J.D.) and is licensed to practice law in Florida, Maine, and Massachusetts. He and his wife live with their daughter on the Eastern Coast of Maine.  He may be reached at [email protected].

The material in all ABA publications is copyrighted and may be reprinted by permission only. Request reprint permission here.