Pharmacy Due Diligence Checklist: 50+ Items

Financial Due Diligence: Pharmacy-Specific Documents

Standard small business financial diligence applies here, but pharmacy financials have specific nuances that require additional documents.

Request 3 years of P&Ls with gross margin broken out by category: generic dispensing, brand dispensing, specialty dispensing, compounding, immunizations, and front-end retail. Combined margins obscure PBM compression in specific drug categories.

**DIR fee reconciliation:** For each year, request the actual DIR fee recoupment by PBM. This should match the deductions on the P&L. If the seller uses cash-basis accounting, DIR fees may have been recorded on payment rather than accrual, creating timing distortions.

**340B revenue documentation:** If the pharmacy participates in the 340B program, request copies of covered entity agreements and trailing 12-month 340B program revenue by entity.

**Prescription fill rate:** Monthly total prescriptions for 36 months. Not annualized summaries — monthly detail. Look for seasonal patterns, trends, and any one-month spikes or drops that need explanation.

• 3 years P&L with gross margin by category (generic, brand, specialty, compounding, front-end)
• Balance sheets for 3 years
• Month-by-month prescription fill data for 36 months
• DIR fee reconciliation by PBM for each year
• 340B program revenue detail (if applicable)
• Accounts receivable aging — insurance vs. cash pay breakout
• Tax returns for 3 years — compare to internal P&L
• Working capital schedule (current assets minus current liabilities)
• Owner compensation, benefits, and add-back documentation
• Inventory purchase history and wholesaler account statements

DEA and Controlled Substance Due Diligence

This category is where pharmacy diligence diverges most sharply from standard SMB acquisition practice.

**DEA Registration status:** Verify the pharmacy's DEA Registration is active, not expired, not suspended, and not under administrative action. DEA registrations can be subject to immediate suspension orders (ISOS) and order to show cause (OTSC) actions that are not always publicly disclosed. Direct verification through the DEA Diversion Investigators or via the DEA's public registrant database is required.

**Schedule II audit:** Request a full physical count of current Schedule II inventory and reconcile it against the pharmacy's DEA Form 222 records (used for Schedule II ordering) and DEA ARCOS (Automation of Reports and Consolidated Orders System) data. Discrepancies between ordered quantities and current inventory need explanation.

**Biennial inventory records:** DEA regulations require pharmacies to conduct biennial inventories of controlled substances. Request the last two biennial inventory records. Missing records are a red flag and potentially a DEA violation.

**Theft or loss reports:** DEA Form 106 is filed when a pharmacy reports theft or significant loss of controlled substances. Request all DEA 106 filings for the past 5 years. Multiple filings signal inventory control problems or internal theft — either is disqualifying.

• Verify DEA registration status through DEA registrant lookup
• Request current Schedule II–V inventory count and DEA Form 222 records
• Review last two biennial controlled substance inventory records
• Request all DEA Form 106 theft/loss filings for past 5 years
• Verify DEA Quotas are in compliance (for CII manufacturers/distributors — less relevant for retail but check)
• Confirm State Board of Pharmacy license is current and in good standing
• Review any state pharmacy board inspection reports for past 5 years
• Check for any Pharmacist-in-Charge (PIC) designation issues

Medicare and Medicaid Compliance: OIG Exclusion and Billing Audit

Medicare and Medicaid billing fraud risk is the most catastrophic compliance exposure in pharmacy acquisitions. A single billing audit finding can result in program exclusion — effectively ending the pharmacy's ability to serve most patients.

**OIG Exclusion List:** The Office of Inspector General maintains a List of Excluded Individuals/Entities (LEIE). Any healthcare provider excluded from federal healthcare programs cannot bill Medicare or Medicaid. Run every employee, contractor, and the entity itself through the OIG LEIE database. This takes 30 minutes and is non-negotiable diligence.

**Current billing patterns:** Request a Prescription Drug Event (PDE) analysis if available — this is the CMS data file that tracks every Medicare Part D claim. Look for unusual patterns: prescriptions billed but never picked up (desk-drawer dispensing), unusually high-cost prescriptions compared to peer pharmacies, and prescriber concentration (one prescriber writing 30%+ of controlled substances is a red flag).

**Medicaid audit history:** Request copies of any Medicaid audits, recoupment notices, or pharmacy integrity reviews received in the last 5 years. Medicaid agencies conduct routine audits of pharmacy billing; a clean audit history is expected. A recoupment notice with an outstanding balance that hasn't been resolved is a deal killer.

**Medicare Part D compliance:** Verify the pharmacy is in good standing with all Medicare Part D plans it participates in. Request copies of any Medicare compliance review notices, corrective action plans, or network exclusion notices.

• Run entity and all employees through OIG LEIE exclusion database
• Run entity through SAM.gov (System for Award Management) exclusion database
• Request Medicaid audit reports and recoupment history for past 5 years
• Request Medicare Part D compliance review history
• Analyze billing data for unusual patterns (high-cost scripts, controlled substance concentrations)
• Review top 20 prescribers by script volume — check each for DEA active registration
• Verify pharmacy is not under any Medicare or Medicaid payment suspension

PBM Contract and Network Status Due Diligence

PBM contracts determine a pharmacy's access to the majority of insured patients. Diligencing these thoroughly is essential.

**Contract inventory:** Request copies of all active PBM contracts and pharmacy services administrative organization (PSAO) agreements. Understand which PBMs the pharmacy participates with directly vs. through a PSAO.

**Preferred network status:** For each major PBM (CVS Caremark, Express Scripts, OptumRx, Humana, Medimpact), confirm whether the pharmacy is in a preferred network tier. Preferred tier status means patients pay lower copays at your pharmacy — it drives volume. Non-preferred status means patients are steered elsewhere.

**Performance metrics:** Request current performance metric reports from each PBM. Metrics tracked include medication adherence (PDC — Proportion of Days Covered), generic dispensing rate (GDR), and statin use in persons with diabetes (SUPD). Pharmacies with scores below PBM thresholds face Performance Improvement Plans or network exclusion risk.

**DIR fee exposure:** For 2023 and prior periods, request actual DIR recoupment schedules. For 2024–2026, confirm the pharmacy is reconciled on the post-reform point-of-sale adjustment basis.

• Copies of all active PBM contracts (direct and through PSAO)
• Confirmation of preferred vs. standard network tier for each major PBM
• Current performance metric reports (PDC, GDR, SUPD) for each PBM
• Any Performance Improvement Plan (PIP) notices in last 24 months
• DIR reconciliation schedules for 2021–2024
• PBM contract renewal dates — flag any expiring within 12 months of close
• PSAO agreement terms and termination provisions

Prescription Data Analysis: Top Prescribers and Patient Concentration

Who is writing prescriptions for your pharmacy's patients is a critical diligence category that most buyers skip.

**Top 20 prescriber analysis:** Request a report of the top 20 prescribers by script count for the trailing 12 months. For each, understand: what is their relationship with the pharmacy? Are they local physicians whose patients naturally fill at this pharmacy, or are there referral arrangements that might not survive a change of ownership?

**Prescriber DEA status:** Any prescriber writing Schedule II scripts must have an active DEA registration. For high-volume controlled substance prescribers in the top 20, verify their DEA registration is active. A prescriber with a revoked DEA license is a red flag — scripts from that provider may be fraudulent.

**Prescription portability risk:** Unlike pharmacy billing, patients choose where to fill their prescriptions and can switch at any time. For any prescriber representing more than 10% of script volume, understand the relationship. If it's a clinic with a formal preferred pharmacy arrangement (common in specialty pharmacies), get copies of the agreement and confirm it's transferable.

**Long-term care contracts:** If the pharmacy serves any nursing homes, assisted living facilities, or long-term care facilities, these contracts represent concentrated revenue that may not survive an ownership change if not properly assigned.

• Top 20 prescribers by script count — trailing 12 months
• Verify DEA registration for high-volume controlled substance prescribers
• Identify any formal preferred pharmacy or referral agreements
• Long-term care facility contract list and assignment provisions
• Patient count and geographic analysis (single-zip-code concentration is a risk)
• Prescription transfer-in vs. transfer-out rate (net retention metric)

Operational, HIPAA, and Third-Party Compliance

The final compliance categories that complete the pharmacy diligence picture.

**HIPAA compliance:** Pharmacies are HIPAA covered entities. Request copies of the pharmacy's HIPAA Privacy and Security policies, the most recent HIPAA risk analysis, and any breach notification reports filed with HHS in the last 5 years. A pharmacy that has never conducted a formal HIPAA risk analysis is a compliance gap — not disqualifying, but requires immediate remediation post-close.

**Inventory shrinkage:** Ask for annual inventory reconciliation reports. Any unexplained shrinkage above 1–2% of inventory value annually warrants investigation — it may indicate theft, billing errors, or inventory control failures.

**Third-party audit findings:** Pharmaceutical wholesalers (McKesson, Cardinal Health, AmerisourceBergen) conduct compliance audits of pharmacies they service. Request copies of any wholesaler audit reports for the past 3 years. Clean audit reports are expected; findings with corrective action requirements indicate process gaps.

**State pharmacy board inspection reports:** Every state pharmacy board conducts periodic inspections. Request the last 3 inspection reports. Minor deficiencies are common and not disqualifying. Repeat deficiencies in the same category, or major violations requiring corrective action, need explanation.

For the pharmacy LOI after completing diligence, the pharmacy LOI template covers all required contingency clauses. For SBA financing structure, see SBA loans for pharmacy acquisitions.

• HIPAA Privacy and Security policies — current and implemented
• Most recent HIPAA risk analysis
• Any HHS breach notification filings in last 5 years
• Annual inventory reconciliation reports — check for unexplained shrinkage
• Wholesaler compliance audit reports for past 3 years
• State Board of Pharmacy inspection reports for past 3 years
• Compounding compliance records if applicable (USP 795/797/800 standards)
• Immunization program compliance (state registration, vaccinator certifications)
• Waste disposal records (pharmaceutical waste, controlled substance destruction)