The enforcement numbers for 2025 are in, and they are not subtle. DEA pharmacy suspensions hit an all-time high. HIPAA settlement amounts climbed for the fifth consecutive year. PBM audit recoupments crossed the $38,000 average mark. This issue breaks down the numbers, highlights what changed, and gives you three things to verify in your pharmacy this month.
By the Numbers: 2025 Pharmacy Enforcement in Review
We compiled data from federal enforcement databases and state board records to build a picture of pharmacy enforcement in 2025. The headline numbers:
The DEA issued 1,247 administrative actions against pharmacies, including 189 immediate suspension orders - up 34% from 2023. The median fine rose to $67,500. Most actions targeted controlled substance documentation failures, not dramatic diversion cases. The pharmacies that got hit were not running pill mills; they were independent pharmacies with inventory discrepancies and incomplete records.
OCR settled pharmacy HIPAA cases for an average of $142,000. Every single pharmacy settlement involved one common finding: failure to conduct a security risk analysis. It does not matter how good your training program is if you cannot produce evidence that you assessed your security risks.
PBM audit recoupments averaged $38,400 for standard retail claims and $127,000 for compound claims. The three largest PBMs audited over 22,000 pharmacy locations.
The theme across all of these: documentation. Not intent, not negligence, not bad actors. Documentation gaps in otherwise well-run pharmacies.
Regulatory Watch: Telehealth Prescribing Rules Finalized
The DEA finalized its framework for controlled substance prescribing via telehealth. The new rules impose additional documentation requirements on pharmacies dispensing CS prescriptions originating from telehealth encounters.
The key change: pharmacies must verify that the prescriber has met the required standard for patient evaluation under the applicable telemedicine exception. For Schedule II prescriptions via telehealth, this means confirming the prescriber has documented compliance with 21 U.S.C. 802(54).
If your pharmacy fills a significant volume of telehealth CS prescriptions, review your verification procedures now. The DEA has signaled that pharmacy-level enforcement for telehealth violations will increase through 2026, particularly targeting pharmacies serving as preferred dispensing locations for high-volume telehealth prescribers.
Three Things to Check in Your Pharmacy This Month
February is a natural checkpoint for compliance programs. Here are three items to verify before the end of the month:
-
DEA Biennial Inventory. If your pharmacy is due for its biennial controlled substance inventory, check the exact due date. The biennial inventory runs from the date of your initial inventory, not the calendar year. Missing the date is a common finding in DEA inspections.
-
Employee License Expirations. Pull a list of every pharmacist and technician license, certification, and registration in your pharmacy. Check for any expiring in Q1 2026. An expired license for even one staff member is a deficiency that inspectors catch instantly.
-
OIG Screening Records. If you have not run your February OIG/SAM exclusion screening yet, do it this week. The LEIE database updates monthly (typically mid-month). Document the date, databases checked, and results for every individual screened.
Trend Alert: States Expanding Mandatory Compliance Programs
Four additional states are considering legislation in 2026 that would require retail pharmacies to maintain formal compliance programs. Currently about 12 states have some form of compliance program requirement.
The proposed requirements vary by state but generally include: a designated compliance officer, written compliance policies, employee training programs, internal monitoring and auditing procedures, and a process for responding to detected violations.
Even if your state does not currently mandate a compliance program, having one in place demonstrates due diligence if you ever face an enforcement action. Regulators and courts consistently look more favorably on organizations that can show a good-faith compliance effort.
This Month's Checklist
- Check your DEA biennial inventory due date and ensure it is scheduled
- Review all staff license and certification expiration dates for Q1 2026
- Run February OIG/SAM exclusion screening and document results
- Review telehealth prescribing verification procedures for controlled substances
- Verify HIPAA security risk analysis is current and documented
- Check that all regulatory postings are current and properly displayed
Stay compliant. Stay ahead. - The Rxperts Team