Research
What an online pharmacy has to post on its own homepage
Where controlled substances are sold online, the rules require a named list of disclosures on the homepage or one click from it — including the pharmacist-in-charge and every prescriber under contract.
A disclosure rule that lives on the website itself
Almost every rule in this area governs records a buyer will never see. One does not.
For online pharmacies handling controlled substances, the drug control regulations require specific information to be displayed on the site's own homepage, or on a page directly linked from it.
That makes it one of the few compliance obligations a reader can check personally, in about a minute, from the outside.
The scope limit matters and should be stated first. This applies where controlled substances are involved. Most peptides sold in this market are not controlled substances, so most peptide sellers are not the party these sections govern.
The statement at the top
The first requirement is a standing statement rather than a data field.
Each online pharmacy must display a statement on its homepage, at all times and in a visible and clear manner. The statement says it complies with the relevant statutory section, with respect to the delivery, sale or offer for sale of controlled substances.
That statement has to include the name of the pharmacy as it appears on its registration certificate.
Which is a small but useful detail: the trading name on the site is supposed to match the registered name in that statement.
Seven items, per pharmacy
The main disclosure list has seven items, and it has to be displayed for each pharmacy that delivers, distributes or dispenses controlled substances pursuant to orders made on or through the site.
The name and address of the pharmacy as they appear on its registration certificate. The pharmacy's telephone number and email address.
The name, professional degree, and states of licensure of the pharmacist-in-charge, plus a telephone number at which that person can be contacted.
A list of the states in which the pharmacy is licensed to dispense controlled substances. And a certification that it is registered with a modification of its registration authorizing internet dispensing.
The item about prescribers
The sixth item is the one worth reading twice, because it reaches past the pharmacy to the clinical side.
The site must disclose a set of details about certain practitioners. Name, address, telephone number, professional degree, and states of licensure with state license number. Those are practitioners with a contractual relationship to provide medical evaluations or issue prescriptions for controlled substances.
The trigger is broad. It covers practitioners reached through referrals from the site, or at the request of the site's owner or operator, or of any employee or agent.
So a telehealth arrangement sitting behind a storefront is not outside the disclosure. Where it involves controlled substances, the individual practitioners are supposed to be named on the site with their license numbers.
The seventh item is a script
The last item is not a data field at all. It is a statement whose wording the regulation supplies.
It says the pharmacy is obligated to comply fully with the controlled substances law and its regulations. It says the pharmacy has obtained a modified registration authorizing it to operate as an online pharmacy. And it says the pharmacy "will only dispense a controlled substance to a person who has a valid prescription issued for a legitimate medical purpose". That prescription must be "based upon a medical relationship with a prescribing practitioner."
The statement then defines what such a relationship includes: at least one prior in-person medical evaluation, or a medical evaluation via telemedicine as the statute defines it.
A reader encountering that paragraph verbatim on a site is looking at required text, not marketing. Its absence, where controlled substances are being dispensed online, is a gap in a listed requirement.
Where the information may sit
The regulation allows one level of indirection and is precise about it.
The information may appear on the homepage of each site the pharmacy operates, or on a page directly linked to the homepage. Where it is on a linked page, that link on the homepage must be visible and clear.
One click, from a visible link. Not buried in a policy center, and not reachable only through a search.
The compliance statement itself has a stricter placement: it goes on the homepage, at all times, in a visible and clear manner.
What has to happen before any of that
The disclosures are the visible end of a notification process that runs thirty days ahead of trading.
Thirty days before offering a controlled substance for sale, delivery, distribution or dispensing by internet, an online pharmacy must apply for a modified registration. It must also notify the state boards of pharmacy in every state where it offers to do so.
The application carries the disclosure information the site will post, plus a certification, under penalty of perjury, that the information is true and accurate.
It also carries every internet address the pharmacy uses, the registration numbers of every pharmacy dispensing through those sites, and the registration numbers of every practitioner under contract to provide evaluations or issue prescriptions.
A second required sentence, and a thirty-day clock
Once the notifications are made, the pharmacy must display a second declaration on its homepage, and the regulation again supplies the form of words.
It states that in accordance with the controlled substances law and the regulations, this online pharmacy has made the notifications to the Administrator required by the statute and the notification section.
Changes run on clocks. Most updated information must be notified no later than thirty days before the change becomes effective.
Two changes run the other way. A dispensing pharmacy ceasing to dispense through a site, or a practitioner ceasing to have a contractual relationship. Those are notified no later than thirty days after the change becomes effective.
The exemption route, and its own posting duty
Not every site dispensing controlled substances is an online pharmacy under the statutory definition. There is an exemption for certain nonpharmacy practitioners, and it comes with a disclosure of its own.
To identify itself as exempt on that basis, a site must post a list of the registered nonpharmacy practitioners affiliated with it. The list goes on the homepage in a visible and clear manner, or on a page directly linked with a visible and clear hyperlink.
Any nonpharmacy practitioner affiliated with such a site is responsible for compliance with that requirement.
An institutional practitioner has an alternative. If it otherwise complies, it may post its own name as it appears on its registration certificate. The name goes on the homepage in a visible and clear manner, identifying the institution as responsible for operating the site.
How to use this as a reader
First, check whether it applies. If nothing being sold is a controlled substance, these sections are not the right instrument and their absence proves nothing.
Where controlled substances are in play, the check is quick. A compliance statement on the homepage naming the registered pharmacy. A visible link to the disclosure page. A pharmacist-in-charge with a name, a degree, states of licensure and a phone number.
A list of states the pharmacy is licensed to dispense in. And named practitioners with license numbers where prescribing is arranged through the site.
What this does not tell you is anything about a specific business. It is a description of what the rule asks for. Whether a given site meets it is a check a reader performs, and this article makes no finding about any seller.
Key takeaways
- These disclosures are among the few compliance obligations a reader can check from the outside.
- They apply where controlled substances are dispensed online, which excludes most peptide sellers.
- Seven items must appear on the homepage or one visible click away, for each dispensing pharmacy.
- The pharmacist-in-charge must be named with degree, states of licensure and a contact number.
- Practitioners under contract to evaluate or prescribe must be named with state license numbers.
- Notification runs thirty days ahead of trading, with a certification under penalty of perjury.
Frequently asked questions
Do these online pharmacy disclosure rules apply to peptide sellers?
Only where controlled substances are involved. The sections govern online pharmacies delivering, distributing or dispensing controlled substances, and sites claiming the nonpharmacy practitioner exemption. Most peptides sold in this market are not controlled substances, so most peptide sellers fall outside these requirements, and their silence on these points is not a finding.
What has to be on the homepage of an online pharmacy?
A statement, displayed at all times in a visible and clear manner, that the pharmacy complies with the relevant statutory section, including the pharmacy's name as it appears on its registration certificate. A separate declaration that it has made the required notifications to the Administrator. And the seven-item disclosure list, either on the homepage or on a page reached by a visible and clear link from it.
Does an online pharmacy have to name the prescribers behind it?
Yes, where they are under contract for controlled substances. The disclosure must include a set of details for any practitioner under contract to provide medical evaluations or issue prescriptions. Those are name, address, telephone number, professional degree, and states of licensure with state license number. The reach covers practitioners found through referrals from the site, or at the request of its owner, operator, employee or agent.
How far in advance must an online pharmacy notify the authorities?
Thirty days before offering a controlled substance for sale, delivery, distribution or dispensing by internet. It must apply for a modified registration and notify the state boards of pharmacy in every state where it offers to do so. Most later changes to that information are notified thirty days before they take effect.
What is the exemption for nonpharmacy practitioners?
A site can identify itself as outside the definition of an online pharmacy on that statutory basis. It must then post a list of the registered nonpharmacy practitioners affiliated with it, visibly on its homepage or one visible click away. An institutional practitioner may instead post its own registered name, identifying itself as responsible for operating the site.
Sources
Each document below is named as it names itself, with the date printed on that document rather than the day it was read.
- 21 CFR 1304.40, Notification by online pharmacies — Electronic Code of Federal Regulations, title 21, September 2020
- 21 CFR 1304.45, Internet Web site disclosure requirements — Electronic Code of Federal Regulations, title 21, April 2009
- 21 CFR 1304.50, Disclosure requirements for Web sites of nonpharmacy practitioners that dispense controlled substances by means of the Internet — Electronic Code of Federal Regulations, title 21, April 2009