How to Verify a Compounding Pharmacy Is Legitimate: A Practical Checklist

Deciding whether compounded medication is safe in principle is one question. Actually checking whether the specific pharmacy behind your specific prescription is legitimate is a different, more concrete task — and one you can do yourself in about ten minutes. This is a step-by-step checklist, not a debate about compounding in general (for that, see is cheap compounded GLP-1 safe? how to vet a low price).

Step 1: Get the pharmacy's actual name

Before anything else, find the name of the specific pharmacy that will fill your prescription — not the telehealth brand, the pharmacy. A program that won't tell you which pharmacy fills its orders has already failed the first check. Legitimate operations name their dispensing pharmacy openly, often on an FAQ or legal page.

Step 2: Check LegitScript certification

LegitScript certifies online pharmacies and telehealth businesses against a defined set of standards, including proper licensure in every jurisdiction where the business operates, a valid-prescription requirement before dispensing, and disclosure of any prior regulatory or civil violations from the past decade¹. LegitScript also requires that certified businesses' pharmacy partners hold LegitScript certification or an equivalent accreditation¹. A pharmacy or program that can point you to its LegitScript certification (or a comparable accreditation) has already been checked against these standards by a third party — that's worth more than a self-reported claim of legitimacy.

Step 3: Confirm state board licensing directly

LegitScript certification is a strong signal but not the only one. Every pharmacy must be licensed in the state where it operates, and most state boards of pharmacy publish a public license lookup tool. Search the pharmacy's name directly on the board of pharmacy website for the state where it's based — a real license will show an active status, a license number, and no unresolved disciplinary actions. If a program is cagey about which state its pharmacy is licensed in, that's the same red flag as not naming the pharmacy at all.

Step 3b: Look for the two standards that predict everything else

Two of LegitScript's certification standards are worth checking specifically because they're strong predictors of overall legitimacy. First, prescription validity: a certified pharmacy "shall only dispense prescription drugs upon receipt of a valid prescription issued by a person authorized to prescribe"¹ — meaning a real medical evaluation has to happen before a prescription exists, not a rubber-stamp questionnaire. Second, disclosure: the standards require an applicant to disclose any prior criminal, regulatory, or civil violations going back a decade¹. A program that's been through certification has had both of these checked by someone other than itself. A program that skips certification is asking you to take both on faith.

Step 4: Ask whether it's a 503A or 503B facility — and confirm

Federal law splits compounding pharmacies into two categories with different oversight levels. 503A pharmacies compound for an individual patient under a specific prescription and are regulated at the state level. 503B outsourcing facilities register with the FDA, follow stricter federal manufacturing standards, and are subject to FDA inspection — a materially higher bar. Ask which category applies, then verify a 503B claim against the FDA's public registered outsourcing facility list. A legitimate 503B operator will be easy to confirm this way; a fabricated claim usually isn't.

Step 5: Check USP <797>/<795> compliance for sterile products

GLP-1 injections are sterile preparations, which puts them under USP General Chapter <797> — the standard covering compounding for injectable, intravenous, and other routes where contamination risk is high². USP <797> compliance is meant to prevent medications from being sub-potent, super-potent, or contaminated through defined environmental and process controls². (USP <795> covers non-sterile compounding and isn't the relevant standard for an injectable product.) A legitimate sterile-compounding pharmacy should be able to speak to <797> compliance specifically, not compounding standards in general terms.

Step 6: Confirm the shortage-based legal basis, if that's the claim

If a program's justification for compounding a copy of an FDA-approved drug rests on an active drug shortage, that basis has to actually be current — the tirzepatide and semaglutide injection shortages were formally declared resolved by the FDA in December 2024 and February 2025, respectively³. See GLP-1 shortage status: what the FDA actually declared and when for the specific dates and what changed. A program still citing "shortage" as its legal basis today is either misinformed or compounding under a different justification it isn't disclosing — either way, ask directly.

Putting the checklist together

Run through these six checks and you'll have a genuinely evidence-based read on legitimacy, rather than a gut feeling based on price or website polish. None of this replaces medical judgment about whether compounded medication is right for you — see compounded vs brand-name GLP-1: which actually saves you money for that trade-off. It's specifically about confirming the source is who it claims to be.

Where verified pharmacies show up in our reviews

We check pharmacy transparency as part of every provider we cover — see how each program stacks up in our provider reviews, and how pharmacy verification factors into scoring in our Value Score methodology. Compare pricing across verified options on our semaglutide and tirzepatide boards once you've run a candidate through this checklist.

This piece sits in our research index alongside every other sourced explainer we publish — the trials, the compounding rules and the pricing mechanics, grouped by the question each one answers.