How to Verify a Compounding Pharmacy Is Legitimate

Short answer: legitimate compounding pharmacies fall into one of two federally defined categories — 503A or 503B — and both can be independently verified through public databases. If a provider can't or won't tell you which category their pharmacy falls into, or the pharmacy doesn't show up when you check, that's a meaningful red flag worth taking seriously.^[1]

If a telehealth provider tells you your GLP-1 medication comes from a "compounding pharmacy," that phrase alone doesn't tell you much — it could describe a properly licensed, closely regulated facility, or it could describe something with none of the oversight that phrase implies. Here's exactly how to tell the difference, using tools anyone can access.

The Two Legitimate Categories

Under federal law, legal compounding pharmacies fall into one of two categories, and understanding which one you're dealing with tells you a lot about the oversight involved.^[1]

503A Pharmacies

A 503A pharmacy compounds medication based on a prescription for a specific, named patient. Day-to-day licensure and oversight sit primarily with state boards of pharmacy. Qualifying 503A compounding is exempt from certain FDA requirements — including CGMP, new-drug approval, and adequate-directions labeling — when the statutory conditions are met, but that is not the same as zero FDA involvement: the agency can still act on serious safety issues.^[1]

503B Outsourcing Facilities

A 503B outsourcing facility is a category created by federal law in 2013 (the Drug Quality and Security Act), specifically to allow larger-batch compounding — with or without a patient-specific prescription — under closer federal oversight. These facilities must register with the FDA, comply with CGMP, undergo FDA inspections on a risk-based schedule, report adverse events, and report the products they compound to the FDA upon initial registration and twice a year (June and December).^[2]

The Practical Difference

If you're picturing a spectrum of oversight, 503B facilities sit much closer to the level of scrutiny applied to conventional drug manufacturers, while 503A pharmacies operate under a lighter, primarily state-based framework intended for individualized patient prescriptions rather than large-scale production. Neither category is inherently the "wrong" choice — a properly licensed 503A pharmacy filling a legitimate, patient-specific prescription is completely different from an unlicensed or misrepresented operation claiming 503A status without actually meeting its requirements.^[1][2]

Why This Verification Actually Matters

This isn't an abstract regulatory distinction — it connects directly to real problems the FDA has documented with compounded GLP-1 products specifically: marketing that can obscure who actually compounds the product, and equivalence claims like "same active ingredient as Ozempic" that may involve salt forms (such as semaglutide sodium or acetate) rather than the approved base form used in branded products.^[5][6]

Compounded drugs are not FDA-approved and do not go through the same premarket review for safety, effectiveness, and quality as approved drugs — which is why verifying that a compounding source is a real, properly registered facility is one of the most concrete, actionable things you can do to protect yourself against misrepresentation.^[7]

Unlike a lot of pharmaceutical questions, this check doesn't require medical expertise. It requires knowing where to look.

How to Actually Check

Verifying a 503B Outsourcing Facility

The FDA maintains a public list called "Registered Outsourcing Facilities," which shows facility names, addresses, registration dates, and related inspection or action fields. If a provider tells you their compounded medication comes from a specific 503B facility, you can check that name directly against this list.^[3] The FDA also maintains a separate searchable database of products outsourcing facilities have reported compounding — so you can check not just whether the facility is registered, but whether it has actually reported compounding the type of product in question.^[4]

Verifying a 503A Pharmacy

Since 503A pharmacies are primarily state-licensed, verification means checking with the relevant state board of pharmacy — boards typically maintain a public license-lookup tool for this purpose.^[1]If a pharmacy ships medication across state lines, it typically needs a non-resident pharmacy license in the state it's shipping to, which can usually be checked through that destination state's board of pharmacy as well. If a provider can't tell you which state licensing board to check, or the pharmacy name doesn't turn up a match, that's worth following up on directly rather than letting it go.

Checking LegitScript Status (A Useful, Optional Signal)

You may also come across the term "LegitScript certified." It's worth understanding exactly what this does and doesn't mean: LegitScript is a private company, not a government body, and its certification is voluntary — not a substitute for FDA registration, 503A state licensure, or 503B outsourcing-facility status.^[8]

LegitScript certification isn't a substitute for confirming actual 503A or 503B status, but it's a legitimate additional signal, and you can independently verify a provider's claimed certification by searching LegitScript's own public directory rather than just taking a provider's word for a badge on their website.^[8]

A Practical Checklist

When a telehealth provider tells you they use compounded medication, here's what's worth asking and checking:

1. Which category is the source — 503A or 503B? A transparent provider should be able to answer this clearly and specifically, not vaguely.^[1]
2. If 503B: does the facility name appear on FDA's Registered Outsourcing Facilities list? This is a direct, public lookup — no guesswork required.^[3]
3. If 503A: is the pharmacy licensed in the relevant state(s), verifiable through that state's board of pharmacy?^[1]
4. Are equivalence claims accurate?Be specifically skeptical of claims like "same active ingredient as Ozempic/Wegovy" without clear confirmation of the actual compound being used — the FDA has flagged cases where compounders used salt forms (semaglutide sodium or acetate) that are not the same as the approved base form.^[5]
5. If LegitScript certification is claimed, does it actually show up in LegitScript's own public directory?^[8]

None of these checks require medical training — they require knowing that the databases exist and taking a few minutes to use them before committing to a provider or a specific compounded product.

What It Means If Something Doesn't Check Out

If a facility name doesn't appear where it should, if a provider is evasive about which category their compounding source falls into, or if a licensing search comes up empty, that's meaningful information — not necessarily proof of fraud, since databases can occasionally lag behind real registration changes, but a strong enough signal to ask more direct questions before proceeding, or to look elsewhere. A legitimate operation should be able to help you verify its own standing without friction; reluctance to do so is itself worth paying attention to.

Frequently Asked Questions

See also: Compounded vs. Brand-Name GLP-1 for the full regulatory and clinical picture on compounded GLP-1 medications, and How to Get Prescribed a GLP-1 Medication for the full evaluation and prescribing process.