Prescriptions
- NCPDP SCRIPT through Surescripts
- Pharmacy-to-pharmacy transfers
- Telehealth prescriber platforms
- Prescription drug monitoring programs where required
Online pharmacy platform
Online Pharmacy Platform Development
Selling medicine online means every order still needs a valid prescription, a pharmacist's review and a license for the state it ships to. Agnotic Technologies builds online pharmacy platforms that put those checks into the workflow, from e-prescription intake to delivery tracking and patient counseling.
E-prescription intakePharmacist verificationDEA-aware designHIPAA-ready
Trusted by global innovators
What does it take to sell medicine online?
To sell medicine online, a licensed pharmacy needs a platform that accepts valid prescriptions, routes each one to a pharmacist for verification, takes payment and tracks delivery, while meeting state licensing and DEA rules for controlled substances. Agnotic Technologies builds online pharmacy platforms for pharmacies and health companies, connected to e-prescribing and pharmacy systems.
The storefront is the small part. Most of the build is the prescription workflow behind it: who sent the prescription, which pharmacist checked it, which state the patient is in, and what happened to the package.
This page covers the online, ship-to-patient platform. Software for the in-store pharmacy, such as dispensing, inventory and claims at the counter, is covered on our pharmacy management software page.
Order lifecycle
How does an online prescription order move?
Six stages, each with an owner and a record. The patient sees a simple checkout; the pharmacy sees every check.
Prescription arrives
An e-prescription comes from the prescriber over NCPDP SCRIPT through the Surescripts network, or as a transfer from another pharmacy, and is matched to the patient account.
Intake checks
Identity, delivery address and state are checked against the pharmacy's licensed states, insurance or cash price is set, and controlled substance prescriptions are routed to their own workflow.
Pharmacist verification
A pharmacist reviews the prescription with the patient profile, allergies and interaction checks, then approves it, holds it or contacts the prescriber. The decision is recorded against the pharmacist's login.
Payment and claim
The pharmacy claim is sent to the patient's pharmacy benefit, or the patient pays by card. Payment is captured only after the pharmacist approves the order.
Fill, pack and ship
Label, packaging and carrier label are produced together, temperature-sensitive items get the right packaging, and the tracking number is sent to the patient.
Counseling and refills
The patient can reach a pharmacist by phone, chat or video, counseling is noted on the order, and refill reminders follow the prescription's remaining refills.
Rule to feature map
Which rules apply when you sell medicine online?
Each rule becomes a feature with an owner. This is the map we work from; your pharmacy counsel confirms it for your states and products.
| Rule | What it requires | What we build |
|---|---|---|
| State pharmacy licensure | A license in the pharmacy's home state and, for shipping, in the patient's state under that state's law | A licensed-states table checked at checkout and again at verification, so an order to an unlicensed state cannot ship |
| 21 CFR 1306.09 | No controlled substance sold over the Internet without a valid prescription, filled by a pharmacy registered as an online pharmacy | A separate controlled substance workflow, switched off until the DEA registration is modified |
| 21 CFR 1306.04 | The pharmacist shares responsibility that a controlled substance prescription is legitimate | Verification screens that show prescriber, history and red flags, with the pharmacist's decision logged |
| 21 CFR 1304.45 | Homepage disclosures for online pharmacies that dispense controlled substances | Disclosure content managed as data, so licensed states and the pharmacist-in-charge stay current |
| 21 CFR Part 1311 | Audited pharmacy applications for electronic prescriptions for controlled substances | Role-based access to prescription edits, signed and archived prescription records, and audit trails |
| HIPAA Security Rule | Administrative, physical and technical safeguards for electronic PHI | Encryption, access control, audit logging and BAAs with every vendor that touches PHI |
Many online pharmacies launch without controlled substances. The workflow can be built and kept off until the registration and audits are in place.
What do we build into an online pharmacy platform?
Modules we scope one by one, so a first release can be a narrow product line and still meet every rule that applies to it.
E-prescription intake
NCPDP SCRIPT messages through Surescripts, transfer requests and prescriber clarifications, matched to the right patient and queued for review.
Pharmacist verification queue
Work queues by priority and state, with patient profile, interaction checks and prescriber contact in one screen, built for pharmacist throughput.
Controlled substance controls
Separate workflow, role-based permissions and signed, archived prescription records, enabled only once the pharmacy's DEA registration allows it.
Payments and pharmacy claims
Card, HSA and FSA payments captured after approval, plus pharmacy benefit claims, refunds and receipts tied to each order.
Delivery tracking
Carrier labels, packaging rules per product, temperature-sensitive handling and tracking updates sent to the patient by text or email.
Patient counseling and refills
Pharmacist chat, call or video from the order page, counseling notes, refill reminders and renewal requests sent back to the prescriber.
Integrations
Systems an online pharmacy connects to
The platform sits between prescribers, the pharmacy and the patient. These are the connections we build.
Pharmacy operations
- Pharmacy management system
- Drug database for interaction checks
- Inventory and wholesaler ordering
- Label and packing stations
Payments
- Card, HSA and FSA payment gateway
- Pharmacy benefit claims
- Refunds and chargebacks
- Receipts and tax records
Delivery and contact
- Carrier label and tracking APIs
- Text and email notifications
- Pharmacist chat and video
- Support ticketing
Launch checklist
Is your online pharmacy ready to launch?
We work through this list with the pharmacist-in-charge before the first real order ships.
- Pharmacy license confirmed for the home state and every state the platform ships to
- Decision recorded on whether controlled substances are in the first release
- If they are: DEA registration modified for online dispensing, homepage disclosures live, and the pharmacy application's audit report on file
- E-prescription and transfer intake tested end to end with test prescriptions
- Pharmacist verification and counseling workflow signed off by the pharmacist-in-charge
- Payments, refunds and pharmacy claims tested, with payment captured only after approval
- Packaging and carrier rules set per product, including temperature-sensitive items
- Business associate agreements signed with every vendor that touches PHI
- No third-party tracking tags on pages that show prescriptions or health data
Failure points
Where do online pharmacy builds fail?
Each of these is cheaper to design for than to fix after launch.
Challenge
Orders shipping to a state where the pharmacy is not licensed
Agnotic approach
The licensed-states table is checked at checkout and at verification, and changes to it are logged with who made them.
Challenge
Controlled substances treated like any other order
Agnotic approach
A separate workflow with its own permissions and records, switched off until the registration and audits allow it.
Challenge
A verification queue built as an afterthought
Agnotic approach
We design the pharmacist screens first, because pharmacist time sets how many orders the pharmacy can safely fill.
Challenge
Patient uploads mistaken for prescriptions
Agnotic approach
An uploaded image starts a request to the prescriber; it is never dispensed on its own.
Challenge
Payment taken before a pharmacist approves
Agnotic approach
Cards are authorized at checkout and captured only after approval, so rejected orders do not need refunds.
Challenge
Health data leaking through marketing tools
Agnotic approach
No third-party pixels on prescription or account pages, and analytics events carry no drug names or conditions.
Scope drivers
What drives the cost to sell medicine online?
We do not quote a price before scoping. These factors move the effort most.
Controlled substances or not
Leaving them out of the first release removes the separate workflow, the audited application and extra disclosures.
Number of states
Each state adds license data, rule checks and sometimes state-specific records to keep.
Insurance or cash only
Cash-pay is a smaller build. Pharmacy benefit claims add adjudication, rejections and reconciliation.
Existing pharmacy system
Connecting to the pharmacy management system you run is usually faster than replacing it, if it exposes an interface.
Delivery model
Carrier shipping, local courier and temperature-sensitive delivery each need their own packaging and tracking flows.
Startup or established pharmacy
Startups often need the full platform and pharmacist tools. Established pharmacies mostly need the online layer.
Who it is for
Who we build online pharmacies for
Every one of them dispenses through a licensed pharmacy; the platform is built for that pharmacy's workflow.
Independent pharmacies
Adding home delivery and online refills to an existing licensed pharmacy.
Digital pharmacy startups
A ship-to-patient pharmacy built as the product, with pharmacist tools from day one.
Telehealth companies
Prescriptions from their clinicians routed to a partner pharmacy, with order status back in the app.
Mail-order pharmacies
High-volume verification queues, packing stations and carrier integrations.
Specialty pharmacies
Temperature-sensitive delivery, onboarding calls and refill coordination.
Health system pharmacies
Discharge and outpatient prescriptions delivered to patients at home.
Compliance as engineering
How do we keep an online pharmacy HIPAA compliant?
Prescriptions are PHI from the moment they arrive. These are the safeguards we build in.
Business associate agreements
Agnotic signs a BAA before any PHI is shared, and development uses test prescriptions and synthetic patients only.
Role-based access
Pharmacists, technicians, support staff and couriers each see only what their role needs, set by user and role.
Encryption and keys
TLS on every connection, encryption at rest, and keys in a secrets manager with rotation.
Audit trails
Every view, edit, approval and shipment is logged with user and time, so the pharmacy can answer any record request.
Compliance-First Healthcare App Development Services Backed by Global Standards
01
HIPAA
Health Insurance Portability and Accountability Act
Protect PHI with privacy-first architecture, encrypted storage and transmission, strict access controls, and traceable audit logs.
02
GDPR
General Data Protection Regulation
Implement lawful consent flows, data minimization, retention controls, and secure processing for sensitive health data.
03
FHIR
Fast Healthcare Interoperability Resources
Enable standardized health data exchange across apps, care teams, and systems through standards-based FHIR APIs.
04
HL7
Health Level Seven International
Support enterprise-grade interoperability with HL7-based integrations for records, events, and clinical messaging workflows.
05
HITRUST
Health Information Trust Alliance
Align security programs to healthcare-specific control and risk management practices trusted by providers and ecosystem partners.
06
HITECH
Health Information Technology for Economic and Clinical Health Act
Design with breach notification readiness, digital record safeguards, and operational controls that support regulated care programs.
07
SaMD
FDA Software as a Medical Device
Plan software quality, traceability, and documentation pathways for products that may require SaMD review and submission.
08
MDR (EU)
Medical Device Regulation (European Union)
Prepare EU market-ready processes for risk classification, evidence tracking, and lifecycle governance under MDR expectations.
09
SAMHSA
Substance Abuse and Mental Health Services Administration
Apply confidentiality controls and consent-aware sharing models for behavioral and mental health data experiences.
How we work
How does an engagement work?
Three stages, with a fixed first release agreed before build starts.
1.
Scoping call
We confirm the licensed states, product lines, payment model and whether controlled substances are in scope.
Rules first
2.
Fixed-scope first release
Intake, pharmacist verification, payments and delivery for one product line, tested with test prescriptions.
Fixed scope
3.
Scale and support
More states, insurance claims, specialty products and, when the registration allows, controlled substances.
Monitored
Standards in scope
Standards behind an online pharmacy
NCPDP SCRIPTEPCS21 CFR 1306FHIR R4HIPAAPCI DSS
Facts and sources
Which federal rules shape online pharmacy software?
Short facts we design around, each linked to the eCFR text.
No controlled substance that is a prescription drug may be delivered, distributed or dispensed by means of the Internet without a valid prescription, and only a pharmacy whose DEA registration is modified to operate as an online pharmacy may fill one.
Source: 21 CFR 1306.09 (eCFR)A controlled substance prescription is effective only if issued for a legitimate medical purpose by a practitioner acting in the usual course of practice, and the pharmacist who fills it carries a corresponding responsibility for proper dispensing.
Source: 21 CFR 1306.04(a) (eCFR)An online pharmacy must comply with state pharmacy licensure law in each state from which, and each state to which, it delivers, distributes or dispenses controlled substances by means of the Internet.
Source: 21 CFR 1301.19(b) (eCFR)Each online pharmacy must display on its homepage a statement that it complies with 21 U.S.C. 831, and must show its DEA-registered name and address, contact details, its pharmacist-in-charge and the states where it is licensed to dispense controlled substances.
Source: 21 CFR 1304.45 (eCFR)A pharmacy application that processes electronic prescriptions for controlled substances must set logical access controls by user name or role for altering or deleting prescription information, and must digitally sign and archive each prescription on receipt or receive and archive a digitally signed record.
Source: 21 CFR 1311.205(b) (eCFR)
Frequently Asked Questions
Prescription medicine has to be dispensed by a licensed pharmacy. Many telehealth and consumer health companies partner with one, and we build the platform that connects their app to the partner pharmacy's workflow.
Only with a valid prescription and a DEA registration modified to operate as an online pharmacy, plus the homepage disclosures and audited electronic prescription software the rules require. Many pharmacies launch without them and add them later.
Prescribers send them as NCPDP SCRIPT messages through the Surescripts network, or another pharmacy transfers them. We build the intake that matches each prescription to the patient and queues it for a pharmacist.
Yes, if it exposes an interface. We connect the online layer to your pharmacy management system for dispensing, inventory and claims, so pharmacists keep the tools they know.
Yes. Agnotic signs a business associate agreement before any PHI is shared, and all development and testing uses test prescriptions and synthetic patients.
It depends on scope; we agree a fixed first release on the scoping call. One product line in a few states without controlled substances is a much smaller release than a national platform.
Yes. A typical first release covers e-prescription intake, pharmacist verification, cash payment and carrier delivery for one product line, with the remaining modules planned behind it.
Engineers use AI tools for drafts and test generation, then review every change. AI tools never see real prescriptions or patient data, and every workflow is tested with test prescriptions before launch.