How a pharmacy earns a place in the network, and how it keeps it.

• 1. Licensure verification. We verify active state pharmacy licenses for every state the pharmacy ships to, confirm them with the issuing board, and check FDA registration for 503B outsourcing facilities. Licenses are re-verified at renewal.
• 2. Regulatory record review. We review FDA Form 483 observations and the pharmacy's responses, warning letters, recalls, and state board disciplinary history. A 483 is not automatically disqualifying. How the pharmacy responded to it tells us more than the observation itself.
• 3. In-person inspection. We visit and walk the facility: cleanroom and sterile compounding practice, USP 795, 797, and 800 workflows, beyond-use dating, API and excipient sourcing, potency and sterility testing, storage, and shipping and cold chain.
• 4. Accreditation and quality review. We review third-party accreditation where the pharmacy holds it, along with testing documentation and standard operating procedures.
• 5. Contracting. Partners sign a services agreement covering pricing, service levels, and non-circumvention before any client is introduced.
• 6. Quarterly compliance checks. Every quarter we re-check licensure, new 483 observations, recalls, and board actions, and review performance against service levels. Between checks, we monitor for new regulatory activity.

Banyan does not compound, dispense, or prescribe. Partner pharmacies hold the licenses and are responsible for filling and shipping prescriptions. Our role is to vet them, negotiate on your behalf, and hold them to the agreed standards.

What we receive

Banyan handles business and order information: practice contact details, formulary and pricing data, and fulfillment status. Prescriptions go directly to the partner pharmacy that fills them.

HIPAA

Where Banyan handles protected health information on behalf of a practice, we operate under a Business Associate Agreement and execute one before that information is shared.

Access and infrastructure

Access to client data is limited to staff who need it for their role, protected by individual accounts and multi-factor authentication. Data is encrypted in transit.

Incidents

If we identify a security incident affecting client or patient data, we investigate, notify affected clients, and follow the notification requirements that apply under HIPAA and applicable state law.

Certifications

Banyan does not currently hold SOC 2 or an equivalent third-party certification. We would rather say so plainly than imply a standard we have not been audited against.