CMS Medication Management Requirements: A Hospital Pharmacy Guide

CMS medication management requirements connect pharmacy operations to the hospital’s responsibility for safe patient care. They address who oversees pharmaceutical services, how medications are controlled and supplied, and what happens when a medication problem is identified.

For pharmacy leaders, the practical challenge is turning those requirements into reliable work across departments, locations, and shifts.

Our CMS pharmacy requirements overview introduces the broader framework. This article takes a closer look at hospital pharmaceutical services under 42 CFR §482.25, with practical examples of how leaders can connect policies, operational controls, and supporting records.

Which CMS Medication Management Requirements Apply?

The starting point for this article is the hospital pharmaceutical services Condition of Participation in 42 CFR §482.25.

It establishes requirements for pharmacy management and the delivery of pharmaceutical services. Related hospital conditions address other parts of medication use, including nursing services, medical records, and quality improvement.

Scope matters: This article focuses on hospitals operating under Part 482. Critical access hospitals, nursing facilities, and ambulatory surgical centers have separate CMS participation frameworks. A pharmacy serving multiple settings should map requirements to each facility’s classification.

CMS’s State Operations Manual, Appendix A explains how surveyors evaluate hospital requirements. Its pharmaceutical services guidance encompasses procurement, storage, compounding, repackaging, dispensing, and medication-related information and care.

That makes this questions useful for leadership: Can the organization explain how a medication moves safely through its system, including the handoffs between departments?

Establish Clear Pharmacist Oversight and Accountability

Section 482.25 assigns a pharmacist responsibility for developing, supervising, and coordinating pharmacy services. It also requires adequate personnel, including for emergency services. The medical staff is responsible for policies that minimize drug errors and may delegate that function to the organized pharmaceutical service.

Operationally, leaders should make responsibilities visible. Consider questions such as:

• Who approves and maintains medication-use procedures?
• Who coordinates pharmacy and nursing responsibilities?
• Who reviews problems identified outside the central pharmacy?
• Who provides coverage when the usual responsible person is unavailable?

A useful starting point is a service map showing where medications are stored, prepared, or supplied and who is responsible for each activity.

Practical example: A hospital opens an outpatient treatment area. Before medication stock is placed there, pharmacy and department leaders identify storage controls, replenishment responsibilities, staff education, and the process for reporting problems. The new location is then incorporated into the organization’s existing oversight activities.

Connect Medication Orders to Safe, Timely Dispensing

CMS’s hospital interpretive guidance calls for pharmacist review of medication orders for appropriateness before the first dose is dispensed, except in emergency situations. It also addresses resolving questions with the prescriber and documenting the discussion and outcome in the medical record or pharmacy copy of the order.

For leaders, the important operational questions concern how that process works under real conditions:

• Can the pharmacist access the information needed for review?
• How are unclear or incomplete orders resolved?
• How does the team distinguish an emergency exception from a routine workaround?
• What happens when an order changes after preparation has started?

An internal review might follow a small sample of orders from receipt through dispensing, looking for unexplained gaps or conflicting information.

Govern ADC and ADM overrides

Automated dispensing cabinets (ADCs), also called automated dispensing machines (ADMs), can allow medication removal before pharmacist verification through an override. A hospital policy should define when that exception is justified, who may use it, and how it is reviewed.

ISMP’s ADC guidance recommends situation-based justification, an order before removal, documented rationale, interdisciplinary approval of override access, and routine review of override reports. An approved medication list alone does not establish that a particular override is appropriate.

Policies should identify eligible medications, locations, and staff roles; required safety checks; and responsibility for reviewing orders and override use. For emergency access, the key question is whether waiting for pharmacist review could harm the patient. Convenience or a routine processing delay should not automatically qualify.

Practical example: Naloxone for suspected opioid-induced respiratory depression or glucagon for severe hypoglycemia may justify emergency access when clinically appropriate under an authorized order or applicable approved protocol and hospital policy. Their names alone do not justify every override.

Review both the override and the timeliness of care

To support CMS’s expectations for safe, timely medication delivery, hospitals can connect override records with the order, administration record, and clinical circumstances. An ADC removal timestamp alone does not establish when the medication reached the patient.

A practical oversight process assigns pharmacy review and interdisciplinary follow-up, defines review timeframes and urgent escalation criteria, and examines:

• Whether the documented circumstances supported bypassing prospective pharmacist review.
• Whether the intended medication reached the correct patient without avoidable delay.
• Whether missing information or discrepancies were resolved.
• Whether recurring overrides indicate a workflow, staffing, or system problem.

Trend findings by medication, care area, and user while accounting for clinical context. Review rescue-medication events for both access performance and possible medication-related harm, as discussed below. These are implementation recommendations; CMS does not provide a universal ADC override list or review interval in §482.25.

Define medication access when a pharmacist is unavailable

Section 482.25(b)(4) limits removal of medications from the pharmacy or storage area, when a pharmacist is unavailable, to personnel designated in medical staff and pharmaceutical service policies, consistent with applicable law.

A practical procedure should explain who may obtain medication, what access is permitted, what information is recorded, and how questions are escalated.

Practical example: An authorized staff member needs an urgently required medication overnight. A defined process helps the person locate the medication, record its removal, and contact the appropriate resource if the order or product is unclear.

Maintain Medication Security and Controlled Substance Accountability

CMS distinguishes general medication security from specific controlled substance requirements. Drugs and biologicals must be secured and locked when appropriate; Schedule II–V drugs must be locked within a secure area. Access to locked areas is limited to authorized personnel.

The regulation also addresses accurate receipt and disposition records for scheduled drugs and reporting of controlled substance abuses and losses under applicable federal and state law.

For an operational review, examine the connection between access and accountability:

• Does access reflect current job responsibilities?
• Are transfers and removals traceable?
• Who reviews unresolved discrepancies?
• How are concerns escalated when the usual manager is absent?

Include controlled substance overrides in accountability reviews

When an override involves a controlled substance, review its clinical justification alongside the record of what happened to the medication. A practical reconciliation connects the patient and order with removal, administration, and any waste or return.

Unexplained differences, repeated unsupported overrides, or unusual access patterns warrant follow-up under the hospital’s discrepancy and diversion procedures. An override is a reason to evaluate the circumstances, not proof of diversion. Appropriate urgent access still requires accurate accountability and applicable reporting.

Naloxone and glucagon are not controlled substances. A naloxone rescue event may nevertheless prompt review of a preceding opioid administration and its associated records.

These questions help teams evaluate their process. They do not replace the separate requirements governing controlled substance records or reporting.

Keep Unusable Medications Out of Patient Care

Section 482.25(b)(3) requires that outdated, mislabeled, or otherwise unusable drugs and biologicals be unavailable for patient use.

The practical challenge is maintaining that control wherever medications are kept: pharmacy shelves, treatment areas, refrigerators, medication carts, and other approved storage locations.

Labeling and product information

A product may be within its expiration date and still require intervention because its label is unreadable, incorrect, or inconsistent with the contents.

The CMS-focused question is how staff recognize the problem, prevent use, and obtain a documented resolution.

For the technical detail, see our NDC labeling and FDA product information guide, which explains product identifiers and the distinctions between manufacturer labeling and pharmacy-generated labels.

Storage conditions and temperature excursions

Storage review should connect the condition observed with the decision about affected inventory.

Practical example: Staff discover that a medication refrigerator has been outside its established range. A useful response records the finding, identifies affected products, prevents use while suitability is assessed under the applicable procedure, and documents the disposition decision.

Our articles on USP <659> packaging and storage and USP <1079> storage and transportation cover the underlying terminology, monitoring, and excursion considerations.

Recall response

CMS survey guidance addresses retrieval of medications recalled or discontinued for safety reasons.

For hospital leaders, the immediate question is whether the response reaches every affected location and relevant preparation. Our drug recall guide explains the detailed identification, communication, and documentation workflow.

Supervise Compounding, Packaging, and Dispensing

Section 482.25(b)(1) places compounding, packaging, and dispensing under pharmacist supervision and requires consistency with state and federal law.

An operational review should identify where these activities occur, who performs them, and how the hospital evaluates the resulting preparation or product before use.

Questions worth asking include:

• Are staff following the applicable approved procedure?
• Can reviewers connect the preparation to its supporting records?
• Are labeling and storage instructions available to the next person handling it?
• How are preparation concerns communicated and resolved?

Our USP chapters overview explains the roles of compounding and related quality standards. Those references provide the technical foundation for a more detailed assessment.

The CMS discussion adds an organizational question: How does the hospital oversee the work and know that its procedures are being followed?

Address Automatic Stops, Drug Information, and the Formulary

Three provisions of §482.25 can receive less attention than storage and dispensing.

Automatic stop policies

For medications not specifically prescribed as to time or number of doses, §482.25(b)(5) requires automatic discontinuation after a reasonable period predetermined by the medical staff. CMS’s hospital interpretive guidance, Tag A-0507 says the hospital must implement, monitor, and enforce that system. It recognizes that electronic ordering parameters may form part of the process; it does not prescribe one universal stop interval or a particular Electronic Medical Record (EMR) tool.

Clinical support should help teams distinguish an intended end of treatment from a stop date that no longer matches the patient’s care plan.

Practical example: An antibiotic order is approaching an illustrative 10-day stop. The patient’s diagnosis, clinical course, or treatment plan has changed, and the treating team determines that extended therapy may be needed. If the order expires without review and an authorized update, treatment could be unintentionally interrupted. Conversely, automatic renewal could continue therapy that is no longer indicated. Ten days is an example, not a CMS requirement or a recommended duration for antibiotics.

Pharmacy and clinical informatics leaders should verify what their EMR actually does:

• Does it identify approaching stop dates and route them to a pharmacist or responsible clinician?
• Does a “soft stop” prompt a review while leaving the order active, or does the order actually discontinue?
• Are any medications automatically renewed, under what authority, and with what clinical review and new endpoint?
• Are unresolved reviews handed off across shifts, weekends, and transfers?

A reminder alone does not establish that an automatic-stop requirement has been met. Likewise, an automatic renewal should not silently defeat the approved stop policy or substitute for an authorized clinical decision.

If the EMR cannot provide a reliable review queue, pharmacy can establish a secure, approved monitoring workflow outside it. For example, a daily expiring-order report or controlled worklist could identify orders due to stop within a locally selected review window. A pharmacist reviews the current indication and documented treatment plan, contacts the responsible prescriber when clarification is needed, and tracks the decision through completion. Antibiotic reviews may also involve the stewardship team. An external worklist supports coordination; it does not authorize administration or replace the current medication order and clinical record.

In settings where patients are usually discharged before longer stop intervals, these events may be infrequent. Average length of stay should not be used to assume that individual patients are protected from unintended discontinuation. Monitor approaching stops and review exceptions such as overdue decisions, unintended missed doses, or renewals without a clear treatment endpoint. These suggested monitoring practices support safe implementation of the hospital’s policy but CMS does not mandate this specific daily report or review window.

Accessible drug information

Professional staff must have access to drug information covering areas such as interactions, dosing, adverse effects, indications, and administration routes.

A practical review can ask staff to demonstrate how they obtain the information needed during routine work and when their usual electronic resource is unavailable.

Formulary oversight

The medical staff must establish a formulary system to support pharmaceutical quality and reasonable costs.

Operationally, formulary decisions should reach the people and systems affected by them. For example, a change in stocked concentration may require coordinated updates to ordering choices, preparation instructions, storage arrangements, and staff education.

Pharmacy can track its formulary review process through a review calendar or register that identifies the medication or drug class, responsible reviewer, due date under hospital policy, review status, and decision by the Pharmacy and Therapeutics (P&T) Committee or other authorized medical staff body. The review schedule should reflect the hospital’s approved process rather than an assumed universal CMS review frequency.

To demonstrate that the process is followed, link each completed review to its supporting evaluation, documented decision and rationale, and any implementation or follow-up actions. Committee minutes, approval records, and evidence that required changes were completed can help show how the hospital carries a formulary decision through to practice; overdue reviews or unfinished actions should remain visible until resolved.

Report Medication Problems and Follow Through

Section 482.25(b)(6) requires immediate reporting of drug administration errors, adverse drug reactions, and incompatibilities to the attending physician and, when appropriate, the hospital’s QAPI program.

An internal incident report should support the required communication. It should not leave staff uncertain about whether the attending physician has been notified.

After the immediate response, an organization can examine contributing factors and decide what follow-up is needed.

Practical example: Staff identify repeated confusion between two stocked concentrations. The team reviews where the confusion arises, implements an approved change, and checks whether the problem recurs.

Use rescue-medication events to identify safety follow-up

A justified rescue-medication override or dispense report can also reveal a medication safety concern. The review should distinguish whether urgent access was appropriate from why rescue treatment became necessary.

For example, naloxone administered after a hospital-administered opioid may prompt review of the preceding dose, administration record, patient monitoring, and contributing clinical factors. Glucagon used for severe hypoglycemia may prompt review of glucose-lowering therapy, nutrition, monitoring, and the patient’s condition. Rescue use alone does not establish a medication error or preventable harm.

Connect the override record to the clinical event and its outcome. If review identifies an administration error, adverse drug reaction, or incompatibility, apply the reporting requirements above. Relevant findings and recurring patterns can inform the hospital’s QAPI activities and corrective-action follow-up.

The goal is to preserve prompt access to needed treatment while learning from the circumstances that required it. A low override count by itself does not demonstrate safe care; review whether necessary treatment was delayed as well as whether overrides were justified.

For proactive safety review, our ISMP medication safety article explains how external safety recommendations can inform local improvement. ISMP recommendations provide a useful resource for that work; they are not themselves CMS regulations.

Build an Evidence Trail Around the Work

A useful internal review connects a requirement with the applicable policy, the activity performed, and the response to any finding.

The following are suggested review examples, not a CMS-prescribed form or universal inspection schedule.

Area	Example evidence to review	Follow-up question
Medication access	Access permissions (badge key card access audits) and removal records (ADC user role audits)	Can unusual access or removals be explained?
ADC/ADM overrides	Override rationale, order, removal and administration records, and review findings	Was urgent access justified, timely, and followed through?
Storage and usability	Inspection findings and disposition records	Were affected products prevented from reaching patients?
Order review	Pharmacist review and clarification documentation/intervention documentation	Was the concern resolved before routine dispensing?
Preparation	Relevant preparation and review records	Can the team reconstruct what occurred?
Medication incidents	Notification and investigation records, near miss reports	Did the response reach the appropriate people?
Formulary changes	Approval and implementation records	Did the decision reach affected workflows?

For example, finding an expired product should lead to its removal and a review of how it remained available. If the same issue appears repeatedly, the organization has a reason to reassess the process.

Select review methods and frequencies based on applicable requirements, guidance, organizational policies, and the risks of the service.

How Pestle Can Help

Pestle Compliance helps pharmacy teams schedule, track, and manage the work behind pharmaceutical services oversight. Teams can organize recurring reviews and event-driven activities around their hospital’s policies, assign responsibilities, and maintain supporting documentation.

That includes many of the workflows covered in this article:

Activity	How teams can use Pestle Compliance
Unit inspections	Schedule inspections by location and document medication storage, labeling, expiration, and security findings, along with actions needed to resolve them.
ADC/ADM override audits	Assign reviews of override reports, record whether the documented circumstances support the override, and track concerns requiring clinical, operational, or medication safety follow-up.
Automatic stop reviews	Schedule review tasks and document completion, outstanding questions, and follow-up with the responsible clinician. Where EMR tools are limited, Pestle can help organize the review process around the hospital’s approved workflow.
Recalls	Coordinate response tasks, document checks of affected locations, attach supporting records, and track outstanding actions through resolution.
Formulary reviews	Schedule medication or drug-class reviews, assign responsible reviewers, and organize evaluations, committee decisions, and implementation follow-up.
Medication access audits	Schedule reviews of access reports or authorized-personnel lists, record exceptions, and track requested corrections and their completion.

Customizable forms help teams capture information consistently across pharmacies. SOPs and supporting documents provide context for the work, while training and competency records help leaders track the education their organization requires.

When a review identifies a problem, investigation tracking can help connect that finding to the response. For example, a unit inspection may identify expired medication that requires removal, an assessment of how it remained available, and a follow-up check. Tracking the finding and the subsequent work together can make it easier to demonstrate what was reviewed, what action followed, and what remains unresolved.

These workflows support the review and documentation process. Clinical decisions, medication orders, and access changes still occur through the hospital’s authorized people and systems.

Support preparation oversight with Pestle Formulas

Pestle Formulas supports structured compounding workflows through master formulation records, ingredient barcode scanning, photo documentation, configurable quality checks, and preparation records. These capabilities help teams standardize preparation work and organize information for verification, operational review, and investigation of preparation concerns.

Together, Pestle Compliance and Pestle Formulas can help pharmacy leaders connect routine oversight with the work and records they need to evaluate. The hospital remains responsible for determining applicable requirements, establishing policies, and exercising professional judgment.

Bring CMS Requirements Into Daily Pharmacy Operations

CMS medication management requirements give hospital leaders a framework for overseeing how medications are accessed, stored, prepared, supplied, and reviewed.

A practical next step is to choose one medication-use process and follow it across locations and shifts. Identify the responsible people, review the supporting records, and examine how exceptions are resolved.

Return to our CMS pharmacy requirements overview for the broader participation framework, or explore Pestle Compliance to see how your team can organize the recurring work behind pharmaceutical services oversight.