Pharmacy record template: What to include and how long to keep it

A pharmacy record is a dated log of every medication dispensed to a patient. Each entry carries the drug name, strength, quantity, fill date, prescriber and dispensing location. Together they make a medication history you can hand to the patient, to an insurer, or to a state inspector without assembling it first.

Federal law sets the floor. The DEA requires two years of dispensing records for Schedule II to V controlled substances. HIPAA gives a patient the right to a copy within 30 days. State boards then set their own retention periods on top, and those vary in both directions.

This guide covers the fields the template captures and the retention period that applies in your state. It also covers how to handle a request to copy or transfer a record.

Key takeaways

A pharmacy record logs the drug name, strength, quantity, fill date, prescriber and dispensing pharmacy for every medication supplied.

HIPAA gives patients the right to a copy within 30 days, with one 30-day extension where the file sits in archive.

The DEA sets a two-year floor for Schedule II to V dispensing records, and state boards set their own periods on top of it.

State rules vary in both directions: Texas also requires two years, California runs one to three, and New York requires five.

Patients use these records for insurance reimbursement, HSA and FSA claims, and medical expense deductions on a tax return.

What is a pharmacy record?

A pharmacy record is a clinical document that logs every medication dispensed to a patient over a defined period. It gives you one place to verify what was supplied, when it went out, and on whose authority.

The core fields are the medication name, its strength or concentration, the quantity dispensed, the date filled and the days supply. Add the prescribing provider and the dispensing location, and the entry stands up on its own. Most records also carry the patient’s date of birth, insurance plan and copay amount.

Who needs to keep one?

Any practice that dispenses or prescribes medication keeps these records. That covers:

• Retail and hospital pharmacies
• Practices running an in-house dispensary
• Primary care practices issuing prescriptions
• Med spas supplying post-treatment medication
• Specialty practices managing chronic conditions

Practices that send patients to an outside pharmacy still keep their own note of what was prescribed. It is the document an auditor asks for, and the one the next clinician reads before adjusting a dose.

What to include in the template

Every field below earns its place with a regulator, an insurer, or the next clinician to open the file.

• Patient information — full name, date of birth, patient ID, insurance plan
• Medication details — generic name, brand name, strength or concentration, route (oral, injection, topical)
• Dispensing data — quantity dispensed, days supply, fill date, refill dates
• Prescriber information — prescriber name, license number, specialty
• Pharmacy location — dispensing pharmacy name, address, pharmacy license number
• Monitoring notes — patient response, side effects reported, next review date
• Special flags — controlled substance schedule, allergy alerts, drug interaction warnings

Capture those fields through digital patient intake rather than a paper pad and the transcription step disappears. The strength you dispensed is then the strength on file. Print the template for paper filing, or rebuild it inside your practice management system and adjust the labels to match how your team already works.

Retention and access rules you have to meet

Three sets of rules apply at once: federal privacy law, federal controlled substance law, and your own state board. They do not line up, so the longest requirement is the one that governs your filing.

HIPAA patient access rights

Under the HIPAA Privacy Rule (45 CFR §164.524), patients have the right to see their pharmacy records within 30 days of a written request. One 30-day extension is allowed where the file has to be pulled from archived storage. You may charge a reasonable copying fee, but you cannot refuse the request.

DEA controlled substance requirements

A practice dispensing Schedule II to V controlled substances keeps a detailed dispensing log. The DEA expects the patient’s name, address and date of birth, plus the substance, strength, quantity, date dispensed and the prescriber’s DEA number.

Those records are kept for a minimum of two years and produced on inspection by the DEA or your state board. The state period sits on top of that federal minimum, and it is not always longer.

State board retention periods

Retention is set state by state, and the spread is wider than the federal floor suggests. Texas requires two years under 22 TAC §291.75, which matches the DEA exactly. California runs from one to three years depending on the prescription type. New York requires five.

Check your own board before you set an archiving schedule. Destroying a record early is a finding in an audit, whatever the federal rule allows. Compliance documentation software can hold a retention clock against each record, which matters most once you bill from more than one state.

How to set up your documentation workflow

A written workflow is what keeps records complete on a busy day. Electronic patient records management also handles the archiving and the access log for you, and those are the two steps that slip first on paper. Work through these six steps.

1. Choose your storage method — paper files ordered by patient, or electronic records inside a practice management system. Electronic wins on search speed and builds the audit trail by itself.
2. Standardize on one form — use a single template, such as the one above, so the same fields get filled every time. A second format is how a field ends up blank.
3. Assign the data entry — name who completes each field, whether that is a pharmacy technician, a nurse, or the dispensing system itself.
4. Set the timing — decide whether records are completed at dispensing, within 24 hours, or in a weekly batch. Name who checks them, and when.
5. Schedule retention and destruction — archive automatically once your state period expires, then destroy the file securely under HIPAA rules.
6. Train the team — anyone who touches a pharmacy record should know the privacy rules, the data entry standard, and how the access log works.

How to handle a records request or transfer

Patients ask for copies to support an insurance claim, to claim a deduction, or to move to a new pharmacy. Handle each request the same way.

• Take it in writing — ask for a signed request naming the date range and the destination. That destination may be the patient, a new provider or an insurer. This is what creates your audit trail.
• Verify identity — confirm the requester is the patient or an authorized representative, by checking ID against the contact details already on file.
• Compile the records — gather the entries inside the requested date range. Archived files may take the full 30 days, plus one 30-day extension where needed.
• Send it in the format asked for — patients may want paper by mail or a PDF by email. A PDF is faster to produce and easier to send securely.
• Log the request — note the date requested, who fulfilled it, the date sent and the delivery method. That log is what demonstrates HIPAA adherence at audit.

Patients moving between pharmacies usually want a running list as well as the historical file. A medication log template gives them one page to keep current between fills.

Insurance claims and tax deductions

Patients request these records for reasons that have nothing to do with treatment, and two come up constantly. Say so at the point of dispensing and you will field fewer calls later.

Insurance reimbursement. A patient switching pharmacies or insurers needs proof of what was dispensed in a given year to claim back out-of-pocket costs. A clear, dated record shortens the claim.

Tax deductions. Patients whose qualified medical expenses pass the IRS threshold can deduct the cost of their medication. The record is the proof of both the amount and the date.

How Pabau keeps medication records complete and audit-ready

Most practices keep medication details in three places: the prescription pad, the patient’s chart, and a spreadsheet somebody maintains for audits. The three drift apart within weeks, and the version an inspector reads is whichever one gets opened first.

Practice management software like Pabau keeps one copy. Dispensing details are recorded against the patient’s chart at the point of care, so the medication history and the clinical note stay in step. Every view and edit is stamped with a name and a time.

Access controls sit on top of that. You can force two-factor authentication, set password expiry rules, and switch on the HIPAA setting that restricts who can open a medication history. So when a patient asks for their records, your team exports a file instead of assembling one.

Keep every medication record audit-ready

Pabau records dispensing details against the patient’s chart and stamps every access with a name and a time. Retention schedules, patient access requests and board inspections then all draw on one file.

Book a demo

Conclusion

The fields on a pharmacy record are the easy part. The retention clock is what catches practices out, because the federal two-year floor is rarely the number they are actually held to.

So set your archiving schedule to the longest period you are subject to. Write down who fills in each field, and keep the record in one system rather than three. Do that and a records request stops being a search through filing cabinets.

Book a demo to see how Pabau holds medication histories, access logs and retention schedules inside a single patient record.

Continue your research

Need a running list rather than a dispensing history? Medication log template gives a patient one page to track doses, times and refills between fills.

Training staff on a medication they have not handled before? Drug card template sets out the class, dose, contraindications and side effects on a single sheet.

Sending records to a third party? Medical release form template captures the written authorization you need before anything leaves the practice.

Still rekeying patient details by hand? Digital intake forms capture patient information once at check-in and file it straight against the chart.

Frequently asked questions