Prescription validation workflow — how does pharmacist verification work on Magento?

Five-step workflow on Magento:

1. Customer uploads Rx — image / PDF, captured at a custom checkout step (Magento Magento_Checkout step plugin) before payment auth. Stored encrypted at rest (S3 + KMS / Azure Blob with customer-managed key) with HIPAA-compliant audit log.
2. Order enters pending_pharmacy_review — custom order state. Inventory reserved, payment authorised but not captured, customer sees “Awaiting pharmacist review” status.
3. Pharmacist queue — admin-side custom UI lists pending orders with Rx image, prescriber NPI lookup (auto-validated against NPPES registry), drug + strength + quantity check against state board limits, prescriber DEA validation if Schedule II–V. License-checked pharmacist (state-licence-validated at admin login) approves / rejects with reason code.
4. Audit trail — every action (Rx scan timestamp, pharmacist’s state license number, IP, decision, reason) written to an immutable log table. WORM retention per state board rules (typically 5–7 years).
5. Fulfillment release — on approval: payment captured, order moves to processing, signature-on-delivery flag for Schedule II–V auto-applied, COA / pedigree document attached.

SLA target: median 6 minutes queue time during business hours, escalation alert if any order pending >30 minutes. The escalation matters because customers will cancel if you keep them waiting. Common bottleneck: prescriber NPI lookup latency — cache NPPES locally with weekly refresh.