Prescription validation workflow, how does pharmacist verification work on Magento?

Five-step workflow on Magento:

1. Customer uploads Rx, image / PDF, captured at a custom checkout step (Magento Magento_Checkout step plugin) before payment auth. Stored encrypted at rest (S3 + KMS / Azure Blob with customer-managed key) with HIPAA-compliant audit log.
2. Order enters pending_pharmacy_review, custom order state. Inventory reserved, payment authorised but not captured, customer sees “Awaiting pharmacist review” status.
3. Pharmacist queue, admin-side custom UI lists pending orders with Rx image, prescriber NPI lookup (auto-validated against NPPES registry), drug + strength + quantity check against state board limits, prescriber DEA validation if Schedule II, V. License-checked pharmacist (state-licence-validated at admin login) approves / rejects with reason code.
4. Audit trail, every action (Rx scan timestamp, pharmacist’s state license number, IP, decision, reason) written to an immutable log table. WORM retention per state board rules (typically 5-7 years).
5. Fulfillment release, on approval: payment captured, order moves to processing, signature-on-delivery flag for Schedule II, V auto-applied, COA / pedigree document attached.

SLA target: median 6 minutes queue time during business hours, escalation alert if any order pending >30 minutes. The escalation matters because customers will cancel if you keep them waiting. Common bottleneck: prescriber NPI lookup latency, cache NPPES locally with weekly refresh.