Radiopharmaceutical Supplier Security Risk Assessment Checklist for Nuclear Pharmacies

A radiopharmaceutical supplier security risk assessment helps you confirm that a supplier is authorized, that security responsibilities are clearly assigned, and that shipments can be accounted for from dispatch through receipt. Use the checklist below alongside your pharmacy’s radiation safety and purchasing procedures.

Match each control to the material, quantity, supplier, and transport method involved. In particular, do not assume every radiopharmaceutical shipment falls under the same NRC security rules: 10 CFR Part 37 applies to licensees possessing aggregated Category 1 or Category 2 quantities of specified radioactive material.

How should nuclear pharmacies verify supplier authorization and security controls?

Confirm that the supplier’s radioactive material license is current and authorizes the relevant radionuclides, activities, and transfers. Check the legal business name and licensed locations against the license, and resolve any differences before placing an order. Ask the supplier to identify its regulator: depending on the location and regulatory jurisdiction, it may be the NRC or an Agreement State agency.

For eligible licensees, the NRC’s License Verification System can help confirm that a license is valid and that the licensee is authorized for the material and quantities involved. If you cannot use the system or need clarification, contact the responsible regulator directly. Agreement States license and inspect certain radioactive material activities, so verify with the appropriate state agency when applicable. See the NRC License Verification System and the NRC Agreement States directory.

• Record the supplier’s license number, issuing authority, authorized locations, expiration date, and relevant material authorizations.
• Check for applicable NRC security controls and state-specific requirements rather than treating “NRC security requirements” as identical in every jurisdiction.
• Ask who is responsible for order approval, shipment release, carrier coordination, and security incident escalation.
• For shipments involving Category 1 or Category 2 quantities, request confirmation that required security programs and shipment controls are in place. Do not request sensitive security plans or personnel lists unless you have a legitimate need to know and are authorized to receive them.
• Document the verification date, method, reviewer, and any follow-up action.

The NRC’s 10 CFR Part 37 requirements apply to specified Category 1 and Category 2 quantities, including access authorization, security programs, and protection of security-sensitive information. A supplier’s statement of compliance is useful due-diligence evidence, but it does not replace checking the applicable license or requirements.

What security measures protect radioactive material during storage and handling?

Assess how the supplier controls access to radioactive material from receipt through preparation and dispatch. For material subject to Part 37, required measures depend on the category and applicable rule provisions. For other material, assess controls against the supplier’s license, applicable regulations, and documented risk procedures rather than assuming Part 37 applies.

• Ask how access is limited to personnel authorized for their assigned duties and how visitors, contractors, and delivery personnel are controlled or escorted.
• Confirm that storage areas have appropriate access restrictions and that material is inventoried and reconciled according to applicable requirements and internal procedures.
• Ask how staff identify and escalate alarms, unexplained inventory differences, suspected tampering, or unauthorized access.
• Review how security equipment is tested, maintained, and supported during power or communications interruptions, where those controls apply.
• Confirm that staff with security responsibilities receive training suited to their roles and know whom to contact when a concern arises.

Part 37 calls for a written security plan and implementing procedures for licensees within its scope, with access to those sensitive documents limited. As a purchaser, you can usually assess the supplier through a written attestation, a controlled audit, or a redacted summary instead of requesting detailed plans that could expose vulnerabilities. See 10 CFR 37.31 and 37.43.

How can pharmacies assess shipment security and chain of custody?

Map the shipment handoffs: who prepares and releases the package, which carrier takes custody, how transit status is monitored, and who receives it at the pharmacy. Set expectations with the supplier for shipment identifiers, estimated arrival windows, delivery updates, and escalation contacts. These practices support chain-of-custody documentation; they should not be mistaken for a universal federally prescribed chain-of-custody form.

Ask whether a transport security plan is required for the material and shipment. Under 49 CFR 172.800, transportation security plans apply to specified hazardous materials, including certain NRC Category 1 and Category 2 radioactive materials and highway route controlled quantities. Applicability depends on the material and quantity, so ask the supplier or carrier to confirm the basis for its determination. See 49 CFR 172.800.

• Verify that the shipment record identifies the sender, authorized recipient, carrier, package or tracking number, material description, and dispatch time.
• Establish how custody transfers are logged and how delivery is confirmed to an authorized recipient.
• Ask how route or schedule changes, missed scans, and unexpected stops are handled and reported.
• Determine what shipment status information the supplier can provide without disclosing restricted security-sensitive details.
• For shipments subject to Part 37 transit requirements, confirm that the responsible licensees follow applicable preplanning, coordination, and receipt-confirmation provisions.

Make clear in your supplier assessment which controls are legally required for the shipment and which are additional risk-management practices requested by your pharmacy. This distinction helps you evaluate the transport security plan without overstating regulatory duties.

What delivery controls reduce loss, theft, or diversion risk?

Agree on a delivery process before dispatch. Identify the authorized recipient or designated receiving role, confirm the delivery address, and ensure the site can accept the package promptly. NRC rules require certain licensees expecting packages above a Type A quantity to arrange for receipt when the carrier offers delivery or to receive notice of arrival at the carrier’s terminal and take possession expeditiously. See 10 CFR 20.1906.

• Use authorized recipient verification: confirm the recipient’s identity and authority against the pharmacy’s approved receiving procedure.
• Do not leave packages unattended in publicly accessible areas or accept delivery at an unapproved location.
• Record the delivery time, recipient, package identifier, and visible package condition.
• Compare the package and shipping documents with the order, and follow written receipt and opening procedures.
• Arrange after-hours and carrier-terminal notifications so a delivery is not left without an accountable receiver.
• For material subject to applicable Part 37 requirements, check whether shipment receipt confirmation or other transit controls apply to the quantity and category.

When required by 10 CFR 20.1906, recipients must monitor package surfaces for contamination or radiation levels, including packages showing signs of compromised integrity, within the regulatory timeframe. Your pharmacy’s procedures should explain which staff perform the checks, how results are recorded, and when to stop handling and notify the Radiation Safety Officer.

How should discrepancies, delays, and security incidents be managed?

Set written escalation steps for a shipment that is late, misrouted, missing, or delivered with an unexpected seal, damage, or other sign of tampering. Staff should promptly notify the Radiation Safety Officer or designated manager, preserve shipment records and packaging as appropriate, and contact the supplier and carrier through verified channels. Do not open or handle a package that appears compromised except as directed by trained personnel under the pharmacy’s procedures.

• For a delay, confirm the last known carrier status, expected arrival, and party responsible for the next update. Record each contact and action.
• For a discrepancy, compare the order, shipping papers, package identifiers, and receipt record; document what does not match and when it was discovered.
• For suspected loss, theft, diversion, unauthorized access, or tampering, secure the area as appropriate, follow emergency procedures, and notify the supplier, carrier, and relevant authorities without waiting for routine follow-up.
• Assess whether the event triggers reporting under the pharmacy’s license, NRC rules, or Agreement State regulations. Reporting obligations depend on the facts, material, and applicable jurisdiction.
• Document the investigation, notifications, recovery actions, disposition, and corrective steps.

NRC regulations include specific reporting requirements for theft or loss of licensed material and certain other incidents; they are not identical for every event. Consult 10 CFR 20.2201 and the applicable regulator’s instructions. For an emergency involving radioactive material, including lost or damaged material or a threat, theft, or suspected criminal activity, the NRC provides a 24-hour Operations Center contact; use the appropriate Agreement State contact when that state is the regulator.

What records and audit evidence should suppliers provide?

Request evidence that allows your pharmacy to assess authorization, shipment controls, and incident readiness without collecting more sensitive information than necessary. The amount of documentation should reflect the product, quantity, route, and identified risks.

• Current radioactive material license details or other regulator-verifiable authorization information.
• A completed supplier security questionnaire or signed attestation describing applicable controls and responsible contacts.
• Shipment manifests, carrier and tracking information, dispatch records, delivery confirmation, and chain-of-custody documentation used for the transaction.
• Relevant training, package receipt, inventory reconciliation, and security equipment testing records, where appropriate and permissible to share.
• Procedures or summaries for handling late, missing, damaged, misrouted, or suspected tampered shipments.
• Audit findings or corrective-action summaries relevant to the service, with sensitive security information redacted or reviewed under controlled access.
• Records showing how the supplier evaluates subcontractors and carriers involved in custody or delivery.

Keep your own assessment record with the documents reviewed, verification date, identified gaps, assigned follow-up actions, and approval decision. Protect any security-sensitive records you receive. If full documents contain sensitive operational details, ask for a redacted copy or a supervised review. A sound assessment combines supplier authorization checks, proportionate security evidence, clear delivery controls, and a documented response process.

FAQs

What supplier credentials should a nuclear pharmacy verify before purchasing radiopharmaceuticals?

Verify the supplier’s current radioactive material license or other applicable authorization, issuing regulator, authorized locations, and authority for the relevant materials and transfers. Use the NRC License Verification System when available to confirm license information, or check with the responsible NRC or Agreement State regulator. Also record the supplier’s security and shipment escalation contacts.

How can a pharmacy confirm that a radiopharmaceutical shipment remained secure in transit?

Review shipment identifiers, dispatch and delivery timestamps, carrier tracking or status records, handoff records, recipient confirmation, and any reported route or schedule exceptions. For applicable Category 1 or Category 2 shipments, confirm that the responsible parties followed the relevant Part 37 and transportation security requirements. A complete documentation trail supports assessment, but no single tracking record by itself proves that every security control functioned as intended.

What should staff do if a radioactive material delivery is delayed or shows signs of tampering?

Notify the Radiation Safety Officer or designated manager, follow the pharmacy’s written procedures, and contact the supplier and carrier using verified channels. Record the time, package condition, tracking details, and notifications. Do not open or handle a suspicious or damaged package except as directed by trained personnel. Escalate suspected loss, theft, diversion, or an emergency to the appropriate authorities under applicable reporting requirements.

What supplier records should be reviewed during a security risk assessment?

Review authorization information, relevant security attestations or controlled summaries, shipment and delivery records, chain-of-custody documentation, applicable training or equipment records, and procedures for delays, discrepancies, and incidents. Request only information relevant to your assessment, and protect or limit access to sensitive security details.