The HHS notice tells a pharmacy where its powder has to come from. An FDA-registered manufacturer, with a certificate of analysis.
Then Arnold & Porter read it and wrote that the conditions "rely mostly on the supplier's COA."
That is the same document a research vendor hands you. So the thing separating a pharmacy vial from a research vial, on paper, is a certificate written by whoever sold the powder.
Which makes it worth knowing how to read one.
A certificate of analysis is a lab report on a specific batch. A good one tells you four things.
The lot number. It has to match the lot on the vial in front of you. A COA for a different batch is a COA for somebody else's product.
Identity. Usually mass spectrometry, confirming the molecule is the one on the label.
Purity. Usually HPLC, reported as a percentage. The number matters less than whether the method is named at all.
The date and the lab. Recent, and run by somebody other than the seller.
Most people never ask for one. The ones who do usually stop at the purity percentage, which is the easiest number to print and the hardest to check.
We put ours on a public page. Purity and endotoxin, product by product, no login and no email required. Go pull one and run it against the four things above.
Keith
P.S. First order is 30% off with WELCOME30. And if you want the longer version of how this policy came together, the comment docket is open until Friday at regulations.gov, docket HHS-OASH-2026-0496.