# Testing checklist: pharmacy delivery app

Source: https://howtotestaproduct.com/how-to-test/pharmacy-delivery/
Generated: 2026-10-07. Licence: CC BY 4.0.

- [ ] 1. release smoke tests
  - Done when: On the release build, a prescription-only item cannot reach payment until a prescription is uploaded or transferred, and an over-the-counter item checks out without one.
  - Risks: store-rejection
  - Tool class: mobile automation. Usually run by: QA engineer.
- [ ] 2. end-to-end functional tests
  - Done when: A new patient uploads a prescription, the pharmacist approves it, the patient pays and the courier marks it delivered, and each step appears in the order history.
  - Risks: regulatory-penalty, store-rejection
  - Tool class: browser automation. Usually run by: QA engineer.
- [ ] 3. compliance checks
  - Done when: A pharmacist-in-charge signs a checklist showing where the app enforces the prescription requirement, controlled-substance refill limits and patient consent for data sharing.
  - Risks: regulatory-penalty, data-breach
  - Tool class: test management. Usually run by: product manager.
- [ ] 4. analytics and event tracking tests
  - Done when: A network capture of browsing, adding and ordering a medication shows no drug name, condition or prescription detail sent to any advertising or analytics endpoint.
  - Risks: regulatory-penalty, data-breach
  - Tool class: proxy. Usually run by: security specialist.
- [ ] 5. accessibility testing
  - Done when: A screen reader user hears the medicine name, strength, quantity, price and refill date on the cart and confirmation screens and completes an order.
  - Risks: accessibility-liability
  - Tool class: accessibility checker. Usually run by: accessibility specialist.
- [ ] 6. data integrity and migration testing
  - Done when: A test controlled-substance refill past its prescription's refill limit, and one with no valid prescription on file, both stop in the pharmacist queue with a visible reason.
  - Risks: regulatory-penalty
  - Tool class: data validation. Usually run by: QA engineer.
- [ ] 7. security scanning
  - Done when: The scan report for the pharmacy app, ordering site and their API shows no open high-severity finding, and a disabled staff account cannot open any prescription record.
  - Risks: data-breach
  - Tool class: DAST scanner. Usually run by: security specialist.
- [ ] 8. penetration testing
  - Done when: A tester signed in as patient A cannot read patient B's prescriptions, insurance card or delivery address by changing an order or patient id.
  - Risks: data-breach
  - Tool class: proxy. Usually run by: security specialist.