There is no law about distribution, only guidelines. I don’t know how they got them but how can they be under criminal investigation? They’re allowed to purchase whatever vaccine they can get their hands upon, are they not?
There are laws about fraud
There are laws about writing and administering prescriptions
They didn't buy the vaccine they were given it by the government, and they had to sign an agreement when they got it.
Their advertisements led to a Google Form signup which asked for insurance info, and was certainly not HIPAA compliant
I doubt someone will go to jail over this but I can see individuals or the organization(s) facing fines, loss of licenses, or being blacklisted from government programs.