MVC refactoring parameter check
The primary intent of your function is to get Patient instance. Secondary intent is to notify of the error. You should always attempt to translate the intent to code and function names. So, your function should return a Patient instance (happy path), or an ActionResult as an out parameter in case something goes wrong. Usually an out keyword is used when the variable is initialized inside of the function, not the ref keyword. This is done mainly to make your intent more declarative and obvious.

private Patient GetPatient(int? patientId, out ActionResult errorResult)
{    
    errorResult = null;
    var patient = null;    
    if (patientId == null)
    {
        errorResult = HttpStatusCodeResult(HttpStatusCode.BadRequest);
    }
    else
    {       
        patient = patientService.GetPatient(patientId.Value);

        if (patient == null || patient.PharmacyId != User.PharmacyId())
        {
            errorResult = HttpNotFound();
        }
    }

    return patient;
}


and the call would look like:

 ActionResult errorResult;
 var patient = GetPatient(patientId, out errorResult);
 if (errorResult!= null)
 {
     return errorResult;
 }
//do the rest of the Patient processing