7.5 Drug Supply Chain Security Act (DSCSA), Track-and-Trace & Product Quarantines

Drug Supply Chain Security Act for Dispensers

The federal Drug Supply Chain Security Act creates a product-level system for tracing most prescription drugs through manufacturers, repackagers, wholesale distributors, and dispensers. Its goal is to keep counterfeit, stolen, diverted, or otherwise illegitimate product out of patient care.

Authorized trading partners and product identifier

A dispenser buys covered product only from an authorized trading partner: an entity holding the required federal or state license or registration for its role. Verify authority rather than relying on a low price or familiar salesperson. Covered packages use the standardized product identifier, including NDC, serial number, lot, and expiration data in machine-readable form.

DSCSA has exclusions and transaction exceptions, including certain patient-specific dispensing and defined distributions, but an exception must actually fit. Controlled-substance ordering records do not replace DSCSA product tracing.

Current transaction documentation

For current enhanced exchange, the key transaction documents are transaction information (TI) and the transaction statement (TS), exchanged electronically and interoperably as the applicable requirement takes effect. The former federal requirement to pass a separate transaction history (TH) ended November 27, 2023. Teaching “the three Ts—TI, TH, TS” as the current steady-state exchange is obsolete.

A dispenser generally maintains the required transaction documentation for six years and must be able to retrieve, associate, and provide it for a product investigation or authorized request. A scan stored without searchable association to the package and transaction may not be operationally adequate.

Suspect and illegitimate product

Indicators include altered or missing product identifiers, unusual price or source, mismatched lot or package, evidence of tampering, diverted or stolen product, notification from a partner or FDA, and a product linked to counterfeit or harmful events.

For suspect product, quarantine it from saleable inventory and promptly investigate with trading partners and records. Do not dispense while status is unresolved. If determined illegitimate, maintain quarantine, coordinate disposition, notify affected immediate trading partners, and notify FDA within 24 hours using the current process. Preserve records and respond to requests. If cleared, document the basis before returning it to saleable stock.

Current small-dispenser exemption

FDA currently provides an exemption from specified enhanced drug-distribution-security requirements until November 27, 2027 for a qualifying small dispenser. FDA defines the category using a dispenser with 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, measured as the agency specifies for the November 27, 2026 threshold. Related dispensers are aggregated under FDA’s definition.

This is not a wholesale exemption from DSCSA. A small dispenser still must buy from authorized trading partners, handle product identifiers and transaction documentation as applicable, investigate suspect product, respond to illegitimate product, and comply with requirements outside the specified enhanced provisions. A pharmacy larger than the threshold cannot claim the small-dispenser extension merely because one location has fewer employees.

Because FDA can issue waivers, exceptions, exemptions, or guidance, verify the live FDA DSCSA exemption page before implementing. The current August 2026 guide should not repeat a 2024 or 2025 deadline as though no extension exists.

Pharmacy workflow

At receiving, verify supplier authority, product identifier and package integrity, quantity, and electronic TI/TS. Reconcile discrepancies and quarantine exceptions. During storage, keep suspect stock physically and electronically blocked. For a recall or investigation, locate on-hand units and affected transactions quickly. Train staff not to bypass quarantine because a patient is waiting.

Exam method

Use ATP + product identifier + electronic TI/TS + six-year records + quarantine/investigate + FDA/partner illegitimate notice. Reject answers that require current transaction history or claim the small-dispenser exemption erases all DSCSA duties.

Product investigation example

A shipment arrives with valid-looking TI/TS, but one serialized package has a different lot and an altered seal. Transaction data does not cure the physical red flags. Quarantine the affected package and any related scope, contact the trading partner, compare identifiers, and document the investigation. If the package is illegitimate, make FDA and immediate-trading-partner notifications and control disposition; if cleared, record why before release.

A qualifying 20-employee independent pharmacy may rely on the current enhanced-security exemption only for provisions the FDA exemption identifies. It still cannot buy from an unlicensed seller or dispense suspect product. A chain cannot count each store in isolation if FDA’s related-dispenser aggregation makes the organization exceed the threshold.

For a regulator request, the dispenser should retrieve transaction data tied to the requested product promptly rather than export an undifferentiated archive. Test retrieval during training so six-year retention is usable, not merely nominal.