8.3 Drug Supply Chain Security Act (DSCSA) & Track-and-Trace

Key Takeaways

  • Enacted as Title II of the Drug Quality and Security Act of 2013 (DQSA; 21 U.S.C. § 360eee), the DSCSA establishes a national, interoperable electronic system to trace prescription drug packages through distribution.
  • Dispensers must receive, verify, and maintain the '3 Ts'—Transaction Information (TI), Transaction History (TH), and Transaction Statement (TS)—for all covered prescription drugs for a mandatory period of six (6) years.
  • Each prescription drug package must bear a standardized 2D Data Matrix barcode encoding four data elements: National Drug Code (NDC), unique serial number (up to 20 alphanumeric characters), lot number, and expiration date.
  • Pharmacies may only trade with Authorized Trading Partners (ATPs) and must immediately quarantine any 'suspect' or 'illegitimate' product.
  • When a dispenser determines that a drug is an 'illegitimate product' (credible evidence of counterfeit, diverted, stolen, or adulterated), it must notify the FDA (via electronic Form 3911) and all immediate trading partners within 24 hours.
Last updated: September 2026

8.3 Drug Supply Chain Security Act (DSCSA) & Track-and-Trace

[!NOTE] Core Statutory & Regulatory Authorities: Pharmaceutical supply chain security is governed by Title II of the Drug Quality and Security Act of 2013 (DQSA, Public Law 113-54), officially designated as the Drug Supply Chain Security Act (DSCSA), codified at 21 U.S.C. §§ 360eee through 360eee-4 (Sections 581–585 of the Food, Drug, and Cosmetic Act).

The pharmaceutical supply chain in the United States is one of the most sophisticated in the world, moving billions of prescription drug packages from manufacturing plants to wholesale distributors, secondary repackagers, community pharmacies, health systems, and ultimately patients. Prior to 2013, supply chain security was fragmented under inconsistent state pedigree laws (such as Florida's and California's varying e-pedigree mandates). Congress enacted the DSCSA to establish a unified, federally preemptive, fully electronic, package-level tracing system. Candidates preparing for the New Jersey MPJE must understand the scope of covered products, the mandatory "3 Ts" documentation, the 6-year record retention requirement, product serialization standards, Authorized Trading Partner (ATP) verification, suspect versus illegitimate drug investigations, and emergency reporting via FDA Form 3911.


Scope of Covered Products vs. Statutory Exemptions

The DSCSA applies specifically to prescription pharmaceutical products distributed within commercial trade, but establishes narrow statutory exemptions based on product characteristics or clinical delivery models:

1. Covered Products

  • Prescription Drugs in Finished Dosage Form: Any prescription drug for human use in finished dosage form ready for administration to a patient without substantial further manufacturing (tablets, capsules, vials, ampules, inhalers, prefilled syringes).

2. Statutory Exemptions (21 U.S.C. § 360eee(24))

The following products are EXEMPT from DSCSA tracing and serialization requirements:

  • Compounded Drugs: Preparations compounded by a licensed pharmacy pursuant to a patient-specific prescription under Section 503A or compounded by an outsourcing facility under Section 503B of the FD&C Act;
  • Blood and Blood Components: Whole blood, packed red blood cells, plasma, and platelets intended for transfusion;
  • Radioactive Biologicals & Radiopharmaceuticals: Diagnostic radiopharmaceuticals and radioactive therapeutic drugs;
  • Medical Devices: Standalone medical devices;
  • Medical Gases: Oxygen, nitrous oxide, and medical air;
  • Over-the-Counter (OTC) Drugs: Non-prescription OTC human drugs;
  • Veterinary Drugs: Medications labeled exclusively for animal use;
  • Dialysis Solutions: Peritoneal dialysis and hemodialysis irrigation solutions;
  • Sterile Water & Normal Saline: Intended exclusively for fluid and electrolyte replenishment or irrigation;
  • Emergency Medical Distributions: Drugs distributed for emergency medical reasons (such as public health crises or severe drug shortages);
  • Minimal Quantities for In-Office Dispensing: Nominal quantities of prescription drugs sold by a retail pharmacy to a licensed practitioner for in-office administration.

The "3 Ts" of Supply Chain Documentation

Under the DSCSA, every change of prescription drug ownership between trading partners must be accompanied by three distinct layers of tracing documentation, universally known as the "3 Ts":

+---------------------------------------------------------------------------------------------------+
|                                THE "3 Ts" OF DSCSA COMPLIANCE                                     |
+---------------------------------------------------------------------------------------------------+
| Transaction Information (TI)  | Comprehensive product details: name, strength, dosage form,      |
|                               | NDC, container size, number of containers, lot number, date of    |
|                               | transaction, date of shipment, and legal business identities.     |
+---------------------------------------------------------------------------------------------------+
| Transaction History (TH)      | Electronic record detailing the cumulative prior TI transactions  |
|                               | back to the original drug manufacturer.                           |
+---------------------------------------------------------------------------------------------------+
| Transaction Statement (TS)    | Legal compliance affidavit affirming that the transferring party  |
|                               | is an Authorized Trading Partner, complied with DSCSA, received   |
|                               | valid 3Ts, and did not ship suspect or illegitimate product.      |
+---------------------------------------------------------------------------------------------------+

1. Transaction Information (TI)

The Transaction Information is the comprehensive data payload identifying the physical drug and transaction particulars. It must include:

  • Proprietary (brand) name or established (generic) name of the drug;
  • Strength and dosage form of the product;
  • National Drug Code (NDC) of the product;
  • Container size and number of containers in the shipment;
  • Lot number assigned by the manufacturer or repackager;
  • Date of the transaction;
  • Date of the shipment (if more than 24 hours after the transaction date);
  • Business name and physical street address of the person/entity from whom ownership is being transferred;
  • Business name and physical street address of the person/entity to whom ownership is being transferred.

2. Transaction History (TH)

The Transaction History is the historical ledger capturing the accumulated chain of Transaction Information for every prior transaction going back to the initial manufacturer. (Note: Under the DSCSA's final interoperable electronic framework, individual package-level tracing satisfies the history requirement, but historical transaction continuity must be verifiable electronically).

3. Transaction Statement (TS)

The Transaction Statement is a sworn, legally binding compliance affidavit executed by the transferring entity confirming that:

  1. The transferring business is an Authorized Trading Partner;
  2. The business received the drug directly from an Authorized Trading Partner;
  3. The business received valid Transaction Information and a Transaction Statement from the prior handler;
  4. The business did not knowingly ship a suspect or illegitimate product;
  5. The business had secure systems and verification processes in place to comply with DSCSA mandates; and
  6. The business did not knowingly provide false transaction information or alter transaction histories.

Mandatory 6-Year Federal Record Retention Requirement

Under 21 U.S.C. § 360eee-1(d)(1)(A)(iii), dispensers (community pharmacies, hospital pharmacies, closed-door facilities) must maintain all Transaction Information (TI), Transaction History (TH), and Transaction Statements (TS) for a mandatory period of six (6) years from the date of the transaction.

[!IMPORTANT] Critical MPJE Retention Comparison: Candidates must carefully distinguish federal and state record retention mandates:

  • DEA Controlled Substance Records (C-II through C-V invoices, DEA 222, CSOS): 2 years (federal/NJ).
  • CMEA Pseudoephedrine Logbooks: 2 years (federal).
  • New Jersey General Prescription Records: 5 years (N.J.A.C. 13:39-7.6).
  • HIPAA Privacy & Disclosure Records: 6 years (federal).
  • DSCSA "3 Ts" Supply Chain Records: 6 years (federal).
Record TypeStatutory SourceMandatory Retention Period
DEA Form 222 / Controlled Substance Records21 CFR § 1304.04 / N.J.A.C. 13:45H2 Years
CMEA Pseudoephedrine NPLEx Logbooks21 U.S.C. § 8302 Years
New Jersey General Prescription FilesN.J.A.C. 13:39-7.65 Years
DSCSA Supply Chain Records (3 Ts)21 U.S.C. § 360eee-16 Years
HIPAA Patient Acknowledgments & Accounting45 CFR § 164.5306 Years

Product Identifiers & 2D Data Matrix Barcode Serialization

To enable automated electronic package tracking, the DSCSA mandates that all individual prescription drug commercial units of sale (bottles, blister packs, cartons) and homogenous cases bear a standardized product identifier.

The Four Mandatory Data Elements

The product identifier consists of a 2D Data Matrix barcode that encodes, and displays in adjacent human-readable format, exactly four pieces of information:

  1. National Drug Code (NDC): The 10-digit or 11-digit FDA drug listing code formatted as a Global Trade Item Number (GTIN);
  2. Unique Serial Number: An alphanumeric identifier up to 20 characters in length generated by the manufacturer that uniquely identifies that specific package from every other package ever manufactured;
  3. Lot Number: The specific manufacturing production batch code; and
  4. Expiration Date: The manufacturer's labeled shelf-life limit.
+---------------------------------------------------------------------------------------------------+
|                         DSCSA 2D DATA MATRIX BARCODE COMPOSITION                                  |
+---------------------------------------------------------------------------------------------------+
|                                 [2D Data Matrix Barcode]                                          |
|                                                                                                   |
| Human-Readable Text:                                                                              |
|   (01) GTIN / NDC:     00301234567890                                                             |
|   (21) Serial Number:  A9B8C7D6E5F4                                                               |
|   (10) Lot Number:     LOT987654                                                                  |
|   (17) Expiration Date:280930 (YYMMDD)                                                            |
+---------------------------------------------------------------------------------------------------+

Authorized Trading Partners (ATPs)

Under 21 U.S.C. § 360eee-1, a dispenser is statutorily prohibited from purchasing, receiving, or trading prescription drugs with any entity that is not an Authorized Trading Partner (ATP). To be an ATP, each supply chain participant must hold valid credentials:

  • Manufacturers & Repackagers: Must hold an active establishment registration with the FDA under Section 510 of the FD&C Act.
  • Wholesale Distributors: Must hold a valid wholesale distributor license issued by the state from which they ship and the state into which they deliver (e.g., must hold a New Jersey wholesale drug license issued by the Department of Health), and must report licensing information annually to the FDA.
  • Third-Party Logistics Providers (3PLs): Must be licensed by the state and report facility data to the FDA.
  • Dispensers (Pharmacies): Must hold a valid, active pharmacy permit issued by the state licensing board (e.g., New Jersey State Board of Pharmacy).

[!CAUTION] Pharmacy Compliance Duty: Before opening an account or purchasing medications from a new secondary wholesaler or alternate distributor, the pharmacist-in-charge (RPIC) must independently verify that the wholesaler is licensed in New Jersey and registered with the FDA as an Authorized Trading Partner.


Suspect Products vs. Illegitimate Products: Identification & Quarantine

A critical area of jurisprudence testing is distinguishing a suspect product from an illegitimate product and executing the appropriate statutory response:

+---------------------------------------------------------------------------------------------------+
|                               SUSPECT VS. ILLEGITIMATE PRODUCTS                                   |
+---------------------------------------------------------------------------------------------------+
| Dimension             | Suspect Product                      | Illegitimate Product               |
+-----------------------+--------------------------------------+------------------------------------+
| **Legal Standard**    | Trading partner has **REASON TO      | Trading partner has **CREDIBLE     |
|                       | BELIEVE** the product is unfit.      | EVIDENCE** confirming it is unfit. |
+-----------------------+--------------------------------------+------------------------------------+
| **Condition**         | Potential counterfeit, diverted,     | Confirmed counterfeit, diverted,   |
|                       | stolen, contaminated, or adulterated.| stolen, contaminated, or tainted.  |
+-----------------------+--------------------------------------+------------------------------------+
| **Immediate Action**  | **IMMEDIATELY QUARANTINE** from      | **IMMEDIATELY QUARANTINE**; secure |
|                       | active stock; initiate investigation.| product for regulatory disposition.|
+-----------------------+--------------------------------------+------------------------------------+
| **Mandatory Agency**  | Internal investigation; no formal    | **Mandatory FDA Form 3911** within |
| **Reporting**         | FDA Form 3911 unless confirmed.      | **24 HOURS** to FDA & partners.    |
+-----------------------+--------------------------------------+------------------------------------+

1. Suspect Product Protocol

  • Definition: A prescription drug for which a trading partner has reason to believe is counterfeit, diverted, stolen, intentionally adulterated to cause serious adverse health consequences or death, fraudulent, or otherwise unfit for distribution.
  • Pharmacy Action:
    1. Immediate Quarantine: Physically segregate and isolate the product in a designated, secure quarantine area away from dispensing inventory.
    2. Investigation: Validate the product identifier (NDC, serial number, lot, expiration) against trading partner records and manufacturer data; examine packaging for microscopic print flaws, missing security features, or broken seals.
    3. Resolution: If the investigation clears the product as authentic and uncompromised, the pharmacy may release it from quarantine and return it to active stock (maintaining documentation of the investigation for 6 years). If the investigation confirms the drug is illegitimate, proceed to the illegitimate protocol.

2. Illegitimate Product Protocol & Mandatory 24-Hour Reporting

  • Definition: A prescription drug for which a trading partner possesses credible evidence demonstrating that the product is counterfeit, diverted, stolen, intentionally adulterated, fraudulent, or unfit for distribution.
  • Mandatory Reporting via FDA Form 3911:
    • The dispenser MUST notify the FDA and all immediate trading partners within twenty-four (24) hours of determining that a product is illegitimate.
    • Notification is submitted electronically using FDA Form 3911 (Drug Notification).
    • The dispenser must coordinate with the FDA, manufacturer, and law enforcement for secure retention, sample testing, evidence preservation, or supervised destruction.
    • Termination of Notification: When an illegitimate product investigation is formally resolved, the dispenser must submit a follow-up Form 3911 to the FDA requesting termination of the incident notification.

Dispenser-to-Dispenser Transfers & Wholesale Distribution Boundaries

Pharmacies frequently transfer medications to neighboring pharmacies to resolve urgent shortages. Candidates must know when an inter-pharmacy transfer is exempt from wholesale DSCSA requirements versus when it triggers full wholesale licensure:

1. The "Specific Patient Need" Exemption

  • Under 21 U.S.C. § 360eee(24)(B)(xiv), the transfer of a prescription drug from one retail pharmacy to another pharmacy is EXEMPT from the definition of wholesale distribution if it occurs to satisfy a "specific patient need".
  • Example: Pharmacy A is short 10 tablets of an urgent transplant medication needed to fill an existing prescription for Patient John Doe. Pharmacy B transfers a bottle to Pharmacy A. Because this transfer satisfies an identified, immediate patient prescription, Pharmacy B is NOT acting as a wholesale distributor and is NOT required to provide 3T documentation.

2. General Inventory Transfers (Triggering Wholesale Licensure)

  • If Pharmacy A transfers excess stock, bulk cases, or slow-moving inventory to Pharmacy B for general stock replenishment (without an identified patient prescription), the transfer constitutes commercial wholesale distribution.
  • Under both federal DSCSA and New Jersey law, the supplying pharmacy must hold a wholesale distributor license and must provide full Transaction Information (TI), Transaction History (TH), and a Transaction Statement (TS) to the receiving pharmacy.

Summary of Key Exam Traps

Scenario Presented on ExamCorrect Legal Interpretation Under DSCSA
Dispenser retains 3 T documents for 2 years (matching DEA rule)Federal Violation: DSCSA mandates a minimum 6-year record retention period
Pharmacy transfers medication to another pharmacy for a specific patient needExempt transfer: Does not require wholesale distributor license or 3 T paperwork
Pharmacy sells excess inventory to sister store for general inventoryWholesale distribution: Requires wholesale license and full electronic 3 T transfer
Pharmacist discovers counterfeit medication in wholesale shipmentMandatory Action: Quarantine product and submit FDA Form 3911 within 24 hours
Dispenser purchases medications from unlicensed secondary distributorFederal Violation: Dispensers may only purchase from Authorized Trading Partners (ATPs)
Dispenser dispenses prescription drug to patient without providing 3 TsLegal & Correct: DSCSA 3 T requirements apply to trading partners, not end-use patients
Test Your Knowledge

A hospital outpatient pharmacy in Newark receives a shipment of a specialty biological oncology medication from a wholesale distributor. Upon scanning the 2D data matrix barcode during routine inventory verification, the pharmacy's electronic inventory management system flags a mismatch between the encoded serial number and the manufacturer's verified repository. Upon physical examination, the pharmacist notes faint adhesive lines indicating that the outer carton labeling was altered. The manufacturer confirms that this serial number was previously reported destroyed in Europe. Having established credible evidence that the drug is counterfeit and an 'illegitimate product,' what actions are legally mandated under the Drug Supply Chain Security Act (DSCSA)?

A
B
C
D
Test Your Knowledge

Under Title II of the Drug Quality and Security Act (the Drug Supply Chain Security Act - DSCSA), dispensers must receive, verify, and maintain supply chain tracing documentation known as the '3 Ts' for all covered prescription drug transactions. What are the '3 Ts,' and what is the federal statutory record retention requirement for these documents?

A
B
C
D
Test Your Knowledge

Under DSCSA package-level serialization requirements, every individual commercial unit of sale of a prescription drug product must bear a 2D Data Matrix barcode encoding a Standardized Numerical Identifier (SNI). Which four specific data elements must be encoded within this 2D Data Matrix barcode and displayed in human-readable format?

A
B
C
D
Test Your Knowledge

An independent retail pharmacy in Morristown, New Jersey, is preparing to dispense an urgent prescription for an oral anti-rejection immunosuppressant medication for a kidney transplant patient. The pharmacy is four tablets short of completing the fill and calls a neighboring independent pharmacy located two miles away. The neighboring pharmacy agrees to transfer one unopened 30-tablet bottle to allow the dispensing pharmacy to fill this specific patient's prescription immediately. How is this transfer classified and regulated under the Drug Supply Chain Security Act (DSCSA)?

A
B
C
D