3.3 DSCSA & Drug Supply Chain Integrity

DSCSA & Drug Supply Chain Integrity

The Drug Supply Chain Security Act (DSCSA), enacted in 2013 as Title II of the Drug Quality and Security Act, directs FDA to build an interoperable, electronic, package-level system for tracing prescription drugs through the U.S. supply chain. The statute's purpose is to detect and remove suspect and illegitimate products — counterfeit, diverted, stolen, intentionally adulterated, or otherwise unfit for distribution — before they reach patients. Every MPJE tests the DSCSA as baseline federal supply-chain law that a New York pharmacy operates under in addition to state wholesale distributor and pedigree rules covered separately.

Trading Partners

DSCSA defines four categories of trading partners, each of which must be properly licensed or registered, and each of which may lawfully transact only with other authorized trading partners:

A pharmacy is a dispenser. Buying product from an unlicensed source — an unauthorized online seller, an unlicensed reverse distributor, or another pharmacy outside a recognized exception — violates DSCSA regardless of the product's actual authenticity.

T3: Transaction Information, History, and Statement

DSCSA requires each change of ownership of a covered product to be accompanied by three pieces of product tracing information, defined at 21 U.S.C. § 360eee and often called the "T3":

• Transaction Information (TI) — product name, strength, dosage form, NDC, container size and count, lot number, and the names/addresses of the transferring and receiving trading partners.
• Transaction History (TH) — the complete chain of prior transactions for the product, going back to the manufacturer.
• Transaction Statement (TS) — a statement by the transferring entity that it is an authorized trading partner, received the product from an authorized trading partner, did not knowingly ship a suspect or illegitimate product, had systems to comply with verification requirements, and did not knowingly falsify or alter the transaction history.

Since the close of FDA's stabilization period, this data must move electronically between trading partners (for example, EPCIS-based data tied to a package-level 2D barcode) rather than on paper alone.

Dispenser (Pharmacy) Obligations on Receipt

A pharmacy receiving a DSCSA-covered product must:

1. Confirm the seller is an authorized trading partner.
2. Receive TI, TH, and TS with, or reasonably contemporaneous with, the shipment.
3. Not accept product if required tracing data is missing — quarantine or return the product and obtain the missing information before dispensing.
4. Retain tracing data for six years.
5. Maintain a system to identify, investigate, and respond to suspect products.

Suspect and Illegitimate Product Handling

A suspect product is one the pharmacy has reason to believe may be counterfeit, diverted, stolen, intentionally adulterated, the subject of a fraudulent transaction, or otherwise unfit for distribution. An illegitimate product is one confirmed, after investigation, to actually be one of those things. The required workflow:

1. Quarantine the suspect product so it cannot be dispensed.
2. Investigate — verify TI/TH/TS, examine packaging and the 2D barcode, contact the trading partner, and check the NDC and lot against manufacturer records.
3. If confirmed illegitimate — notify FDA and the immediate trading partner within 24 hours of confirmation (FDA Form 3911, submitted through the CDER NextGen 3911 platform or by email, is the standard notification channel).
4. If cleared — document the investigation and release the product.

Implementation Status: Stabilization Period and Small Dispenser Exemption

FDA's original DSCSA statutory deadline for full electronic, interoperable, package-level tracing was November 27, 2023. FDA granted a one-year stabilization period — through November 27, 2024 — during which it exercised enforcement discretion over the enhanced drug distribution security requirements of Section 582(g)(1) of the FD&C Act while trading partners matured their systems. That stabilization period has ended, and enhanced electronic tracing requirements now generally apply across the supply chain.

FDA separately granted small dispensers — pharmacies whose owning corporate entity has 25 or fewer full-time-equivalent licensed pharmacists or pharmacy technicians — an exemption from certain Section 582(g)(1) enhanced requirements through November 27, 2026 (issued June 12, 2024, reissued with clarifying edits July 12, 2024). This exemption narrows a specific set of enhanced obligations; it does not eliminate a small dispenser's baseline duties to buy only from authorized trading partners, receive T3 data, and investigate suspect products.

Exam Traps

• Missing tracing data on receipt means quarantine or return — never dispense first and request the paperwork later.
• The 24-hour notification clock for a confirmed illegitimate product starts at the moment of confirmation, not the next business day.
• Small dispenser status depends on corporate-level pharmacist/technician headcount (25 or fewer FTE), not an individual store's staffing.
• The small dispenser exemption is partial and time-limited (through November 27, 2026) — it is not a blanket DSCSA exemption.
• Six-year tracing-data retention is a DSCSA-specific rule and may exceed the general pharmacy record retention period found in state law.