11.2 Distribution Records, DSCSA, Recalls & Oregon Record Retention
Key Takeaways
Under the DSCSA, pharmacies deal only with authorized trading partners, keep transaction information and statements for 6 years, and quarantine and investigate suspect products.
When a product is found to be illegitimate, the pharmacy must notify FDA on Form 3911, and its trading partners, within 24 hours.
Enhanced DSCSA requirements applied to dispensers with 26 or more pharmacists and technicians from November 27, 2025; FDA exempts small dispensers until November 27, 2027.
Oregon keeps most pharmacy records 3 years, clinical records 7 years, and immunization and prescribing training records 6 years (OAR 855-104-0055).
Oregon pharmacy records stay on site for 12 months, may then move off site but must be produced within 3 business days, and paper non-controlled prescriptions may be imaged after 120 days.
Why this matters
Area 4.1 includes distribution records, and Area 4.2 covers recordkeeping "in compliance with legal requirements." Two bodies of law dominate. The federal Drug Supply Chain Security Act (DSCSA) governs product tracing and suspect-product handling. Oregon's universal record-retention rule (OAR 855-104-0055) sets how long and where records are kept.
DSCSA basics for dispensers
The DSCSA (FDCA section 582; 21 U.S.C. 360eee-1) built an electronic, interoperable, package-level tracing system in phases ending with "enhanced drug distribution security."
| Concept | What a pharmacy (dispenser) must know |
|---|---|
| Authorized trading partners | Buy from and sell to only licensed or registered partners: manufacturers, repackagers, wholesale distributors and dispensers |
| Product identifier | Prescription packages carry a 2D DataMatrix code with the NDC, serial number, lot and expiration date |
| Transaction information (TI) and transaction statement (TS) | Received with each change of ownership and kept 6 years. The separate transaction-history requirement ended with the 2023 enhanced-security transition |
| Verification | When a product is suspected, verify the product identifier with the manufacturer, at least the lot and expiration date (and serial numbers under enhanced security), and respond to verification requests |
| Suspect product | Reason to believe it may be counterfeit, diverted, stolen, intentionally adulterated, subject to fraud or unfit. Quarantine and investigate |
| Illegitimate product | Credible evidence of those conditions. Quarantine, notify FDA (Form FDA 3911) and immediate trading partners within 24 hours, dispose of it properly, and keep records |
| Exemptions | Dispensing to a patient is not a "transaction." Sales between dispensers to meet a specific patient need have limited TI exemptions |
Compliance timing
FDA's exemptions ended for dispensers with 26 or more full-time pharmacists and technicians on November 27, 2025. For small dispensers (25 or fewer), FDA extended its exemption from certain enhanced requirements to November 27, 2027 (FDA notice updated August 2026). Core duties already apply to everyone: authorized trading partners, suspect and illegitimate product handling, and record retention.
Oregon's rules mirror these duties. Pharmacists must quarantine and physically separate "suspect or illegitimate" products (OAR 855-115-0125(5); OAR 855-041-1036(1)(d)) and may acquire drugs only from Oregon-registered outlets.
FDA recalls
| Class | Meaning | Pharmacy response |
|---|---|---|
| I | Reasonable probability of serious adverse health consequences or death | Quarantine immediately. Follow the recall depth, often patient level, and contact affected patients |
| II | Temporary or medically reversible adverse effects, or remote probability of serious harm | Quarantine and return or destroy as directed |
| III | Unlikely to cause adverse health consequences | Remove from stock as directed |
The pharmacy's policies must assign responsibility for drug recalls. Central-fill and remote-processing applications must describe this too.
Oregon record retention (OAR 855-104-0055)
| Record | Retention |
|---|---|
| Most records required by ORS 475, ORS 689 and OAR 855: prescriptions, refills, transfers, controlled-substance records, temperature logs, self-inspection forms | 3 years |
| Clinical pharmacy records (CDTM, protocol and formulary prescribing, clinical services) | 7 years |
| Training records for immunization and for protocol or formulary prescribing | 6 years, or uploaded to the licensee's eGov record |
| CPE proof | 6 years (OAR 855-135-0050) |
| PSE/ephedrine sales log | 2 years (ORS 475.230) |
| RDSP surveillance video | 6 months (still images 3 years) |
| PPL video | 30 days (6 months if an incident is under review) |
Where records are kept
- Registrant records: on site for at least 12 months, available immediately at inspection. After that they may be kept in a secure off-site location and produced within 3 business days (OAR 855-104-0055(2); OAR 855-041-1160(5)).
- Records outside a registrant, such as a pharmacist's consulting records, are stored securely by the pharmacist and produced within 3 business days.
- Records must be kept longer when federal law requires it (for example, DSCSA's 6 years), when the licensee has notice of a Board investigation, or when the Board asks.
- Paper non-controlled prescriptions may be destroyed after 120 days if an exact, legible electronic image exists with the clarifications attached (OAR 855-041-1160(3)). Controlled substance prescriptions must be kept in the original form federal rules require.
Note
Federal DEA rules require only 2 years for controlled-substance records (21 CFR 1304.04). Oregon's 3-year rule (OAR 855-080-0070) governs Oregon pharmacies.
Exam scenario
A pharmacy receives a shipment of an oral oncology drug whose packaging looks altered and whose DataMatrix serial number doesn't match the transaction information. The pharmacist quarantines the product, investigates, and asks the manufacturer to verify the identifier. If it is determined to be illegitimate, the pharmacy notifies FDA (Form 3911) and its trading partners within 24 hours. It keeps the investigation records and the transaction documents (6 years under DSCSA, longer than Oregon's 3) and documents the quarantine under OAR 855-115-0125(5).
An Oregon pharmacy determines that a product it received is illegitimate under the DSCSA. What notification is required?
Notify FDA (Form FDA 3911) and immediate trading partners within 24 hours of the determination
Notify the Board of Pharmacy within 10 days
Notify only the patient who would have received it
No notification; destroy the product
How long must an Oregon pharmacist keep records of prescriptions issued under a statewide protocol?
3 years
2 years
6 years
7 years, as clinical pharmacy records under OAR 855-104-0055
After 14 months, an Oregon pharmacy moves its old prescription files to a secure off-site storage facility. A compliance officer requests a file. Within what time must it be produced?
Immediately at inspection
Within 30 days
Within 3 business days
Within 24 hours
Sections you finish are checked off in the contents.