2.6 DSCSA & Drug Supply Chain Integrity

DSCSA & Drug Supply Chain Integrity

The Drug Supply Chain Security Act (DSCSA), enacted in 2013 as Title II of the Drug Quality and Security Act, requires the FDA to build an interoperable, electronic, package-level system to trace prescription drug products through the U.S. supply chain. The goal is to detect and remove suspect and illegitimate products—counterfeits, diverted, recalled, or otherwise unsafe. For the PA MPJE, you must know the trading-partner definitions, the three tracing statements, the November 27, 2024 final enforcement date, and the suspect/illegitimate product workflow.

Trading Partners

The DSCSA defines four categories of trading partners. Each must be authorized by FDA or the relevant state authority, and trading with an unauthorized source is prohibited.

[!IMPORTANT] A pharmacy is a dispenser under DSCSA. A pharmacy cannot lawfully acquire a DSCSA-covered prescription product from anyone other than an authorized trading partner. Buying from an unlicensed wholesaler, an internet source outside the regulated supply chain, or another pharmacy (with limited exceptions) is prohibited.

Product Tracing: TI, TH, and TS

The DSCSA requires trading partners to pass product tracing information with each transaction (sale, transfer, or return of a covered prescription drug). The three tracing statements, codified at 21 U.S.C. § 360eee et seq., are:

Beginning with the November 27, 2024 stabilized system, the tracing must be in electronic, interoperable form (e.g., EPCIS 1.2 data via a package-level 2D Data Matrix barcode and aggregated data). Paper tracing is no longer sufficient for covered products.

Pharmacy Obligations at Receipt

A dispenser (pharmacy) must:

1. Verify authorization of the trading partner from whom it purchases.
2. Receive TI, TH, and TS with each incoming shipment of a covered product. Pharmacies may receive the data electronically through a wholesale distributor portal rather than paper-in-hand with each shipment, provided the data is accessible within two business days of a request.
3. Not accept product if tracing information is missing or incomplete. The pharmacy must either return the product or quarantine it and work with the trading partner to obtain the missing data.
4. Retain tracing data for six years (or longer if required by state law).
5. Investigate suspect products promptly.

Suspect and Illegitimate Product Handling

A suspect product is one for which the pharmacy has reason to believe it is counterfeit, diverted, stolen, intentionally adulterated, intended for fraudulent transaction, or otherwise unfit for distribution such that use of the product would result in serious adverse health consequences or death.

An illegitimate product is one that the pharmacy has confirmed through investigation to be counterfeit, diverted, stolen, intentionally adulterated, or otherwise unfit.

Required workflow:

1. Quarantine the suspect product physically or electronically so it is not dispensed.
2. Investigate promptly—check TI/TH/TS, contact the trading partner, examine packaging, verify lot and NDC against FDA records.
3. If confirmed illegitimate: notify FDA (through FDA's Form 3911 or the appropriate notification mechanism) and the immediate trading partner within 24 hours of confirmation.
4. If cleared as legitimate: release the product and document the investigation outcome.

November 27, 2024 Final Enforcement Date

The DSCSA was phased in over a decade. The FDA granted a stabilization period that ended November 27, 2024, after which all trading partners, including dispensers, must operate under the fully electronic, package-level interoperable system. After this date:

• Paper TI/TH/TS is no longer sufficient for most covered products.
• Pharmacies must be able to capture and retain package-level data (e.g., 2D Data Matrix scans).
• FDA may take enforcement action for non-compliant transactions.

Some products remain temporarily out of scope under grandfathering and exemption rules:

• Product manufactured, distributed, or dispensed before November 27, 2024, that is still in the supply chain.
• Products in the exceptions list the FDA published (e.g., certain radiopharmaceuticals, blood products, and individually tailored medical gases) — verify the current FDA list.
• Product imported under the drug importation programs (Section 801 of FDCA) for state Medicaid programs, which follow separate rules.

State Overlays and Inspections

Pennsylvania wholesale distributor licensure is administered under the Prescription Drug Wholesale Distributor Licensure Act and related DOH rules. A pharmacy's permit inspection under 49 Pa. Code § 27.11 includes verifying that the pharmacy acquires product only from authorized trading partners. Out-of-state pharmacies shipping into Pennsylvania must register with the PA Board, and their wholesale distributor relationships must be documented.

Exam Traps and Scenarios

• A wholesaler ships product without TI/TH/TS — the pharmacy must not stock the product for dispensing; quarantine or return and obtain the missing tracing before dispensing.
• 2D barcode scan fails on receipt — investigate; the failure does not automatically make the product illegitimate, but the pharmacy cannot dispense it until cleared.
• Product tracing must be retained six years — even though Pennsylvania pharmacy records generally must be retained two years, DSCSA tracing data has a longer federal retention.
• Suspect product confirmed as illegitimate on Friday — notify FDA and the trading partner within 24 hours; the 24-hour clock starts at confirmation, not at the next business day.
• A pharmacy purchases directly from another pharmacy — generally prohibited unless the seller is an authorized trading partner or the transaction qualifies under a specific exception (e.g., intra-chain transfer with proper tracing).
• Compounded products from a 503B outsourcing facility — DSCSA applies to compounded products from 503B outsourcing facilities; verify tracing on receipt.