4.4 Recordkeeping, Retention & Documentation

Recordkeeping and Retention

Pharmacy supply-chain operations generate records that must be retained for specific periods under federal and state law. Good recordkeeping supports recalls, audits, and investigations, and is a core Domain 1 competency.

Federal Retention Requirements

DSCSA: 6 Years

Under DSCSA Title II, trading partners must keep transaction information, transaction history, and transaction statement (the "T3" documents) for not less than 6 years. This supports track-and-trace investigations and the enhanced drug distribution security (EDDS) requirements, whose compliance dates were phased in from May 27, 2025 (manufacturers and repackagers) through November 27, 2026 (small dispensers). If a suspect or illegitimate product is identified, these records let the supply chain trace the product back to the manufacturer.

DEA: 2 Years

DEA registrants must maintain controlled-substance records for at least 2 years and keep them readily retrievable. This includes initial and biennial inventories, DEA Form 222 order forms, dispensing records, and wastage documentation. Many states require longer retention (5 years or more), so the stricter state requirement governs.

State Dispensing Records

State boards of pharmacy set retention for prescription and dispensing records — commonly 5 years, sometimes longer for controlled substances or pediatric records. Pharmacy technicians should know their state's requirement; when federal and state differ, the longer period applies.

Invoices, Wastage, and Recall Records

• Invoices and receipts document receipt of drug inventory and support DSCSA traceability — retain at least as long as the DSCSA window (6 years) where they serve as transaction records.
• Wastage logs document the destruction of expired, damaged, or partially administered drugs — especially controlled substances, which require a witness signature and often a specific form.
• Recall records document the recall notice, quantity quarantined, return/destruction, and notifications; keep these as part of the quality file for audit and trending.

340B Audit Records

HRSA may audit covered entities and review several years of 340B records. Maintain 340B purchase records, dispensing records tied to eligible patients, split-billing software output, child site records, and duplicate-discount compliance documentation. Accurate, retrievable records are the entity's defense in an audit; missing records can result in repayment demands.

Good Documentation Practices (GDP)

All records should follow good documentation practices:

• Date every entry (and time where relevant, e.g., controlled-substance administration and wastage)
• Signature (or unique electronic identifier) of the person making the entry
• Permanence — entries in ink or an audit-trailed electronic system; no pencil, no correction fluid; errors corrected with a single line, initialed and dated, with the correct entry alongside
• Contemporaneous — recorded at the time of the event, not reconstructed later
• Legible and attributable — traceable to the specific person and event

Worked Scenario: A DSCSA Audit

A wholesaler request reaches a pharmacy for T3 documents on a drug purchased 4 years ago that is now under investigation. The pharmacy must be able to retrieve, within a reasonable time, the transaction information, transaction history, and transaction statement showing the chain back to the manufacturer. If records were kept only 3 years, the pharmacy would be unable to comply — a DSCSA violation. A 6-year retention policy and retrievable storage (electronic or paper) are essential.

Electronic vs. Paper Records

Records may be paper or electronic, but electronic systems must have an audit trail that captures who made each entry, when, and any changes. The system must be validated, access-controlled, and backed up. Paper records must be legible, indelible, and stored to prevent loss or damage. Either format is acceptable as long as the records are retrievable for the full retention period.

"Readily Retrievable" for DEA

DEA requires controlled-substance records to be readily retrievable — the registrant must be able to produce them on request, separated by drug schedule, within a reasonable time. Filing systems that bury CS records among general pharmacy files, or that require extensive searching, do not meet this standard. Many pharmacies maintain a separate, indexed CS file (paper or electronic) specifically to satisfy retrievability.

Audit-Readiness

Audit-readiness means any record can be produced quickly: a DSCSA T3 pull for a suspect product, a DEA inspection request, a state board audit, or an HRSA 340B audit. The combination of correct retention periods, retrievable storage, and good documentation practices turns recordkeeping from a chore into a compliance asset.