3.4 Suspect & Illegitimate Product Handling

Suspect vs Illegitimate — Two Distinct Definitions

DSCSA distinguishes two statuses with different definitions and different obligations:

• Suspect product — a product that a trading partner believes (has reason to believe) may be counterfeit, diverted, stolen, intentionally adulterated, intended for fraud, or otherwise unfit for distribution such that use of the product would result in serious adverse health consequences or death. "Suspect" is a belief-based status — the trading partner has not yet confirmed the problem.
• Illegitimate product — a product that a trading partner has verified to be counterfeit, diverted, stolen, intentionally adulterated, intended for fraud, or otherwise unfit. "Illegitimate" is a confirmed status — verification has occurred.

The progression is: reason to believe → suspect → investigate → if confirmed → illegitimate → report. The exam tests the difference between "believed" (suspect) and "verified" (illegitimate).

Red Flags — What Makes a Product Suspect

A pharmacy technician should recognize these red flags during receiving:

• Counterfeit — packaging, labeling, or product characteristics inconsistent with the known genuine product (mismatched fonts, missing security features, off-color tablets).
• Diversion — product intended for one market or channel appearing in another (e.g., foreign-labeled product in a domestic pharmacy receive, or product marked "hospital use only" arriving through retail wholesale).
• Grey market — product sourced through unauthorized or non-authorized trading partners outside the legitimate supply chain.
• Misbranded — labeling that is false, misleading, or missing required information.
• Poor product integrity — damaged packaging, broken seals, evidence of tampering, or signs of temperature excursion (e.g., a cold-chain product arriving warm or with a compromised data logger).

Receiving Verification Steps

When receiving a covered product, the technician's DSCSA verification steps include:

1. Verify the product identifier — confirm the package carries a valid GTIN/NDC + serial + lot + expiration, and that the identifier matches the accompanying transaction data.
2. Verify trading partner authorization — confirm the shipment is from an authorized trading partner (licensed manufacturer, repackager, wholesale distributor, or 3PL).
3. Inspect for signs of suspect product — check seals, packaging condition, temperature logs for cold-chain products, and consistency between the case and inner packages.

If any of these checks fail, the product should be treated as suspect and moved into the suspect-product workflow.

Quarantine and Investigation

Once a product is identified as suspect:

• Quarantine — physically segregate the product so it cannot be dispensed or sold while under investigation.
• Investigate — review transaction data (TI/TH/TS or package-level tracing data), contact the upstream trading partner, and document the findings.
• Determine status — if the investigation confirms a problem (counterfeit, diverted, stolen, etc.), the product becomes illegitimate; if the investigation clears the concern, the product may be returned to stock with documentation.

FDA Form 3911 — 24-Hour Reporting

When a product is verified as illegitimate, the trading partner must:

• Notify FDA by submitting FDA Form 3911 (Drug Reporting Form) within 24 hours of making the determination.
• Notify immediate trading partners (both upstream and downstream) that may have received or supplied the affected product, so they can investigate their own inventory.

Form 3911 is FDA's mechanism for reporting suspect and illegitimate drug products. The 24-hour clock starts when the trading partner confirms the product is illegitimate — not from the moment of initial suspicion.

What "Notify Immediate Trading Partners" Means in Practice

Notifying immediate trading partners means contacting the entity that sold you the product (the upstream partner) and any entity to which you may have onward-distributed the same lot or package (the downstream partner), so each can quarantine and investigate its own inventory. The notification should identify the product, the lot/serial, the nature of the confirmed problem, and the action you have taken. This two-directional notification is what stops a single bad package from propagating further through the supply chain while FDA assesses the scope.

The "Reason to Believe" Threshold

DSCSA does not require certainty to trigger the suspect-product process — it requires a reason to believe the product may be counterfeit, diverted, stolen, or otherwise compromised. A single red flag (a broken seal, a mismatched serial, a temperature excursion) is enough to establish reason to believe. The technician's job is not to confirm the problem — that is the investigation's job — but to recognize the red flag, quarantine, and escalate so the investigation can determine whether the product becomes illegitimate.

Recordkeeping — Six Years

DSCSA transaction data and records related to suspect/illegitimate product handling must generally be retained for six years. This includes TI/TH/TS (or their EDDS equivalents), investigation records, Form 3911 submissions, and trading-partner notifications. Keep them retrievable, because DSCSA sets a response clock when a regulator asks: a dispenser must produce the applicable transaction information and transaction statement within 2 business days of a request made in connection with a recall or a suspect/illegitimate-product investigation, while manufacturers, repackagers, and wholesale distributors must respond within 1 business day.

Technician Scenario

A technician receives a case of a cold-chain biologic. The temperature data logger shows a 6-hour excursion above the labeled storage range, and one inner vial's serial number does not match the case's aggregation data. The technician quarantines the case, notifies the pharmacist-in-charge, and documents the discrepancy. The pharmacist contacts the wholesaler and reviews the package-level tracing data. If the investigation confirms the product was diverted and relabeled, the product is illegitimate: the pharmacy submits FDA Form 3911 within 24 hours, notifies the wholesaler, and retains all records for six years.

Exam Tip

Three numbers to memorize together: 24 hours (Form 3911 notification once illegitimate is confirmed), 2 business days (a dispenser's deadline to produce records on request — 1 business day for manufacturers, repackagers, and wholesale distributors), and 6 years (recordkeeping retention). Mixing these up is a common exam trap — the 24-hour clock starts at confirmation of illegitimacy, not at initial suspicion.