9.2 Drug Supply Chain Security Act (DSCSA) Track-and-Trace

9.2 Drug Supply Chain Security Act (DSCSA) Track-and-Trace

The Drug Supply Chain Security Act (DSCSA) was enacted by the United States Congress as Title II of the Drug Quality and Security Act (DQSA) of 2013 (Pub. L. 113-54), amending the Federal Food, Drug, and Cosmetic Act (FD&C Act § 581 et seq., 21 U.S.C. § 360eee et seq.). Designed to replace a fragmented patchwork of state pedigree laws with a uniform, federal electronic tracing system, the DSCSA protects public health by preventing the introduction, distribution, and sale of counterfeit, stolen, contaminated, diverted, or substandard prescription drugs.

Over a phased 10-year implementation timeline culminating in enhanced package-level requirements, the DSCSA established an end-to-end, interoperable, electronic tracing infrastructure. For Virginia pharmacists and pharmacy owners, compliance requires deep familiarity with the foundational 3Ts of product tracing, strict verification of Authorized Trading Partners (ATPs), package-level serialization, rigorous suspect versus illegitimate product protocols, and long-term record retention.

---

Scope of Covered Products and Statutory Exemptions

The DSCSA applies specifically to covered prescription drug products intended for human use in finished dosage forms (tablets, capsules, injectables, liquids). However, federal law establishes key statutory exemptions where DSCSA track-and-trace requirements do NOT apply:

• Blood or blood components intended for transfusion;
• Radioactive drugs or biologics;
• Medical gases (e.g., USP oxygen, nitrogen, nitrous oxide);
• Compounded drug products prepared under Section 503A or 503B of the FD&C Act;
• Intravenous fluids for replenishment of fluid, electrolytes, or calories;
• Irrigation solutions or sterile water for injection;
• Over-the-counter (OTC) monograph or NDA medications;
• Prescription drug samples distributed to practitioners pursuant to the Prescription Drug Marketing Act (PDMA);
• Emergency medical distributions between healthcare entities to alleviate temporary shortages.

---

The Core Taxonomy of Product Tracing: The "3Ts"

Whenever a covered prescription drug product changes commercial ownership across the supply chain, the transferring entity must provide, and the receiving dispenser must capture and verify, the 3Ts: Transaction Information (TI), Transaction History (TH), and Transaction Statement (TS).

1. Transaction Information (TI)

Transaction Information represents the granular data describing the specific pharmaceutical item transferred and the commercial entities involved:

• Proprietary (brand) or established (generic) name of the product;
• Strength and dosage form of the product;
• National Drug Code (NDC) of the product;
• Container size and number of containers;
• Lot number assigned by the manufacturer;
• Date of the transaction;
• Date of shipment (if different from transaction date);
• Business name and physical street address of the transferor (seller/shipper);
• Business name and physical street address of the transferee (purchaser/receiver).

2. Transaction History (TH)

Transaction History is an accumulative record comprising the complete chain of prior Transaction Information (TI) for every previous change of ownership, tracing the product sequentially back to the original manufacturer. Under the final package-level electronic tracing framework, TH is integrated into interoperable electronic exchange networks.

3. Transaction Statement (TS)

The Transaction Statement is an explicit, legally binding electronic certification made by the entity transferring ownership, attesting that the entity:

1. Is an Authorized Trading Partner (ATP) under the DSCSA;
2. Received the product directly from an authorized trading partner;
3. Received the required Transaction Information (TI) and Transaction Statement (TS) from the prior owner;
4. Did not knowingly alter the product's transaction history;
5. Did not knowingly ship suspect or illegitimate product;
6. Maintains verified systems and processes to comply with verification requirements; and
7. Did not knowingly provide false or fraudulent transaction information.

Dispenser Prohibition: Under federal law, a pharmacy cannot accept ownership of a covered prescription drug product unless the prior owner provides the complete 3Ts (TI, TH, and TS) prior to or at the time of delivery. Receiving inventory without accompanying 3T data constitutes an actionable federal regulatory violation.

---

Authorized Trading Partners (ATPs) & Serialization Standards

A central pillar of the DSCSA closed distribution model is the Authorized Trading Partner (ATP) mandate. Dispensers may only purchase, receive, distribute, or transfer prescription drugs to and from entities that satisfy federal ATP definitions:

• Wholesale Distributors: Must be licensed by the state from which the drug is shipped, licensed in the state to which the drug is delivered (holding an active Virginia Wholesale Distributor permit issued by the Virginia Board of Pharmacy under Va. Code § 54.1-3435), and registered in the FDA's annual wholesale database.
• Third-Party Logistics Providers (3PLs): Must hold appropriate state licensure and FDA 3PL registration.
• Manufacturers and Repackagers: Must hold valid federal establishment registrations with the FDA.
• Dispensers (Pharmacies): Must hold an active pharmacy permit from the state board in which they reside (e.g., Virginia Board of Pharmacy).

Package-Level Serialization: The 2D DataMatrix Barcode

Under enhanced DSCSA standards, manufacturers and repackagers must imprint a machine-readable 2D DataMatrix barcode and human-readable text on every individual commercial unit. This Product Identifier encodes four mandatory data elements constituting the Serialized Numerical Identifier (SNI):

1. National Drug Code (NDC): Identifies labeler, product, and package size;
2. Unique Serial Number: Up to 20 alphanumeric characters uniquely identifying that specific bottle or box;
3. Lot Number: Manufacturer batch identifier;
4. Expiration Date: Formulation shelf-life limit.

Enhanced DSCSA Package-Level Product Identifier:
┌────────────────────────────────────────┐
│  [ 2D DataMatrix ]   (01) 00301234567890 (NDC / GTIN)
│  [    Barcode    ]   (21) A1B2C3D4E5F6   (Serial Number)
│  [               ]   (17) 280930         (Exp: Sept 30, 2028)
│                      (10) LOT89421A      (Lot Number)
└────────────────────────────────────────┘

---

Suspect vs. Illegitimate Product Protocols

Pharmacies must establish and maintain written standard operating procedures (SOPs) to identify, quarantine, investigate, and report suspect or illegitimate products within their inventory.

The Legal Thresholds

Quarantine, Investigation, and the 24-Hour Notification Mandate

1. Immediate Quarantine: Upon identifying any suspect product, the pharmacy must immediately physically isolate and quarantine the product in a dedicated, secured storage area separate from all active dispensing stock. The quarantine area must be clearly labeled to prevent accidental dispensing.
2. Internal Investigation: The pharmacy must promptly conduct an investigation in coordination with the manufacturer and trading partners to validate the product identifier and packaging authenticity.
3. Resolution of Suspect Product:
   • Cleared as Legitimate: If the investigation proves the product is authentic and not compromised, it may be released from quarantine and returned to active dispensing stock. The pharmacy must maintain full documentation of the determination.
   • Confirmed as Illegitimate: If the investigation confirms credible evidence of counterfeiting, diversion, theft, or adulteration, the product is deemed illegitimate.
4. Mandatory 24-Hour Reporting: Once a product is determined to be illegitimate, the pharmacy must notify the FDA and all immediate trading partners within twenty-four (24) hours:
   • FDA Notification: Must be submitted electronically using FDA Form 3911 (Drug Notification Form);
   • Trading Partner Notification: Must notify immediate wholesale suppliers and upstream distributors within 24 hours so they can quarantine matching inventory;
   • Disposition: Illegitimate products must remain securely quarantined until proper disposition (destruction or surrender to law enforcement/FDA) is executed.

---

Mandatory Six-Year Record Retention Architecture

Record retention under the DSCSA represents one of the most critical legal traps for pharmacy exam candidates. While standard federal CSA records and Virginia pharmacy dispensing logs are subject to a two-year retention mandate, DSCSA records are governed by federal drug quality law:

The Six (6) Year Mandate: Under FD&C Act § 582(d)(1)(A)(iii), dispensers must retain all product tracing documentation—including Transaction Information (TI), Transaction History (TH), Transaction Statements (TS), suspect product investigation logs, and electronic FDA Form 3911 filings—for at least SIX (6) YEARS from the date of the transaction.

All records must be readily retrievable and provided to federal FDA inspectors or Virginia Board of Pharmacy compliance officers upon official request within statutory inspection deadlines.