The Drug Supply Chain Security Act (DSCSA)
Is Your Pharmacy Ready for Full Compliance?

It’s taken more than 10 years, but final provisions of the Drug Supply Chain Security Act (DSCSA) are set to take effect on November 27, 2024.

From that point on, manufacturers, distributors, pharmacists, and other stakeholders will all use the same electronic process to verify the safety of prescription medications, share data, and report instances of suspect or illegitimate drugs. The new process, called a “track-and-trace-system,” is a key feature of the DSCSA, and it replaces what had become a patchwork of state reporting requirements, and a series of disconnected, siloed technology systems.

The following analysis provides an overview of the Drug Supply Chain Security Act, including all pharmacist-related compliance requirements. The discussion also details how technology-based solutions, including PrimeRx and InfiniTrax, can help ensure seamless and full compliance.

1. Introduction

It’s taken more than 10 years, but final provisions of the Drug Supply Chain Security Act (DSCSA) are set to take effect on November 27, 2024.

Success, though, will depend on full compliance and active participation by all stakeholders, including pharmacists. Stakeholders have been working diligently since the 2013 passage of the law to develop the necessary technology, revamp existing protocols, and ensure industry-wide understanding of the law’s provisions.

The final, November 2024 deadline calls for all stakeholders to comply with the legislation’s requirements to trace medications at the unit level. But in a sign of just how significant these changes will be for the industry, in June 2024 the Food and Drug Administration announced a compliance exemption for qualified “small dispensers.” Eligible entities, which include pharmacies with fewer than 25 full-time employees licensed as pharmacists or pharmacy technicians, can maintain manual logs for required information, instead of having an electronic system in place, as mandated by the law. The small dispenser exemption is in effect until November 27, 2026.

All other stakeholders are subject to the November 2024 deadline.

Most pharmacist-related provisions are technology-based, and feature standards for track-and-trace reporting requirements. Certain technology providers have kept pace with these requirements and offer solutions that facilitate DSCSA compliance. For example, the PrimeRx pharmacy management solution includes multiple capabilities that facilitate compliance. PrimeRx users can integrate directly with InfiniTrax, a technology development company that offers solutions designed specifically for DSCSA requirements.

2. Then and Now: The Need for National Drug Safety Standards

The Drug Supply Chain Security Act was included in the broader Drug Quality and Security Act (DQSA) that was signed into law by President Barack Obama in 2013. The DQSA, which was written to be phased in over a 10-year period, consists of two core provisions:

Title I: Drug Compounding Quality Act: This provision provides the Food and Drug Administration (FDA) with the authority to regulate certain aspects of compounding pharmacies. Specifically, according to Drugstore News, the law allows the FDA “to regulate compounding pharmacies that produce large volumes of drugs without individual prescriptions, while distinguishing between sterile compounding of injected drugs and traditional compounding of products like mouthwashes and topical ointments.”

Prior to enactment of this legislation, “compounders were subject to state law,” with federal authorities having “limited power over them,” according to The New York Times. The new law makes compounding pharmacies subject to federal reporting and inspection requirements, among other provisions.

Title II: Drug Supply Chain Security Act: This provision, according to the legislation, “establishes requirements to facilitate the tracing of prescription drug products through the pharmaceutical supply distribution chain.” More specifically, the law outlines a system for tracking drugs which, as reported by the Times, is intended to ensure that counterfeit and stolen drugs stay out of the drug supply. The law includes provisions for nationwide serial numbers for drugs and an electronic drug-tracing mechanism.

At the time the law was passed, it was described by The New York Times as “an important step to a safer drug supply in the United States.” The law was praised by leading representatives of the pharmaceutical and pharmacy industries, along with other stakeholders. The National Association of Drug Stores, for example, noted that the bill “establishes one national standard for supply-chain regulation as opposed to an unworkable patchwork of state laws and regulations.” The Generic Pharmaceutical Association (now the Association for Accessible Medications) praised the bill for “establishing a predictable, reliable national standard for electronic prescription medicine tracking.” More directly, one drug safety consultant noted, “it has very sharp teeth.”

Even more telling, the legislation passed both the U.S. House of Representatives and the Senate with strong, bipartisan support.

To understand why the legislation garnered such an outpouring of support, it’s helpful to understand some events that were swirling around at the time. Among other things:

A 2012 nationwide outbreak of meningitis was traced to a single Massachusetts compounding pharmacy. The outbreak resulted in almost 800 patients becoming infected – including 64 deaths — and was traced to gross contamination, criminal negligence, and unsanitary conditions at the pharmacy.
Also in 2012, an illegal “drug diversion and relabeling scheme” was uncovered in New York State, in which more than $500 million in prescription drugs were illegally obtained from Medicaid recipients and then resold to unsuspecting buyers, including pharmacies and wholesalers.
According to the Pew Charitable Trusts, “several times” during 2012 and 2013, doctors’ offices and clinics were notified by the FDA that they may have inadvertently purchased counterfeit vials of the cancer drug, Avastin. The fake drugs apparently came from international sources, “and passed through a series of intermediaries, including at least one licensed U.S. wholesaler.”
Provisions of California’s “E-Pedigree Law,” which would establish state-specific standards and requirements for drug safety were scheduled to take effect in January 2015. Once implemented, California would join as many as two dozen other states that had already adopted their own standards and regulations. California’s pending law drew attention to the lack of national “track-and-trace” standards for ensuring drug safety and integrity.

These were a few of the factors that created a “perfect storm” of momentum in support of national standards for ensuring the safety of the nation’s drug supply chain.

Now, more than a decade later, the need for a secure drug supply chain remains evident. Consider a few recent incidents:

In October 2024 the Centers for Disease Control issued a public alert regarding “a potential public health risk among individuals ordering what they believe to be prescription medications from online pharmacies.” Specifically, the notice alerted the public about a network of individuals “running illegal online pharmacies,” and selling counterfeit prescription pills, known to contain fentanyl.
In June 2023 pharmaceutical manufacturer Novo Nordisk alerted the public that a counterfeit Ozempic® (semaglutide injection) pen had turned up in the United States. The product was reportedly purchased at a retail pharmacy. The company said it was working with the FDA to identify the origin and distribution of the counterfeit pen, which reportedly contained another type of diabetes medication. The company was alerted to the problem when a patient unknowingly used the counterfeit medication and experienced an adverse reaction.
In March 2023, the U.S. Department of State issued a travel warning alerting Americans about “recent media reports regarding counterfeit pharmaceuticals available at pharmacies in Mexico.” The counterfeit drugs, the advisory warned, included medications “tainted with fentanyl and methamphetamine.” An investigation by the Los Angeles Times found the problem to be widespread, with tainted medications purchased from pharmacies throughout the country. Although these drugs were limited to Mexican pharmacies, the fallout reverberated throughout the United States, with several Americans having overdosed or died from the fake medications.

Now, with the final stages of the DSCSA set to take effect, it’s essential for pharmacists to ensure they understand, and are in full compliance with the law’s many pharmacy-specific provisions.

3. Drug Supply Chain Security Act – Key Pharmacy Provisions

According to the FDA, an underlying goal of the Drug Supply Chain Security Act (DSCSA) is to “create a tighter, closed prescription drug distribution system to prevent harmful drugs from entering the supply chain, detect harmful drugs if they do enter the supply chain, and enable rapid response when such drugs are found.”

To do this, the law outlined several specific roles and responsibilities for pharmacists and included a series of compliance deadlines – spanning 10 years – that would culminate in full compliance by November 2023. However, in August 2023 the FDA announced a one-year “stabilization period,” which extended the compliance deadline to November 27, 2024. [Note that “small dispensers,” defined as entities, including pharmacies, that employ fewer than 25 full-time pharmacists or technicians, were given a further exemption from certain provisions until November 27, 2026.]

At the heart of the law is the development of an electronic, interoperable system to identify and trace prescription drugs as they move through the U.S. supply chain. This includes the system ability to:

Facilitate the exchange of information by trading partners at the individual level.
Improve efficiency of recalls.
Enable prompt response to suspect and illegitimate products when found; and
Create transparency and accountability in the drug supply chain.

The law also establishes national standards for licensure of wholesale distributors and third-party logistics providers.

To achieve its important goals, the law includes three key provisions.

A. Product Tracing

Beginning in 2015, manufacturers, wholesale drug distributors, repackagers, and dispensers (primarily pharmacies) were required to exchange information about the handling history of each drug sold in the U.S. market. While product tracing at the lot level was required as of 2015, tracing at the package-level becomes mandatory in 2024.

Specifically, each drug transaction must now be accompanied by FDA-required information that includes:

Transaction information (TI)

Proprietary or established name of the product
Strength and dosage form of the product
NDC number of the product
Container size
Number of containers
Lot number of the product
Date of the transaction
Date of the shipment, if more than 24 hours after the date of the transaction
Business name and address of the person from whom and to whom ownership is being transferred.

Transaction history (TH)*

A statement in paper or electronic form, including the transaction information for each prior transaction going back to the manufacturer of the product.

*Note that this requirement expired in November 2023.

Transaction statement (TS)

A statement, in paper or electronic form that affirms the following points:

The entity transferring ownership in a transaction is authorized as required by DSCSA.
The product was received from a person who is authorized as required by DSCSA.
Transaction information and a transaction statement were received from the prior owner of the product, as required under the law.
The entity did not knowingly ship a suspect or illegitimate product.
The entity has systems and processes in place to comply with verification requirements under the law; and
The entity did not knowingly provide false information and did not knowingly alter the transaction history.

B. Product Verification

Also beginning in 2015, manufacturers, wholesale drug distributors, repackagers, and dispensers (primarily pharmacies) are required to have in place systems and processes to comply with product verification requirements. Specifically, this includes the ability to handle “suspect and Illegitimate products” that may be counterfeit, diverted, stolen, intentionally adulterated, or appear otherwise unfit for distribution.

Stakeholders must put in place a process to investigate and handle suspect and illegitimate drugs, and include steps to:

Respond to verification requests from the FDA about suspected products.
Quarantine and investigate any suspect product to determine if it is illegitimate.
Notify trading partners and the FDA of any illegitimate product.
Respond to notifications of illegitimate products; and
Satisfy recordkeeping requirements.

C. Product Identification (Serialization)

The law established requirements for manufacturers and repackagers to print or affix a unique product identifier (bar code) on the smallest individual sellable unit. The product identifier is composed of four specific data elements:

National Drug Code
Serial number
Lot number
Expiration date.

The product identifier must be “human and machine-readable,” with a two-dimensional (2-D) bar code adopted as the standard for machine processing.

According to InfiniTrak technology provider, in 2018 all products were required to have a serial number in addition to the lot, NDC, and expiration date. However, “the data was not required to transmit the serial number.” That requirement takes effect in November 2024.

Pharmacy-Specific Requirements and Timeline

Pew Charitable Trusts refers to pharmacies as “the last stop in the distribution supply chain before medicines reach patients,” and therefore an “essential component” in the new supply chain system. In outlining pharmacy-specific responsibilities, DSCSA refers specifically to “dispensers,” which are defined as “a retail pharmacy, hospital pharmacy, or a group of chain pharmacies under common ownership or control, or any other person authorized by law to dispense or administer prescription drugs, and the affiliated warehouses of distribution centers of such entities.”

The law includes several responsibilities unique to “dispensers,” as outlined by the American Society of Health-System Pharmacists (ASHP), which include:

2022

Trade with authorized trading partners: Dispensers may engage in transactions only with appropriately licensed or registered trading partners. Pharmacists are expected to have processes in place for confirming the licensing and registration of all trading partners.
Product Tracing: Pharmacies must have a process in place to manage product tracing documentation:
- Pharmaceutical products may only be accepted if they arrive with the transaction history (TH)*, transaction information (TI), and transaction statement (TS).
- All product tracing information must be kept in a secure format for six years.

*TH requirement expired in November 2023.

Suspicious or Illegitimate Products. Pharmacies are required to investigate any prescription drug in their possession that appears suspicious. This may include a product that seems to be physically altered or is missing required information such as the expiration or a product identifier.
- Quarantine any suspect product.
- Collaborate with the manufacturer of suspect or illegitimate prescription pharmaceutical products to ensure patients do not receive the product.
- Report findings of illegitimate products to the FDA and applicable trading partners.

Accept only serialized products. Dispensers may engage in transactions only of products encoded with a unique product identifier (bar code), which will be used to verify a drug’s legitimacy and enable product tracing in the event of a recall or identification of a suspect product.

2023 (Delayed until November 27, 2024*)

Unit-level traceability

Final provisions of the DSCSA were scheduled to take effect on November 27, 2023, although the FDA delayed enforcement until November 2024. These provisions, called the Enhanced Drug Distribution Security Requirements include policies and procedures to ensure unit-level traceability. According to the American Society of Health-System Pharmacists (ASHP), specific requirements include:

A secure, interoperable electronic system must be in place that allows trading partners to exchange TI and TS information.
The ability to use a package identifier (PI) to verify products at the package level. According to the FDA, a package identifier refers to a “standardized graphic (i.e., bar code) that includes the product’s standardized numerical identifier (composed of the NDC and a unique alphanumeric number), lot number, and expiration date.” The product identifier must be presented in a 2-dimensional data matrix barcode for packages, and in a linear 2-dimensional data matrix barcode for homogenous cases.
The ability to verify the product identifier on a package or sealed case via a secure, interoperable electronic system.

The ability to ensure that trading partners can provide TI and TS information via a secure, interoperable electronic system when requested by the FDA or other federal/state agencies.
The ability to ensure that its secure, interoperable system allows for the prompt production of TI for each transaction going back to the manufacturer. This will allow for prompt “tracing” should questions arise about the origin of a suspect product.
Capability for its electronic system to address returns by ensuring that TI and TS information accompanies a product sent back through the supply chain.

4. Prepare Your Pharmacy for Full Compliance – Action Steps

To help pharmacies prepare for full compliance, Cardinal Health outlined specific areas of concentration, with corresponding action items. Those focus areas and actions include:

1. Interoperable data exchange: The Electronic Product Code Information Services (EPICS) technology format will officially replace the Electronic Data Interchange (EDI) format that has historically allowed wholesalers and other suppliers to transmit information to pharmacies. Pharmacies must ensure they have access to an EPICS-based solution, either via supplier-provided web portals or by enlisting a 3rd party technology provider. [See below for information about InfiniTrax EPICS capabilities.]

Action: Determine how your pharmacy will receive EPICS transactions.

2. Global Location Number: Every pharmacy must have a Global Location Number (GLN), which is a unique 13-digit code used for identification purposes. GLNs are available from GS1 for a one-time fee of $30. Once you have obtained a GLN for your pharmacy, provide that information to each wholesaler/manufacturer/supplier with which you interact.

Action: Make sure your pharmacy has a GLN number, and provide that number to all wholesalers and suppliers.

3. Product verification for all suspect products. When a pharmacist encounters a suspect product, he or she is required to verify that the product identifier (2D barcode) affixed to the package aligns with the NDC serial number, lot number, and expiration date assigned to the product by the manufacturer or repackager.

Action: Make sure you have a process in place should you receive an inquiry from the FDA about a suspect product.

4. Returns: Management of product returns is also changing. According to Cardinal Health, “any product being returned must be returned to the source from which it was originally purchased.” And critically important, the data associated with the return must match the records maintained by the original seller. For example, the serial number of a product being returned to a wholesaler must match the serial number included in the wholesaler’s record of the transaction.

Action: Understand the new rules for returning products.

5. Facilitating Compliance with PrimeRx and InfiniTrax

As pharmacies familiarize themselves with applicable DSCSA provisions, it becomes clear that technology has been given a leading role in securing the nation’s pharmaceutical drug supply. Just about every compliance requirement included in the DSCSA is technology-based, as is the law’s ultimate goal – a nationwide track-and-trace system for ensuring the safety of medications provided to patients.

Not surprisingly, pharmacists may feel a bit overwhelmed by the scope of the DSCSA requirements. But as pharmacies take steps to ensure compliance, they will find that help is available. Specifically, many leading technology providers have kept pace with DSCSA requirements, and offer solutions designed to facilitate compliance.

This includes the industry-leading PrimeRx pharmacy management system which includes several capabilities that facilitate DSCSA compliance. In addition, third-party technology provider InfiniTrak has been at the forefront of developing DSCSA-specific track-and-trace solutions. PrimeRx pharmacies now can integrate directly with InfiniTrak for a comprehensive compliance solution.

Key InfiniTrax capabilities include:

EPCIS-ready. The solution supports the DSCSA-mandated EPCIS data protocol. This avoids having to maintain access points with each wholesaler, supplier, etc.
Easy capture of transaction data elements including drug lot/expiration numbers, GTIN numbers, NDCs, and serial numbers.
Real-time verification of trading partner licensing authority.
Workflows that support the identification and verification of suspicious products, product quarantines, and guidance for notifying the Food and Drug Administration.
Ability to search for products by date, supplier, description, NDC, invoice number, lot, status, and type.
Ability to coordinate global location numbers (GLN) for interoperability.
Ability to store – and easily access – DSCSA compliance reviews and inspection documentation as needed.

PrimeRx capabilities include:

2D Barcodes: The DSCSA requires all product identifiers to be available in 2D format. PrimeRx supports this requirement and allows users to capture data elements that include:
- Drug Lot
- Expiration Date
- Serial Numbers
- Global Trade Item Number (GTIN)
- National Drug Code.

PrimeRx users can access the 2D barcode scan feature from multiple screens including:

Receive Drug Entry
Rx Entry
Drug Pick Verification
Rph Verification.

This multiple screen capability facilitates the process for busy pharmacists and avoids having to toggle between different screens.

Recordkeeping. PrimeRx offers extensive recordkeeping capabilities that allow pharmacy managers to efficiently store documentation and information about all aspects of pharmacy operations. With regard to DSCSA compliance, the system can seamlessly process and store mandated transaction documents. This allows pharmacies to easily satisfy DSCSA requirements that records be maintained for a minimum of six years.
Report generation. In addition to storing this information, PrimeRx allows the pharmacy manager to generate detailed reports on a wide range of patient, inventory, and operations topics. This includes reports to satisfy FDA information requests regarding specific transactions, or drug investigations. Should a pharmacy determine that a drug is illegitimate, PrimeRx can facilitate compliance with all FDA reporting requirements.
Compounding. Compound medications are included in DSCSA track-and-trace requirements. PrimeRx facilitates compliance with extensive solutions designed specifically for compounding pharmacies. PrimeRx allows pharmacies to identify the lot number for each ingredient used in a medication. Pharmacies can also trace all medications tied to a particular lot and provide required transaction details.

6. Conclusion

The Drug Supply Chain Safety Act was somewhat unique in that it enjoyed broad support among all affected parties. Stakeholders including manufacturers, pharmacies, distributors, repackagers, and third-party logistics providers were all on board with the fundamental need for the legislation — namely the goal of protecting the U.S. drug supply and prioritizing patient safety. As the FDA continues to implement key provisions of the legislation, it’s essential for stakeholders to remain engaged and aware of all compliance requirements.

A supply chain is only as strong as its weakest link. And when it comes to drug safety, no stakeholder – especially a pharmacy – wants to risk jeopardizing patient safety or drug integrity. This is why pharmacies are increasingly recognizing the important role of technology as a critical tool in promoting compliance and safety.

References

Boyette, Chris, “New York authorities charge 48 in massive Medicaid fraud,” CNN, July 18, 2012.

“Confused by the Drug Supply Chain Security Act (DSCSA)?” Cardinal Health™ webinar, August 15, 2023.

“DSCSA compliance policies establish 1-year stabilization period for implementing electronic systems,” Food and Drug Administration, August 30, 2023.

DeArment, Alaric, “Senate passes Drug Quality and Security Act,” Drugstore News, November 17, 2023.

“Drug Supply Chain Security Act,” U.S. Food and Drug Administration, August 21, 2023.

“DSCSA compliance policies establish 1-year stabilization period for implementing electronic systems,” U.S. Food and Drug Administration, August 23, 2023.

“FDA Postpones DSCCA Provision Enforcement by Three Years,” Crowell Health Solutions, November 5, 2020.

“FDA’s Small Dispenser DSCSA Exemption,” National Association of Boards of Pharmacy, July 19, 2024.

“New England Compounding Center Pharmacist Sentenced for Role in Nationwide Fungal Meningitis Outbreak,” Food and Drug Administration Office of Criminal Investigations, January 31, 2018.”

“New Law Helps Protect Patients from Counterfeit Drugs and Other Risks,” Pew Charitable Trusts, July 17, 2014.

“Novo Nordisk warns of counterfeit Ozempic® (semaglutide infection) pen found in US,” Novo Nordisk press release, June 16, 2023.

“Potential public health risk among individuals ordering counterfeit prescription medications from online pharmacies,” CDC Newsroom, October 2, 2024.

Sheets, Connor, and Blakinger, Keri, “Fentanyl-tainted pills now found in Mexican pharmacies from coast to coast,” The Los Angeles Times, June 14, 2023.

Tavernise, Sabrina, “Bill on Compounding Clears Congress a Year After a Meningitis Outbreak,” The New York Times, November 18, 2013.

“Timeline for the Drug Supply Chain Security Act,” Pew, April 30, 2014.

“U.S. warns about fake, dangerous pills being sold in Mexico,” Associated Press, March 18, 2023.

“What you need to know now about California e-Pedigree,” HealthcarePackaging.com, July 20, 2012.

The Drug Supply Chain Security Act (DSCSA) Is Your Pharmacy Ready for Full Compliance?