DSCSA: US Drug Supply Chain Security

The Product Identifier

Manufacturers affix a product identifier to each package and homogeneous case: a standardised graphic, in human-readable form and on a machine-readable carrier conforming to an international standard, that carries the standardised numerical identifier, lot number and expiration date (§ 581(14)). The standardised numerical identifier is the National Drug Code for the product and package configuration combined with a unique alphanumeric serial number of up to 20 characters (§ 581(20)).

Manufacturers keep the product identifier information for at least 6 years after the transaction. A package that must carry a standardised numerical identifier does not also need a device UDI.

Tracing Information

With each change of ownership, the seller gives the buyer transaction information, a transaction statement and, historically, the transaction history. Transaction information is the product’s name, strength and dosage form, NDC, container size and number of containers, lot number, transaction and shipment dates, and the names and addresses of both parties (§ 581(26)). The transaction statement attests that the seller is authorised, received the product from an authorised partner, did not knowingly ship a suspect or illegitimate product, and has verification systems in place (§ 581(27)). Each is kept for at least 6 years.

Section 582(g)(1) took effect ten years after enactment, on 27 November 2023. It requires transaction information and statements to be exchanged in a secure, interoperable, electronic manner, with transaction information that includes the product identifier for each package. It also requires systems to verify product at package level, to answer promptly with transaction information when FDA or a state asks in a recall or investigation, and to gather the transaction information back to the manufacturer. Lot-level paper records no longer meet it.

Suspect and Illegitimate Product

A suspect product is one there is reason to believe is potentially counterfeit, diverted or stolen, intentionally adulterated, the subject of a fraudulent transaction, or otherwise unfit so as to risk serious adverse health consequences or death (§ 581(21)). An illegitimate product is one for which credible evidence shows the same (§ 581(8)).

On finding a suspect product, a trading partner quarantines it and investigates in coordination with trading partners, including verifying the product identifier at package level. If the product is cleared, it may be distributed again. If it is illegitimate, the partner quarantines and dispositions it, retains a sample for examination at FDA’s request, and notifies FDA and affected trading partners within 24 hours of the determination. Investigation and disposition records are kept for at least 6 years.

Manufacturers must also answer a verification request from an authorised partner within 24 hours, confirming whether the product identifier matches the one they applied, and answer an FDA or state request for tracing information within 1 business day, and in no case more than 48 hours, in a recall or suspect-product investigation.

Exemptions and Where They Stand

FDA’s August 2023 compliance policies gave a stabilisation period to 27 November 2024. FDA then exempted eligible trading partners that had begun systems connections but could not finish in time, in its letter of 9 October 2024: manufacturers and repackagers until 27 May 2025, wholesale distributors until 27 August 2025, and dispensers with 26 or more full-time employees licensed as pharmacists or qualified as pharmacy technicians until 27 November 2025.

Small dispensers — those whose owning company has 25 or fewer such employees — and where applicable their trading partners, are exempt from certain section 582 requirements until 27 November 2027, according to FDA’s DSCSA exemptions page. Trading partners outside these exemptions may request a waiver, exception or exemption. Because these dates have moved more than once, check FDA’s current DSCSA pages before relying on any of them.