The Drug Supply Chain Security Act (DSCSA): “Track and Trace” Is Now Law, Are You Compliant? Your Duty to Identify Illegitimate Products.

After a decade of rollout, the Drug Supply Chain Security Act (DSCSA) “track and trace” framework is now the operating reality for prescription drugs in the United States. If you make, repackage, wholesale, distribute, or dispense prescription drugs, you have legal duties to trace products electronically and to detect, quarantine, investigate, and report illegitimate products. The purpose is simple: stop counterfeit, diverted, or tampered drugs from reaching patients. This article explains what the law requires, why it matters, and how to get compliant—especially around your duty to identify and handle illegitimate products.

What DSCSA Requires Today

DSCSA creates an end‑to‑end, electronic, package‑level tracing system. The law applies to human prescription drugs in finished dosage form and to the trading partners that handle them: manufacturers, repackagers, wholesale distributors, third‑party logistics providers (3PLs), and dispensers (pharmacies and certain providers).

• Only trade with Authorized Trading Partners (ATPs). You must verify that each supplier and customer holds the right state/federal licenses and FDA registrations. Why: keeping bad actors out is more effective than catching them later.
• Exchange and maintain transaction data. Trading partners must capture and store transaction information and statements electronically. Under the enhanced system, data must support package‑level traceability and investigations. Why: complete, consistent data lets you trace a unit quickly during recalls or investigations.
• Use product identifiers. Drug packages must carry a 2D data matrix encoding the product identifier: NDC (commonly within a GTIN), unique serial number, lot number, and expiration date. Why: the serial number enables item‑level verification to spot counterfeits.
• Verify when needed. When a product is suspect—or for specific processes like saleable returns—trading partners must verify the product identifier with the manufacturer. Why: serial‑level verification confirms authenticity.
• Investigate and report. If you determine a product is illegitimate, you must quarantine, remove from commerce, notify FDA and your immediate trading partners, and document disposition. Why: rapid containment prevents harm and alerts the network.
• Keep records for six years. You must be able to produce transaction data and investigation records. Why: investigations often look back over multiple handoffs.

Key Timing: “It’s Law,” With a Stabilization Period

DSCSA is law nationwide. The “enhanced drug distribution security” phase (interoperable, electronic, package‑level tracing) took effect in late 2023. The FDA announced a stabilization period to allow industry to finish implementation. As of late 2024, FDA signaled continued enforcement discretion for some enhanced requirements into 2025. That does not pause your core obligations: use authorized partners, capture and respond with transaction data, serialize, verify when appropriate, and handle suspect/illegitimate products correctly. Regulators expect good‑faith progress and working systems.

Suspect vs. Illegitimate: Know the Difference

• Suspect product means you have reason to believe a drug may be counterfeit, diverted, stolen, intentionally adulterated, subject of a fraudulent transaction, or otherwise unfit for distribution.
• Illegitimate product means you have determined it meets one of those conditions.

Why it matters: “Suspect” triggers quarantine and investigation. “Illegitimate” triggers mandatory notifications and removal from the supply chain.

Your Duty to Detect and Handle Illegitimate Products

You must have written procedures to detect, investigate, and report. The law expects you to act quickly because delays create patient risk.

• Detect. Train staff to spot red flags on receipt and during inventory:
  • 2D code won’t scan or decodes to serial numbers not in your data feed.
  • Package shows tamper evidence, misspellings, wrong NDC/strength, or unusual fonts/colors.
  • Transaction data is incomplete, inconsistent, or missing a product identifier.
  • Supplier cannot prove ATP status or license looks expired or mismatched.
  • Unusual sourcing (new middleman) or atypical pricing/quantities for the market.
• Quarantine. Immediately segregate the product physically and in your system. Why: to prevent sale/use while you investigate.
• Investigate. Compare the package, 2D code, and your transaction data. Send a verification request to the manufacturer for the exact serial(s). Check upstream/downstream partners. Document every step. Why: a documented chain shows you acted responsibly and helps regulators trace root cause.
• Determine status. If verification fails, packaging is falsified, or diversion/theft is confirmed, the product is illegitimate.
• Notify within 24 hours. Once you determine illegitimacy, notify FDA and your immediate trading partners as soon as possible, no later than 24 hours. Use FDA’s Form 3911 process. Why: early alerts let others quarantine affected lots and stop spread.
• Disposition. Follow manufacturer and regulatory instructions to return or destroy. Record final actions. Why: records prove compliance and support any recall/reimbursement.

What “Good” Looks Like for Electronic Traceability

Enhanced DSCSA expects interoperable, electronic exchange and retrieval at the package level. In practice, most companies use standardized event files (for example, EPCIS) to move data alongside shipments. What matters most is that you can:

• Receive data that includes product identifier, quantities, shipment details, and trading partner identifiers.
• Match received physical units to data (scan the 2D code, don’t rely on linear barcodes). Why: linear barcodes lack the serial number.
• Store and secure data for at least six years in a way you can search quickly by serial, lot, or NDC.
• Respond to tracing and verification requests promptly (typically within one business day or as directed by FDA) with accurate, complete data.

Role‑Specific Compliance Checklists

Manufacturers

• Serialize every saleable unit and case with a conforming 2D data matrix and human‑readable details.
• Provide complete, accurate electronic transaction data to downstream partners before or at shipment.
• Maintain verification services to respond to serial checks from partners (including saleable returns verification).
• Have rapid processes for investigations, field corrections, and notifications.

Repackagers

• Re-serialize repackaged units and maintain linkages to source lots.
• Ensure labels and 2D codes are correct; keep rework/relabeling logs aligned with data flows.
• Support downstream verification and investigations.

Wholesale distributors

• Only buy/sell with ATPs; screen licenses continuously.
• Validate inbound data, scan 2D codes on receipt, and flag mismatches.
• Verify saleable returns by serial with the manufacturer before resale.
• Be able to trace and notify quickly during recalls/investigations.

3PLs

• Register with FDA and operate under written agreements defining DSCSA roles and data exchanges.
• Protect data integrity across warehousing and shipping events; maintain segregation and controls.

Dispensers (pharmacies, certain clinics)

• Accept products only from ATPs. Capture and keep transaction data electronically.
• Scan 2D codes at receiving. Do not rely on invoices alone to prove traceability.
• Quarantine and investigate any suspect product. Notify within 24 hours if illegitimate.
• Train staff and run periodic mock recalls to test your trace and response time.

How To Run a Solid Investigation (Step by Step)

1. Trigger and quarantine. Separate the product. Lock inventory record.
2. Gather facts. Photograph packaging and 2D code. Extract serial, lot, expiry, NDC. Pull inbound transaction data and supplier ATP evidence.
3. Verify with manufacturer. Submit a verification request for the specific serial(s). Track request/response times.
4. Check data integrity. Compare what you scanned to what your data shows. Look for serials not shipped to you, duplicate serials, wrong lots, or mismatched quantities.
5. Escalate. If verification fails or packaging is falsified, treat as illegitimate. Escalate internally to quality/compliance and externally as required.
6. Notify. File an FDA Form 3911 for illegitimate product determination. Inform your immediate trading partners so they can act.
7. Disposition and close. Return or destroy per instructions. Update SOPs if gaps were found. Store records for six years.

Common Pitfalls That Create Noncompliance

• Scanning the wrong barcode. Staff scan linear UPCs at receiving, missing the serial in the 2D code. Fix: configure scanners to prefer 2D data matrices and train staff.
• Paper processes lingering. Invoices and PDFs don’t meet enhanced electronic traceability expectations. Fix: adopt DSCSA‑capable systems that exchange and store structured data.
• Unverified partners. Assuming long‑time suppliers are licensed without checking. Fix: implement automated license checks and maintain evidence files.
• Data mismatch tolerance. Ignoring small discrepancies (like 1–2 units off) during receiving. Fix: treat mismatches as potential red flags; investigate before releasing stock.
• Slow investigations. No clear owner or after‑hours coverage. Fix: define roles, 24‑hour escalation paths, and response SLAs.
• Poor recordkeeping. Storing data in multiple places without audit trails. Fix: centralize and secure records with role‑based access and retention controls.

Practical Steps to Get Ready Now

• Map your flows. Document every inbound and outbound path for DSCSA products. Identify where data enters, where it’s stored, and who acts on it.
• Close your ATP gaps. Build a checklist for onboarding and renewing trading partners. Keep licenses and registrations on file.
• Upgrade receiving. Use scanners that read 2D data matrices reliably. Configure your system to validate serial/lot/expiry against inbound data.
• Standardize your data. Align on a structured format with partners. The goal is accurate package‑level data that you can query by serial.
• Drill your team. Run quarterly simulations: a suspect receipt, a verification request, and a 24‑hour illegitimate product notification.
• Document SOPs. Write step‑by‑step procedures for detection, quarantine, verification, notification, and disposition. Keep them current.
• Measure readiness. Track KPIs: percent of receipts with 2D scans, percent matched to data, verification turnaround time, investigation cycle time, and recall response time.

Bottom Line

DSCSA’s “track and trace” is no longer future planning; it is the standard for doing business with prescription drugs. Your obligations are clear: trade only with authorized partners, exchange and safeguard accurate electronic data, verify when appropriate, and act fast to identify and remove illegitimate products. The why behind every step is patient safety. Build systems that make the right action the easy action, and test them until they are second nature. That is how you stay compliant—and keep unsafe products out of patients’ hands.

Download