DSCSA Explained: The Drug Supply Chain Security Act
Updated
Quick answer
The Drug Supply Chain Security Act, enacted in November 2013 as Title II of the Drug Quality and Security Act, creates a national system for tracing prescription drugs from the manufacturer to the pharmacy. Every package carries a unique product identifier, every transfer generates records that must be kept for six years, every party in the chain must be an authorized trading partner, and any suspect product must be quarantined and investigated rather than dispensed. For a technician it shows up at the receiving door and in the returns process.
The problem it was written to solve
A prescription drug can pass through several hands between the factory and the patient: manufacturer, repackager, wholesale distributor, logistics provider, pharmacy. Every handover is an opportunity for counterfeit, diverted, stolen, or improperly stored product to enter the legitimate chain, and once inside it becomes very hard to distinguish from genuine stock. The DSCSA closes that gap by making the chain traceable: if each package is uniquely identified and each transfer is documented, a suspect product can be traced back to where it entered.
The law was written as a phased ten-year build toward full electronic, interoperable, package-level tracing, replacing a patchwork of differing state pedigree laws with one federal standard. FDA has adjusted several compliance dates during that rollout, including a stabilization period and later exemptions for smaller dispensers, so confirm the current deadline position against the FDA page linked in the sources rather than relying on a date quoted in any study guide, including this one.
The product identifier
Every package and homogeneous case of a prescription drug carries a product identifier, in both human-readable form and a two-dimensional data matrix barcode. It has four parts.
| Component | What it does |
|---|---|
| National Drug Code (NDC) | Identifies the product: labeler, product, and package size. |
| Serial number | A unique alphanumeric string for that individual package. This is what makes each box distinguishable from every other box of the same drug. |
| Lot number | The manufacturing batch, used for recalls. |
| Expiration date | The date beyond which the product must not be dispensed. |
The serial number is the piece that makes the system work. An NDC identifies a product, but every box of that product shares it. A serial number identifies one specific box, which is what allows a returned package to be verified as the one that actually shipped, and a counterfeit carrying a duplicated serial number to be spotted.
Transaction records: TI, TH, and TS
When ownership of a drug changes, the seller passes documentation to the buyer. The three traditional pieces are Transaction Information, which describes the product, quantity, lot, dates, and the parties; Transaction History, which traced the chain of prior transactions back to the manufacturer; and the Transaction Statement, the seller's attestation that they are authorized, received the product from an authorized partner, and complied with the law.
As the system moved to full electronic interoperable tracing, the separate Transaction History document was phased out, with its function absorbed into the electronic transaction data that trading partners exchange. Both framings appear in exam material, so know the three names and know that the history component was the one retired.
Retention: transaction records are kept for six years from the date of the transaction. This is one of the most commonly tested single facts about the DSCSA, and it is longer than most other pharmacy retention periods, which is precisely why it makes a good question.
Authorized trading partners
A pharmacy may only buy from, and sell to, authorized trading partners: parties holding the federal registration or state licence the law requires for their role. In practice this means a pharmacy cannot buy stock from an unlicensed source because the price is attractive, and cannot transfer product to an entity that is not properly licensed. Verifying that a supplier is an authorized trading partner is a routine part of the purchasing process.
Note that pharmacies are classed as dispensers under the law, and that limited pharmacy-to-pharmacy transfers for a specific patient need are treated differently from wholesale distribution. Where a pharmacy distributes above the threshold the law sets, it can fall into the wholesale category with the heavier obligations that follow.
Suspect and illegitimate product
A suspect product is one with reason to believe it may be counterfeit, diverted, stolen, intentionally adulterated, or otherwise unfit. An illegitimate product is one where that has been confirmed. The required response runs in a fixed order.
| Step | What happens |
|---|---|
| Quarantine | Physically separate the product so it cannot be dispensed while its status is unresolved. |
| Investigate | Work with the trading partner it came from to determine whether the product is in fact illegitimate, and validate the transaction records. |
| Notify | If the product is confirmed illegitimate, notify FDA and the immediate trading partners, using FDA's notification form, within 24 hours. |
| Clear or dispose | If the investigation clears the product, document the outcome. If not, follow FDA direction on disposition. |
The 24 hour notification window for confirmed illegitimate product is a favourite exam detail. So is the order of operations: quarantine comes first, because the immediate priority is keeping the product away from patients while everything else is worked out.
What the technician actually does
- Confirm that transaction documentation arrives with every shipment and is stored correctly.
- Check incoming stock against the order, including lot numbers and expiration dates.
- Scan and verify product identifiers where the pharmacy's system supports it.
- Verify saleable returns before they go back into sellable inventory.
- Quarantine anything that looks wrong: damaged or mismatched packaging, an unexpected supplier, a missing identifier, or paperwork that does not match the goods.
- Alert the pharmacist immediately rather than investigating independently.
Frequently asked questions
What does DSCSA stand for?
The Drug Supply Chain Security Act. It was enacted in November 2013 as Title II of the Drug Quality and Security Act, and it builds a system for tracing prescription drugs through every step of the US supply chain so that counterfeit, stolen, contaminated, or otherwise harmful products can be detected and removed.
What are the three transaction documents in the DSCSA?
Transaction Information, Transaction History, and Transaction Statement, often shortened to TI, TH, and TS. Transaction Information describes the product and the parties, Transaction History traced the chain of previous transactions, and the Transaction Statement is the seller's attestation that they are authorized and complied with the law. As the law moved to full electronic interoperable tracing, the separate Transaction History requirement was phased out in favour of electronic transaction data exchanged between trading partners.
What is a product identifier under the DSCSA?
A unique code applied to each package, containing the National Drug Code, a serial number unique to that package, the lot number, and the expiration date. It appears both in human-readable text and in a two-dimensional data matrix barcode so it can be scanned and verified electronically.
What is an authorized trading partner?
A manufacturer, repackager, wholesale distributor, third-party logistics provider, or dispenser that holds the registration or licence the law requires. A pharmacy may only buy from and sell to authorized trading partners, which is what keeps unverified product out of the legitimate chain.
How long must a pharmacy keep DSCSA records?
Six years from the date of the transaction. This is longer than most other pharmacy record retention periods, which is exactly why it gets tested. The records must be retrievable within a reasonable period if FDA or a state regulator requests them.
What should a technician do with a suspect product?
Quarantine it immediately so it cannot be dispensed, and tell the pharmacist. The investigation, the decision about whether the product is illegitimate, and the notification to FDA are handled under the pharmacist's direction. The technician's critical contribution is recognizing the problem and stopping the product before it reaches a patient.
Test yourself
Supply chain questions sit in the Federal Requirements domain next to controlled substance law and FDA safety programs. Work them in context on the PTCB federal requirements quiz. It is worth reading this page against Risk Evaluation and Mitigation Strategies, because the two answer different questions about the same prescription: a REMS asks whether this patient may safely receive the drug, while the DSCSA asks whether this package is genuinely what it claims to be. The DEA controlled substance schedules cover the third strand, which is who may handle the drug and under what recordkeeping.
Official sources
- FDA: Drug Supply Chain Security Act (DSCSA), including current compliance dates
- DailyMed: current FDA product labeling and NDC records
PTCB Quiz Prep is an independent study resource, not affiliated with the Pharmacy Technician Certification Board or the FDA. DSCSA compliance dates have been adjusted several times during the phase-in, so confirm the current position against the FDA page above. This page is exam preparation, not legal or regulatory advice. Part of the PTCB Federal Requirements domain.