Practical Answers to the DSCSA Questions Pharmacies Keep Asking

DSCSA stands for the Drug Supply Chain Security Act.

For pharmacies, DSCSA is the federal law that helps protect the prescription drug supply chain by requiring trading partners to trace certain prescription drugs as they move through the supply chain.

In plain English, DSCSA is about knowing:

• Who supplied the product?
• Whether the supplier is an Authorized Trading Partner
• What transaction data came with the product?
• Where that data is stored
• How records can be retrieved
• What the pharmacy did when something was missing or questionable

DSCSA is not just paperwork. It is a recordkeeping, verification, documentation, and response process.

Yes. Pharmacies are considered dispensers under DSCSA and have DSCSA responsibilities.

Some requirements may apply differently depending on the type of pharmacy, size of the dispenser, product involved, transaction involved, and timing of FDA exemptions.

But pharmacies should not assume DSCSA does not apply. At a minimum, pharmacies should know their suppliers, understand where product tracing information is stored, maintain required records, and have procedures for suspect or illegitimate product concerns.

November 27, 2026, is the deadline tied to the small dispenser exemption for certain enhanced DSCSA requirements.

Qualifying small dispensers received additional time for certain enhanced electronic, interoperable requirements. But the date should not be treated as the day to start preparing.

Pharmacies need time before the deadline to set up supplier connections, confirm data flow, train staff, test workflows, document exceptions, and practice record retrieval.

The deadline is November 27. The smart start date is much earlier.

For FDA’s small dispenser exemption, qualification generally depends on whether the company that owns the dispenser had 25 or fewer full-time employees who are licensed pharmacists or qualified pharmacy technicians as of the applicable reference date.

Pharmacies should document how they determined their status. If there is uncertainty, the pharmacy should involve its compliance team or legal counsel.

Do not guess. And do not assume the exemption removes every DSCSA responsibility.

No. The exemption gives qualifying small dispensers more time for certain enhanced DSCSA requirements. It does not erase all DSCSA obligations.

Small dispensers still need to know their suppliers, understand where product tracing information is stored, access records when needed, and maintain appropriate procedures for suspect and illegitimate product concerns.

The exemption gives time. It does not make DSCSA disappear.

TI means Transaction Information. It includes key information about the product and transaction, such as product name, strength, dosage form, NDC, lot number, quantity, transaction date, shipment date, and trading partner information.

TS means Transaction Statement. It is the statement from the trading partner that certain DSCSA requirements were met.

TH means Transaction History. It refers to prior transaction information for the product as it moved through the supply chain. As DSCSA has moved toward enhanced electronic tracing, the practical focus has shifted more heavily toward electronic transaction information and transaction statements.

For pharmacies, the key point is simple: the pharmacy needs to know whether required transaction data is being received, where it is stored, and how to retrieve it later.

EPCIS stands for Electronic Product Code Information Services. It is a common electronic format used to exchange serialized DSCSA transaction data between trading partners.

For pharmacies, EPCIS matters because many suppliers use it to send DSCSA transaction data connected to shipments and product identifiers.

A pharmacy does not need every staff member to understand the technical structure of an EPCIS file. But the pharmacy should know whether EPCIS data is being received, where it is stored, and how related records can be retrieved.

EDDS generally refers to Enhanced Drug Distribution Security. It describes the enhanced DSCSA framework for secure, interoperable, electronic product tracing at the package level.

In plain English, EDDS is about moving from older tracing methods toward more connected electronic data exchange across the supply chain.

For pharmacies, EDDS increases the importance of supplier readiness, electronic transaction data, product identifier information, reconciliation activity, and record retrieval.

No. DSCSA should not be reduced to “scan every package every time.”

Scanning can be extremely useful, especially for reconciliation activity and product identifier review. But scanning is a tool, not the entire DSCSA program.

The broader issue is whether the pharmacy can receive and retain transaction data, review supplier records, document missing information, manage exceptions, handle suspect product concerns, retain records, and retrieve proof when needed.

Reconciliation is the process of comparing product received against related shipment or transaction data.

For pharmacies, reconciliation can help confirm that the product, shipment, and DSCSA records belong together.

Reconciliation may involve scanning barcodes on packages, cases, totes, or pallets, depending on the workflow and available data.

The practical goal is not to create extra work. The goal is to document what was checked and what happened next.

An Authorized Trading Partner is a trading partner that is properly licensed or registered for its role in the prescription drug supply chain.

For pharmacies, this usually means knowing that suppliers are authorized to sell prescription drug product.

Pharmacies should have a process for reviewing supplier status and keeping supplier information current. A pharmacy cannot have a strong DSCSA process if it does not know where product is coming from.

Missing or delayed transaction data should be documented.

The pharmacy should know:

• Which supplier was involved?
• Which shipment or product was affected?
• What data was expected?
• What was missing or delayed?
• Who followed up?
• What response was received?
• How the issue was resolved or escalated?

Missing data should not live only in email or memory. A documented missing-data workflow helps the pharmacy show what it did.

DSCSA records generally need to be retained for six years.

That means the pharmacy’s recordkeeping process must survive staff turnover, supplier changes, software changes, email cleanup, and time.

The question is not only whether the record was saved. The question is whether the pharmacy can still find and explain the record years later.

If product appears suspect, the pharmacy should stop and follow its suspect product process.

That may include reviewing available transaction data, checking product identifier information, quarantining product when appropriate, contacting the supplier or manufacturer, documenting the investigation, escalating internally, and reporting when required.

Staff should know when to stop and ask for help. The middle of a product concern is the wrong time to invent the process.

Form FDA 3911 is used for certain reports to FDA involving illegitimate product and termination of notifications.

Not every issue requires a 3911. But pharmacies should understand when a suspect product concern may need to be escalated and when reporting may be required.

The pharmacy should involve its compliance team or legal counsel when facts are unclear.

Supplier portals can be useful. But they should not be the pharmacy’s entire DSCSA plan.

Portals may differ by supplier. Access may change. Records may be hard to connect across suppliers, locations, accounts, and shipments.

Portals may not document the pharmacy’s missing-data follow-up, reconciliation activity, exceptions, suspect product review, or internal decision-making. A portal can be part of the process. It should not carry the whole process.

Email and spreadsheets may help track some activity, but they are fragile as a complete DSCSA process.

Records can be scattered. Versions can conflict. Staff may not know where to look. Supplier data may be inconsistent. Missing-data follow-up can get lost. Six-year retention can become difficult.

When someone asks for proof, the pharmacy may have to rebuild the story manually. That is not where a busy pharmacy wants to be.

Not always. Pharmacy management systems, inventory systems, and DSCSA compliance systems serve different purposes.

A pharmacy management system is usually focused on dispensing, prescriptions, billing, adjudication, and patient workflow. Inventory systems are focused on stock levels, ordering, replenishment, purchasing, and valuation.

DSCSA focuses on supplier records, transaction data, product tracing, reconciliation activity, exception documentation, suspect product procedures, six-year retention, and record retrieval.

Some integrations can be useful, especially single sign-on or administrative connections. But integration should not be treated as a magic word.

The better question is: will the integration improve DSCSA readiness or just add complexity? For many pharmacies, a focused DSCSA system provides more practical value than forcing DSCSA data through systems built for different jobs.

It depends on the pharmacy.

A small pharmacy with a few suppliers may move faster. A pharmacy with multiple locations, many suppliers, 340B accounts, incomplete records, staff turnover, or manual workarounds may need more time.

Implementation is not just subscribing to software. It includes supplier setup, transaction data review, staff training, reconciliation testing, missing-data cleanup, exception workflow review, and record retrieval practice.

The more complex the pharmacy, the earlier implementation should begin.

DSCSA has real teeth. In serious cases, violations tied to prohibited acts under the Federal Food, Drug, and Cosmetic Act can create civil or criminal exposure, including fines and possible imprisonment.

That does not mean every documentation mistake becomes a criminal case. But it does mean DSCSA should be taken seriously.

The practical risk for many pharmacies is being unable to show where product came from, whether required records were received and retained, what happened when data was missing, and how the pharmacy responded when something looked wrong.

Poor documentation can make a difficult situation harder to defend.

In general, DSCSA applies to certain prescription drug products distributed in the United States.

Not every product in the pharmacy is treated the same way. Some product categories are generally outside DSCSA product tracing requirements, such as certain over-the-counter drugs, animal drugs, medical gases, certain IV products, and lawfully compounded drugs.

Scope questions can depend on the product and transaction. When the answer is unclear, the pharmacy should involve its compliance team or legal counsel.

Yes. DSCSA does not replace recall procedures, but organized DSCSA data can help support product questions, recall research, supplier questions, investigations, and suspect product review.

DSCSA records may help identify supplier, shipment, transaction date, lot number, quantity, missing-data history, exception documentation, and related transaction records.

Better records can make product questions easier to answer.

Pharmacies should stop treating DSCSA as a future project.

The practical next steps are:

• Confirm whether the pharmacy qualifies as a small dispenser.
• Review supplier information.
• Confirm where transaction data is stored.
• Identify missing or delayed data.
• Train staff.
• Test reconciliation activity.
• Review suspect product procedures.
• Confirm six-year retention.
• Practice record retrieval.
• Start implementation well before the deadline.

The goal is not to panic. The goal is to prepare while there is still time.