1
Thou shalt know your trading partners.
DSCSA opens with a question that sounds basic and is anything but: who are you doing business with?
Every pharmacy needs a real process for confirming that its suppliers and trading partners are authorized: manufacturers, wholesalers, repackagers, third-party logistics providers, and anyone else who touches the product on its way to your shelf.
Do not assume a supplier is compliant just because the box arrived at your door. Supplier status, account setup, GLNs, data routing, and the availability of transaction data all matter.
The rule is short: know your sources, confirm they are authorized, and keep records that show a reasonable process is in place.
If a stranger handed you a prescription drug on the street, you would ask questions. Your loading dock deserves the same scrutiny.
2
Thou shalt receive the required transaction data.
If DSCSA-covered product comes into your pharmacy, the transaction data that belongs with it should be received, accessible, and retained.
Depending on the trading partner, product, and timing, this may arrive as EPCIS data, an EDI 856 document, or another accepted form of transaction information.
The real test is not whether the data exists somewhere in the universe. It is whether your pharmacy can find it, connect it to the product you received, and produce it on demand.
If a supplier, regulator, auditor, or your own team asks for it and it cannot be found, you may have a compliance problem.
Data you cannot locate is, for compliance purposes, data you do not have.
3
Thou shalt not confuse product receipt with compliance.
A shipment on the dock does not mean the compliance work is done.
Receiving the physical product and receiving its DSCSA data are related, but they are not the same thing. Your pharmacy should have a process to confirm that what arrived is supported by the right transaction information.
This does not mean every package must be scanned. FDA has not set a percentage of total amount of product that must be scanned. Your obligation is product verification, which can be met through visual comparison, barcode scanning, OCR, or other reasonable methods, guided by your risk tolerance and your trust in the supplier’s serialized data.
What matters is a reasonable, documented process confirming that the physical product and the electronic or documented record belong together.
The goal is not busywork. It is confidence that the product in your hand and the record in your system are telling the same story.
4
Thou shalt document exactly what you do.
In compliance, undocumented work can look like work that never happened.
A pharmacy can be doing everything right, but without a record it is far harder to prove. DSCSA compliance should leave a trail: supplier setup, data receipt, reconciliation activity, exception notes, support tickets, quarantine actions, suspect product investigations, staff training, and responses to trading partner inquiries.
Good documentation does not need to be complicated. It needs to be clear, organized, searchable, and defensible.
When someone asks what you did, the answer should never depend on memory alone.
5
Thou shalt take exceptions seriously.
Missing EPCIS data, failed transmissions, GLN problems, duplicate records, routing errors, mismatched product identifiers, unresolved shipment questions. These are not minor annoyances. Very often, they are the real work of DSCSA compliance.
A strong process gives every exception a home: a clear way to identify it, assign it, track it, and resolve it. When one appears, you should know what it is, who owns the follow-up, what action was taken, and whether it is closed.
Scattered emails, sticky notes, and “I think someone called about that” are not a compliance strategy.
6
Thou shalt quarantine first when product is suspect.
When product is questionable, patient safety comes first, before convenience and before the schedule.
If product appears suspect, illegitimate, mismatched, diverted, counterfeit, stolen, or otherwise questionable, you need a process to separate or quarantine it when appropriate, investigate the concern, and document the outcome.
No one wants false alarms. No one wants dangerous product reaching a patient even more.
Give your team one clear path to follow: stop, separate, investigate, document, escalate, resolve.
7
Thou shalt train the people doing the work.
DSCSA compliance does not live in the compliance office. It lives at the receiving door.
The people checking shipments, scanning barcodes, reviewing exceptions, and calling suppliers are the ones who turn policy into practice. Their training should be practical and role-based.
A receiving clerk does not need a law school lecture on DSCSA. They need to know what to do when product arrives, what a mismatch looks like, where the data lives, when to escalate, and how to document the activity.
Simple training that people actually remember beats a forty-page procedure that nobody opens.
8
Thou shalt not wait until the deadline.
Some DSCSA requirements have phased in over time, and small dispensers have additional time under FDA’s exemption from certain enhanced requirements. Treat that extra time as runway, not as an excuse to wait.
Supplier data issues, missing EPCIS files, scanner workflows, GLN cleanup, staff training, reporting, and exception handling each take time to improve.
The pharmacy that waits until the last minute often discovers the problem was never one large task. It was fifty small unresolved ones.
The best time to build a compliance process is before anyone asks to see it.
9
Thou shalt prepare for inspections long before inspection day.
Inspection readiness is not a folder you assemble the night before someone asks for records.
A ready pharmacy can show where its DSCSA data is stored, how product receipt is reviewed, how exceptions are handled, how staff are trained, and how supplier issues are tracked.
The goal is not perfection. It is preparedness.
When a regulator, trading partner, or internal auditor asks for documentation, you want to answer with confidence instead of scrambling in panic.
A clean record is a calm record.
10
Thou shalt remember the purpose: protect the patient.
DSCSA can blur into a maze of acronyms, portals, files, scanners, GLNs, EPCIS documents, ASNs, exceptions, and deadlines. The purpose underneath all of it is much simpler.
DSCSA exists to keep unsafe, counterfeit, stolen, contaminated, diverted, or otherwise harmful prescription drugs away from the people who trust you to fill their prescriptions.
Every supplier check, every transaction record, every reconciliation step, every quarantine, every exception note, and every staff training session serves that one mission.
Compliance is not about staying out of trouble. It is about honoring the trust a patient places in your pharmacy and in the pharmaceutical supply chain.
