How the DSCSA tracks prescription drugs and what the pharmacy must do
PTCB topic: DSCSA: serialization, tracing and quarantine
- Each package has an NDC, serial number, lot number and expiration date.
- The serial number makes each package unique.
- No transaction information and statement, no taking ownership. Keep them 6 years.
- Suspect product (reason to believe): quarantine and investigate it.
- Illegitimate product (credible evidence): notify FDA within 24 hours.
Key facts
- The product identifier shows the standardized numerical identifier (NDC plus a unique serial number of up to 20 characters), the lot number and the expiration date, in human-readable and machine-readable form.
- A pharmacy may not accept ownership of a prescription drug unless the seller provides the transaction information and transaction statement.
- Product tracing documentation is kept for at least 6 years.
Show all 7 key factsShow fewer
- A sale to another pharmacy to fill a prescription for an identified patient (specific patient need) does not require tracing documents; restocking does.
- Suspect product: reason to believe it may be counterfeit, diverted, stolen, intentionally adulterated or otherwise unfit. It is quarantined and investigated.
- Illegitimate product: credible evidence that it is. The pharmacy notifies FDA and its immediate trading partners within 24 hours.
- The DSCSA covers finished-dosage prescription drugs; over-the-counter drugs, medical gases and lawfully compounded drugs are excluded.
Quick check1 question · 2 more at the end
Under the DSCSA, the product identifier on a package of a prescription drug contains which information?
Correct answer: A.
The DSCSA product identifier is a standardized graphic printed in both human-readable form and on a machine-readable data carrier (a barcode). It contains the standardized numerical identifier, which is the NDC plus a unique serial number, along with the lot number and expiration date. It lets each package be identified and verified as it moves through the supply chain.
A Correct: the product identifier carries the standardized numerical identifier (NDC plus serial number), the lot number and the expiration date.
B Patient and prescriber details belong on the prescription label, not on the manufacturer's package.
C Seller names and invoice details are part of transaction records, not the product identifier.
D A DEA number and storage conditions are not part of the DSCSA product identifier.
Full lesson
Each part starts with its main idea. Open a part when you want the details.
The short answer: The Drug Supply Chain Security Act traces prescription drugs package by package. Each package carries a product identifier: NDC plus a unique serial number, lot number and expiration date. Pharmacies accept drugs only with transaction information and statements, keep them 6 years, quarantine suspect product, and notify FDA within 24 hours of finding illegitimate product.
1 What is the DSCSA for?The Drug Supply Chain Security Act (DSCSA) builds an electronic way to identify and trace prescription drugs at the package level. 1 min
The Drug Supply Chain Security Act (DSCSA) builds an electronic way to identify and trace prescription drugs at the package level. Its goal is to keep counterfeit, stolen and other harmful drugs out of the supply chain, find them if they get in, and remove them fast. The 2026 PTCE outline added it as a new knowledge area.
The law calls pharmacies dispensers. Manufacturers, repackagers, wholesale distributors and dispensers are trading partners, and a pharmacy may buy from and sell to authorized trading partners only.
2 What is printed on each package?Every package carries a product identifier in plain text and in a machine-readable barcode. 1 min
Every package carries a product identifier in plain text and in a machine-readable barcode.
| Element | What it identifies |
|---|---|
| NDC | The product and its package configuration |
| Serial number | This one package (up to 20 characters) |
| Lot number | The batch it was made in |
| Expiration date | When the lot expires |
The NDC plus the serial number make the standardized numerical identifier. The serial number is what makes each package unique, which is why the process is called serialization. Verification means checking that a package's identifier matches what the manufacturer assigned.
3 What paperwork travels with each purchase?Product tracing documents must arrive with every purchase, or the pharmacy may not take ownership. 1 min
Product tracing documents must arrive with every purchase, or the pharmacy may not take ownership.
- Transaction information: product name, strength and dosage form, NDC, container size, number of containers, lot number, transaction and shipment dates, and seller and buyer names and addresses.
- Transaction statement: the seller's statement that it is authorized and did not knowingly ship suspect or illegitimate product.
Keep these records at least 6 years. A pharmacy that sells to another trading partner must send them along. Dispensing to a patient needs none, and neither does a sale to another pharmacy for an identified patient (a specific patient need). Restocking another pharmacy's shelves still needs documents.
4 Which drugs are covered?The DSCSA covers prescription drugs in finished dosage form, such as tablets, capsules and vials. 1 min
The DSCSA covers prescription drugs in finished dosage form, such as tablets, capsules and vials. Exclusions include over-the-counter drugs, animal drugs, blood for transfusion, radioactive and imaging drugs, medical gases, certain homeopathic drugs and lawfully compounded drugs.
5 What is the difference between suspect and illegitimate product?The two terms differ in the strength of the evidence. 1 min
The two terms differ in the strength of the evidence.
- Suspect product: there is reason to believe it may be counterfeit, diverted, stolen, intentionally adulterated or otherwise unfit to distribute. Examples are a broken seal or a label that looks wrong.
- Illegitimate product: credible evidence shows it is one of those things.
6 What does the pharmacy do with suspect or illegitimate product?The pharmacy responds with the same five steps every time. 1 min
The pharmacy responds with the same five steps every time.
- Quarantine the suspect product in a clearly identified separate area, or use other procedures, so it cannot be dispensed.
- Investigate promptly with trading partners: check the lot number, verify product identifiers and review the tracing documents.
- If it is cleared, it may return to stock.
- If it is illegitimate, notify FDA and immediate trading partners within 24 hours, usually on Form FDA 3911. Then disposition the product and keep a sample if asked.
- Keep investigation and disposition records at least 6 years.
The law set November 27, 2023 for fully electronic, package-level tracing, and FDA has granted temporary exemptions since then. Under FDA's notice of August 6, 2026, small dispensers keep a partial exemption until November 27, 2027. A small dispenser's owning company has 25 or fewer full-time pharmacists and pharmacy technicians. Quarantine, investigation and notification still apply to them.
7 What the technician doesThe technician is often the first to spot a problem at check-in. 1 min
The technician is often the first to spot a problem at check-in.
- Confirm tracing documents came with the order; report missing ones to the pharmacist.
- Inspect packages; separate anything suspicious and alert the pharmacist right away.
Common mistakes
The traps students fall into most. Read these before you practice.
Watch out: The serial number makes each package unique, not the NDC or lot number.
Watch out: Suspect means reason to believe; illegitimate means credible evidence, not the other way around.
Watch out: Illegitimate product is reported to FDA, not to DEA on a theft or loss form.
Watch out: Tracing records are kept 6 years, not the 2 years used for the pseudoephedrine logbook.
How to remember it
Remember four words for a suspicious package, "Spot, Stop, Separate, Say." Spot the problem, stop it from being dispensed, separate it, and say so to the pharmacist.
Self-check:
- Which part of the identifier makes each package unique?
- What is the difference between suspect and illegitimate product?
- Within how many hours must FDA hear about illegitimate product?