The Drug Supply Chain Security Act is building an electronic, interoperable system that can trace a prescription drug package from manufacturer to dispenser. For a pharmacy that buys manufactured product it is a set of obligations with dates attached. For a compounding pharmacy or 503B it is something different: its own output is excluded from the law, but the identifiers, the event standards and the recall discipline the law has forced on the rest of the supply chain are exactly what a compounder needs to run a recall in minutes instead of days. This explainer covers both.
What the DSCSA is
The DSCSA is Title II of the Drug Quality and Security Act of 2013, codified at sections 581 to 585 of the Federal Food, Drug, and Cosmetic Act. It pre-empted the patchwork of state pedigree laws and set a ten-year path to unit-level electronic tracing of prescription drugs. It applies to trading partners — manufacturers, repackagers, wholesale distributors, third-party logistics providers and dispensers — and to "product", defined as a prescription drug in finished dosage form for administration to a patient without substantial further manufacturing. The definition excludes blood and blood components, radioactive drugs, imaging drugs, certain intravenous products, medical gases, homeopathic drugs, and drugs compounded in compliance with §503A or §503B.
The product identifier and transaction data
Two data structures do the work. The product identifier is a standardised graphic on each package and homogeneous case carrying the National Drug Code, a serial number, the lot number and the expiration date, in human-readable form and in a machine-readable 2D DataMatrix barcode. The transaction data are what trading partners exchange when ownership changes: transaction information (product name, strength, dosage form, NDC, container size, number of containers, lot, transaction date, shipment date, seller and buyer), a transaction history (the chain of prior transactions — retired in the interoperable phase), and a transaction statement (the seller's attestations that it is authorised, received the product from an authorised partner, and so on). In the enhanced phase the transaction information carries the package-level serials, exchanged electronically — in practice as GS1 EPCIS messages.
- Serialization
- A unique serial number on every saleable unit, not just the lot. With the NDC it forms the standardised numerical identifier (SNI).
- Verification
- Confirming that a product identifier corresponds to one the manufacturer commissioned — required for suspect and illegitimate product and, for wholesalers, saleable returns.
- Interoperable tracing
- Trading partners exchange serialized transaction information electronically so that a package can be traced to the manufacturer on request from FDA or a partner.
- Authorised trading partner
- A manufacturer, repackager or wholesaler that is registered or licensed as required; a dispenser must trade only with authorised partners.
The timeline, including the 2025–2026 dispenser dates
| Date | Milestone |
|---|---|
| 1 January 2015 | Lot-level transaction information, history and statement exchanged for each change of ownership |
| 27 November 2017 | Manufacturers place product identifiers on packages and cases (FDA compliance policy delayed enforcement one year) |
| 27 November 2018 | Repackagers serialize |
| 27 November 2019 | Wholesale distributors trade only serialized product and verify saleable returns |
| 27 November 2020 | Dispensers trade only serialized product and verify suspect product by identifier |
| 27 November 2023 | Statutory start of enhanced drug distribution security: interoperable, electronic, package-level tracing; FDA announced a one-year stabilisation period |
| 27 November 2024 | End of stabilisation; FDA issued staggered exemptions by trading-partner type |
| 27 May 2025 | Manufacturer and repackager exemption ended |
| 27 August 2025 | Wholesale distributor exemption ended |
| 27 November 2025 | Exemption ended for dispensers with 26 or more full-time pharmacists and technicians |
| 27 November 2026 | Small dispenser exemption (25 or fewer full-time pharmacists and technicians) ends |
What a dispenser must do
A pharmacy dispensing manufactured product is a dispenser. Its duties under §582(d): trade only with authorised trading partners; receive transaction information and statements for each product it buys (and, in the enhanced phase, receive them electronically with package-level serials before or at the time of receipt); keep them for six years; have a system to identify suspect product, quarantine and investigate it, and notify FDA and partners of illegitimate product within 24 hours; respond to FDA or a trading partner's request for transaction information within 48 hours (24 hours in the enhanced phase, for a recall or suspect-product investigation); and verify the product identifier on suspect product. Dispensers are not required to serialize anything themselves. Most rely on their wholesaler's portal or a DSCSA service provider to receive and store the data, but the obligation to be able to produce it is the pharmacy's. A specialty or mail-order pharmacy with 26 or more pharmacists and technicians is already past its exemption date; smaller pharmacies have until November 2026.
Compounded drugs: excluded, and why that is not the end of it
Drugs compounded in compliance with §503A or §503B are not "product" under the DSCSA, so a compounding pharmacy's own output carries no DSCSA product identifier and its shipments to patients or clinics are not DSCSA transactions. Three things still apply. First, when a compounder buys finished manufactured drugs — as ingredients, for dispensing alongside compounded items, or as office stock — those purchases are DSCSA transactions and the pharmacy is a dispenser for them. Second, a 503B's cGMP obligations under 21 CFR 211.150 and 211.196 require distribution records that allow a complete recall of each lot, and 21 CFR 7 governs the recall itself. Third, a 503A under USP and state rules must be able to identify and retrieve what it dispensed from a lot. Unit-level serialization is the practical way to meet the last two, and it is why compounders adopt the DSCSA's identifiers and event standards without being subject to the law: a lot-level record tells you a problem lot shipped 1,400 units to 900 addresses; a serialized record tells you which 1,400 and where each one is.
GS1 building blocks: GTIN, SGTIN, SSCC, DataMatrix, EPCIS
The DSCSA does not name a standards body, but the US supply chain settled on GS1. The pieces:
- GTIN
- Global Trade Item Number — the product identifier. For an NDC-labelled drug it embeds the NDC under the GS1 US prefix; a compounded product without an NDC takes a GTIN under your own GS1 company prefix.
- SGTIN
- Serialized GTIN — a GTIN plus a serial number, identifying one unit. In a barcode it is carried as application identifiers (01) GTIN and (21) serial.
- Lot and expiry
- Application identifiers (10) lot and (17) expiry, carried alongside GTIN and serial in the same barcode.
- GS1 DataMatrix
- The 2D symbology used for the product identifier on packages; small enough for a vial wrap.
- SSCC
- Serial Shipping Container Code — an 18-digit identifier for a logistic unit (carton, tote, pallet), carried as (00) in a GS1-128 barcode. Aggregation records which SGTINs are inside which SSCC.
- EPCIS
- Electronic Product Code Information Services — the GS1 standard for recording and sharing what happened to an identified object: what (the EPC), when, where (read point and business location), and why (business step such as commissioning, packing, shipping, receiving; and disposition such as active, in transit, recalled).
Aggregation is what makes serialization workable at a dock: scanning one SSCC on a carton tells you every unit inside without opening it, and shipping the carton ships the units. EPCIS events on commissioning, aggregation and shipping are the data that, exchanged between partners, produce interoperable tracing; recorded internally, they produce a per-unit journey.
Serialization and recall, mechanically
Here is what serialization looks like in Pharmacy Flow, step by step, so the value is concrete. When a unit is filled from a released finished lot it receives a serial from a database sequence with a unique index, and a GS1 DataMatrix label is printed with (01) GTIN, (10) lot and (21) serial; the unit record carries the lot's BUD as its expiry. Packing a unit into a parcel and a parcel into a carton records aggregation, and the carton carries an SSCC on a GS1-128 license plate; cartons aggregate into pallets with their own SSCC. Fill, pack, verify and ship each write an EPCIS-style event with read point, business step, disposition, actor and time, so the unit's journey is a query on its serial. Carrier scans arrive by webhook into a per-event table de-duplicated on the carrier's event id. If a lot is questioned, the trace page lists every shipment and every dispensed unit of the lot. Initiating a recall creates a recall record with a 21 CFR 7 classification, populates one row per traced unit with disposition Pending, flags every unit of the lot Recalled, and tracks per-unit disposition until effectiveness is reconciled. A unit flagged Recalled fails the fill scan if it is ever presented again.
Trace one serial with us
We will fill a unit, pack it into an SSCC carton, ship it, watch carrier scans arrive, then recall the lot and show the per-unit population — on live software.
What Pharmacy Flow does and does not do
| Capability | Today | Notes |
|---|---|---|
| Unit serial per dispensed unit, GS1 DataMatrix (01)(10)(21) | ✓ | Serials from a database sequence; unique index |
| SSCC cartons and pallets, GS1-128 (00) | ✓ | Aggregation recorded; carton detail shows contained units |
| EPCIS-style events for fill, pack, verify, ship | ✓ | Read point, business step, disposition, actor, time |
| Per-serial journey and per-lot trace | ✓ | Trace page lists shipments and units per lot |
| Recall with 21 CFR 7 class and per-unit disposition | ✓ | Recalled units fail the fill scan |
| Carrier scan history, de-duplicated | ✓ | One row per carrier event |
| Receiving manufactured product by lot with documents attached | ✓ | Quarantine until QA release; putaway by storage condition |
| Electronic exchange of DSCSA transaction data with trading partners (EPCIS messaging) | — | On the roadmap; not in the product today |
| Verification Router Service queries | — | Not in the product |
Related reading: 503A vs 503B for which rules apply to your model; Part 11 for the audit trail behind the events; security and compliance; the specialty and mail-order pages for dispensers with volume; the 503B launch playbook; the inventory module; and the resources index.
Frequently asked questions
Does the DSCSA require unit-level serialization?+
Yes, of manufacturers and repackagers, since 2017–2018. Wholesalers and dispensers must trade only serialized product and, in the enhanced phase, exchange package-level transaction data electronically. Dispensers do not serialize product themselves.
Do compounded drugs need a DSCSA product identifier?+
No. Drugs compounded in compliance with §503A or §503B are excluded from the DSCSA definition of product. Compounders serialize for recall readiness and, for 503Bs, to meet cGMP distribution-record requirements, not because the DSCSA requires it.
When does my pharmacy have to comply with the enhanced requirements?+
If you have 26 or more full-time pharmacists and technicians, your exemption ended 27 November 2025. If you have 25 or fewer, it ends 27 November 2026. Check FDA's DSCSA page for the current status of exemptions before relying on these dates.
What is the difference between a GTIN and an NDC?+
The NDC is FDA's product code. The GTIN is GS1's global identifier; for US drugs it embeds the NDC. A compounded product has no NDC, so a compounder assigns GTINs under its own GS1 company prefix.
How does serialization help with recalls?+
A lot-level record says a problem lot shipped some number of units to some number of addresses. A serialized record with aggregation and shipping events says exactly which units went in which cartons to which addresses on which dates, so the recall population is a query and each unit's disposition can be tracked to reconciliation.
Does Pharmacy Flow exchange DSCSA data with my wholesaler?+
Not today. It receives manufactured product by lot with the transaction documents attached and keeps the lot's history, and it serializes what you dispense with GS1 identifiers and EPCIS-style events. Electronic EPCIS exchange with trading partners is on the roadmap; most pharmacies currently meet the receiving obligation through their wholesaler's portal or a DSCSA service provider.
What is EPCIS?+
The GS1 standard for recording and sharing supply-chain events about identified objects: what happened (business step), to which identifiers, where (read point), when, and with what outcome (disposition). Internally it produces a per-unit journey; exchanged between partners it produces interoperable tracing.