Track-and-Trace
Mickie Cathers
On August 25, 2023, FDA announced a 1-year delay for supply chain trading partners to comply with the final enhanced drug distribution security requirements under the Drug Supply Chain Security Act (DSCSA), also known as track-and-trace, that were scheduled to take effect on November 27, 2023. FDA is calling this additional time a “stabilization period.”
This delay affects the final implementation phase of a series of DSCSA requirements that have been unfolding since 2013.
The new compliance deadline of November 27, 2024, will help achieve DSCSA’s prescription drug product traceability and security goals while minimizing supply disruptions and avoiding interruptions to patient care.
“This is a huge win for pharmacists who are still working toward complying with these final supply chain security requirements,” said Michael D. Hogue, PharmD, FAPhA, FNAP, FFIP, executive vice president and CEO of APhA. “APhA has strongly advocated to FDA with our concerns for the readiness of all supply chain members, and we appreciate FDA taking this important step to delay compliance with these requirements to ensure patients will be able to get the medications they need without unnecessary disruptions in the supply chain.”
This final step of enhanced drug distribution for the DSCSA requirements involves electronic verification, among other things.
What is a stabilization period?
The stabilization period is meant to allow trading partners, including dispensers (i.e., pharmacies) to implement, troubleshoot, and mature their electronic interoperable systems for exchanging transaction information, as required by law. The stabilization period is intended to avoid disruption to the supply chain and ensure continued patient access to drug products as the supply chain puts systems and processes in place.
FDA has specifically stated that this period isn’t intended to provide, and shouldn’t be viewed as providing, a justification for delaying efforts to comply with DSCSA. FDA is strongly urging trading partners to continue their effortrs to implement necessary measures to satisfy the new drug supply chain security requirements.
If a pharmacy hasn’t already established how they will comply with the new requirements, they should start exploring their options with their wholesaler or vendors offering software solutions. It will take time to integrate these systems and set up processes for compliance and troubleshoot problems.
Latest updates
In new guidance, FDA provides information to assist supply chain partners, including dispensers such as pharmacies, in complying with the agency’s requirements for enhanced drug distribution security for tracing at the package level.
In the final guidance, released September 2023, FDA details the use of electronic standards for tracing products through the pharmaceutical supply chain. FDA said it will allow trading partners to monitor drug products through the pharmaceutical supply chain using email exchanges and portals. The aim is to address the needs of smaller pharmacies, which may lack the encrypted internet connections necessary for exchanging Electronic Product Code Information Services (EPCIS) data. The guidance advises trading partners to use GS1’s EPCIS standard to transmit information through the supply chain.
FDA said that this guidance finalizes the policy articulated in the July 2022 revised draft guidance to reflect the enhanced drug distribution security requirements in the law, including that only electronic methods of product tracing will be permitted and verification of product at the package level will be required, unless a waiver, exception, or exemption applies.
What has already taken place
DSCSA, passed in 2013, created a stepwise approach for implementing requirements for supply chain security. The goal was to create an electronic, interoperable exchange of information that identifies and traces certain prescription drugs down to the package level as they move through the supply chain to protect consumers from counterfeit, stolen, contaminated, or otherwise harmful drugs. DSCSA requires pharmacies—referred to as “dispensers”—to use an electronic, interoperable system that tracks a drug at the unit level throughout the supply chain until it reaches the patient.
Requirements unfolded in several phases over this 10-year period, with the final requirements set to go into effect this November 2023. Certain benchmarks were to be hit in 2020.
Starting January 1, 2015, pharmacies can only do business with licensed wholesalers and pharmacies, and FDA-registered manufacturers.
As of November 27, 2020, pharmacies were required to buy and sell—what the track-and-trace law refers to as “engaging in transactions”—only products with a required “product identifier” on their packages.
Most products—although not all—packaged by manufacturers after November 27, 2018, are required to be affixed or imprinted with a product identifier that features the products’ National Drug Code plus a unique serial number, lot number, and an expiration date. By November 27, 2020, dispensers should have put processes in place to ensure the product identifier is on the package when they received products that required it. The product identifier is included in both human-readable format and on a machine-readable data carrier in a 2D data matrix barcode.
“The challenge for dispensers is that not all drug product packages are required to have a product identifier, and there is no central database to check if a product should have one,” said Ilisa Bernstein, PharmD, JD, FAPhA, senior vice president of pharmacy practice and government affairs at APhA. “If unsure, check with the manufacturer to see if a product identifier should be on the package.”
Since January 2015, dispensers must have systems and processes for actions that must be taken if they have suspect or illegitimate product. It is important that dispensers have SOPs and train staff on the steps to take if they find suspect or illegitimate product, including the proper documentation and who to notify. FDA is enforcing this requirement and recently issued a warning letter to a firm that did not comply. “For suspect and illegitimate product, dispensers must still quarantine product, conduct investigations, and [arrange for] disposition [of] illegitimate product,” Bernstein said.
Small business dispensers
DSCSA requires FDA to assess the impact of these requirements on small dispensers—those with 25 or fewer full-time employees—in order to ensure that the requirements do not impose undue economic hardship. If so, FDA is to determine timelines for compliance or alternative ways for small business dispensers to comply. FDA acknowledged that they received a number of letters from small business dispensers requesting a delay in compliance. Recently, FDA asked the public for comment on questions that will be posed to assess the impact. FDA is expected to start this study in the coming months.
APhA, the National Community Pharmacists Association, and other pharmacy partners collaborated to identify the economic impact of compliance on small business dispensers. They also had several meetings with FDA since DSCSA was passed and submitted letters informing them of the lack of readiness throughout the supply chain. APhA noted that without stable connections to trading partners and appropriate systems and processes, there could be disruptions up and down the supply chain, leading to shortages or lack of access and availability of drugs for our patients.
Going forward
FDA is strongly urging all members of the supply chain to continue their efforts to implement necessary measures to satisfy these enhanced drug distribution security requirements despite this 1-year delay. ■
Current dispenser requirements
The Pharmaceutical Distribution Security Alliance, a coalition of supply chain partners of which APhA is an observer, recently published DSCSA questions and answers for dispensers. They note that dispensers’ current track-and-trace obligations—those for which dispensers must already have systems and processes in place—are that
✔ Transaction information: A paper or electronic statement that includes product name, strength, dosage form, National Drug Code (a unique, three-segment number that serves as a universal product identifier for drugs), container size, strength and dosage form, number of containers, transaction date, shipment date, name and address of the seller and buyer, and lot number.
✔ Transaction history: A paper or electronic statement that includes the transaction information for each prior transaction of the product back to the manufacturer.
✔ Transaction statement: A paper or electronic confirmation transferring ownership of the product.
- They must provide subsequent owners of a product with the 3Ts at the time of or prior to the transaction.
- They must capture and store the 3Ts, including lot level information if provided, for no less than 6 years after the transaction.
- They must reply to FDA or other federal or state agency requests for information within 2 business days.
- They must only engage in transactions with authorized trading partners, and
- They must conduct a suspect-product investigation that includes the capability to quarantine suspect products in their possession or control.
✔ Dispensers who transfer products to another dispenser without a specific patient need may need to register as a wholesale distributor or refrain from the transaction unless another exemption is satisfied.
✔ If the dispenser, in coordination with the manufacturer, concludes that a product in the dispensers’ possession or control is illegitimate, the dispenser shall follow specific steps outlined in DSCSA:
- Arrange for disposition of illegitimate product and assist with the trading partner’s disposition.
- Retain a sample of the product for further physical examination or laboratory analysis.
- Notify FDA and all immediate trading partners within 24 hours of making an illegitimate product determination.
- Respond to notification from FDA that product is illegitimate and identify all illegitimate product subject to the notification.
- Terminate the notification if such a determination is made in consultation with FDA.
- Maintain records of disposition of an illegitimate product for 6 years after disposition.
✔ Pharmacists who encounter products without a product identifier should determine whether the product is grandfathered. Dispensers may accept grandfathered product if there is documentation that the product was introduced into the drug supply chain before November 27, 2018. The full scope of the grandfathering exemption is described in the FDA final guidance titled Grandfathering Policy for Packages and Homogenous Cases of Product Without a Product Identifier. Read the guidance at apha.us/Grandfathered.
On the horizon
Phase 3 of DSCSA’s full implementation involves enhanced drug distribution security. Its compliance deadline has been recently updated to November 27, 2024. Why it matters: an electronic system will improve
FDA’s ability to recall products, detect illegitimate products earlier, and secure the supply chain. The systems and processes that pharmacies must implement will change workflow as products are received and returned, among other circumstances.
✔ Exchange transaction information (e.g., product identifier at the package level) and transaction statements in a secure, interoperable, electronic manner.
✔ Implement systems or processes for package-level product verification, which may include use of aggregation and inference, as necessary.
✔ Implement systems or processes for verification of product at the package level, including the standardized numerical identifier.
✔ Implement systems or processes to promptly facilitate gathering the information necessary to produce the transaction information and transaction statement for each transaction going back to the manufacturer, if FDA or an authorized trading partner requests a suspect or illegitimate product investigation.
✔ If a dispenser enters into a written agreement with a third party—including an authorized wholesale distributor—to confidentially maintain required information and statements, the dispenser must maintain a copy of the written agreement. ■
Legend
✔ Complete at least once
✔ Continuous requirement
✔ Key tip