Full implementation of the Drug Supply Chain Security Act (DSCSA) was to begin on November 27, 2023. However, on August 25, 2023, US Food & Drug Administration (FDA) issued what it refers to as a “Stabilization Policy,” — a one-year period of non-enforcement for certain DSCSA requirements. In our view, FDA expects drug supply chain trading partners to use this time to continue complying with all current DSCSA requirements, while also making efforts to comply with new requirements that become effective on November 27, 2023. In this post, we will discuss the current DSCSA requirements and what you will need to implement no later than November 27, 2024.
Current DSCSA Requirements
Some trading partners and regulators may be unaware of DSCSA’s currently enforceable requirements. Under the DSCSA, the following requirements currently are in effect:
- Trading partners (manufacturers, repackagers, wholesale distributors, and dispensers of prescription drugs) must be authorized and can only transact (ie, buy, sell, or trade) covered prescription drugs with other Authorized Trading Partners (ATPs).
- ATPs must have in place “verification” systems for identifying and managing suspect and illegitimate products.
- All covered drug packages and homogenous cases that ATPs transact should be imprinted with a product identifier, unless the package or case is grandfathered or subject to an FDA-granted waiver, exception, or exemption.
- ATPs must provide, receive, and maintain lot-level transaction data – the transaction information, transaction history (where required), and transaction statement (also referred to as the “3Ts”) – with each transaction with trading partners. Whether lot numbers must be provided with transaction information and transaction history depends on a variety of factors.
- Upon receiving an appropriate request from a regulator, or government official, an ATP must be able to respond with the lot-level transaction data in its possession.
- Dispensers may only return products to the wholesale distributor from which they purchased the product, and the wholesale distributor must associate the return with transaction data it provided to the dispenser to be able to resell the returned (and otherwise safe) product.
- Manufacturers and repackagers must be able to respond to requests from ATPs to verify product identifiers, that is, confirm that the identifier is one the manufacturer or repackager assigned to a product.
- Trading partners must maintain DSCSA-related compliance records for 6 years.
DSCSA Requirements Can Be Enforced Now
Although the Stabilization Policy will be in place for the next year, certain violations of DSCSA requirements constitute prohibited acts under the Federal Food, Drug, and Cosmetic Act and can be enforced. This can result in seizures of products, court-ordered injunctions, and civil and criminal fines and penalties, including imprisonment. Recently, FDA issued a warning letter for DSCSA violations, and the US Department of Justice handed down a criminal indictment against an individual involved in alleged DSCSA violations. State regulators also may bring enforcement actions for violations of the DSCSA.
November 2023 DSCSA Requirements
Under DSCSA, on November 27, 2023, enhanced security requirements go into effect. All ATPs must:
- Exchange transaction information and transaction statements securely, electronically, and interoperably. Transaction information must include the unique identifier of each package in the transaction.
- Have systems for verifying product identifiers at the package level.
- Be able to respond to appropriate tracing requests and trace products at the package level.
- If accepting a saleable return, be able to associate that return with the transaction information and transaction statement associated with the initial sale of that product.
FDA recommends that trading partners exchange transaction information and transaction statements using the GS1 Electronic Product Code Information Services (EPCIS) standard. The selling ATP can also send the required transaction information and transaction statement to a portal that the purchasing trading partner can access.
Understanding FDA’s Compliance Policies
In the Stabilization Policy, FDA states it “does not intend to take action to enforce” these 2023 requirements until November 27, 2024.” Nevertheless, FDA has stated that it “generally expects trading partners to have the systems and processes in place to meet these requirements as of November 27, 2023”. The additional time is for “systems to stabilize and be fully interoperable for accurate, secure, and timely electronic data exchange.”
FDA cautions that this year “should not be viewed as providing…a justification for delaying efforts” to comply with DSCSA requirements. Trading partners are expected to continue use of all the current methods discussed above for data exchange, tracing, and verification until November 27, 2024.
Shortly after the Stabilization Policy was announced FDA also published a statement regarding requirements for wholesale distributors to verify saleable returns at the package level and for dispensers to verify the product identifiers in suspect product investigations. FDA has extended its current 2020 non-enforcement policy regarding these requirements to November 27, 2024.
What Needs to Be Done Over the Next Year?
During this stabilization period, any trading partner that delays implementation efforts risks enforcement action. Given the complexity of the new 2023 requirements, by delaying implementation, your company may risk being found non-compliant with DSCSA requirements. FDA officials have stated that they have no intention to extend the stabilization period further. They may require trading partners who are still not compliant in November 2024 to apply for and obtain FDA approval of an exemption, and there is no guarantee that such a request would be granted.
We believe the best course of action is for every trading partner to start implementing the new requirements by November 27, 2023. You can then use the stabilization period to refine and perfect your processes and further your DSCSA knowledge so that, by the November 27, 2024, deadline, you will be smoothly exchanging products and data with your ATPs in a stable, interoperable manner.
Whether you are starting or continuing your DSCSA journey, visit dscsa.pharmacy for information on DSCSA requirements.