In 2008, contaminated heparin products imported from China were found to be responsible for possibly over 100 deaths and hundreds more injuries.1 The cause of this was reportedly an adulterant added during the manufacturing process that was not properly accounted for. While this was known about, it was not reported as it was considered a cost-saving measure. Then in 2012, the New England Compounding Center was found responsible for packaging and marketing three lots of methylprednisolone injections that resulted in hundreds of fungal meningitis infections, including at least 64 deaths.2 The company was purported to have been improperly following safety procedures and purposely mislabeling products that it was selling. Following this, 14 NECC employees were charged with a variety of criminal offenses, with some pharmacists and executives sentenced to serve prison time while other convicted groups had to pay thousands of dollars in fines. To prevent such tragedies from occurring again and to improve pharmaceutical oversight, Congress passed the Drug Quality and Security Act (DQSA).
This Act is divided into two Titles, with the first being primarily in relation to the rise of compounding pharmacies and attempts to use them in order to circumvent typical safety/monitoring procedures. The second title, known as the Drug Supply Chain Security Act (DSCSA), focuses on monitoring the entire drug supply chain from beginning to end to ensure that medications dispensed to patients come from valid sources and are maintained in safe conditions until they reach the patient. As of the end of 2025, all relevant parties should be part of a nationally developed “track and trace” program for ensuring such compliance. But what does this entail exactly, and what is your pharmacy doing to follow these necessary regulatory ?
The Components of the Supply Chain
- Manufacturer – creates the drug products
- Repackager – entity that does not make drugs on site, but does package them into their own proprietary storage system
- Wholesale Distributor – entity that purchases large quantities of medications (typically directly from the manufacturer) then sells them to pharmacies, hospitals, etc…
- Third Party Logistics (3PL) – operates locations of logistical importance for the distribution of medications such as storage warehouses, transportation vehicles, shipping packaging, etc…
- Dispenser – the pharmacy, hospital, etc… that will dispense these medications through a valid medication order to the patient population
Essentially, if an entity in the supply chain is responsible for the direct possession/security of medications at any point, this Act applies to them, unless they receive a specific exemption from the FDA.
Only under specific circumstances can dispensers also be exempt from following certain parts of the DCSCA (Ex. An Epi-Pen being used on a patient having an anaphylactic reaction upon receiving a vaccine, medication samples for an office, Narcan provision programs). Even then, other procedures must be followed when providing medications for such purposes.
Requirements of the DCSCA
Beginning with the manufacturer and continuing as the medication is passed to each entity in the supply chain, certain information must be maintained. This documentation is what is commonly called the 3 Ts:
- Transaction History: information from any prior transaction
- Transaction Information: names/addresses of those involved, the date of transaction and delivery if >24-hour shipment time, and medication details (such as NCD, strength, etc…)
- Transaction Statement: essentially a liability statement confirming the legitimacy of the transaction and product being transferred per DCSCA safety standards
These details must be kept for 6 years after completion of the transaction (though to be safe, 10 years is the current CMS-required [Medicare/Medicaid] record keeping standard).
In the event that a medication/package arrives that is suspicious (misspelled labelling, inconsistent medication appearance, improper documentation, etc.), it is to be quarantined in a specially designated area for this purpose. An investigation into the item’s legitimacy should then be conducted, with all prior entities on the supply chain mandated to respond to federal/state requests within a timely manner (timing differs depending on the entity). This process also applies to product recalls, to ensure faster tracing and easier investigation into possibly dangerous products.
Pharmacy Procedures for Compliance
To anyone who is familiar with the process of receiving/managing medication shipment orders at their pharmacy, this won’t come as a surprise, but it can sometimes be tricky to keep up with all of the necessary details and ensure proper stock is maintained.
When shipments arrive, they should contain the medications requested, an invoice with all required documentation, and stickers that are mandated to be placed on their associated smallest individual saleable unit. Any damaged or improperly documented items should be set aside into the “quarantine zone” to be dealt with or escalated as required.
Another feature now required on every medication container is the unique barcode that resembles a QR code. To maintain compliance with DCSCA when scanning prescriptions, it is now strongly recommended to confirm medications via this barcode instead, as it will also uniquely associate with the NDC, serial number, lot number and expiration date of the medication being dispensed. In switching to use of this barcode, a greater level of regulatory cohesion is maintained, and medications being dispensed can be traced more efficiently. For example, if a problem was discovered for one particular lot number of lisinopril, not every patient who was dispensed lisinopril must be contacted. This new system should make it easier to identify what specific patients received the affected lot number so that they can be appropriately informed more quickly.
So far, while there haven’t been any prosecutions for violating the DSCSA, the FDA has sent a warning letter to the wholesaler Sterling Distributors3 and issued a Texas-based MedSpa a Form 4834 to cite observed violations as recently as 2025. Reported penalties can include imprisonment for one year and a fine of up to $1,000 on the first violation, as well as appropriate escalations in both punishments for each repeat offense.
The field of pharmacy is certainly changing in ways that go far beyond just new medications coming out. As much as new regulations and procedures can seem like a hassle, history has demonstrated why such measures are necessary. By familiarizing ourselves with these new requirements and implementing them properly, we can ensure that incidents like the ones in 2008 and 2012 are truly a thing of the past.
