The Drug Supply Chain Security Act (DSCSA) outlines critical steps to build an electronic, interoperable system to identify and trace prescription drugs as they are distributed in the United States. DSCSA has staged implementation over a 10-year period that began with the enactment of the law in November 2013. So where does DSCSA stand now? DCAT Value Chain Insights examines key implementation activities.

Implementation of the Drug Quality and Security Act (DQSA), signed into law on November 27, 2013, is underway as the US Food and Drug Administration (FDA) begins its work under Title II of DQSA, known as the Drug Supply Chain Security Act (DSCSA), which outlines critical steps to build an electronic, interoperable system to identify and trace prescription drugs as they are distributed in the United States. DSCSA, which has staged implementation over a 10-year period, is designed to create a system that will facilitate the exchange of information (i.e., transaction information, transaction history, and transaction statement) at the individual package level about where a drug has been in the supply chain. In February 2014, the FDA issued its Implementation Plan for the law, which specifies the deliverables required of the agency under DQSA (see Table I at end of article). Thus far, the FDA has published five guidances relating to the implementation of the DSCSA (see Table II at end of article).

Examining the DSCSA
Under the DSCSA, tracing and serialization requirements first took effect with the passage of the law on November 27, 2013, and then are staged for implementation with some requirements taking effect January 1, 2015, others taking effect four years after enactment, and a new “Phase II” occurring 10 years after enactment. The requirements will require use of a product identifier: a GS-1-compliant standardized graphic that includes, in both human-readable form and on a machine-readable data carrier: the standardized numerical identifier, lot number, and expiration date of the product.

The requirements of DSCSA apply to the following: manufacturers (i.e, holder of a new drug application (NDA) or abbreviated new drug application (ANDA), a co-licensed partner, or an affiliate of the NDA/ANDA holder or co-licensed partner); repackagers; wholesale distributors; third-party logistics providers (which are subject to licensure provisions); and dispensers (e.g., pharmacies and healthcare providers). The traceability requirements generally apply to the transaction (the transfer of product between persons in which a change of ownership occurs) and the product (prescription drugs in finished dosage form intended for human use).  With respect to that transaction between parties, the law outlines requirements for the transaction information, transaction history, and transaction statement.

Transaction information includes the proprietary or established name(s) of the product, the strength and dosage form of the product, the National Drug Code number, container size, number of containers, dates of transaction and shipment, and the business name and address of those from/to whom ownership is being transferred. The transaction history includes the transaction information dating back to the manufacture of the product. The transaction statement is a statement in which the entity transferring ownership in a transaction meets certain requirements, such as being an authorized entity under DQSA to be involved in a transaction, receiving the transaction information or transaction statement from the prior owner of the product, and not knowingly shipping a suspect or illegitimate product.

Phase I of implementation of the DSCSA began with the passage of the law on November 27, 2013, which locked in federal pedigree requirements. The DSCSA also immediately created “floor and ceiling” preemption with respect to state and local laws related to the tracing of products through the distribution system that are inconsistent, more stringent, or in addition to the DSCSA requirements.

The next phase of implementation began in January 1, 2015 and imposed important requirements. First, entities must trade with only authorized trading partners (i.e, manufacturers; wholesale distributors; third-party logistics providers; and dispensers). Entities also must pass, capture, and maintain the transaction history, transaction information, and transaction statement; the exception is that dispensers were given until July 1, 2015 to comply. Entities must also respond to requests for information and have systems and processes to investigate, verify, and respond to suspect and illegitimate products.

In December 2014, the FDA issued draft guidance for trading partners (manufacturers, wholesale distributors, and repackagers) who must provide and capture certain product tracing information. The draft guidance addresses the readiness of the pharmaceutical distribution supply chain to comply with the related to the exchange of product tracing information. The requirements for the tracing of products through the pharmaceutical distribution supply chain went into effect on January 1, 2015, for manufacturers, wholesale distributors, and repackagers, and on July 1, 2015, for dispensers. The draft guidance announced FDA's intention with regard to enforcement of the product tracing information requirements under section 582 of the Food, Drug, and Cosmetics (FD&C) Act. In the draft guidance, the FDA said that it does not intend to take action against trading partners (manufacturers, wholesale distributors, and repackagers) who do not, prior to May 1, 2015, provide or capture the transaction information, transaction history, and transaction statement required by section 582 of the FD&C Act. The draft guidance said that the compliance policy is limited to the requirements that trading partners provide and capture product tracing information; it does not extend to other requirements in section 582 of the FD&C Act, such as verification related to suspect and illegitimate product (including quarantine, investigation, notification and recordkeeping) and requirements related to engaging in transactions only with authorized trading partners.

Four years after enactment (November 27, 2017), manufacturers must pass the transaction history, transaction statement, and transaction information in electronic form, serialize product, and meet enhanced verification requirements. In each succeeding year, repackagers, wholesale distributors, and dispensers respectively must comply with similar requirements.

Phase II begins 10 years after enactment. Key requirements under Phase II implementation are that product identifiers will be used to electronically pass the required information, and the information passed will allow product to be traced at the package level, not just the lot level. Also, the transaction history will be replaced with a “one up, one back” data packet. Systems and process will be required to enable package-level verification. And entities must associate the transaction information and transaction statement for saleable returns.

Under Phase II implementation, the FDA must establish two processes by guidance by November 27, 2015. First, is a process through which an entity may request a waiver and exemption from the serialization requirements on the basis of undue economic hardship, emergency medical reasons, or declaration of a public health emergency. Second, the FDA must establish a process for establishing additional products or transaction exemptions.

The DSCSA established uniform national licensing standards for wholesale distributors and third-party logistic providers. The DSCSA sets out seven broad categories of licensing standards for wholesale distributor and for third-party logistic providers, to be established by November 27, 2015. The DSCSA preempted all state standards, requirements, and regulation with respect to licensure of wholesale distributors and third-party logistic providers that are inconsistent or less stringent than those requirements under the DSCSA.  State standards that are more stringent are also preempted if they are already covered by or related to the federal standards.

Goals for the DSCSA
The goal of DSCSA is that 10 years after enactment, the system will facilitate the exchange of information at the individual package level about where a drug has been in the supply chain. The new system is intended to  enable verification of the legitimacy of the drug product identifier down to the package level, enhance detection and notification of illegitimate products in the drug supply chain, and facilitate more efficient recalls of drug products. Drug manufacturers, wholesale drug distributors, repackagers, and many dispensers (primarily pharmacies) are working in cooperation with the FDA to develop the new system over the staged 10-year implementation.

Among key provisions implemented over the next 10 years are requirements for:

Product identification: Manufacturers and repackagers to put a unique product identifier on certain prescription drug packages, for example, using a bar code that can be easily read electronically.

Product tracing: Manufacturers, wholesaler drug distributors, repackagers, and many dispensers (primarily pharmacies) in the drug supply chain to provide information about a drug and who handled it each time it is sold in the US market.

Product verification: Manufacturers, wholesaler drug distributors, repackagers, and many dispensers (primarily pharmacies) to establish systems and processes to be able to verify the product identifier on certain prescription drug packages.

Detection and response: Manufacturers, wholesaler drug distributors, repackagers, and many dispensers (primarily pharmacies) to quarantine and promptly investigate a drug that has been identified as suspect, meaning that it may be counterfeit, unapproved, or potentially dangerous.

Notification: Manufacturers, wholesaler drug distributors, repackagers, and many dispensers (primarily pharmacies) to establish systems and processes to notify the FDA and other stakeholders if an illegitimate drug is found.

Wholesaler licensing: Wholesale drug distributors to report their licensing status and contact information to FDA. This information will then be made available in a public database.

Third-party logistics provider licensing: Third-party logistic providers, those who provide storage and logistical operations related to drug distribution, to obtain a state or federal license.

FDA guidance to date
As part of its role in implementing the provisions of DSCSA, the FDA is required to issue guidance. Table II outlines the guidance that the FDA has issued to date. Key guidance includes  a draft guidance, issued in November 2014, DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs: How to Exchange Product Tracing Information, which establishes initial standards for the interoperable exchange of the product tracing information related to each transaction of certain human, finished, prescription drugs covered by the statute, in paper or electronic format, through the extension and/or use of current systems and processes.

Also in November 2014, the FDA issued a procedural draft guidance, DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs: How to Exchange Product Tracing Information. This draft guidance establishes standards to help trading partners comply with the requirements of Section 582 of the Food, Drug, and Cosmetics (FD&C) Act to provide the subsequent trading partners product tracing information through the extension and/or use of current systems and processes. Under these provisions, trading partners are also required to capture and maintain the applicable product tracing information for not less than except years after the date of the transaction. Except as otherwise specified by the DSCSA, the product tracing information can be provided to subsequent purchasers in paper or electronic format.

For the purposes of this draft guidance and establishing initial standards for the exchange of tracing information, the FDA noted that “interoperability” encompasses the ability to exchange product tracing information accurately, efficiently, and consistently among trading partners. It specified that in order for any system, process, or practice to be interoperable, the subsequent purchaser must be able to successfully capture and maintain the product tracing information, regardless of whether the information is provided in a paper or electronic format. In the draft guidance, the FDA said that it may revisit this application of “interoperability” as processes and capabilities that promote more standardization become available and as electronic systems evolve and are more widely accessible. The draft guidance specified that paper or electronic formats can include: paper or electronic versions of invoices; paper versions of packing slips; electronic data Interchange (EDI) standards, such as advance ship notice (ASN), which is currently used to provide the receiving entity with advance data on shipments; and EPCIS (Electronic Product Code Information Services), which defines a data-sharing interface that enables supply chain partners to capture and communicate data about the movement and status of objects in the supply chain.

The FDA has issued other draft guidance. To assist third-party logistics providers and wholesale distributors to comply with the new reporting requirements, FDA published a draft guidance, Drug Supply Chain Security Act Implementation: Annual Reporting by Prescription Drug Wholesale Distributors and Third-Party Logistics Providers in December 2014. The draft guidance outlines the information that should be submitted to FDA, the timing of the submissions, a preferred format for the submissions, and a preferred method for reporting using FDA's Center for Drug Evaluation and Research Direct Electronic Submissions Portal. To assist manufacturers, repackagers, wholesale distributors, and dispensers to comply with the new verification requirements, the FDA published the draft guidance for industry, Drug Supply Chain Security Act Implementation: Identification of Suspect Product and Notification in June 2014.

Industry initiatives
Industry initiatives are also underway to facilitate implementation of the DSCSA. In September 2014, an industry-based association, GS1 US, published a guideline that details how to implement GS1 Standards to support the DSCSA. GS1 Healthcare US was established in 2008 to bring together leading manufacturers, wholesalers, healthcare providers, government agencies, and industry associations to address regulatory and business process challenges in healthcare. The guideline, Applying GS1 Standards to US Pharmaceutical Supply Chain Business Processes to Support the Drug Supply Chain Security Act , was developed in collaboration with GS1 Healthcare US, a GS1 US industry-led standards initiative. The guideline offers pharmaceutical industry stakeholders best practices for meeting immediate lot-level management deadlines and sets the foundation for serialized item-level traceability.The guideline focuses on how GS1 Standards, particularly the GS1 Electronic Product Code Information Services (EPCIS), support lot-level management deadline for manufacturers, wholesalers and repackagers, and the deadline for hospital and retail pharmacies. According to GSI, as a GS1 data sharing standard, EPCIS provides the data attributes and message structure needed to comply with the information handling and retrieval provisions of the DSCSA, including the transaction statement, transaction Information, and transaction history, In addition, GS1 says that the EPCIS-based approach enables users to address requirements for serialization, starting in 2017, and item-level traceability, starting in 2023. The guideline also addresses the application of other GS1 Standards to support the law's requirements for product serialization and item traceability, including the Global Location Number (GLN), the Global Trade Item Number (GTIN), the Serial Shipping Container Code (SSCC), and GS1 Data Carriers and Application Identifiers.