DSCSA compliance in a community pharmacy is rarely a knowledge problem. Most pharmacists can describe the obligations. It is a retrieval problem: the data exists, it lives in somebody else’s portal, and nobody has tested whether it can be produced on demand years after the fact.
That gap is about to get more expensive for small dispensers.
Where the deadlines actually sit
The enhanced drug distribution security requirements were phased in with exemptions by trading partner type. Most have now expired:
| Trading partner | Exemption expired |
|---|---|
| Manufacturers and repackagers | 27 May 2025 |
| Wholesale distributors | 27 August 2025 |
| Dispensers (standard) | 27 November 2025 |
| Small dispensers | 27 November 2026 |
A small dispenser is a corporate entity owning a dispenser with 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, counted as of 27 November 2024. You determine your own eligibility and do not notify FDA. FDA has signalled it does not expect to extend this further.
If you are not a small dispenser, the enhanced requirements already apply to you.
What already applies to everyone, exemption or not
The exemption covers the enhanced requirements. It does not touch the foundational obligations that have been in force since 2015. Right now, every dispenser must:
Buy only from authorised trading partners. Your suppliers must hold valid state licensure and be properly registered. Keep the evidence, and re-check it rather than assuming it holds.
Receive and retain transaction information and a transaction statement for six years from the date of the transaction. This is the number to commit to memory.
Have a working suspect product process. Quarantine, investigate, and clear or escalate.
Notify FDA within 24 hours using Form FDA 3911 if you determine product is illegitimate, and notify your immediate trading partners.
Respond to trading partner information requests within two business days in a recall or a suspect or illegitimate product investigation.
What transaction information actually contains
Transaction information (TI) carries the proprietary or established name, strength and dosage form, NDC, container size and number of containers, lot number, transaction date, shipment date where it differs by more than 24 hours, and the business name and address of both parties to the transfer.
The transaction statement (TS) is the seller’s attestation that it is authorised, received the product from an authorised trading partner, did not knowingly ship suspect or illegitimate product, has systems to comply, and did not knowingly provide false information.
Under the enhanced requirements this data becomes electronic, interoperable and package-level, exchanged as EPCIS events rather than documents.
What changes for small dispensers after November 2026
The five things currently exempted come into force:
- Electronic exchange of transaction information and statements in a secure, interoperable format
- Package-level product identifiers included in transaction data
- Systems to verify product at package level
- The ability to respond promptly with transaction detail during recalls and suspect product investigations
- Systems to facilitate gathering transaction information back to the manufacturer on a regulatory request
Practically, that means being able to provide package-level transaction information to FDA within 24 hours of a request, and being able to read and act on the product identifier.
The product identifier
Each package carries a GS1 2D DataMatrix encoding four elements: the GTIN derived from the NDC, a unique serial number, the lot number and the expiration date. The NDC and serial number together form the standardised numerical identifier. In GS1 terms these are application identifiers 01, 21, 10 and 17.
The operational consequence is that “check the bottle” becomes “scan the package”, and your scanning and receiving workflow has to capture and retain what it reads rather than just confirming a match.
The retrieval test
Here is the exercise that tells you where you actually stand. Pick a product you dispensed roughly four years ago. Now produce the transaction information and transaction statement for the lot it came from.
Most independents discover the same three problems.
The data lives in the wholesaler’s portal. Convenient, and fine until you need history from a wholesaler you no longer buy from. Portal access usually ends with the relationship. The six-year obligation does not.
Secondary purchases are unaccounted for. The primary wholesaler’s portal covers the primary wholesaler. Product bought elsewhere has its own paperwork, frequently as an email attachment nobody archived.
Nobody owns it. DSCSA responsibility tends to be assumed rather than assigned, and assumed responsibilities do not survive staff turnover.
A workable SOP
Keep it short enough that people follow it:
- Named owner for DSCSA, with a named deputy
- Authorised trading partner verification at onboarding and on a recurring schedule, with evidence retained
- Receiving procedure that captures transaction data at the point of receipt, including for secondary purchases
- Archiving to storage you control, exported from supplier portals rather than left in them, with the six-year clock running from the transaction date
- Suspect product procedure: quarantine physically, investigate, document the investigation and its outcome
- Illegitimate product procedure: Form FDA 3911 within 24 hours, notify trading partners, retain the filing
- An annual retrieval drill, treating a random lot as though FDA had asked
That last item is the one that finds the gaps, and it costs an hour.
Two caveats
State law sits on top of federal law. Boards of pharmacy have their own pedigree and recordkeeping rules, and several impose requirements beyond DSCSA. Check your board rather than assuming federal compliance is sufficient.
Not every product is in scope. DSCSA excludes certain categories, and dispensing to a patient is the end of the chain rather than a traceable transaction. The exclusions are specific and worth reading properly rather than working from a summary, because getting them wrong in either direction creates work or exposure.
The underlying problem is that DSCSA data is a supply chain record that a pharmacy needs to hold for six years, while the systems that generate it belong to somebody else. Attergo Compliance keeps that evidence in a store you control with the retention clock attached, and Attergo Inventory ties it to the lots that actually moved through your shelves, which is what turns a retrieval request into a search rather than a scramble.