Clock is Ticking, 1-Year until DSCSA’s Enhanced Drug Distribution Security Requirements Take Effect

Ten years in the making, and full implementation is finally coming. In about a year—beginning on November 27, 2023—prescription drug manufacturers and their supply chain partners will be required to fully trace and verify certain prescription drug products at the package (i.e., unit) level. That is—beginning on that date—manufacturers, wholesale distributors, repackagers, and dispensers will be required to exchange serialized product information and verify information on the drug packages (i.e., the smallest “individual saleable unit” of product intended for ultimate sale to the dispenser) as they are distributed within the United States. Failure to comply subjects the violators to significant fines and other penalties.

The Drug Supply Chain Security Act (“DSCSA”) was enacted in November 2013 to—among other goals—enhance traceability within the pharmaceutical distribution supply chain, thereby improving detection and removal of counterfeit, stolen, contaminated, or otherwise harmful drug products.^[1] The requirements were phased in over a ten-year period. Several key requirements began in 2015, including the need for trading partners to provide product tracing information at the lot level to subsequent purchasing trading partners. By 2018, manufacturers and repackagers were required to add unique product identifiers (including lot number, expiry date, and serial number) to each drug package and to verify products using these product identifiers upon request by trading partners—for example—on instances of suspect product. The last phase will go into effect next year, reflecting enhanced drug distribution security requirements—commonly referred to as the “enhanced system”—that mandates each trading partner to exchange and verify the product identifier information at the package level and allows full end-to-end tracking of every item as sold throughout the distribution chain. This culminates the last major stage of the DSCSA’s implementation.

To assist manufacturers and other stakeholders to effectively implement the DSCSA requirements, the Food and Drug Administration (“FDA”) has through the years issued more than 30 various guidance and policy documents.^[2] These include—for example—guidances on product identifier requirements, identification of illegitimate or suspect products, and notifications requirements to the FDA. More recently, in July 2022, the FDA added to this growing body of resources, when it published two additional draft guidances relating to the implementation of the DSCSA. One guidance—entitled DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs Guidance for Industry (“DSCSA Standards Guidance”)^[3]—identifies the standards needed to facilitate data exchange for tracing prescription products through the drug supply chain, while the other—entitled Identifying Trading Partners Under the Drug Supply Chain Security Act (“Identifying Trading Partners Guidance”)^[4]—provides guidance in categorizing entities considered as trading partners under the DSCSA. In this Alert, we review the key features of these two draft guidance documents, and we share our takeaways for companies working to prepare for DSCSA compliance.

DSCSA Standards Guidance

The FDA’s DSCSA Standards Guidance establishes the necessary standards to facilitate the adoption of secure, interoperable, electronic data exchanges amongst the pharmaceutical distribution supply chain. It applies to trading partners (i.e., manufacturers, wholesale distributors, dispensers, and repackagers) engaged in product “transactions,” which—under the DSCSA—is defined as “a transfer of product between persons in which a change of ownership occurs.” “Products”—as specifically defined under the DSCSA—with certain exceptions (e.g., blood products and radioactive drugs) is “a prescription drug in a finished dosage form for administration to a patient without requiring substantial further manufacturing, such as capsules, tablets, and lyophilized products before reconstitution.”

This July 2022 draft guidance—which revises an earlier FDA draft guidance issued in 2014—is intended to facilitate the creation of a uniform methodology for product tracing at the package level. Beginning on November 27, 2023, all trading partners will be required to use electronic-based approaches to: “(1) exchange transaction information that includes package level product identifiers for each package included in transactions and transaction statements; (2) verify products at the package level; (3) promptly respond with the transaction information and transaction statement for a product in the event of a recall or for investigations; (4) facilitate the gathering of transaction information for a product going back to the manufacturer in the event of a recall or for investigations; and (5) accept saleable returns under appropriate conditions.”

The guidance specifies that paper-based methods for product tracing will no longer be allowed for all trading partners beginning on November 27, 2023. Although manufacturers—unlike other trading partners—are already currently required to use electronic-based methods to furnish necessary transaction information to subsequent purchasing trading partners, wholesale distributors, dispensers, and repackagers are still currently permitted to use paper-based methods, provided that product tracing requirements can still be met using such methods.

In the DSCSA Standards Guidance, the FDA also adopts the use of GS1’s—a global supply chain standards organization—Electronic Product Code Information Services (“EPCIS”) standard for data associated with transaction information and transaction statements. The FDA emphasized that EPCIS is an “appropriate globally recognized standard” and that “there is considerable agreement among stakeholders that EPCIS is a suitable standard to adopt for the enhanced drug distribution security requirements.”

Interestingly, this new guidance is silent on whether email or web-based platforms such as web portals is an acceptable means for transmitting or accessing product tracing information, a method which was explicitly noted as acceptable under the 2014 guidance. The use of web portals—e.g., a website provided by manufacturers to its trading partners for buying products would arguably enable access to drug transaction information to trading partners such as smaller dispensers who lack the required infrastructure or resources for EPCIS implementation.

Identifying Trading Partners Guidance

Also issued in July 2022, the Identifying Trading Partners Guidance aims to provide guidance to industry and state and local governments in categorizing entities involved in the drug distribution chain. It describes the activities that would determine the type of trading partner an entity may be and the applicable requirements under the DSCSA. These trading partners include manufacturers, repackagers, wholesale drug distributors (“WDD”), third-party logistics providers (“3PL”), and dispensers.

This July draft guidance revises a previous draft guidance—issued in 2017—to further clarify what activities if conducted by private-label distributors, salvagers, returns processors, or reverse logistics providers would cause them to be considered as trading partners under the DSCSA, thereby triggering the applicable requirements for being “authorized trading partners.”^[5] It also discusses additional drug distribution scenarios that may—or may not—subject entities distributing drugs to requirements under the DSCSA. Accordingly, the FDA does not generally consider the distribution of drugs for emergency medical reasons, office use, or research purposes as wholesale distribution under the DSCSA.

Lastly, the guidance notes that the FDA is currently drafting regulations^[6] that establish federal standards for the licensing of and reporting for WDDs and 3PLs, as required under the DSCSA. For example, the proposed rule aims to establish national standards, terms, and conditions for the licensure of WDDs and 3PLs that—when final—will harmonize and preempt the current patchwork system of state laws, which often contain differing standards. Until those federal licensing regulations are effective, however, the FDA will generally consider a WDD who holds a valid license under state law to be fully licensed for DSCSA purposes. Similarly, the “FDA will generally consider a 3PL to be fully licensed for DSCSA purposes, unless FDA determines that the 3PL is not utilizing good product handling and distribution practices and publishes notice thereof.”

Next Steps & Key Takeaways

• Implementation and testing: Given that the November 2023 deadline is fast approaching, it behooves all trading partners to prepare and test their DSCSA data systems in order to ensure a smooth transition by the go-live date. Industry experts warn that manufacturers need to start testing their systems and begin exchanging data with trading partners now in order to identify data glitches and have time to remediate any gaps.
• Data management is crucial: Data management and data accuracy are key, as trading partners ensure that drug products can indeed be traced and verified at the package level. Ensure that IT and technological infrastructures are in place and validated for accurate reconciliation of drug product and serial numbers as they move through the distribution chain. While it is—of course—important to detect counterfeit or diverted product, it is equally important that accurate data is exchanged to prevent inadvertent rejection of legitimate product.
• Adequate resources for internal teams: Ensure that internal supply chain, operations, product security, and quality teams are appropriately staffed to handle the additional workload that would be associated with the enhanced system requirements. For example, expect that additional resources would be needed to routinely reconcile and manage data, as well as investigate errors as they occur.
• Review vendor / trading partner contracts: Evaluate and update, if needed, contracts, including quality agreements, with trading partners to confirm that DSCSA requirements and expectations—for example—on product tracing, timely company notification, recordkeeping, and handling of product returns, are addressed. At the same time, discuss with trading partners their ongoing efforts to comply with DSCSA requirements and ensure that adequate controls are in place at least by the deadline. It is important that trading partners understand their responsibilities and work together to facilitate secure and efficient distribution of the company’s drug products.
• Update inspection and monitoring plans to include DSCSA requirements: Live monitoring and lookback auditing will be essential to ensure DSCSA systems and internal controls are operating effectively and efficiently. Identifying gaps in the process during routine monitoring and inspections would help organizations remediate issues in a timely manner. Just as there continue to be issues seen with the implementation of the EU’s False Medicines Directive—that came into force in 2011—experts warn that implementation of this last major phase of the DSCSA is unlikely to be problem-free.
• Adequately investigate and remediate breaks in the supply chain: When your company does receive reports of suspect or illegitimate products, or any indication that integrity of your distribution chain may be in jeopardy, be ready to adequately and timely investigate and remediate such issues, including to engage third party experts and / or investigative firms as needed, to ensure that appropriate controls are in place and any signals of potential compromise do not further escalate or worsen.