DSCSA Product-Tracing Records a Pharmacy Must Be Able to Retrieve

Pharmacies must receive and maintain DSCSA product-tracing information for covered prescription drugs and be able to access relevant records during an investigation or recall. FDA states pharmacies retain tracing documentation for six years. Requirements are evolving toward interoperable electronic exchange, with FDA exemptions and enforcement policies that must be checked for the pharmacy’s size and transaction.

The point of product tracing

The Drug Supply Chain Security Act (DSCSA) creates tracing, verification, and product-identifier requirements for covered prescription drugs as they move through the supply chain. A pharmacy needs enough information to identify where a package came from and support investigation if the product is recalled or suspected to be illegitimate. These records are part of the pharmacy’s supply-chain controls, distinct from a patient’s dispensing label and prescription record.

Transaction information and transaction statement

The tracing information generally includes transaction information (TI) and a transaction statement (TS) for the product. Earlier versions of DSCSA also referred to transaction history (TH); FDA explains that the statutory requirement for transaction history ended in November 2023 as enhanced requirements took effect, though legacy documents or specific exceptions may still use prior terminology. Use current FDA guidance and the supplier’s system rather than assuming every document must have the same format.

Six-year access

FDA’s pharmacist guidance says pharmacies should store product-tracing documentation in paper or electronic format for six years. A third party may maintain records under an agreement, but the pharmacy remains responsible for its obligations and must maintain access. A record is useful only if staff can retrieve it when asked. Confirm that the system links the product or lot to the source transaction and that backups and user access work.

Electronic interoperable exchange

DSCSA’s enhanced security requirements call for secure, interoperable electronic data exchange. FDA has issued implementation guidance, exemptions, and stabilization policies that affect exact timing and requirements. Some small dispenser exemptions may apply for a defined period; they do not eliminate every DSCSA obligation. The pharmacy should rely on its compliance lead and current FDA page to determine which rules apply to its business and each trading relationship.

What pharmacies provide and when

FDA states pharmacies generally do not need to provide tracing documents when dispensing a prescription to a patient. When a pharmacy transfers product to another trading partner, the tracing obligations may apply, subject to specific exceptions such as patient-specific dispensing. If FDA or another authorized official requests records during a recall or investigation, the pharmacy needs a process to find and provide the relevant information promptly.

A workable record structure

At receipt, match the supplier’s tracing data to the shipment and receiving record. Store the electronic message or document in a searchable repository tied to supplier, date, product, and lot or package identifier as applicable. Ensure invoices, product identifiers, and trace messages can be associated. Staff should know the process for hold, return, recall, or investigation requests. Test retrieval periodically rather than discovering a missing link during an urgent event.

Common mistakes

Do not confuse a wholesaler invoice with all required tracing information. Do not assume that keeping a PDF somewhere is enough if it cannot be located by product or transaction. Do not send patient dispensing data to another party when the law does not require it. Do not discard records at the end of a shorter general document-retention cycle if the DSCSA period still applies. And do not assume small pharmacy size automatically removes all requirements.

Example: recall request

A manufacturer announces a recall affecting a particular lot. The pharmacy identifies whether it received the lot by matching package data to its receiving record and tracing data, quarantines affected stock, and follows the recall SOP. If FDA requests information, the pharmacy retrieves the associated tracing records and provides them through the specified channel. A reliable system lets staff answer which supplier and transaction are involved without searching every invoice manually.

PTCE takeaway

Know that DSCSA tracing records support supply-chain verification and recall response. Pharmacies retain tracing documentation for six years and maintain access, while current electronic exchange and small-dispenser rules depend on FDA guidance and exemptions.

Operational checks that prevent mix-ups

The pharmacy should know which staff member can retrieve records after hours and during a recall. That person needs access to the wholesaler portal or repository, a method to identify affected product by lot or package identifier, and an escalation contact for missing data. If a supplier transmits records electronically, preserve the original data or a reliable accessible representation in a system that supports retrieval and audit. Avoid storing tracing files only in an individual employee’s inbox or local desktop. If the pharmacy contracts with a third party to store the records, keep the agreement and confirm the service will return the needed data promptly if the contract ends. Record retention should be coordinated with recall and privacy procedures so product tracing remains available without exposing unnecessary patient information.

Scope and handoff details

Tracing requirements apply to covered prescription drugs, not every product in a pharmacy. FDA FAQs explain that certain categories are excluded or treated differently, including some medical gas, blood products, and products compounded under section 503A or 503B; exact scope depends on the statutory definitions and transaction. Do not decide that an entire supplier shipment is exempt because one item is. Maintain a process to identify covered products and ask the compliance lead about edge cases. The pharmacy should also distinguish DSCSA tracing records from controlled-substance invoices, purchase orders, temperature records, and patient records. They may be linked during an investigation, but their retention periods and access controls can differ.

Points to carry into practice

• Check the current FDA or DEA source and the pharmacy SOP for the exact requirement.
• Hold and escalate an unresolved discrepancy instead of guessing or bypassing a control.