Navigating Pharmaceutical Supply Chain Security

The Drug Supply Chain Security Act (DSCSA), signed into law on November 27, 2013, outlines steps to achieve interoperable, electronic tracing of products at the package level to identify and trace certain prescription drugs as they are distributed in the United States. These requirements enhance the Food and Drug Administration’s (FDA) ability to help protect consumers from exposure to drugs that may be counterfeit, stolen, contaminated or otherwise harmful. Implementing these requirements also improves the detection and removal of potentially dangerous drugs from the drug supply chain to protect U.S. consumers.

For eligible trading partners that meet the conditions of the FDA’s Oct. 9, 2024, exemption, these trading partners are exempt from certain DSCSA requirements until the following dates:

• For manufacturers and repackagers, May 27, 2025.
• For wholesale distributors, Aug. 27, 2025.
• For dispensers with 26 or more pharmacists and technicians, Nov. 27, 2025.
• Dispensers with 25 or fewer pharmacists and technicians were previously exempted until Nov. 2026. Here is the link to the full FDA exemption announcement for small dispensers.

The DSCSA Stabilization Period has been in place since Nov. 27, 2023, and will end on Nov. 27, 2024. Through its Oct. 9, 2024, publication, FDA granted additional time, in phases, across the supply chain to eligible trading partners subject to the conditions outlined in that document to exchange complete and accurate serial DSCSA transaction data.

In addition, customers may opt-in to have the data transmitted daily to the customer in-house or third-party DSCSA repository to store on their behalf.

During the wholesale distributor FDA exemption period, all DSCSA Transaction Information for in-scope products will continue to be shared in a lot-based format and, as it is made available, in a serial-based format. On Aug. 27, 2025, the current Lot-based Transaction History will be sunset and serialized product identifier information for in-scope products will be added to the DSCSA Transaction Information.

McKesson distributors will use the FDA recommended Electronic Product Code Information Services (EPCIS) standard to provide and maintain the data associated with Transaction Information and Transaction Statements.

Yes, McKesson’s distribution businesses intend to make use of the FDA’s Oct. 9, 2024, exemption for wholesale distributors in accordance with the criteria and conditions of that exemption. The “FDA Grants Exemptions from Certain DSCSA Requirements” letter sent in November 2024, serves as notice to our customer trading partners of this intention. This document can be accessed on the DSCSA page within your ordering portal.

• Products will be identified by a Global Trade Identification Number (GTIN).
• Trading partners will be identified by a Global Location Number (GLN).

The FDA’s Oct. 9, 2024, Exemption for Wholesale Distributors states, in part:

• 582(g)(1)(A) “that the transaction information and the transaction statements be exchanged in a secure, interoperable, electronic manner…”
• 582(g)(1)(B) “that the transaction information required to be exchanged include the product identifier (e.g., the National Drug Code, serial number, lot number, and expiration date) at the package level for each package included in the transaction.”
• 582(g)(1)(C) “that systems and processes for verification of product at the package level, including the standardized numerical identifier, be in accordance with the standards established under the guidance issued…”
• 582(g)(1)(D) “for systems and processes necessary to promptly respond with the transaction information and transaction statement for a product upon a request by the Secretary, or other appropriate Federal or State official.”
• 582(g)(1)(E)) “for systems and processes necessary to promptly facilitate gathering the information necessary to produce the transaction information for each transaction going back to the manufacturer…”
• 582(g)(1)(F) “that each person accepting a saleable return have systems and processes in place to allow acceptance of such product and may accept saleable returns only if such person can associate the saleable return product with the transaction information and transaction statement for the product.”
• 582(c)(4)(D) “to verify the product identifier, including the standardized numerical identifier, upon receipt of saleable returned product prior to further distribution.”

McKesson is in the process of gathering the GLNs for our customers and loading them into our systems. Establishing and submitting GLN number(s) is imperative to continue to conduct business throughout the supply chain.

A GLN is required before a customer can begin receiving serialized DSCSA transaction Information.

McKesson’s distribution businesses have begun receiving complete and accurate serialized DSCSA transaction data for the majority of DSCSA product purchases from manufacturers and repackagers as of May 27, 2025.

McKesson’s distribution businesses expect to provide complete and accurate serial DSCSA transaction data for all DSCSA product sales to their customers by Aug. 27, 2025.

McKesson’s distribution businesses expect to implement the DSCSA requirements for saleable returns for all DSCSA-eligible product on Aug. 27, 2025.

While large dispensers (26 or more pharmacists/technicians) have an exemption from certain DSCSA serialization requirements until Nov. 27, 2025, and small dispensers (25 or less pharmacists/technicians) have an exemption from certain DSCSA serialization requirements until Nov. 27, 2026, the DSCSA requirements for distributors for saleable returns becomes effective on Aug. 27, 2025.

GS1 (Global Standard 1) standard identifiers will be used for product and party/location identification in the interoperable electronic exchange. Products will be identified by Global Trade Identification Number(s) (GTIN). Trading partners will be identified by Global Location Number(s) (GLN).

In-scope DSCSA product will continue to have NDC numbers. The GTIN includes the NDC.

DSCSA requirements do not apply to nonprescription drugs (over-the-counter drugs) or animal drugs (drugs subject to section 512 of the FD&C Act). Drugs that fall under the DSCSA requirements are defined by the FD&C Act. Product tracing, product identifier, authorized trading partner, and verification requirements in Section 582 of the FD&C Act apply to product as defined by Section 581(13) of this Act. Product means "a prescription drug in finished dosage form for administration to a patient without substantial further manufacturing (such as capsules, tablets, and lyophilized products before reconstitution)."

The section 582 requirements do not apply to:

• Blood or blood components intended for transfusion
• Radioactive drugs or biologic products
• Imaging drugs
• Certain intravenous (IV) products
• Medical gases
• Certain homeopathic drugs
• Lawfully compounded drugs
• There are also exclusions, refer to the definition of transaction noted in section 581(24) of the FD&C Act. This list of in-scope DSCSA drugs is dynamic and is subject to change.

This information is available on the item product page of all McKesson ordering portals.

Prior to the customer’s respective serialization DSCSA effective date, customers should make changes, including but not limited to the following:

• All customers (dispensers, health systems, pharmacies, etc.) should be prepared to respond directly to regulators if asked about tracing information for DSCSA products they have purchased. McKesson cannot respond to regulators on the customer’s behalf.
• All trading partners, including dispensers, are expected to be able to search the repositories where their serial DSCSA transaction information and transaction statements are stored and retrieve the requested information upon request.
  • DSCSA transaction data will be accessible through McKesson portals or in the customer’s in-house or third-party system if the customer requested this information to be transferred to such system. A link to this data will be added to the portals once this feature goes live.
• All trading partners will need to check the serialization number before making a return of a DSCSA product to McKesson to ensure that they purchased the serial product identifier on the product in question from McKesson before initiating the return.
• Product returns where McKesson is unable to verify or associate the product cannot be accepted for saleable return under the DSCSA.
• Dispensers should continue to perform suspect product reviews and investigations as they have since 2015. Use of the DSCSA transaction data may be necessary when conducting suspect product investigations.
• McKesson will provide training to support education efforts to help enable implementation of the DSCSA’s requirements.

*Customers should not rely on this information as legal or other professional advice with respect to the customer’s DSCSA obligations.

McKesson Third Party Logistics (3PL) offers an End-to-End DSCSA Solution, Integrated Scanning Solution and additional DSCSA Support Services. Below is a brief overview of these solutions. For more information, please reach out to 3PLdscsainquiries@mckesson.com.

• End-to-End DSCSA Solution – This solution is backed by our deep industry expertise and best-in-class Advanced Track and Trace (ATTP) platform by SAP. When enrolled in this solution, customers can enjoy the simplicity of having all DSCSA-related activities housed with one partner.
• Integrated Scanning Solution – For clients that choose to use an outside vendor for their DSCSA repository, we offer a solution that seamlessly integrates transaction data taking place within our facilities into our customers’ systems.
• Additional DSCSA Support Services – We offer additional services that can allow our customers to customize any of our DSCSA solutions or support their unique needs. Our additional services include:
  • Identify or assign missing customer GLNs
  • Product authentication inquiry support
  • Suspect product investigations
  • Support for 3911 filing with the FDA for illegitimate product
  • Trading partner license status check
  • Support for migrating from third-party repository to McKesson ATTP repository
  • Exception handling from a dedicated team