Enacted in 2013, the Drug Supply Chain Security Act (DSCSA) remains relatively unknown among pharmacists and pharmacy owners. However, DSCSA compliance is critically important, as non-compliance can lead to significant consequences in DEA audits and investigations.
The Drug Supply Chain Security Act (DSCSA) is a federal law that Congress enacted in 2013 in an effort to protect patients against the risks associated with counterfeit prescription medications. At the time the DSCSA was enacted, this was viewed as a significant concern; and, while other priorities have consumed federal resources in the area of prescription drug compliance in recent years, enforcement activity under the DSCSA remains high.
In particular, the U.S. Drug Enforcement Administration (DEA) and the U.S. Food and Drug Administration (FDA) have been focusing on pharmacies’ compliance obligations under the DSCSA. While the statute applies to commercial parties at all stages of the prescription drug lifecycle – from manufacturing to distribution – pharmacies have received particular attention since they are considered the last line of defense for counterfeit medications making their way into patients’ hands. As a result, pharmacists and pharmacy owners need to be aware of their obligations, and they must adopt policies, procedures, and protocols designed to ensure strict DSCSA compliance.
What are Pharmacies’ Legal Obligations Under the DSCSA?
The DSCSA imposes numerous compliance obligations for pharmacies of all sizes and in all specialties. To begin, the FDA breaks pharmacies’ primary obligations down into three categories: prevention, detection, and response. Specifically, the FDA advises that pharmacies should:
Prevent: Confirm that All “Trading Partners” are Licensed or Registered, and Avoid Doing Business with Unlicensed and Unregistered Parties
“To help determine whether trading partners [with which pharmacies transact business] (manufacturing, repackagers, wholesale distributors, third-party logistics providers, and pharmacies) are licensed or registered,” pharmacies should:
- Check manufacturers’ and repackagers’ registrations with the FDA;
- Check wholesale distributors’ and third-party logistics providers’ licenses with the FDA; and,
- Check other pharmacies’ licenses with their state licensing boards.
Detect: Collect Pharmaceutical Drug Tracing Documentation in Order to Identify Any Counterfeit Medications
“The law requires drugs to be traced as they move through the supply chain, and pharmacies must:
- “Only accept prescription drugs that are accompanied by three pieces of product tracing documentation – transaction information, transaction history, and transaction statement. . . ;
- “Store the product tracing documentation you receive in paper or electronic format for six years[; and,]
- “Generate and provide all product tracing documentation with the transaction if [pharmacies] sell . . . prescription drug[s] to . . . trading partner[s].”
Respond: Investigate Suspicious Medications and Handle All Counterfeit (or Otherwise Illicit) Prescription Drugs Appropriately
“Pharmacies must have a process to investigate and handle suspect and illegitimate prescription drugs, which includes drugs that may be or have evidence that it is counterfeit, diverted, stolen, intentionally adulterated, or unfit for distribution.” This process must include, at a minimum:
- Quarantine and inspection of suspect medications in order to assess their legitimacy;
- Working with manufacturers to, “take specific steps to ensure patients to not receive . . . illegitimate drugs;” and,
- Notifying the FDA and any trading partners from which illegitimate medications were purchased or to which illegitimate medications were sold.
While these steps may all seem fairly straightforward in isolation, combined they can present significant compliance burdens for pharmacies—particularly when you consider that these steps must be taken with respect to all medications dispensed on an ongoing basis. As a result, pharmacies need to put appropriate systems in place, and they must adopt policies and procedures designed to ensure that these systems are operating effectively at all times.
What is Required to Implement an Effective DSCSA Compliance Program and Avoid DEA Scrutiny?
With these legal requirements in mind (and keeping in mind that this is not exclusive of pharmacies’ obligations under the DSCSA), what can pharmacists and pharmacy owners do to establish and maintain compliance? As always, pharmacies’ compliance programs must be custom-tailored to their specific operational risks. Generally speaking, however, the core components of DSCSA compliance will generally include:
1. Routine Registration and Licensing Confirmations
Under the DSCSA, pharmacies must have protocols in place to confirm that all relevant third parties have the requisite registrations and licenses. This information is readily available from the FDA and other sources, and the FDA and DEA expect pharmacies to make use of the tools they have at their disposal. Once confirmed, current registrations and licenses should be documented, and pharmacies should maintain logs that they can provide to the FDA or DEA when necessary.
2. Review of Received Prescription Medications for Tracing Information
Upon receiving new medication shipments, pharmacies must promptly inspect the shipments to confirm that they include the required tracing information. This includes the “3Ts”: transaction information (TI), transaction history (TH), and transaction statement (TS). If any of this tracing information is missing, the pharmacy should follow documented policies and procedures for quarantining and rejecting the medication as well as providing the required notices to the FDA and other parties.
3. Generation of Tracing Information When Selling Prescription Medications to Trading Partners
When selling prescription medications to trading partners, pharmacies must update medications’ tracing information prior to transmission. This applies to all sales other than those directly to patients or to other pharmacies to fill specific patient needs. This added tracing information must be fully compliant, and pharmacies should have mechanisms for maintaining internal documentation of all tracing information they add to sold medications.
4. Documentation of Communications with Trading Partners
When communicating with trading partners with regard to questions about tracing data or concerns about the legitimacy of prescription drugs, pharmacies should ensure that all communications are thoroughly documented and that records of these communications are kept on file. In the event of a DEA audit or inspection pertaining to an illegitimate medication, these records could be essential to demonstrating that the pharmacy took the necessary steps to meet its obligations under the DSCSA.
5. Record Retention for Tracing Information
In addition to maintaining records of generated tracing information and communications with trading partners, pharmacies must also retain records of all tracing information they receive from their trading partners as well. Under the DSCSA, these records must be maintained for a minimum of six years. Either electronic or hardcopy storage is permissible. While simply establishing retention protocols is a good first step, pharmacy owners will also want to ensure that their storage protocols allow for efficient retrieval in the event of a DEA inquiry.
6. Standard Procedures for Quarantine and Inspection of Suspect Prescription Medications to Determine Legitimacy
In addition to confirming the existence of licensing, registration, and tracing information, upon receiving new medications pharmacies must also follow appropriate quarantine and inspection procedures for suspect drugs. This begins with establishing internal policies and procedures for determining when a shipment is “suspect,” and continues through making a final determination as to whether the medication is legitimate or may be counterfeit, diverted, stolen, intentionally adulterated, or otherwise “unfit for distribution.”
7. Documentation of Quarantine and Inspection Results
Thoroughly documenting all quarantine and inspection efforts is also necessary. Even if a pharmacy follows compliant quarantine and inspection procedures, if it cannot prove that its efforts are (and have been) compliant, it will be at risk in the event that the DEA initiates an audit or inspection targeting potential violations of the DSCSA. Thorough documentation is the hallmark of an effective compliance program, and this applies with respect to all aspects of pharmacies’ compliance efforts under the DSCSA and other statutes.
8. Automated Notifications or Standard Procedures for Providing Required Notices
In the event that a pharmacy identifies a suspect or illegitimate prescription medication, it must promptly provide notice to the appropriate party or parties. In order to ensure that appropriate notice is delivered on time every time, pharmacies must adopt automated internal notification protocols or other standardized procedures that ensure the appropriate personnel are reminded of their reporting obligations.
9. Standard Procedures for Removing Illegitimate Medications from the Supply Chain
In addition to providing the requisite notice, pharmacies must also assist in removing illegitimate medications from the supply chain. What is necessary in any particular circumstance will depend on the nature of the issue, the trading partner(s) involved, and various other factors. Among all of the various obligations imposed upon pharmacies under the DSCSA, failing to comply with this obligation presents one of the greatest risks for pharmacies targeted by the DEA.
10. Protocols for Responding to DEA Inquiries
Finally, due to the very real risk of facing a DEA audit or inspection, pharmacies should have protocols in place for responding to inquiries from DEA agents. While an inquiry should trigger action internally, it should also trigger immediate engagement of outside defense counsel. At Oberheiden P.C., our federal pharmacy lawyers and consultants have extensive experience in all aspects of pharmacy compliance and defense, and we can work with you to make sure your pharmacy is protected.
Contact the Pharmacy Compliance Lawyers and Consultants at Oberheiden P.C.
Do you have questions about your pharmacy’s compliance obligations under the DSCSA? If so, we encourage you to schedule a complimentary initial consultation with a federal pharmacy compliance attorney at Oberheiden P.C. To arrange an appointment as soon as possible, call us at 888-680-1745 or tell us how we can help online today.
