Michelle Korpela,PharmD, Director Clinical & Compliance Services, Morris & Dickson 

The Drug Supply Chain Security Act (DSCSA) represents more than a decade of work to strengthen the safety and security of the nation’s prescription drug supply. It was designed to protect patients from counterfeit, stolen, diverted, or illegitimate medications. This federal law creates an interoperable system to allow prescription drugs to be traced electronically through the supply chain from manufacturer to distributor to dispenser. 

Although full implementation was originally scheduled to occur after a ten-year rollout, the FDA recognized that portions of the industry needed additional time and pivoted to a phased enforcement. Most trading partners have already implemented their requirements, but the final compliance deadline is quickly approaching for small dispensers. 

As of November 27, 2026, pharmacies that are considered small dispensers must comply with the final electronic tracing requirements of DSCSA. While previous enforcement delays caused some pharmacies to postpone preparations, no addition extensions have been announced. Independent pharmacies should use the coming months to ensure their systems, documentation, and staff are prepared before the final deadline arrives. 

Fortunately, much of the groundwork has already been laid by manufacturers and distributors. For most independent pharmacies, the remaining steps are manageable with some thoughtful planning and well-documented procedures. 

Who is a Small Dispenser? 

Small dispensers are pharmacies who have 25 or fewer full-time licensed employees. Employee count is determined across all pharmacies operating under the same corporate ownership, not by the individual store location. Large dispensers who employ 26 or more pharmacists and technicians had to meet all requirements by November 27, 2025.  

There is no formal process by which a pharmacy needs to notify a governing body that they consider themself to be a small dispenser. It’s up to the individual pharmacy to generate their own conclusion as to whether they are a small or large dispenser. However, the pharmacy should document evidence to support the conclusion that they had 25 or fewer employees as of November 27, 2025 (the day large dispensers were expected to be in compliance). Documentation may include: 

  • Payroll records 
  • Human Resources rosters 
  • IRS forms showing full and part-time employment 
  • Licensure documentation  

Pharmacies should retain this documentation with their other compliance records in the event a regulator asks for evidence to support their determination. 

Understanding the Pharmacy Requirements 

For most independent pharmacies, DSCSA preparedness can be broken down into three primary areas: 

  1. Confirming the pharmacy only works with authorized trading partners 
  1. Receiving and maintaining electronic product tracing information 
  1. Having documented procedures to investigate and respond to suspect or  

illegitimate product 

While these requirements sound extensive, most pharmacies already meet portions of them through normal purchasing and inventory practices. The remaining work mostly involves documenting those procedures while ensuring electronic transactions are received and maintained. 

Trading Partners 

The first step in DSCSA compliance is to ensure every distributor, manufacturer, or pharmacy from which medications are purchased is an authorized trading partner (ATP). Pharmacies should already be purchasing through a licensed wholesaler, but DSCSA requires the pharmacy to verify and document that their suppliers are appropriately licensed and registered. 

To validate a drug distributor is an ATP, the pharmacy should verify the distributor holds a valid license under state law. Distributors are typically required to register in each state they ship products into. This license is often managed by the Board of Pharmacy or a similar body. For at least six years, pharmacies should maintain paper or electronic documentation demonstrating that each trading partner is authorized. This may include copies of state licenses, registration records, or electronic verification obtained from the appropriate licensing body.  

There is more work if pharmacies order products directly from the manufacturer. Some states require these trading partners to be licensed in the state. Manufacturers shipping direct should provide the pharmacy with proof they are an FDA Registered Manufacturer.   

If the pharmacy is ordering controlled substances, they should also get a copy of the trading partner’s DEA Permit and any applicable state controlled substance permit. 

What is Required by November 27, 2026? 

Pharmacies should already be familiar with the requirement that they receive and store product tracing documentation in what was previously known as T3 data (Transaction Information, Transaction History, Transaction Statement). The final stage of DSCSA is the interoperability of electronic data. As of November 27, 2026, ALL pharmacies (both large and small dispensers) will be required to receive serialized electronic transaction (EPCIS) data. Pharmacies should keep regularly updated procedures outlining how their procedures evolve as they are working toward this requirement. 

Global Location Numbers
Before a pharmacy can begin receiving serialized transaction information, it must have an accurate Global Location Number (GLN), which is a Global Standard 1 (GS1) identifier. This number is used to identify trading partners by their location, making it a necessary requirement for DSCSA. At this point, all pharmacies should already have a GLN for their wholesaler to ship any products to the site.  

It is important to understand that a pharmacy’s GLN is attached to their specific location, like an address. If your pharmacy moves down the street, it will be necessary to receive a new GLN to remain in compliance. Pharmacies should ensure their GLN is accurate and complete at this point.  

There may be instances where a wholesaler or buying group enumerated GNLs on behalf of their customers. If a pharmacy finds they have more than one GLN for the same location, they must determine which GLN will be used so the other can be deactivated. Only the entity that enumerated the GLN can request it be deactivated or changed. 

Receiving Electronic Transaction Data 

Beginning November 27, 2026, pharmacies must be capable of receiving serialized EPCIS transaction data for prescription drug products received after the compliance date. Products received by small dispensers before November 27, 2026, are not required to have associated EPCIS data. However, if your pharmacy is a large dispenser, you should already be maintaining EPCIS data for all products at this point. 

EPCIS is the standardized electronic format used throughout the pharmaceutical supply chain to communicate product tracing information. Rather than receiving transaction history through paper documentation or PDFs, pharmacies will receive electronic records associated with serialized product identifiers. 

Importantly, pharmacies are expected to receive and maintain this information, but they are not required to manually reconcile every transaction unless a discrepancy or investigation arises. 

Pharmacies should ensure they have a 2D barcode scanner since all serialized data uses the 2D barcode. During the next ten years, the FDA will transition all products to a new 12-digit NDC. Moving away from the 10-digit NDC will discontinue the need for a 1D barcode. Morris & Dickson has 2D scanners available (item #521880), but any 2D model should work to scan and verify incoming orders. 

Software Solutions 

Many pharmacies assume they are required to purchase new software to comply with DSCSA. In reality, the law does not require pharmacies to use a third-party solution provider. However, many independent pharmacies find these services valuable because they simplify receiving, organizing, and retaining serialized transaction data.  

A solutions provider can help by serving as a central repository, or virtual filing cabinet, for data from trading partners. Instead of retrieving transaction records from several distributor portals, pharmacies can access all records from a single location. 

If a pharmacy purchases from a small number of distributors, this is potentially something the pharmacy staff could manage on their own.  However, if a pharmacy shops around at several different distributors (including for vaccines), works with free drug programs, or sells product to other pharmacies, a software vendor may be beneficial to simplify the workload. 

When evaluating vendors, pharmacies should consider: 

  • How will EPCIS data be received? 
  • How long will records be retained? 
  • Will the system integrate with our current pharmacy software? 
  • How are product investigations handled? 
  • What support is available during implementation? 

Some solutions providers may offer additional services as part of their package. Examples include verification that trading partners are authorized, modules to resolve data discrepancies, integrations with pharmacy software systems to manage inventory and drug recalls, and even tools that assist a pharmacy in filling out the FDA Form 3911 to report suspect product. Solutions providers will maintain the required six years of data, if not longer than the required period. Having a central storage site can also make pulling reports much easier for the pharmacy.  

Some third-party solutions providers to consider: 

  • Cervey – Integration with the Morris & Dickson web portal for simplicity and coordination 
  • LSPedia – Utilized by Morris & Dickson to enable end-to-end serialization and EPCIS data exchange across distribution operations 

If your pharmacy is contemplating a solutions provider, determine which provider will best meet your needs. Some pharmacies can benefit from a more basic module, while others might see benefits to paying more for all the bells and whistles. Either way, pharmacies should begin the onboarding process sooner rather than later.  

Your provider will need to set up data feeds with all trading partners the pharmacy works with. Since the large dispenser deadline is already in place, the solutions provider should already have an active EPCIS feed with most, if not all, of the larger distributors and manufacturers that ship direct to the pharmacy. However, if your pharmacy utilizes a very small secondary distributor, the set-up process may take longer. 

Working with Your Drug Distributors 

Pharmacies should generate a list of contacts for each drug distributor your pharmacy receives product from. Contact names or phone numbers should be included who to contact in various situations, such as when you do not receive transaction data with your order.  

If your pharmacy is not using a solution provider, it is important to document in your procedures how you will communicate with each wholesaler you purchase from. In the event of a regulator request for product information, the distributor cannot respond on the customer’s behalf.  

Pharmacies should also verify that electronic data is successfully flowing before the compliance deadline. Performing a test transaction with each primary distributor can help identify issues while there is still time to correct them. 

Policies and Procedures 

The most important thing a pharmacy can do to prepare is to ensure they have clear policies and procedures documented. All staff should be trained in these policies, and training records retained.  Examples include: 

  • Receiving serialized product  
  • Verifying receipt of EPCIS data  
  • Handling missing transaction data  
  • Investigating suspect product  
  • Quarantining illegitimate product  
  • Responding to FDA or state regulator requests  
  • Product recalls  
  • Employee training  
  • Record retention 

If your pharmacy utilizes a third-party solution vendor, they may have ready-made templates for these types of procedures.  

But simply having written procedures is not enough. Staff members should understand their responsibilities, receive documented training, and know who is responsible for carrying out each aspect of the pharmacy’s DSCSA program. 

Final Readiness 

Pharmacies should strive to be ready several weeks before the November deadline. Perform a mock compliance review to ensure all components of the DSCSA program are functioning as intended. This includes confirming that EPCIS files are being received, trading partner documentation is current, policies have been updated, and staff understand how to respond if transaction information is missing or suspect product is identified. 

Addressing problems before the deadline will be far easier than attempting to resolve them during an inspection or product investigation. 

Conclusion 

While DSCSA has been more than a decade in the making, the final steps for independent pharmacies are far less intimidating that most owners expect. By verifying trading partners, confirming EPCIS data is receivable and accessible, documenting clear policies and procedures, and training staff, pharmacies can confidently meet the November 27, 2026 deadline. 

Waiting to prepare until the final weeks could create unnecessary problems, particularly if changes to software, data connections, or workflows are needed. Starting now gives pharmacies time to test their systems, resolve issues, and be compliant before enforcement begins. 

For more information, check out the “DSCSA Readiness for Small Dispensers: GLNs, SOPs, and Practical Next Steps,” a webinar from Cervey and Morris & Dickson. https://www.youtube.com/watch?v=LcILpHzG8OQ.

References: 

  1. U.S. Food and Drug Administration. (n.d.). Drug Supply Chain Security Act (DSCSA). https://www.fda.gov/drugs/drug-supply-chain-integrity/drug-supply-chain-security-act-dscsa 

Customers should not rely on this information as legal or other professional advice.