DSCSA Pedigree Requirements 2026 — What Pharmacies Actually Need to Capture

Why DSCSA quietly became the most expensive compliance gap in US pharmacy

The Drug Supply Chain Security Act has been on the books since 2013, but enforcement teeth — particularly for the lot-level transaction-data exchange that took effect November 2024 — are now sharp. Independent pharmacies that have been getting by on paper invoices, PDF transaction histories, and "we'll find it if we need to" spreadsheets are running out of runway. And the cost of a DSCSA gap usually shows up at the worst moment: during a recall, during an FDA inspection, or when a wholesaler audit asks you to produce TI / TH / TS records on a randomly selected lot from 18 months ago.

This post is the no-nonsense version of what DSCSA actually requires you to capture, where the typical pharmacy is falling short, and the cheapest path to compliant.

The three records DSCSA requires for every prescription product transaction

For each prescription drug product you receive, you must capture and retain three documents:

Transaction Information (TI). The product description, strength, dosage form, NDC, container size, number of containers, lot number, transaction date, and shipping date. Plus the seller's name and address and your name and address.

Transaction History (TH). A statement (typically a sentence in the document) that the prior transaction histories are included or available — establishing the chain of custody from manufacturer through every distributor.

Transaction Statement (TS). A statement from the seller affirming compliance with DSCSA — confirming they have the systems and procedures in place, did not knowingly provide false information, did not accept ownership without TI/TH/TS, and complied with verification requirements.

These three documents must be retained for six years from the date of the transaction. On request from FDA or state regulators, you must be able to produce them within a defined response window (the rule says "as soon as practicable" but state boards typically interpret this as 24-48 hours).

What the typical independent pharmacy is doing — and why it falls short

The typical workflow: PDFs land in an email inbox or get accessed through the wholesaler's portal. Staff don't open them unless something goes wrong. Six months later, when an inspector asks for the TI/TH/TS for lot #123ABC of a specific NDC received in March, the staff member spends two hours hunting through email and the wholesaler portal trying to find it.

The DSCSA gap isn't that the records don't exist — wholesalers are good about generating them. The gap is that the records aren't tied to your inventory system at the lot level. So when something happens to that lot — a recall, a complaint, an FDA records request — you can't quickly find which units of which prescriptions came from that lot, when you received them, who you dispensed to, and what the chain of custody before you was.

What "DSCSA-ready" actually means in practice

A pharmacy that's genuinely DSCSA-ready can answer all of the following in under 60 seconds without leaving their inventory system:

• For lot #X of NDC Y, what was the TI / TH / TS we received with it?
• When did we receive that lot, from which wholesaler, and what was the invoice number?
• How many units of that lot did we dispense, and to which patient prescriptions?
• How many units do we still have on shelf?
• What's the chain of custody behind that lot before it reached us?

If your current system can't do that in 60 seconds, you have a DSCSA gap. The gap may not bite this quarter or next, but it will bite — and the bite usually comes during a recall when you're under time pressure.

The five things to fix this month

1. Capture the lot number at receiving, every time, no exceptions. Whether your wholesaler provides EDI 856 ASN files, paper packing slips, or PDF invoices, the lot needs to land in your inventory system tied to the specific units of that NDC. If your current process is "we'll add the lot number if we remember to," you're not DSCSA-ready.

2. Store TI / TH / TS documents tied to the lot. A folder of PDFs in Dropbox doesn't count. The documents need to be linked to the specific lot in your inventory system so you can pull them up by querying the lot, not by searching email.

3. Verify the seller's statements. DSCSA requires you to verify the TI/TH/TS isn't from a suspect product source. In practice this means: don't accept product from unauthorized trading partners. Maintain a list of authorized wholesalers and reject anything outside that list.

4. Tie dispensing back to lot. When a unit is dispensed, your system should record which lot it came from. This is the link that makes recall response work — without it, you can't tell which patients got the recalled lot.

5. Test the recall workflow before you need it. Pick a random lot you received 6 months ago. Time how long it takes you to produce a complete record: TI/TH/TS, units received, units dispensed, units in stock, prescription IDs. If it takes longer than 30 minutes, the workflow needs work.

The exception list — products NOT subject to DSCSA

Not every product moves under DSCSA. Excluded categories include:

• Blood and blood components for transfusion
• Radioactive drugs
• Imaging drugs (specific list)
• Intravenous products for fluid / electrolyte replenishment
• Medical gases
• Most homeopathic drugs
• Compounded drugs (subject to other rules)
• OTC drugs (subject to other rules)

The vast majority of prescription products — including all controlled substances, biologics, and most specialty drugs — are subject to DSCSA. Don't assume exclusion.

How serialization changes the calculus

The 2024 DSCSA enhanced drug distribution security requirements added serialized lot data to the chain of custody. In practice this means that for the products covered, the unit-level serialized data (in the 2D barcode on each package) needs to flow through the chain along with the lot-level TI/TH/TS. This adds operational complexity at receiving — you need to scan the unit-level barcodes and verify them against the EPCIS file the wholesaler sent.

For most independent pharmacies, the serialization piece is manageable if your inventory system supports the 2D barcode scanning workflow. If you're using a system that was built before 2018, it probably doesn't.

What an FDA records request actually looks like

FDA records requests under DSCSA typically arrive by email or letter. They name a specific NDC and lot, ask for the TI/TH/TS for the entire chain of custody back to the manufacturer, and give you a deadline (usually 24-48 hours). They sometimes also ask for downstream — units dispensed, patient prescription IDs, customer notification logs.

A pharmacy that's DSCSA-ready produces this in 15-30 minutes. A pharmacy that isn't spends 8-16 hours hunting, often with the owner pulled off other work, often with a panicked call to the wholesaler asking for documents that should have been on file. The gap shows up as inspection finding, manual write-up, occasional warning letter, and (in egregious cases) loss of authorisation to receive product from licensed wholesalers — which is a slow-motion business-ending event.

Where ShelfLifePro fits

ShelfLifePro captures lot at receiving (manually or via Invoice OCR), stores TI/TH/TS documents linked to the lot, ties dispensing to the originating lot, and produces FDA-ready records on demand. The recall workflow is one click. We built this for independent pharmacies who don't have the staff time to run a separate compliance system on top of their dispensing software.

Start a free 14-day trial — we'll import your current inventory and you can run a recall-readiness drill on day one to see exactly where the gap is.

Related reading

• FSMA 204 — what US grocers and distributors actually need now
• FDA Product Recall — the first 24 hours, hour by hour
• How indie pharmacies beat CVS on waste — 2% vs 7%
• Long-term care pharmacy emergency kit inventory