DSCSA Record Retention for Dispensers: The Six-Year Rule

The short answer

Six years. That's the number you came for, and it comes straight from the statute.

Under the Federal Food, Drug, and Cosmetic Act, section 582(d), a dispenser has to capture the transaction information, transaction history, and transaction statement for the product it buys, and keep them for not less than six years after the transaction. The clock starts at the transaction date, not when you dispense the last bottle and not when the product expires.

The rest of this post covers what actually counts as "the records," what form they can take, and what happens when someone asks to see them. That last part is where pharmacies get caught out, because keeping a record and being able to find it fast aren't the same thing.

What the six years actually covers

DSCSA talks about three documents, often called the "three Ts." Section 581 of the FD&C Act defines them, and section 582(d) is what makes a dispenser keep them:

• Transaction information (TI): product name, strength, dosage form, NDC, container size, number of containers, lot number, transaction date, shipment date, and the names and addresses of the seller and buyer.
• Transaction history (TH): the trail of prior transactions back to the manufacturer. For transactions after the enhanced requirements kicked in, the Act lets TI do most of this work.
• Transaction statement (TS): the trading partner's attestation that they're authorized, got the product from an authorized partner, didn't knowingly ship suspect or illegitimate product, and so on.

Then there's a fourth category people forget. Section 582(d)(4) says that when a dispenser investigates suspect product or deals with illegitimate product, it keeps the records of that investigation and the disposition. Those also run for at least six years, but the clock starts after the investigation or disposition wraps up, not at the original purchase.

If you want the full picture of what DSCSA asks of a pharmacy beyond retention, the DSCSA compliance checklist for independent pharmacies walks through each obligation in order.

Working out the end date

The arithmetic is simple. The trouble is that every invoice has its own end date, so your records are always expiring on a rolling basis.

For example, picture three deliveries to a typical independent pharmacy:

• A wholesaler shipment with a transaction date of March 14, 2025 must be kept until at least March 14, 2031.
• A secondary-source purchase dated November 2, 2025 runs to at least November 2, 2031.
• A suspect-product investigation that opens in January 2026 and closes in April 2026 runs to at least April 2032, counted from the close.

The safe habit is to never shred by "year folder" in a hurry. Purge only after the latest date in that batch has passed six full years, and if anything in the folder is tied to an open investigation, a recall, or a dispute, leave the whole folder alone.

Paper or electronic

Section 582(d) of the FD&C Act lets dispensers keep these records electronically, and the Act also allows the TI and TS to arrive in paper or electronic form under the original requirements. Nothing in the retention clause demands a filing cabinet.

The direction of travel is clearly electronic, though. Section 582(g) sets out the enhanced drug distribution security requirements: TI and TS exchanged in a secure, interoperable electronic way at the package level. Once those apply to you, the data shows up as electronic records (EPCIS files, typically sent through a portal or network). Printing them out isn't keeping them in any useful sense, because you lose the package-level detail you'd need to answer a trace request. If you're curious what's actually inside one of those files, the explainer on what an EPCIS shipping event contains breaks it down field by field.

When the enhanced requirements bite depends on your size and on FDA's exemption timelines, which have moved more than once. The post on the DSCSA small dispenser exemption covers who qualifies and when.

Letting your wholesaler hold the records

You don't have to host six years of data yourself. Section 582(d) of the FD&C Act lets a dispenser sign a written agreement with a third party, including an authorized wholesale distributor, to keep the records confidentially on its behalf.

This is how a lot of pharmacies handle it in practice: the wholesaler's portal is the archive. That's fine, but read the agreement with three questions in mind:

• Does it say six years in writing? A portal that rolls off data after a shorter period doesn't meet the statute, whatever the sales rep says.
• What happens if you switch wholesalers? You still need records for transactions with the old one. Get an export before the account closes.
• Does it cover secondary suppliers? Your primary wholesaler's portal won't hold transactions from anyone else. Those need their own home.

Producing records on request

Retention only matters because someone may ask. Under section 582(d) of the FD&C Act, when FDA or another appropriate federal or state official asks during a recall, or to investigate suspect or illegitimate product, the dispenser has to provide the relevant TI, TH, and TS. The Act sets the window at no more than two business days, or another reasonable time the official sets.

Two business days goes fast if your records are in a box in the back room or spread across three supplier portals with three logins nobody remembers. Say a request names one lot of one product. Here's the drill you want to be able to run:

• Search by NDC and lot, not by invoice number. The request won't give you your invoice numbers.
• Pull the TI, TS, and any TH for every transaction involving that lot.
• Check whether any of that lot is still on the shelf, and quarantine it if the request involves suspect product.
• Send the documents and keep a note of what you sent and when.

If step 1 means going through paper by hand, practice it once on a random lot before anyone asks for real. You'll find out how long it actually takes.

How this sits next to other retention rules

DSCSA isn't the only retention clock running in a pharmacy, and the clocks don't line up. DEA's rule at 21 CFR 1304.04(a) requires controlled substance records to be kept for at least two years, for example, and your state board of pharmacy will have its own rules for prescriptions and purchase records.

The practical takeaway: when two rules cover the same document, keep it for whichever period is longer. A controlled-substance invoice that also carries DSCSA transaction data gets six years, not two. Your state board's inspection list is worth checking against this too. The state board of pharmacy inspection checklist is a good place to start.

A simple retention setup

Software or not, a workable setup needs four things:

• One index. A list or spreadsheet that maps every supplier to where its DSCSA records live: which portal, which drawer, which login.
• Lot-level searchability. If the records only file by invoice date, add NDC and lot to your index as invoices come in.
• A purge rule written down. "Nothing destroyed until six years past the latest transaction date in the batch, and never while tied to an open investigation or recall."
• A yearly drill. Pick a lot at random and time how long it takes to pull its full paperwork.

A paper system can meet the six-year rule just fine. Where it struggles is the two-business-day retrieval once you're buying from several sources, and once package-level electronic data becomes part of the record.

Where stock records come in

DSCSA retention is about proving where product came from. The day-to-day job of knowing which lots are on your shelf, and which are getting close to expiry, sits right next to it. Being able to find a lot fast helps with both. ShelfLifePro serves independent pharmacies with batch and expiry tracking, and if you'd like to see whether it fits how your shop works, there's a 14-day free trial, no credit card required.