DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs Guidance for Industry U.S. Department of Health and Human Services Food and Drug Administration Center for Drug Evaluation and Research (CDER) Center for Biologics Evaluation and Research (CBER) Office of Regulatory Affairs (ORA) September 2023 Administrative/Procedural DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs Guidance for Industry Additional copies are available from: Office of Communications, Division of Drug Information Center for Drug Evaluation and Research Food and Drug Administration 10001 New Hampshire Ave., Hillandale Bldg., 4th Floor Silver Spring, MD 20993-0002 Phone: 855-543-3784 or 301-796-3400; Fax: 301-431-6353; Email: druginfo@fda.hhs.gov https://www.fda.gov/drugs/guidance-compliance-regulatory-information/guidances-drugs and/or Office of Communication, Outreach and Development Center for Biologics Evaluation and Research Food and Drug Administration 10903 New Hampshire Ave., Bldg. 71, Room 3128 Silver Spring, MD 20993-0002 Phone: 800-835-4709 or 240-402-8010; Email: ocod@fda.hhs.gov https://www.fda.gov/vaccines-blood-biologics/guidance-compliance-regulatory-information-biologics/biologics-guidances U.S. Department of Health and Human Services Food and Drug Administration Center for Drug Evaluation and Research (CDER) Center for Biologics Evaluation and Research (CBER) Office of Regulatory Affairs (ORA) September 2023 Administrative/Procedural Contains Nonbinding Recommendations TABLE OF CONTENTS I. INTRODUCTION............................................................................................................. 1 II. BACKGROUND ............................................................................................................... 2 III. TO WHOM DOES THIS GUIDANCE APPLY? .......................................................... 3 IV. WHAT PRODUCTS DOES THIS GUIDANCE ADDRESS? ...................................... 3 V. WHAT TRANSACTIONS DOES THIS GUIDANCE ADDRESS? ............................ 3 VI. WHAT DOES INTEROPERABILITY ENCOMPASS FOR PURPOSES OF THE INITIAL STANDARDS FOR THE EXCHANGE OF TRACING INFORMATION UNDER SECTION 582(A)(2)(A)?................................................................................... 4 VII. WHAT DOES INTEROPERABILITY ENCOMPASS FOR THE PURPOSE OF ENHANCED DRUG DISTRIBUTION SECURITY UNDER SECTION 582(G)(1)? 4 VIII. WHAT STANDARDS SHOULD TRADING PARTNERS ADOPT FOR THE ENHANCED DRUG DISTRIBUTION SECURITY REQUIREMENTS? ................. 6 IX. BUILDING TECHNOLOGICAL APPROACHES TO COMPLY WITH ENHANCED DRUG DISTRIBUTION SECURITY REQUIREMENTS ................... 6 Contains Nonbinding Recommendations DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs Guidance for Industry1 This guidance represents the current thinking of the Food and Drug Administration (FDA or Agency) on this topic. It does not establish any rights for any person and is not binding on FDA or the public. You can use an alternative approach if it satisfies the requirements of the applicable statutes and regulations. To discuss an alternative approach, contact the FDA office responsible for this guidance as listed on the title page. I. INTRODUCTION This guidance identifies the standards necessary to facilitate adoption of secure, interoperable, electronic data exchange among the pharmaceutical distribution supply chain, and clarifies the trading partners, 2 products, 3 and transactions 4 subject to such standards. This guidance is issued subject to sections 582(h)(4)-(5) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) (21 U.S.C. 360eee-1(h)(4)-(5)), as added by the Drug Supply Chain Security Act (DSCSA) (Title II of Public Law 113-54). In November 2014, FDA issued a draft guidance for industry, titled DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs: How to Exchange Product Tracing Information, as required by section 582(a)(2)(A) of the FD&C Act. In July 2022, FDA issued a revised draft guidance for industry, titled DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs, that updated the policies articulated in the 2014 draft guidance. 1 This guidance has been prepared by the Office of Compliance in the Center for Drug Evaluation and Research (CDER) in cooperation with the Center for Biologics Evaluation and Research (CBER) and the Office of Regulatory Affairs (ORA) at the Food and Drug Administration. 2 Trading partner is defined in section 581(23) of the FD&C Act. Although third-party logistics providers are also considered trading partners under section 581(23)(B), the provisions of sections 582(b)-(e) do not impose requirements on them. 3 Product is defined in section 581(13) of the FD&C Act. 4 Transaction is defined in section 581(24) of the FD&C Act. 1 Contains Nonbinding Recommendations This guidance finalizes the policies articulated in the July 2022 revised draft guidance to reflect the enhanced drug distribution security requirements in section 582(g)(1) of the FD&C Act that will go into effect on November 27, 2023, 5 including that only electronic methods of product tracing will be permitted and verification of product at the package level will be required, unless a waiver, exception, or exemption applies. It also makes certain changes to improve clarity. In general, FDA's guidance documents do not establish legally enforceable responsibilities. Instead, guidances describe the Agency's current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited. The use of the word should in Agency guidances means that something is suggested or recommended, but not required. II. BACKGROUND The DSCSA outlines requirements for enhanced drug distribution security, which include the steps to achieve interoperable, electronic tracing of products at the package level. 6 These requirements for enhanced drug distribution security go into effect on November 27, 2023. Section 582(g)(1) of the FD&C Act sets forth enhanced drug distribution security requirements for trading partners, including adherence to standards established by FDA for the exchange of transaction information and transaction statements 7 in a secure, interoperable, electronic manner and the verification 8 of product at the package level. Additionally, section 582(h)(4)(A) of the FD&C Act specifies that FDA issue a draft guidance, revise the draft guidance as appropriate, and finalize the guidance to identify and make recommendations with respect to the standards necessary for adoption to support the secure, interoperable, electronic exchange of data among the pharmaceutical distribution supply chain that comply with a form and format developed by a widely recognized international standards development organization. In this guidance, FDA considered the standards established under sections 505D of the FD&C Act (21 U.S.C. 355e) and 582(a)(2) of the FD&C Act as described in the July 2022 revised draft 5 FDA issued compliance policy guidances that represent an enforcement policy with respect to: (a) the enhanced drug distribution security requirements in section 582(g)(1) of the FD&C Act; and (b) verification requirements for saleable returned product for wholesale distributors in section 582(c)(4)(D) of the FD&C Act and verification requirements for dispensers regarding suspect or illegitimate product in sections 582(d)(4)(A)(ii)(II) and (d)(4)(B)(iii) of the FD&C Act. For more information, see the compliance policy guidances for industry Enhanced Drug Distribution Security Requirements Under Section 582(g)(1) of the Federal Food, Drug, and Cosmetic Act - Compliance Policies (August 2023) and Wholesale Distributor Verification Requirement for Saleable Returned Drug Product and Dispenser Verification Requirements When Investigating a Suspect or Illegitimate Product - Compliance Policies, Revision 1 (August 2023). For this guidance, references to compliance with the Nov 27, 2023, date that the requirements under section 582(g)(1) will go into effect are subject to the enforcement policies articulated in the compliance policy guidance for industry Enhanced Drug Distribution Security Requirements Under Section 582(g)(1) of the Federal Food, Drug, and Cosmetic Act - Compliance Policies. We update guidances periodically. To make sure you have the most recent version of a guidance, check the FDA guidance web page at https://www.fda.gov/regulatory-information/search-fda-guidance-documents. 6 Package is defined in section 581(11) of the FD&C Act. 7 Transaction information and transaction statement are defined in sections 581(26) and (27) of the FD&C Act, respectively. 8 Verification is defined in section 581(28) of the FD&C Act. Contains Nonbinding Recommendations guidance for industry DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs. The pilot projects conducted per section 582(j) of the FD&C Act also informed this guidance. 9 This guidance is intended to facilitate the creation of a uniform methodology for product tracing while ensuring the protection of confidential commercial information and trade secrets. FDA has also published other guidances addressing the enhanced drug distribution security requirements, including the attributes necessary for enhanced product tracing and verification, which should be read in conjunction with this guidance. 10 III. TO WHOM DOES THIS GUIDANCE APPLY? This guidance applies to manufacturers, wholesale distributors, dispensers, and repackagers 11 who engage in transactions of "products" as defined in section 581(13) of the FD&C Act. Whether an entity meets the DSCSA definition of a particular type of trading partner depends on the activities engaged in by such entity. If an entity meets the definition of more than one type of trading partner, the entity must comply with all applicable requirements under section 582(a)(1) of the FD&C Act. However, trading partners are not required to duplicate requirements. 12 The DSCSA requires that manufacturers, wholesale distributors, dispensers, and repackagers who engage in transactions of products meet the applicable requirements for being authorized 13 trading partners. 14 IV. WHAT PRODUCTS DOES THIS GUIDANCE ADDRESS? This guidance applies to transactions involving products as defined in section 581(13) of the FD&C Act. In general, a product is a prescription drug in a finished dosage form for administration to a patient without requiring substantial further manufacturing, such as capsules, tablets, and lyophilized products before reconstitution. See section 581(13) of the FD&C Act for specific exclusions from the definition of product. Stakeholders should review these exclusions to determine whether a specific prescription drug is statutorily excluded from the DSCSA definition of product and is thus excluded from the product tracing requirements of section 582 of the FD&C Act. V. WHAT TRANSACTIONS DOES THIS GUIDANCE ADDRESS? 9 See FDA's Drug Supply Chain Security Act Pilot Project Program web page at https://www.fda.gov/drugs/drug- supply-chain-security-act-dscsa/dscsa-pilot-project-program. 10 For DSCSA-related guidance documents, see FDA's Drug Supply Chain Security Act Law and Policies web page at https://www.fda.gov/drugs/drug-supply-chain-security-act-dscsa/drug-supply-chain-security-act-law-and-policies. 11 Manufacturer, wholesale distributor, dispenser, and repackager are defined in section 581(10), (29), (3), and (16) of the FD&C Act, respectively. 12 See section 582(a)(1) of the FD&C Act. 13 Authorized is defined in section 581(2) of the FD&C Act. 14 See sections 582(b)(3), (c)(3), (d)(3), and (e)(3) of the FD&C Act. Contains Nonbinding Recommendations This guidance applies to transactions as defined in section 581(24) of the FD&C Act. In general, a transaction is defined as a transfer of product between persons in which a change of ownership occurs. The statutory definition exempts certain types of transfers. Section 581(24)(B) of the FD&C Act lists specific exemptions from the definition of transaction. Stakeholders should review these exemptions to determine whether a specific transfer is statutorily exempt from the DSCSA definition of transaction and is thus exempt from the product tracing requirements of section 582 of the FD&C Act. VI. WHAT DOES INTEROPERABILITY ENCOMPASS FOR PURPOSES OF THE INITIAL STANDARDS FOR THE EXCHANGE OF TRACING INFORMATION UNDER SECTION 582(A)(2)(A)? FDA considers "interoperability," for purposes of the initial standards for the exchange of tracing information under section 582(a)(2)(A) of the FD&C Act, to encompass the ability (1) to exchange transaction history, 15 transaction information, and transaction statements accurately, efficiently, and consistently among trading partners; and (2) for a subsequent purchaser's system, process, or practice to successfully capture and maintain the transaction history, transaction information, and transaction statements, regardless of whether they are provided in a paper or electronic format. Until November 27, 2023, wholesale distributors, dispensers, and repackagers can use either paper-based or electronic-based methods to provide transaction history, transaction information, and transaction statements to subsequent purchasing trading partners as long as the selected method allows the information to be exchanged in a manner that complies with the requirements of section 582(c)(1), (d)(1), and (e)(1) of the FD&C Act, respectively. Section 582(b)(1)(C) of the FD&C Act currently requires manufacturers, unlike other trading partners, to use electronic-based methods to provide transaction history, transaction information, and transaction statements to subsequent purchasing trading partners. 16 However, a manufacturer may provide transaction history, transaction information, and transaction statements in a paper format if the subsequent purchaser is either a: (1) State licensed health care practitioner authorized to prescribe medication; or (2) licensed individual who dispenses product in the usual course of professional practice and is under the supervision or direction of a licensed prescribing health care practitioner. 17 VII. WHAT DOES INTEROPERABILITY ENCOMPASS FOR THE PURPOSE OF ENHANCED DRUG DISTRIBUTION SECURITY UNDER SECTION 582(G)(1)? Beginning November 27, 2023, electronic-based approaches are generally required to be used among all trading partners to meet the enhanced drug distribution security requirements outlined in section 582(g)(1) of the FD&C Act. 18 As described in this provision (and generally summarized below), beginning on that date, trading partners are required to: (1) use secure, 15 Transaction history is defined in section 581(25) of the FD&C Act. 16 See section 582(b)(1)(C)(i) of the FD&C Act. 17 See section 582(b)(1)(C)(ii) of the FD&C Act. 18 For additional provisions related to enhanced drug distribution security, see sections 582(g)-(m) of the FD&C Act. Contains Nonbinding Recommendations interoperable, electronic approaches to exchange transaction information and transaction statements, which generally must include package level product identifiers for each package included in the transaction; 19 (2) have systems and processes in place to verify products at the package level; 20 (3) have systems and processes in place to promptly respond with the transaction information and transaction statement for a product upon a request by the Secretary, or other appropriate Federal or State official, in the event of a recall or for investigations of suspect or illegitimate product; 21 (4) have systems and processes in place to facilitate the gathering of information needed to produce the transaction information for a product (going back to the manufacturer, as applicable), in the event of a request by the Secretary, or other appropriate Federal or State official, on account of a recall or for suspect or illegitimate product investigations, or in the event of a request by an authorized trading partner (in a secure manner that protects confidential commercial information and trade secrets) for purposes of investigating a suspect product or assisting with such a governmental request; 22 and (5) if the trading partner accepts saleable returns, have systems and processes in place to accept product and saleable returns if the trading partner can associate the saleable return product with the transaction information and transaction statement associated with that product. 23 Considering trading partners' transition to exclusively utilize electronic-based approaches to satisfy the enhanced drug distribution security requirements by November 27, 2023, FDA considers interoperability, for purposes of the enhanced drug distribution security requirements, to differ from the processes and capabilities that allow a system, process, or practice to be interoperable under the initial standards for exchange of tracing information in section 582(a)(2)(A) of the FD&C Act. Based on trading partner and other stakeholder progress and/or piloting activities, we note that: (1) the processes and capabilities that promote more standardization of how product tracing information is exchanged and documented have become available; and (2) electronic approaches have evolved and become more affordable and accessible to a wider range of trading partners with various business operation structures. As such, for the purpose of the enhanced drug distribution security requirements under section 582(g)(1), FDA interprets interoperability for enhanced drug distribution security to encompass the ability to securely exchange, capture, and maintain electronic transaction information and transaction statements accurately, efficiently, and consistently among trading partners, in a manner that enables compliance with all enhanced drug distribution security requirements. 19 See section 582(g)(1)(A)-(B) of the FD&C Act. Beginning November 27, 2023, section 582(k)(1) of the FD&C Act effectively ends the requirements for trading partners to provide and receive transaction history. However, based on section 582(g)(1)(E) of the FD&C Act, trading partners must by that date have systems and processes necessary to promptly facilitate the gathering of information necessary to produce the transaction information for each transaction going back to the manufacturer, as applicable, in the event of a recall or for certain investigations. 20 See section 582(g)(1)(C) of the FD&C Act. 21 See section 582(g)(1)(D) of the FD&C Act. 22 See section 582(g)(1)(E) of the FD&C Act. 23 See section 582(g)(1)(F) of the FD&C Act. Contains Nonbinding Recommendations VIII. WHAT STANDARDS SHOULD TRADING PARTNERS ADOPT FOR THE ENHANCED DRUG DISTRIBUTION SECURITY REQUIREMENTS? FDA recommends that trading partners use the Electronic Product Code Information Services (EPCIS) standard 24 to provide and maintain the data associated with transaction information and transaction statements. EPCIS is a global GS1 standard that allows trading partners to capture and share information about products as they are transacted through the supply chain. Use of EPCIS can support and enable electronic and interoperable interfaces used by trading partners to help ensure compliance with DSCSA requirements and is compatible with a range of different technological approaches. FDA concludes that EPCIS is an appropriate globally recognized standard, and FDA understands there is considerable agreement among stakeholders that EPCIS is a suitable standard to adopt for the enhanced drug distribution security requirements. It is essential for trading partners to adopt standards that address how the data associated with transaction information and transaction statements are electronically exchanged to achieve enhanced drug distribution security interoperability. To help ensure successful, efficient enhanced drug distribution security interoperability, FDA recommends that trading partners make a collaborative effort to follow the same standards that address how the data associated with transaction information and transaction statements are electronically exchanged. IX. BUILDING TECHNOLOGICAL APPROACHES TO COMPLY WITH ENHANCED DRUG DISTRIBUTION SECURITY REQUIREMENTS FDA recognizes there are a variety of technological approaches available to trading partners to comply with enhanced drug distribution security requirements outlined in section 582(g)(1) of the FD&C Act, and FDA does not expect all trading partners to rely upon a single technological approach; trading partners may choose the technological approach best suited to their individual business needs so long as it complies with relevant requirements. However, the Agency recommends that a trading partner use a technological approach utilizing the EPCIS standard. For example, internet-based platforms such as email and web portals that utilize EPCIS could be technological approaches that enable DSCSA compliance, as could other technological approaches that utilize EPCIS. In addition, any technological approach a trading partner uses must also utilize data standards that facilitate a uniform process or methodology for product tracing and ensure the protection of confidential commercial information and trade secrets. 25 We note that trading partners' efforts to protect such information should not be limited to adhering to EPCIS, but should also include using individual system(s) and procedure(s), and business practices that ensure the confidentiality of such information. For data capture and exchange specifically, a trading partner should use EPCIS, as described in this guidance. FDA believes the recommendations in this guidance can serve as foundational steps toward establishing enhanced drug distribution security. As FDA continues to make recommendations for the DSCSA enhanced drug distribution security requirements, supply chain stakeholders should consider these recommendations for successful implementation. 24 EPCIS (Electronic Product Code Information Services) is a standard developed by GS1. For more information see https://www.gs1.org/standards/epcis. 25 See section 582(g)(1) of the FD&C Act.