New DSCSA Guidance Details Layers Of Verification System Requirements

By Kalie E. Richardson, Hyman, Phelps & McNamara

In December 2023, FDA published guidance titled Verification Systems Under the Drug Supply Chain Security Act for Certain Prescription Drugs (“verification systems guidance” or “guidance”), which is the seventh final guidance of 2023 interpreting the 2013 Drug Supply Chain Security Act (DSCSA). Readers would be wise to have earlier DSCSA guidances on hand, as the verification systems guidance cites throughout to the myriad other FDA guidance documents. It is not all that surprising that FDA went on a guidance blitz in 2023 given that the DSCSA was supposed to be fully implemented in 2023 — 10 years after the act’s 2013 passage.

This latest guidance describes the drug supply chain’s “verification system” as the “coordinated body of processes and procedures that forms a trading partner’s individual organizational scheme,” through which a trading partner can determine whether the product identifier affixed to a package corresponds to the lot number and expiration date assigned to the product by the manufacturer or the repackager, as applicable.¹ The guidance addresses verification systems that manufacturers, wholesale distributors, dispensers, and repackagers (collectively, “trading partners”) must have in place in seven different contexts:

1. Suspect Product Determination
2. Suspect Product Quarantine and Investigation
3. Cleared Product Notification for Suspect Product
4. Illegitimate Product Quarantine and Disposition
5. Illegitimate/High Risk of Illegitimacy Product Notifications
6. Responses to Requests for Verification from Authorized Trading Partners
7. Processing Saleable Returns

Note that while third-party logistics providers (3PLs) are included as “trading partners” under the DSCSA, they are not within the scope of this guidance as the DSCSA does not impose direct verification requirements on 3PLs.² Given that 3PLs do take physical possession of product notwithstanding their lack of ownership, however, there could certainly be situations in which collaboration with a 3PL will be required, particularly in the context of quarantining suspect or illegitimate product.

Suspect Product Determination

The verification systems guidance notes that trading partners must have systems in place to determine whether a product is a suspect product. Trading partners should pay particular attention to product that may be counterfeit, diverted, stolen, intentionally adulterated, the subject of a fraudulent transaction, or unfit for distribution, as those terms are interpreted in FDA’s guidance titled Definitions of Suspect Product and Illegitimate Product for Verification Obligations Under the Drug Supply Chain Security Act (March 2023). However, the verification systems guidance doesn’t shed light on how exactly trading partners should determine whether a product may be suspect, which is instead discussed in a third guidance: Drug Supply Chain Security Act Implementation: Identification of Suspect Product and Notification (June 2021) (suspect product and notification guidance). A system to determine that a product is suspect may include “know your customer” and supplier evaluation procedures, product-specific procedures for high-cost or high-demand products, and visual inspection procedures. For example, unsolicited sales offers from potential trading partners with which the entity has no established business relationship may require additional due diligence, as would a product offered by an established trading partner at a price that is “too good to be true.”  

Suspect Product Quarantine And Investigation

If a trading partner determines that a product is suspect or receives a request for verification of the product identifier from FDA (after FDA’s determination that the product within the possession or control of the trading partner is a suspect product), the product must be quarantined and investigated. Suspect product may be quarantined by physically separating it from the non-suspect inventory, such as placing it in a designated quarantine area in a warehouse. For trading partners who use electronic inventory and/or order management systems, product can also be quarantined electronically by placing a “hold” on the product, which would indicate the quarantine status and that the product should not be sold or further distributed. The authority to change the quarantine status of a product should be limited to specific individuals, depending on the type of trading partner. For manufacturers and repackagers, quality control staff should likely have this responsibility. For a wholesale distributor, it may be the facility manager or designated representative, and for a dispenser it may be the pharmacist-in-charge.

Once quarantined, the trading partner must investigate the suspect product. A logical first step in the investigation is to validate the transaction information, which includes the product’s name, strength and dosage form, NDC, container size, and lot number, as well as the number of containers, date of transaction and shipments, and the business name and address of the person from whom and to whom ownership is being transferred.³ The investigation will likely require active communication and collaboration with other trading partners in the supply chain. Laboratory analyses may also be required, which FDA expects would be conducted by the manufacturer.

The product-identifier must also be verified at the package level. Manufacturers and repackagers must be able to confirm that (1) the NDC and lot number reported in its internal records made at the time of the transaction and (2) the NDC, serial number, lot number and expiration date of the product identifier imprinted upon or affixed to the package or homogenous case of the suspect product corresponded to the information originally assigned to the product. Wholesale distributors must conduct the same verification against the information received from the manufacturer, repackager, or other distributor. During an investigation of suspect product, dispensers must verify the product identifier for at least three packages or 10% of the suspect product, whichever is greater, or all packages if there are fewer than three.⁴ All trading partners must keep records of the investigation of a suspect product for not less than six years following the conclusion of the investigation.

Cleared Product Notification For Suspect Product

For product that was the subject of an FDA request for verification of the product identifier, the trading partner must submit a “cleared product notification” to FDA if the trading partner’s investigation determines that the product is not illegitimate. The notification must include the reason why the product was determined to be suspect and a summary of the investigation that led to the trading partner’s determination that the product was not an illegitimate product. Cleared product notifications should be made — before the product is further distributed or dispensed — by sending an email to drugnotifications@fda.hhs.gov until FDA’s electronic DSCSA Portal is active.

Illegitimate Product Quarantine And Disposition

Once the trading partner has determined that the product in its possession or control is illegitimate, or upon receipt of such a notification from FDA or another trading partner, the product must be quarantined and dispositioned. The quarantine system requirements for illegitimate product largely function the same as those provided for suspect product, with the acknowledgement that it may not be possible for the trading partner to quarantine product that has been stolen and is no longer in its physical custody.

The illegitimate product must then be removed from the supply chain, in accordance with the trading partner’s procedures, to ensure that the public health hazards associated with that product are appropriately controlled. For example, a waste management company may be contracted to destroy the product as appropriate and provide a certificate of destruction. For product that is still in the trading partner’s physical possession, representative samples of the illegitimate product should be retained for potential further examination and analysis by the manufacturer, FDA, or other state or federal regulator.

Illegitimate/High Risk Of Illegitimacy Product Notifications

Trading partners must have systems in place to notify FDA and immediate trading partners of an illegitimate product and to act on such notifications received by another trading partner or FDA. Manufacturers must be able to notify FDA and immediate trading partners of suspect products that pose a “high risk” of illegitimacy within 24 hours.⁵ As explained in the suspect product and notification guidance, high risk of illegitimacy notifications are required for products the manufacturer has reason to believe are in an immediate trading partner’s possession and for specific high risks that could increase the likelihood of an illegitimate product entering the U.S. pharmaceutical distribution supply chain.  

Responses To Requests For Verification From Authorized Trading Partners

By statute, manufacturers and repackagers must have systems in place to respond to requests for verification of the product identifier from an authorized trading partner that is in possession or control of a product they believe to be manufactured or repackaged by the respective manufacturer or repackager within 24 hours of receiving the request or in “other such reasonable time.”⁶

The verification systems guidance clarifies two important points concerning product identifier verification requests. First, manufacturers and repackagers must respond to verification requests, even if the request is not from an immediate trading partner.

For example, Manufacturer A sells the product to Distributor B, who sells the product to Distributor C, who then sells the product to Dispenser D. In this scenario, Manufacturer A must respond to verification requests from C and D, even if A has never directly sold any product to C or D. Additionally, FDA has interpreted that a best practice is to respond to product identifier verification requests within one business day of receipt. Trading partners should not further distribute or dispense the product while the verification request is pending.

Systems For Processing Saleable Returns

Manufacturers, wholesale distributors, and repackagers must be able to process saleable return products that they intend to further distribute.⁷ The saleable return system must allow the trading partner to verify the product identifier on each sealed homogenous case or on each package of returned product, if not in a sealed homogenous case. Verification requirements for saleable returns are discussed in greater detail in Wholesale Distributor Verification Requirement for Saleable Returned Drug Product and Dispenser Verification Requirements When Investigating a Suspect or Illegitimate Product - Compliance Policies Revision 1 (August 2023). In the verification systems guidance, FDA acknowledges that the verification process for a saleable return is very similar to an illegitimate product investigation and anticipates that some trading partners will use the same system to fulfill both requirements.

Key Takeaways From The Verifications System Guidance

While FDA is clear in its expectation that trading partners have product verification processes and procedures in place that can be used in a variety of contexts, what remains murky is how exactly FDA envisions this being implemented. While the requirements of the guidance apply to the individual trading partner, an individual system will ultimately only work if there are clear lines of communication between trading partners throughout the supply chain.

It seems that FDA, too, is curious to hear how exactly trading partners will be sharing information. Less than three weeks prior to the publication of the verification systems guidance, FDA published a request for information to better understand the status of readiness of trading partners’ electronic interoperable systems and processes for enhanced drug distribution security under the DSCSA.⁸

References:

1. Verification Systems Guidance, footnote 4.
2. See 21 USC § 360eee(23)(B), § 360eee-1(b) through (e).
3. 21 U.S.C. § 360eee(26).
4. 21 U.S.C. § 360eee-1(d)(4)(A)(ii)(II).
5. 21 U.S.C. § 360eee-1(b)(4)(B)(ii)(II).
6. 21 U.S.C. §§ 360eee-1(b)(4)(C) and (e)(4)(C).
7.  21 U.S.C. §§ 360eee-1(b)(4)(E), (c)(4)(D) and (e)(4)(E).
8. Implementing Interoperable Systems and Processes for Enhanced Drug Distribution Security Requirements Under Section 582(g)(1) of the Federal Food, Drug, and Cosmetic Act; Establishment of a Public Docket; Request for Information and Comments, 88 Fed. Reg. 80,726 (Nov. 20, 2023).

About the Author:

Kalie E. Richardson is a senior associate at Hyman, Phelps & McNamara. She focuses her practice on state and federal regulatory strategy and compliance, primarily for pharmaceutical manufacturers and wholesale distributors. Recently, she has assisted manufacturers with FDA Form 483 responses and ongoing inspection remediation, as well as internal investigations. She also advises manufacturers, wholesale distributors, 503B outsourcing facilities, and pharmacies on state licensing strategy in all 50 states, the District of Columbia, and Puerto Rico.  She also advises on controlled substance issues, Drug Supply Chain Security Act compliance, and conducts regulatory due diligence related to corporate transactional matters.