Compliance

Published April 15, 2026 · Updated May 29, 2026

DSCSA compliance for pharmacies, in plain English.

Q: Does DSCSA apply to correctional and detention pharmacies?

Yes — correctional and detention pharmacies are dispensers under DSCSA, and their deadline is usually earlier, not later, than a community pharmacy's. FDA's small-business exemption is measured at the corporate entity that owns the dispenser, not at the facility. Where a multi-state correctional healthcare contractor or a dedicated correctional pharmacy vendor holds the pharmacy license, its company-wide count of full-time pharmacists and technicians is well above 25, so the site never qualified as a small business dispenser and the enhanced requirements have applied since 2025. A jail or facility that holds its own small pharmacy permit may still qualify. Work out who holds the permit before assuming you have until 2027.

The short version

DSCSA is the U.S. federal law that requires pharmacies to track every prescription drug package by serialized barcode (GTIN + lot + serial + expiration), buy only from authorized trading partners, retain transaction records for at least 6 years, and verify product authenticity before resale. On August 6, 2026, FDA exempted qualifying small business dispensers from the package-level electronic tracing requirements until November 27, 2027. You qualify only if the corporate entity that owns your pharmacy has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, counted across the whole company as of November 27, 2026. Every dispenser above that threshold is subject to the enhanced requirements today. DSCSA software handles the package-level serial capture and audit-record export that general-purpose pharmacy management systems typically leave on the table.

Regulatory status as of August 31, 2026. On August 6, 2026 FDA granted qualifying small business dispensers a further one-year exemption, running from November 27, 2026 to November 27, 2027, from six enhanced drug distribution security requirements in FD&C Act §582(g)(1) and two product-identifier verification requirements in §582(d)(4). Nothing else in §582 was exempted, no statutory date changed, and dispensers that do not meet FDA's small-business definition remain subject to the enhanced requirements now. FDA exemptions may be limited in duration or revised without notice. Not sure whether the extension covers your pharmacy? Work through the test here.

The Drug Supply Chain Security Act (DSCSA) is a U.S. federal law passed in 2013 with a stair-step rollout. The law governs how prescription drugs are tracked through the supply chain — from manufacturer to wholesaler to dispenser — and it has direct implications for every pharmacy that holds inventory. Which obligations apply to you right now depends on how big the company that owns your pharmacy is: qualifying small businesses have until November 27, 2027 for the package-level electronic tracing piece, and everyone else is already subject to it.

This guide covers what DSCSA actually requires of a dispenser, what a serialized barcode contains, and what DSCSA software needs to do in practice — including the gaps most general-purpose pharmacy management systems leave on the table.

What DSCSA actually requires of dispensers

If you're a pharmacy that buys, holds, and dispenses prescription drugs, the law treats you as a "dispenser" and you have four core obligations:

Buy only from authorized trading partners. Wholesalers must be licensed; manufacturers must be registered. You're responsible for confirming this.
Receive and retain transaction records. Every shipment comes with electronic transaction information (TI) and transaction statements (TS) you must keep for 6 years.
Verify product authenticity. If you suspect a drug is illegitimate, you must investigate, quarantine, and notify trading partners and the FDA. You also have to verify the product identifier on returned saleable drugs before reselling them.
Operate at the package level. Prescription drug packages already carry a serialized 2D barcode (GS1 DataMatrix) with GTIN, lot, serial number, and expiration date, and since November 27, 2020 a pharmacy may only transact product encoded with a product identifier. What the small-business-dispenser exemption defers — until November 27, 2027, and only for pharmacies that qualify — is the requirement to exchange and verify that data electronically at the package level. Your systems still need to be able to capture and store all four.

What the August 2026 exemption does and does not do

The exemption is narrow. FDA lifted six requirements in §582(g)(1) and two product-identifier verification requirements in §582(d)(4), and stated plainly that the exemptions "do not apply to other requirements in section 582." Whatever your size, today you must still buy only from authorized trading partners; refuse ownership of product that arrives without transaction information and a transaction statement; retain those records for at least six years; produce them within two business days on request; transact only in product encoded with a product identifier; and quarantine, investigate, and report suspect or illegitimate product. What the exemption defers is the method — secure, interoperable, package-level electronic exchange — not the underlying duty.

FDA was explicit that this is not a reason to stop work: the exemptions "are not intended to provide, and should not be viewed as providing, a justification for delaying efforts by small business dispensers to implement the enhanced drug distribution security requirements," and FDA "strongly urges small business dispensers to continue their efforts."

You do not have to file anything with FDA to rely on the exemption. FDA does recommend telling your wholesalers you are relying on it, so shipments are not held up. Separately, FDA is asking small dispensers to complete its small dispensers assessment survey by September 22, 2026 — that is not a compliance deadline and not a condition of the exemption, but it is the study that will shape whether package-level tracing is judged feasible for pharmacies your size, and a consultant or vendor may complete it on your behalf.

What's in the serialized barcode

The DSCSA-compliant barcode encodes four GS1 application identifiers (AIs):

AI 01 — GTIN-14: The 14-digit Global Trade Item Number identifying the manufacturer's product (drug + strength + package size).
AI 17 — Expiration date: 6 digits, YYMMDD format. Some manufacturers use DD=00 to mean "last day of the month."
AI 10 — Lot number: Up to 20 alphanumeric characters. Variable length, terminated by an FNC1 group separator (ASCII 0x1D) or end of string.
AI 21 — Serial number: Up to 20 alphanumeric characters. Unique per package within a lot. This is the piece that's new under DSCSA — pre-DSCSA barcodes typically only had GTIN, lot, and expiration.

The presence of AI 21 (serial number) is what distinguishes a DSCSA-compliant barcode from a pre-DSCSA one. Most manufacturers have been shipping serialized stock for years; the November 2026 small-dispenser deadline closes the door on non-serialized drugs in the trading-partner chain.

Why FNC1 / GS character handling matters

Variable-length AIs (10, 21, 240) terminate when the scanner encounters the FNC1 character — ASCII byte 0x1D, also called Group Separator (GS). If your scanner is configured to strip this byte (the default on many HID-mode Bluetooth scanners), the parser sees a single concatenated mess instead of distinct lot and serial fields. Real DSCSA scans simply won't parse correctly.

If you're using a Zebra DS2278 or similar, the scanner needs "GS character transmission for HID Keyboard" enabled in its programming guide. Without it, your system records the lot but loses the serial — which means you're not actually capturing DSCSA-required data. RxRescue's setup guide walks operators through this configuration step-by-step.

What DSCSA software (and your inventory system) needs to do

Whatever software you use, it has to:

Capture all four AIs from a serialized 2D barcode (GTIN, lot, serial, expiration).
Store them as distinct fields, not concatenated text.
Preserve raw scan data for audit purposes — if an FDA or wholesaler dispute arises about whether a specific package was authentic, you need to prove what was scanned.
Detect and reject duplicate serial numbers — receiving the same serialized package twice almost always indicates a counterfeit or chain-of-custody issue.
Track expiration dates at the package level. Lot-level tracking isn't sufficient when DSCSA-required serial-level data is available.

Most pharmacy management systems handle the purchasing and transaction-document side of DSCSA. Where they commonly fall short is two layers deeper: on-shelf inventory (knowing exactly which serialized packages you currently hold, which are nearing expiration, and which have been pulled or returned) and inbound receiving reconciliation (matching the wholesaler's shipment manifest against what actually arrived, bottle by bottle). Many pharmacies still do both steps by hand, in a spreadsheet or on paper. RxRescue is built to fill both gaps: daily on-shelf inventory visibility and manifest-to-shelf receiving reconciliation, with discrepancies categorized, documented, and included in the durable receiving record before it is finalized.

How RxRescue handles DSCSA scans

RxRescue's GS1 parser is fixture-tested against the full set of DSCSA barcode patterns: standard serialized scans, pre-DSCSA lot-only scans, scans with AIM symbology prefixes (]d2, ]C1), scans with leading FNC1, last-day-of-month dates (DD=00), and dozens of edge cases. Each scan is stored with raw input preserved, parser version tagged, and timestamp logged for audit.

The product is built around a strict No-PHI boundary: it stores stock data (GTIN, lot, serial, expiration, drug name, quantity) and is designed not to collect PHI by blocking patient-identifying fields at the import layer. See our security & compliance posture for what this means for HIPAA scope and procurement-level review.

Start a 30-day free trial →

Frequently asked questions about DSCSA

How long must a dispenser maintain DSCSA transaction records?

DSCSA requires dispensers (pharmacies) to maintain transaction information and verification records for at least 6 years from the date of the transaction. Most pharmacies keep them 7 years to align with state-board retention requirements. When FDA or a state official requests those records, a dispenser has two business days to produce them, and the statute permits either paper or electronic format (FD&C Act §582(d)(1)(D)). The tighter 1-business-day/48-hour standard people often cite belongs to manufacturers, wholesale distributors and repackagers — not dispensers. Paper is legal. It is just slow, and it stops being practical once your pharmacy loses the small-business-dispenser exemption and has to answer at the package level.

When is the DSCSA enforcement deadline for small dispensers?

November 27, 2027 — but only for pharmacies that qualify. On August 6, 2026, FDA extended its exemption for small business dispensers by one year, from November 27, 2026 to November 27, 2027. This is a formal exemption granted under FD&C Act §582(a)(3); it is not enforcement discretion, and it is not the stabilization period, which was a separate measure that ended in 2024. A pharmacy qualifies only if the corporate entity that owns it has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, counted across the whole company as of November 27, 2026. Every dispenser above that threshold is subject to the enhanced requirements today.

What is the DSCSA serialization timeline?

DSCSA was enacted in 2013 with a roughly ten-year phase-in. The enhanced, package-level requirements took effect November 27, 2023. FDA then staggered relief by trading-partner type: manufacturers and repackagers through May 27, 2025, wholesale distributors through August 27, 2025, and dispensers with 26 or more full-time pharmacists and technicians through November 27, 2025 — all of which have now expired. Only qualifying small business dispensers still have relief, and on August 6, 2026 FDA extended theirs to November 27, 2027. So the date that matters most depends on who owns your pharmacy: if the owning company has 25 or fewer full-time pharmacists and technicians, it is November 27, 2027; if not, the requirements already apply.

Does my pharmacy management system handle DSCSA compliance?

Most pharmacy management systems handle the purchasing and receiving side of DSCSA — capturing T3 transaction documents from the wholesaler. Where they typically fall short is on-shelf inventory: knowing which specific serialized packages you currently hold, which are nearing expiration, and which have been pulled or returned. That gap is what a dedicated physical-inventory tool covers. See how RxRescue fits alongside your PMS for the layer model.

Does DSCSA apply to correctional and detention pharmacies?

Yes — and their deadline is usually earlier, not later, than a community pharmacy's. FDA's small-business exemption is measured at the corporate entity that owns the dispenser, not at the facility. Where a multi-state correctional healthcare contractor or a dedicated correctional pharmacy vendor holds the pharmacy license, its company-wide count of full-time pharmacists and technicians is well above 25, so that site never qualified as a small business dispenser and the enhanced requirements have applied since 2025. A jail or facility that holds its own small pharmacy permit may still qualify. Work out who holds the permit before assuming you have until 2027 — we wrote about that dispenser-of-record gap in DSCSA in the correctional pharmacy.

What is the difference between DSCSA T3 documents and serialization?

T3 documents (Transaction Information, Transaction History, Transaction Statement) record the chain of custody — who shipped what to whom. Serialization adds a unique identifier to each package (GTIN, lot, serial number, expiration) so that an individual bottle can be tracked and verified, not just a transaction line. Both are required under DSCSA; serialization is the part that requires barcode-aware scanning at the package level.

What if a wholesaler ships me a non-DSCSA-compliant bottle?

Reject and return it. Under DSCSA, dispensers are required to verify that incoming product carries a compliant serialized barcode and matching transaction documentation. Accepting non-compliant product creates a chain-of-custody gap that surfaces in audits and can disqualify the bottle from future return-credit. Most wholesalers will accept the return without dispute when the rejection reason is DSCSA-non-compliance.

Validated as of 2026-05-13. DSCSA regulatory references reviewed quarterly.