Compliance
DSCSA compliance for pharmacies, in plain English.
The Drug Supply Chain Security Act (DSCSA) is a U.S. federal law passed in 2013 with a stair-step rollout that finishes in 2027. It governs how prescription drugs are tracked through the supply chain — from manufacturer to wholesaler to dispenser — and it has direct implications for every pharmacy that holds inventory.
What DSCSA actually requires of dispensers
If you're a pharmacy that buys, holds, and dispenses prescription drugs, the law treats you as a "dispenser" and you have four core obligations:
- Buy only from authorized trading partners. Wholesalers must be licensed; manufacturers must be registered. You're responsible for confirming this.
- Receive and retain transaction records. Every shipment comes with electronic transaction information (TI) and transaction statements (TS) you must keep for 6 years.
- Verify product authenticity. If you suspect a drug is illegitimate, you must investigate, quarantine, and notify trading partners and the FDA. You also have to verify the product identifier on returned saleable drugs before reselling them.
- Operate at the package level. By the November 2027 enforcement deadline, every prescription drug package must carry a serialized 2D barcode (GS1 DataMatrix) containing GTIN, lot, serial number, and expiration date. Your systems must be able to capture and store all four.
What's in the serialized barcode
The DSCSA-compliant barcode encodes four GS1 application identifiers (AIs):
- AI 01 — GTIN-14: The 14-digit Global Trade Item Number identifying the manufacturer's product (drug + strength + package size).
- AI 17 — Expiration date: 6 digits, YYMMDD format. Some manufacturers use DD=00 to mean "last day of the month."
- AI 10 — Lot number: Up to 20 alphanumeric characters. Variable length, terminated by an FNC1 group separator (ASCII 0x1D) or end of string.
- AI 21 — Serial number: Up to 20 alphanumeric characters. Unique per package within a lot. This is the piece that's new under DSCSA — pre-DSCSA barcodes typically only had GTIN, lot, and expiration.
The presence of AI 21 (serial number) is what distinguishes a DSCSA-compliant barcode from a pre-DSCSA one. Most manufacturers have been shipping serialized stock for years; the 2027 deadline closes the door on non-serialized drugs in the trading-partner chain.
Why FNC1 / GS character handling matters
Variable-length AIs (10, 21, 240) terminate when the scanner encounters the FNC1 character — ASCII byte 0x1D, also called Group Separator (GS). If your scanner is configured to strip this byte (the default on many HID-mode Bluetooth scanners), the parser sees a single concatenated mess instead of distinct lot and serial fields. Real DSCSA scans simply won't parse correctly.
If you're using a Zebra DS2278 or similar, the scanner needs "GS character transmission for HID Keyboard" enabled in its programming guide. Without it, your system records the lot but loses the serial — which means you're not actually capturing DSCSA-required data. RxRescue's setup guide walks operators through this configuration step-by-step.
What your inventory system needs to do
Whatever software you use, it has to:
- Capture all four AIs from a serialized 2D barcode (GTIN, lot, serial, expiration).
- Store them as distinct fields, not concatenated text.
- Preserve raw scan data for audit purposes — if an FDA or wholesaler dispute arises about whether a specific package was authentic, you need to prove what was scanned.
- Detect and reject duplicate serial numbers — receiving the same serialized package twice almost always indicates a counterfeit or chain-of-custody issue.
- Track expiration dates at the package level. Lot-level tracking isn't sufficient when DSCSA-required serial-level data is available.
Most pharmacy management systems handle the purchasing and receiving side. Where they often fall short is on-shelf inventory: knowing exactly which serialized packages you currently hold, which are nearing expiration, and which have been pulled or returned. That gap is what RxRescue is built to fill.
How RxRescue handles DSCSA scans
RxRescue's GS1 parser is fixture-tested against the full set of DSCSA barcode patterns: standard serialized scans, pre-DSCSA lot-only scans, scans with AIM symbology prefixes (]d2, ]C1), scans with leading FNC1, last-day-of-month dates (DD=00), and dozens of edge cases. Each scan is stored with raw input preserved, parser version tagged, and timestamp logged for audit.
The product is built around a strict No-PHI boundary: it stores stock data (GTIN, lot, serial, expiration, drug name, quantity) but explicitly blocks patient-identifying fields. This keeps you out of HIPAA-covered territory while still meeting DSCSA's serialization-tracking requirements.