FDA Announces 1-Year "Stabilization" Period For DSCSA Compliance — Don't Mistake It For An Enforcement Delay

By Eric Marshall and Zach Howard, Leavitt Partners

On August 30, the FDA announced the establishment of a one-year stabilization period with regard to the enhanced security and unit-level electronic traceability requirements of the Drug Supply Chain Security Act (DSCSA) that go into effect on Nov. 27, 2023. This announcement was made in a guidance document titled “Enhanced Drug Distribution Security Requirements Under Section 582(g)(1) of the Federal Food, Drug, and Cosmetic Act — Compliance Policies.” This stabilization period provides trading partners in the pharmaceutical supply chain with much-needed flexibility to stabilize and mature their electronic systems and processes for electronic tracing of drugs at the package level while ensuring the technical complexities of electronic tracing do not disrupt the continued flow of authentic medicines to the patients who need them.

This stabilization period is effective from Nov. 27, 2023 — the date on which the DSCSA enhanced requirements take effect — to Nov. 27, 2024. During that time, FDA expects trading partners to have implemented the required electronic systems and processes, but it does not intend to take enforcement action, allowing trading partners the opportunity to ensure those new systems and processes are running smoothly. FDA has stressed that this stabilization period should not be viewed as a delay of the DSCSA’s November 2023 requirements, stating in its guidance, “FDA strongly urges trading partners to continue their efforts to implement necessary measures to satisfy these enhanced drug distribution security requirements.”

DSCSA Background

The DSCSA became law in 2013 and established critical steps that companies must take over 10 years to enhance the security of the pharmaceutical supply in the U.S., including the implementation of interoperable electronic systems for tracing drug transactions in the United States by Nov. 27, 2023. Over the last decade, pharmaceutical supply chain companies have implemented systems and processes to ensure the legitimacy of their suppliers and customers; established drug traceability at the lot level; added unique serialized identifiers to each prescription drug package sold in the U.S.; and implemented systems and processes to identify, investigate, and respond to suspicious and illegitimate drug products. The DSCSA’s requirements culminate on Nov. 27, 2023, with the requirement to move from lot-level traceability to individual unit- or package-level traceability. These new requirements include:

1. use of secure, interoperable electronic approaches to exchange transaction information for each individual package in the supply chain,
2. establishment of systems and processes to verify products at the package level, including saleable returns,
3. implementation of systems and processes to promptly respond with the transaction information and transaction statement for a product, upon request, in the event of a recall or investigation of suspect or illegitimate product, and
4. implementation of systems and processes to facilitate the gathering of information needed to compile the transaction information for a product going back to the manufacturer, as applicable, in the event of a recall or suspect or illegitimate product investigation.

Supply chain trading partners (including manufacturers, repackagers, wholesale distributors, pharmacies, and other dispensers) have been working for years to develop and deploy the systems and processes needed to meet those requirements. With those efforts, however, came an appreciation for just how technically complex those systems and processes are. At steady state, trading partners will be interoperably exchanging and managing data for tens of billions of individual drug package sales and purchases, and that interoperability must extend from highly sophisticated multinational corporations to mom-and-pop pharmacies with limited resources and a plateful of competing demands. The scope and granularity of this process is unrivaled across any industry.

While trading partners throughout the supply chain share a commitment to DSCSA implementation and its goal of supply chain security, it became increasingly clear that strict enforcement of the Nov. 27, 2023, requirements during the early days of system deployment would risk bringing the supply chain to a screeching halt and disrupting patient access to needed medications. A single data error in a DSCSA file could ripple through the supply chain and hold hostage hundreds or thousands of good medications. The novelty and complexity of these systems and processes is almost certain to result in a difficult-to-manage level of such errors and challenges as companies develop the necessary experience with them and implement improvements to stabilize them. Fortunately, the FDA recognized the complexity of these early days and is allowing the industry to undertake those stabilization activities without the risk that they will be forced to choose between compliance risk and patient access.

The Guidance: Time For Work, Not Delay

In its guidance — as well as remarks since its issuance — FDA makes clear that it expects trading partners to have implemented the required systems and processes by Nov. 27, 2023. The stabilization period is not an opportunity to delay implementation; rather, it is an opportunity to refine, improve, and stabilize those systems and processes without disrupting the continued flow of legitimate product. Simply stated, you cannot stabilize a system that that you are not actively using.

The FDA makes this point abundantly clear in its guidance:

“This guidance is not intended to provide, and should not be viewed as providing, a justification for delaying efforts by trading partners to implement the enhanced drug distribution security requirements under section 582(g)(1) of the FD&C Act. FDA strongly urges trading partners to continue their efforts to implement necessary measures to satisfy these enhanced drug distribution security requirements.”

The FDA also notes in its guidance that implementation must be a comprehensive collaboration among all stakeholders. Not only are thousands of trading partners bound by these new DSCSA requirements, but many other supporting organizations are as well. Some of these supporting organizations include solutions providers, standards organizations, trade and professional organizations, state authorities, and federal authorities. It is essential that these organizations all work together to understand and execute what is needed to stabilize the systems and processes for electronic unit-level tracing. One place where this collaboration can occur is through the Partnership for DSCSA Governance, a public-private partnership between the supply chain and FDA committed to defining a comprehensive framework for DSCSA interoperability.

It is essential that trading partners continue — even expedite — their DSCSA implementation activities and not use this stabilization period as an excuse to postpone implementation efforts. Any postponement will leave a trading partner further behind their peers and more likely to face FDA enforcement after the stabilization period.

Other Guidance To Pay Attention To

The FDA has also released a number of recent guidance documents pertaining to the DSCSA that will help trading partners take advantage of this stabilization period. Some of these guidance documents include:

• Further information on Enhanced Drug Distribution Security at the Package Level
• Compliance Policies for Wholesale Distributor Verification Requirement for Saleable Returned Drug Product and Dispenser Verification Requirements When Investigating a Suspect or Illegitimate Product
• Standards for the Interoperable Exchange of Information for Tracing of Certain Human, Finished, Prescription Drugs

About The Authors:

Eric Marshall is a principal in the Washington, D.C. office of Leavitt Partners and the executive director of the Partnership for DSCSA Governance (PDG), a public-private partnership between industry and FDA that is committed to implementing supply chain security protections in the U.S. At Leavitt Partners, he advises healthcare coalitions on health policy and provides consulting services to drug and device companies. A regulatory lawyer by training, he is an industry specialist in the areas of drug, device, and diagnostics regulation. A portion of Eric’s practice is focused on domestic and international supply chain security. Marshall leads Leavitt Partners’ alliance practice, helping the firm and clients with industry collaboratives committed to advancing sound health policy initiatives. Prior to joining Leavitt Partners, he practiced law, counseling healthcare and life science clients on regulatory, compliance, and transactional matters.

Zach Howard is an associate at Leavitt Partners based in Washington, D.C. His work is focused on the intersection of health law, policy, and regulation. Before joining Leavitt Partners, he worked as an attorney at a national law firm specializing in health law matters and serving healthcare provider clients. He also served as a clerk on the Select Subcommittee on the Coronavirus Crisis in the U.S. House of Representatives on the Majority (D) Side. Additionally, he served as a clerk in both the Office of the General Counsel, CMS Division, and the Office of Counsel to the Inspector General at the Department of Health and Human Services. Howard received his B.A. in American history from Washington and Lee University and his J.D. and M.H.A. from The Ohio State University.