U.S. Department of Health and Human Services 
Office of Inspector General 
Drug Supply Chain 
Security: 
Dispensers 
Received Most 
Tracing 
Information 
OEI-05-16-00550 
March 2018 
Daniel R. Levinson 
OEI-00-00-00000  Inspector General 
oig.hhs.gov 
July 2017 
oig.hhs.gov  U.S. Department of Health and Human Services 
Report in Brief 
March 2018  Office of Inspector General 
 
OEI-05-16-00550 
Drug Supply Chain Security: Dispensers 
Why OIG Did This Review 
Received Most Tracing Information  Drug diversion, counterfeiting, and 
the importation of unapproved drugs 
may result in potentially dangerous 
What OIG Found 
drugs entering the drug supply chain, 
We found that all 40 selected drug  Key Takeaway 
posing a threat to public health and 
dispensers received at least some drug  We found that selected 
product tracing information from their  dispensers are moving  safety.  To enhance the security of this 
trading partners, and 26 of these dispensers  toward full implementation  supply chain, the DSCSA requires 
received all required elements of this  of the Drug Supply Chain  trading partners in the drug supply 
chain to create a record of each drug 
information.  The remaining 14 dispensers  Security Acts (DSCSAs) 
product transaction.  The FDA can 
were missing a few of the required elements.   requirements for the tracing 
then use such records to investigate 
Two of these dispensers were unaware of the  of drug products.  However, 
Drug Supply Chain Security Act (DSCSA) and  some concerns exist about  suspect and illegitimate drug products 
and potential diversion. 
requirements for drug product tracing.  The  missing information and a 
DSCSA requires that dispensers receive  lack of awareness of DSCSA  This study is the second in a series of 
complete tracing information before  requirements.  Complete  Office of Inspector General (OIG) 
accepting ownership of a drug product.   drug product tracing  examinations of drug supply chain 
Although dispensers are generally  information can help FDA  security, each following the 
implementing the requirements for drug  and others respond to  implementation of various DSCSA 
product tracing, missing information and  potentially harmful drugs in  provisions.  The previous study found 
a lack of awareness of DSCSA requirements  the drug supply chain.  that selected wholesale distributors 
raise concerns that a complete tracing record  exchanged drug product tracing 
for a drug product may not always be  information with other trading 
available to support investigations of suspect and illegitimate drug products in  partners and about one-half of 
the supply chain.  Complete tracing information for drug products should help  wholesalers exchanged all required 
the Food and Drug Administration (FDA), State agencies, and other Federal  information. 
agencies investigate and identify harmful drugs in the supply chain to prevent 
Future OIG work will test whether 
further distribution and facilitate efficient recalls of drugs. 
drug product tracing information can 
The dispensers in this study received drug product tracing information in  be used to trace drug products 
a variety of transmission modes and formats.  This variety is a result of  through the entire drug supply chain. 
dispensers and their trading partners using different systems rather than 
adopting a standardized way to exchange this information.  Neither the DSCSA  How OIG Did This Review 
nor FDA guidance requires a uniform transmission mode or format for the  Between December 2016 and 
exchange of drug product tracing information.  February 2017, we interviewed 
40 dispensers.  These dispensers 
What OIG Recommends 
varied in size and type and included 
To facilitate dispensers compliance with the DSCSA, we recommend that FDA 
independent retail pharmacies, chain 
offer educational outreach to dispensers where appropriate.  Specifically, we 
retail pharmacies, and small and large 
recommend that FDA provide education to ensure that dispensers understand 
hospital pharmacies.  We requested 
their responsibilities to receive complete drug product tracing information from 
that dispensers submit examples of 
trading partners before taking ownership of drug products.  FDA concurred 
drug product tracing information 
with our recommendation. 
provided by their trading partners. 
Full r eport can be found at oig.hhs.gov /oei/r eports/oei-05-16-00550.asp  TABLE OF CONTENTS 
BACKGROUND  1 
Methodology  4 
FINDINGS  6 
All selected dispensers received drug product tracing information, and nearly two-thirds  6 
received everything required 
Dispensers received drug product tracing information in a variety of ways  8 
Nearly all dispensers have a system to capture and maintain drug product tracing  11 
information and reported they can retrieve it within 2 business days of a request 
CONCLUSION AND RECOMMENDATION  12 
Provide educational outreach to dispensers about DSCSA requirements for receiving drug  12 
product tracing information 
AGENCY COMMENTS AND OIG RESPONSE  13 
APPENDICES  14 
A: DSCSA Definitions  14 
B: Detailed Methodology  18 
C: Product Tracing Form  20 
D: Packing Slip  21 
E: Invoice  22 
F: Agency Comments  23 
ACKNOWLEDGMENTS  25   
 
BACKGROUND 
Objective 
To describe selected dispensers exchange of drug product tracing 
information in the drug supply chain as required by the Drug Supply Chain 
Security Act (DSCSA). 
Potentially dangerous drugs entering the drug supply chain pose a threat to 
public health and safety.  In one example from May 2015, the Food and 
Drug Administration (FDA) issued a warning that a counterfeit version of 
Botox may have been sold to doctors offices and clinics by an unlicensed 
supplier.  FDA stated that these counterfeit versions were unsafe and should 
not be used.1  Further, a 2012 congressional report raised concerns about 
the safety of drugs that pass through complex distribution networks that 
often involve secondary wholesale distributors that do not always purchase 
drugs directly from drug manufacturers.2 
To strengthen drug supply chain security and protect patients from harmful 
drugs, Congress passed the DSCSA in November 2013.3  Among other 
things, the DSCSA established drug product tracing requirements for certain 
prescription drugs.4  The DSCSA generally requires that trading partners in 
the drug supply chain (i.e., drug manufacturers, repackagers, wholesale 
distributors, and dispensers (primarily pharmacies)) exchange information 
about each drug every time a transfer of ownership occurs, creating a 
record of each trading partners ownership of the drug.  This record should 
help FDA, other appropriate State and Federal agencies, and other 
stakeholders investigate and identify harmful drugs in the supply chain to 
prevent further distribution and facilitate efficient drug recalls. 
This study is the second in a series of examinations by the Office of 
Inspector General (OIG) of drug supply chain security and the DSCSA.  This 
series will evolve as new DSCSA provisions become effective.  The previous 
study found that selected wholesale distributors exchanged drug product 
tracing information and about one-half of them exchanged all required 
 
1 FDA, Counterfeit Version of Botox Found in the United States, April 16, 2015.  Accessed at 
https://www.fda.gov/Drugs/DrugSafety/ucm443217.htm on June 14, 2017. 
2 Senate Staff Report, Shining Light on the Gray Market, June 25, 2012.  Accessed at 
https://democrats-
oversight.house.gov/sites/democrats.oversight.house.gov/files/migrated/uploads/7.25.12%20
Staff%20Report%20Shining%20Light%20on%20the%20Gray%20Market.pdf on June 14, 2017. 
3 Drug Quality and Security Act, Title II, P.L. No. 113-54 (enacted November 27, 2013), 
amending and adding sections 581 through 585 to the Federal Food, Drug, & Cosmetic Act 
(FD&C Act). 
4  582 of the FD&C Act. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               1 
OEI-05-16-00550   
information.  Future work will test whether drug product tracing information 
can be used to trace drugs through the entire drug supply chain. 
The Drug Supply Chain Security Act 
The DSCSA created a Federal framework to address vulnerabilities in the 
drug supply chain.  The DSCSA provides FDA and appropriate State and 
Federal officials with tools to trace drugs through the supply chain.  For 
example, if counterfeit drugs are discovered, this system could provide FDA 
with information to determine at what point in the drug supply chain the 
problem originated and identify where the drugs were distributed so they 
can be quarantined before they cause harm. 
The distribution of drugs from the drug manufacturer to the patient involves 
a variety of trading partners, including drug manufacturers, repackagers, 
wholesale distributors (hereinafter referred to as wholesalers), and 
dispensers.5, 6, 7, 8  Generally, drugs pass between trading partners until they 
reach the dispensing pharmacy and ultimately the patient.  Dispensers are 
typically the last trading partner in the drug supply chain.  Exhibit 1 shows 
one way drugs might flow through the drug supply chain to the dispenser.  
In this example, the dispenser purchases the drug from the wholesaler, 
which purchases the drug directly from the drug manufacturer. 
Exhibit 1: Example of Drug Supply Chain Process  
Drug 
Wholesaler Dispenser
Manufacturer
 
Source: OIG analysis of the drug supply chain, 2016. 
 
Alternatively, the distribution of drugs may involve additional trading 
partners in the drug supply chain.  For example, some transactions may 
involve an additional wholesaler or repackager that did not purchase the 
 
5 A manufacturer is defined as the person who holds a products FDA-approved application 
or license or, if a product is unapproved, the person who manufactured the product.  This 
term also includes a co-licensed partner or an affiliate of the application holder.   581(10) of 
the FD&C Act. 
6 A repackager is defined as a person who owns or operates an establishment that repacks 
and relabels a product or package for further sale or distribution without a further 
transaction.   581(16) of the FD&C Act. 
7 A wholesale distributor is defined as a person engaged in wholesale distribution.   581(29) 
of the FD&C Act. 
8 A dispenser is defined to include a retail pharmacy, hospital pharmacy, a group of chain 
pharmacies under common ownership and control, or any person legally authorized to 
dispense or administer prescription drugs.   581(3) of the FD&C Act. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               2 
OEI-05-16-00550   
drug directly from the drug manufacturer.  Although less typical, drugs also 
may pass through one dispenser to another dispenser, such as when drugs 
are not available directly from wholesalers.9 
DSCSA Requirements on Dispensers Exchange of Drug Product 
Tracing Information 
Beginning July 1, 2015, the DSCSA required dispensers and their trading 
partners to exchange drug product tracing information for transactions 
involving a product.10  DSCSA defines a product as a prescription drug in 
a finished dosage form for administration to a patient without substantial 
further manufacturing (hereinafter we refer to product as a drug 
product).11  DSCSA defines a transaction generally as the transfer of [a 
drug] product between persons in which a change of ownership occurs.12 
Drug product tracing information includes three components: transaction 
information, transaction history, and a transaction statement.  Transaction 
information is composed of 10 elements that describe the transaction, 
including drug product information, such as the National Drug Code (NDC) 
and dosage form.13, 14  Transaction history is a statement that shows the 
transaction information for each prior transaction.15  The transaction 
statement is a statement that the trading partner transferring ownership 
provides to the subsequent purchaser.16  See Appendix A for complete 
definitions. 
DSCSA Requirements on Dispensers Maintenance of Drug Product 
Tracing Information 
Beginning July 1, 2015, the DSCSA also required dispensers to capture drug 
product tracing information and maintain it for not less than 6 years after 
the transaction.17  Dispensers may contract with a third party to maintain 
drug product tracing information on their behalf.18  Dispensers must capture 
and maintain this information so they can retrieve it in the event of a recall 
or for the purposes of investigating a suspect or illegitimate drug product.  
 
9 These transactions are not subject to DSCSA drug product tracing requirements when 
dispensers sell drugs to another dispenser to fulfill a specific patient need.   582(d)(1)(A)(ii) of 
the FD&C Act. 
10  582(d)(1) of the FD&C Act. 
11  581(13) of the FD&C Act.  The definition of product is limited by exemptions listed in 
Appendix A. 
12  581(24)(A) of the FD&C Act. 
13  581(26) of the FD&C Act. 
14 Drugs are identified using a unique, three-segment number called NDC, which serves as a 
universal product identifier for drugs.  Definition available at 
http://www.fda.gov/Drugs/InformationOnDrugs/ucm142438.htm. 
15  581(25) of the FD&C Act. 
16  581(27) of the FD&C Act. 
17  582(d)(1)(A)(iii) of the FD&C Act. 
18  582(d)(1)(B) of the FD&C Act. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               3 
OEI-05-16-00550   
Upon a request by FDA or other appropriate Federal or State officials, 
dispensers generally must provide the drug product tracing information 
within 2 business days.19  The DSCSA does not require dispensers to capture 
and maintain drug product tracing information using any specific system or 
process. 
FDA Guidance on Exchanging Drug Product Tracing Information 
FDA guidance outlines general parameters for the interoperable exchange 
of drug product tracing information but does not require that trading 
partners exchange drug product tracing information in the same way.20  
Instead, the guidance provides trading partners with latitude to choose how 
they exchange information.  For example, trading partners may exchange 
drug product tracing information using any transmission mode, including 
electronic data interchange advance ship notices (EDI/ASN), web portals, 
and paper.  In addition, trading partners may exchange information in any 
format, including product tracing forms, packing slips, and invoices. 
FDA twice delayed enforcement of drug product tracing requirements for 
dispensersultimately postponing action against dispensers that did not 
comply with DSCSA until March 1, 2016.  Most recently, FDA announced that 
it did not intend to take action against dispensers who, prior to 
March 1, 2016, accepted ownership of a drug product without receiving 
tracing information.21  This delay was in response to smaller, independent 
dispensers concerns that they need additional time to work with trading 
partners to ensure they can capture and maintain the required drug product 
tracing information.22 
FDA also has communicated with trading partners, including dispensers, 
about DSCSA requirements by hosting events and presenting at 
professional conferences.  For example, FDA held a public meeting to 
provide information to and gather information from trading partners about 
efforts to implement DSCSA requirements.  FDA also held a webinar 
focused on guidance for identification and notification of suspect drug 
product.23 
This study reviewed a nonrepresentative selection of 40 dispensers of 
Methodology 
varying size and type.  The 40 were composed of 15 small independent 
retail pharmacies; 15 large chain retail pharmacies; 5 small inpatient hospital 
 
19  582(d)(1)(D) of the FD&C Act. 
20 FDA, DSCSA Standards for the Interoperable Exchange of Information for Tracing of Certain 
Human, Finished, Prescription Drugs: How to Exchange Product Tracing Information Draft 
Guidance, November 2014. 
21 FDA, DSCSA Implementation: Product Tracing Requirements for Dispensers  Compliance 
Policy Guidance for Industry Revised October 2015.  Accessed at 
https://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidanc
es/UCM453225.pdf on June 14, 2017. 
22 Ibid. 
23 FDA, Guidance for Industry Drug Supply Chain Security Act (DSCSA) Implementation: 
Identification of Suspect Product and Notification, webinar held December 2016. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               4 
OEI-05-16-00550   
pharmacies; and 5 large inpatient hospitals.  We used the National Council 
for Prescription Drug Programs (NCPDPs) definitions of independent 
pharmacies as dispensers with one to three locations and chain 
pharmacies as dispensers with four or more locations.  We designated 
inpatient hospital dispensers as small or large on the basis of the hospital 
bed count.  For more detail about the sample selection, see Appendix B. 
To address our objective, we first requested that dispensers submit 
examples of drug product tracing information provided to them by their 
trading partners.  Next, we conducted phone interviews with dispensers to 
ask about the drug product tracing information and about their 
implementation of the drug product tracing requirements.  For chain retail 
pharmacies and inpatient hospitals, we interviewed staff who were primarily 
pharmacy directors.  For independent retail pharmacies, we interviewed 
owners or presidents. 
We collected this information between December 2016 and February 2017.  
We conducted our data collection in this timeframe9 months after FDA 
began enforcing the dispenser drug product tracing requirementsto give 
dispensers time to implement and comply with the provisions. 
We focused on dispensers receipt of drug product tracing information 
because this most represents their role at the end of the drug supply chain.  
During interviews, OIG determined that only one of the 40 selected 
dispensers sold drug products to other dispensers.  We did not include this 
exchange in our analysis of drug product tracing information. 
Limitations 
We based our findings on dispensers self-reported information from 
interviews and on examples of drug product tracing information that the 
dispensers provided.  We did not independently verify the responses.  Our 
findings represent only the 40 selected dispensers and cannot be projected 
to the whole population of dispensers. 
Standards  This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
   
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               5 
OEI-05-16-00550   
FINDINGS 
All 40 selected dispensers reported they received at least some drug 
All selected 
product tracing information from their trading partners as required by 
dispensers received 
DSCSA, and, of these, 26 dispensers received all required elements (i.e., 
drug product 
transaction information, transaction history, and transaction statements).  
tracing information,  As the last partner in the supply chain, dispensers primarily receive drug 
product tracing information from wholesalers and manufacturers. 
and nearly 
two-thirds received 
Of the 40 dispensers, 14 did not receive all required drug product 
everything required  tracing information 
Fourteen dispensers did not receive one or more required elements of drug 
product tracing information.  DSCSA requires that dispensers receive 
complete drug product tracing information prior to accepting ownership of 
a drug product.24  FDA guidance notes that missing drug product tracing 
information may be an indication that the drug product is suspect or 
illegitimate, significantly increases the risk of a suspect product entering the 
supply chain, and warrants heightened scrutiny.25  Exhibit 2 (on the next 
page) shows which drug product tracing information each dispenser was 
missing. 
The 14 dispensers that were missing drug product tracing information 
included 6 independent, 5 chain, and 3 hospital pharmacies.  Two of these 
fourteen dispensers were independent dispensers that reported not 
knowing about DSCSA and not being aware of drug product tracing 
requirements.  The invoices they received contained some drug product 
tracing information. 
 
   
 
24  582(d)(1)(A)(i) of the FD&C Act. 
25 FDA, Drug Supply Chain Security Act Implementation: Identification of Suspect Product and 
Notification Guidance for Industry, December 2016, p. 5.  Accessed at 
https://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidanc
es/UCM400470.pdf on June 15, 2017. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               6 
OEI-05-16-00550   
Exhibit 2: Fourteen Dispensers Were Missing Elements of Drug Product Tracing Information 
Dispenser  Type/Size of Pharmacy  Drug Product Tracing Information 
    Transaction Information  Transaction  Transaction 
Statement  History 
    Strength  Dosage  Transaction     
Form  Date 
1  Independent          Missing 
2  Independent  Missing         
3*  Independent        Missing   
4  Independent  Missing  Missing       
5  Independent    Missing       
6*  Independent        Missing   
7  Chain      Missing  Missing   
8  Chain        Missing   
9  Chain      Missing     
10  Chain  Missing         
11  Chain        Missing   
12  Hospital/Small    Missing       
13  Hospital/Large    Missing    Missing   
14  Hospital/Large    Missing       
Total dispensers missing information  9  6  1 
Source: OIG analysis of dispenser interview notes and product tracing examples, 2017. 
* Dispensers that were unaware of DSCSA drug product tracing requirements. 
 
Nine dispensers were missing one or more elements of transaction 
information.  Dosage form was the most common element of the 
transaction information that was missing.  Dispensers gave some 
explanations for missing dosage form, noting that the dosage form may be 
included in the drug product name (e.g., Spiriva HandiHaler, which is an 
inhaler) or that they can determine the dosage form by looking up 
information associated with the NDC.  Although the NDC is one way to 
determine the dosage form, the DSCSA requires that the transaction 
information include both the NDC and dosage form. 
Six dispensers were missing a transaction statement, which indicates the 
seller adhered to the DSCSA and that it, among other things, received 
transaction information and a transaction statement from the drug 
products prior owner.26 
Of the 40 dispensers, 25 do not review drug product tracing 
information, and they may not be aware of missing information 
Twenty-five selected dispensers reported that they never review the drug 
product tracing information they receive.  Of these, 13 dispensers were 
 
26  581(27) of the FD&C Act. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               7 
OEI-05-16-00550   
missing drug product tracing information and 12 had complete drug 
product tracing information.  Although the DSCSA does not explicitly 
require dispensers to review drug product tracing information, the law 
prohibits dispensers from accepting ownership of a drug product without 
having received drug product tracing information prior to, or at the time of, 
the transaction.27  Unless dispensers review the drug product tracing 
information they receive, they cannot know if any information is missing or 
whether the transaction complies with the DSCSA. 
Four dispensers in this study reported that they always review drug product 
tracing information; these dispensers had complete drug product tracing 
information.  Reviewing drug product tracing information gives dispensers 
an opportunity to see if information is missing and take additional steps to 
investigate if necessary.  Reviewing drug product tracing information also 
should help dispensers identify suspect drug products for possible 
quarantine and investigation and protect public health and safety by 
decreasing the risk of a dangerous drug product entering the supply chain. 
 
Dispensers received  Dispensers in this study received drug product tracing information in a 
variety of transmission modes and formatsmeaning they received drug 
drug product 
product tracing information through, for example, paper invoices, packing 
tracing information 
slips, emails, and web portals.  This variety is a result of dispensers and their 
in a variety of ways  trading partners using different systems rather than adopting a 
standardized way to exchange this information.  Neither the DSCSA nor 
FDAs guidance require the exchange of drug product tracing information in 
the same way.  Drug product tracing information was missing from 
information transmitted using paper and web portals and among all formats 
used by dispensers in this study. 
Dispensers received drug product tracing information using four 
different transmission modes: web portals, paper, EDI/ASN, and 
email 
Dispensers reported receiving drug product tracing information using four 
different transmission modeswith more than half of dispensers using 
multiple modes.  The mode refers to the manner in which drug product 
tracing information is transmitted.  Exhibit 3 (on the next page) illustrates 
the modes that the 40 dispensers in this study used to receive drug product 
tracing information. 
   
 
27  582(d)(1)(A)(i) of the FD&C Act. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               8 
OEI-05-16-00550   
Exhibit 3: Dispensers Received Drug Product Tracing Information 
Using a Variety of Transmission Modes 
36
28
8
3
Web Portal Paper EDI/ASN Email
 
Source: OIG dispenser interviews and drug product tracing examples, 2017. 
Note: Numbers do not add to 40 because dispensers received drug product tracing information in 
multiple modes. 
 
Web portals are the most common transmission mode reported by 
dispensers in this study.  Dispensers primarily received drug product tracing 
information through web portals.  Wholesalers provide drug product tracing 
information through the same web portal system that dispensers use to 
place drug orders.  Because they use an existing system, wholesalers and 
dispensers do not need to have new software to exchange this 
information.28 
Paper is the second most common transmission mode reported by 
dispensers in this study.  Paper was most commonly used for drug products 
shipped directly from manufacturers. 
Eight selected dispensers received drug product tracing information 
through EDI/ASN.  These dispensers are chain pharmacies, and one is a 
large hospital.  EDI/ASN is a set of standardized, structured fields used to 
electronically communicate the contents of a shipment to a customer.29  No 
independent pharmacies or small hospitals reported using EDI/ASN, and 
many were unaware of the technology. 
 
28 OIG, Drug Supply Chain Security: Wholesalers Exchanging Most Tracing Information, 
OEI-05-14-00640, September 2017. 
29 1EDISource, EDI 856 Overview.  Accessed at http://www.1edisource.com/transaction-
sets?tset=856 on May 9, 2017. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               9 
OEI-05-16-00550   
Dispensers received drug product tracing information in three 
different formats: product tracing forms, packing slips, and invoices 
Dispensers reported receiving drug product tracing information in three 
formatswith more than half receiving multiple formats.  The format refers 
to the way in which drug product tracing information is organized and 
presented.  Exhibit 4 illustrates the prevalence of each format in which the 
40 dispensers in this study received drug product tracing information. 
Exhibit 4: Dispensers Received Drug Product Tracing Information in a 
Variety of Formats 
36
23
15
Product Tracing Form Packing Slip Invoices
 
Source: OIG dispenser interviews and drug product tracing examples, 2017. 
Note: Numbers do not add to 40 because dispensers received drug product tracing information in 
multiple formats. 
 
Dispensers in this study most commonly received drug product tracing 
information on product tracing forms.  Product tracing forms are designed 
specifically to capture and clearly represent drug product tracing 
information.  See Appendix C for an example of a product tracing form. 
Dispensers also reported that they received drug product tracing 
information on packing slips and invoices.  Packing slips detail the contents 
of shipments.  Packing slips were most commonly provided with drug 
products shipped directly from manufacturers.  Invoices include information 
about the drug products being received and the prices charged for those 
drug products.  Packing slips and invoices can be modified so they include 
all necessary elements of drug product tracing information.  See 
Appendices D and E, respectively, for examples of a packing slip and 
invoice.   
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               10 
OEI-05-16-00550   
Nearly all dispensers  Nearly all dispensers reported that they capture and maintain drug product 
tracing information and can retrieve information within 2 business days of a 
have a system to 
request.  DSCSA requires dispensers to capture and maintain drug product 
capture and 
tracing information for at least 6 years and provide it generally within 2 days 
maintain drug  of a request by FDA or other appropriate Federal or State official.30, 31  The 
two independent dispensers unaware of the DSCSA drug product tracing 
product tracing 
requirements are not actively capturing or maintaining the information and 
information and 
would be unable to independently retrieve it. 
reported they can 
Thirty-eight dispensers capture and maintain drug product tracing 
retrieve it within 
information on web portals, paper storage, or computer servers.  About half 
2 business days of a  of dispensers capture and maintain the information using multiple storage 
request  systems.  Independent dispensers stated that they rely on their suppliers to 
capture and maintain drug product tracing information on web portals 
because they do not have the resourcestime, staff, or moneyto create 
i
and maintain their own storage systems. 
s
Tphe same 38 dispensers reported that they should be able to provide drug 
peroduct tracing information within 2 business days of a request.  Although 
nnone of these dispensers have been asked to retrieve the information by 
FDA or another Federal or State official, most reported that they do not 
s
anticipate problems retrieving it because the information is primarily 
e
maintained on web portals. 
r
 s 
 h
a
 
v
 
e 
 a 
 w
a
 
y 
 
t
 
o 
  m
a
 
i
  n
t
 
a
  i
n 
d
 
r
30  582(d)(1)(A)(iii) of the FD&C Act. 
3u1  582(d)(1)(D) of the FD&C Act. 
Drug Supply Chain Security: Dispensergs  Received Most Tracing Information                                                               11 
OEI-05-16-00550 
p
r
o  
CONCLUSION AND RECOMMENDATION 
We found that all selected dispensers received drug product tracing 
information, and nearly two-thirds received all required information.  
Dispensers received this information in a variety of ways.  Further, nearly all 
dispensers had a way to capture, maintain, and retrieve information. 
Although our results show that, on the whole, selected dispensers are 
moving toward full implementation of drug product tracing requirements, 
some concerns exist.  In particular, a third of dispensers were missing some 
required information, and two independent dispensers were unaware of 
DSCSA and the drug product tracing requirements.  These results raise 
concerns that complete drug product tracing information may not always 
be available to help facilitate a recall or support an investigation by FDA or 
another agency into suspect and illegitimate drug products in the supply 
chain.  Ultimately, dispensers receipt and review of complete drug product 
tracing information can help ensure the security of the drug supply chain 
and protect patients from harmful drugs that have entered. 
This study is the second in a series examining drug supply chain security 
and the implementation of the DSCSA.  In previous work, we determined 
that all selected wholesalers exchanged drug product tracing information, 
and about half exchanged all required elements.  Building on the results of 
these studies, future OIG work will determine the extent to which drug 
product tracing information can be used to trace drugs through the entire 
supply chain. 
For this study, we recommend that FDA provide educational outreach to 
facilitate dispensers compliance with the DSCSA.  Specifically, we 
recommend that FDA should: 
Provide educational outreach to dispensers about DSCSA 
requirements for receiving drug product tracing information 
FDA should provide educational outreach to dispensers to make sure they 
are aware of their responsibilities to receive complete drug product tracing 
information from suppliers prior to, or at the time of, taking ownership.  
FDA also should consider providing specific educational outreach to 
independent pharmacies, which may have limited resources for legal 
advising or other education.  The two dispensers in this study that were 
unaware of DSCSA were independent pharmacies.  For instance, FDA could 
provide additional outreach by holding a webinar, creating a frequently 
asked questions document, or speaking at a dispenser conference. 
 
 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               12 
OEI-05-16-00550   
AGENCY COMMENTS AND OIG RESPONSE 
FDA concurred with our recommendation. 
FDA intends to review its dispenser communications plan and identify and 
create opportunities to work with dispenser-centric trade and professional 
organizations to provide additional education and outreach.  FDA also 
noted that, as the last trading partner in the supply chain before a drug 
product is dispensed to a patient, dispensers play a vital role in ensuring 
patient safety; therefore, it is essential that dispensers understand their 
product tracing responsibilities under DSCSA. 
For the full text of FDAs response, see Appendix F. 
   
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               13 
OEI-05-16-00550   
APPENDIX A: DSCSA Definitions 
Transaction ( 581(24) of the FD&C Act) 
Transaction 
(A) In General.The term transaction means the transfer of product 
between persons in which a change of ownership occurs. 
(B) Exemptions.The term transaction does not include 
(i) intracompany distribution of any product between members of an 
affiliate or within a manufacturer; 
(ii) the distribution of a product among hospitals or other health care 
entities that are under common control; 
(iii) the distribution of a product for emergency medical reasons 
including a public health emergency declaration pursuant to section 319 
of the Public Health Service Act, except that a drug shortage not caused 
by a public health emergency shall not constitute an emergency medical 
reason; 
(iv) the dispensing of a product pursuant to a prescription executed in 
accordance with section 503(b)(1); 
(v) the distribution of product samples by a manufacturer or a licensed 
wholesale distributor in accordance with section 503(d); 
(vi) the distribution of blood or blood components intended for 
transfusion; 
(vii) the distribution of minimal quantities of product by a licensed retail 
pharmacy to a licensed practitioner for office use; 
(viii) the sale, purchase, or trade of a drug or an offer to sell, purchase, 
or trade a drug by a charitable organization described in section 
501(c)(3) of the Internal Revenue Code of 1986 to a nonprofit affiliate of 
the organization to the extent otherwise permitted by law; 
(ix) the distribution of a product pursuant to the sale or merger of a 
pharmacy or pharmacies or a wholesale distributor or wholesale 
distributors, except that any records required to be maintained for the 
product shall be transferred to the new owner of the pharmacy or 
pharmacies or wholesale distributor or wholesale distributors; 
(x) the dispensing of a product approved under section 512(c); 
(xi) products transferred to or from any facility that is licensed by the 
Nuclear Regulatory Commission or by a State pursuant to an agreement 
with such Commission under section 274 of the Atomic Energy Act of 
1954 (42 U.S.C. 2021); 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               14 
OEI-05-16-00550   
(xii) a combination product that is not subject to approval under section 
505 or licensure under section 351 of the Public Health Service Act, and 
that is 
(I) a product comprised of a device and 1 or more other regulated 
components (such as a drug/device, biologic/device, or 
drug/device/biologic) that are physically, chemically, or otherwise 
combined or mixed and produced as a single entity; 
(II) 2 or more separate products packaged together in a single 
package or as a unit and comprised of a drug and device or device 
and biological product; or 
(III) 2 or more finished medical devices plus one or more drug or 
biological products that are packaged together in what is referred to 
as a medical convenience kit as described in clause (xiii); 
(xiii) the distribution of a collection of finished medical devices, which 
may include a product or biological product, assembled in kit form 
strictly for the convenience of the purchaser or user (referred to in this 
clause as a medical convenience kit) if 
(I) the medical convenience kit is assembled in an establishment that 
is registered with the Food and Drug Administration as a device 
manufacturer in accordance with section 510(b)(2); 
(II) the medical convenience kit does not contain a controlled 
substance that appears in a schedule contained in the 
Comprehensive Drug Abuse Prevention and Control Act of 1970; 
(III) in the case of a medical convenience kit that includes a product, 
the person that manufacturers the kit 
(aa) purchased such product directly from the pharmaceutical 
manufacturer or from a wholesale distributor that purchased the 
product directly from the pharmaceutical manufacturer; and 
(bb) does not alter the primary container or label of the product 
as purchased from the manufacturer or wholesale distributor; 
and 
(IV) in the case of a medical convenience kit that includes a product, 
the product is 
(aa) an intravenous solution intended for the replenishment of 
fluids and electrolytes; 
(bb) a product intended to maintain the equilibrium of water 
and minerals in the body; 
(cc) a product intended for irrigation or reconstitution; 
(dd) an anesthetic; 
(ee) an anticoagulant; 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               15 
OEI-05-16-00550   
(ff) a vasopressor; or 
(gg) a sympathomimetic; 
(xiv) the distribution of an intravenous product that, by its formulation, is 
intended for the replenishment of fluids and electrolytes (such as 
sodium, chloride, and potassium) or calories (such as dextrose and 
amino acids); 
(xv) the distribution of an intravenous product used to maintain the 
equilibrium of water and minerals in the body, such as dialysis solutions; 
(xvi) the distribution of a product that is intended for irrigation, or sterile 
water, whether intended for such purposes or for injection; 
(xvii) the distribution of a medical gas (as defined in section 575); or 
(xviii) the distribution or sale of any licensed product under section 351 
of the Public Health Service Act that meets the definition of a device 
under section 201(h). 
Transaction history ( 581(25) of the FD&C Act) 
The term transaction history means a statement in paper or electronic 
form, including the transaction information for each prior transaction going 
back to the manufacturer of the product. 
Transaction information ( 581(26) of the FD&C Act) 
The term transaction information means 
(A) the proprietary or established name or names of the product; 
(B) the strength and dosage form of the product; 
(C) the National Drug Code of the product; 
(D) the container size; 
(E) the number of containers; 
(F) the lot number of the product; 
(G) the date of the transaction; 
(H) the date of the shipment, if more than 24 hours after the date of the 
transaction; 
(I) the business name and address of the person from whom ownership is 
being transferred; and 
(J) the business name and address of the person to whom ownership is 
being transferred. 
Transaction statement ( 581(27) of the FD&C Act) 
The transaction statement is a statement, in paper or electronic form, that 
the entity transferring ownership in a transaction 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               16 
OEI-05-16-00550   
(A) is authorized as required under DSCSA; 
(B) received the product from a person that is authorized as required under 
the DSCSA; 
(C) received transaction information and a transaction statement from the 
prior owner of the product, as required under section 582; 
(D) did not knowingly ship a suspect or illegitimate product; 
(E) had systems and processes in place to comply with verification 
requirements under section 582; 
(F) did not knowingly provide false transaction information; and 
(G) did not knowingly alter the transaction history. 
Product ( 581(13) of the FD&C Act) 
The term product means a prescription drug in a finished dosage form for 
administration to a patient without substantial further manufacturing (such 
as capsules, tablets, and lyophilized products before reconstitution), but for 
purposes of section 582, does not include blood or blood components 
intended for transfusion, radioactive drugs or radioactive biological 
products (as defined in section 600.3(ee) of title 21, Code of Federal 
Regulations) that are regulated by the Nuclear Regulatory Commission or 
by a State pursuant to an agreement with such Commission under 
section 274 of the Atomic Energy Act of 1954 (42 U.S.C. 2021), imaging 
drugs, an intravenous product described in clause (xiv), (xv), or (xvi) of 
paragraph (24)(B), any medical gas (as defined in section 575), homeopathic 
drugs marketed in accordance with applicable guidance under this Act, or a 
drug compounded in compliance with section 503A or 503B. 
 
 
 
 
 
 
 
 
 
 
 
 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               17 
OEI-05-16-00550   
APPENDIX B: Detailed Methodology 
Sample Selection 
We selected our nonrepresentative, random sample of dispensers from two 
Centers for Medicare & Medicaid Services sources: Prescription Drug Event 
(PDE) data and Provider of Services (POS) data.32  We used PDE data from 
August 2016 to select retail pharmacies.  We used POS data from 
September 2016 to select hospital pharmacies.  To address variations in 
practices dependent on size of the business, we first categorized each retail 
pharmacy as independent or chain and each hospital pharmacy as small or 
large. 
Retail Pharmacies.  To select our random sample of retail pharmacies, we 
identified dispensers with dates of service between July 2015 and June 2016 
to ensure we were selecting active dispensers.  We then categorized 
dispensers using the independent and chain type codes in NCPDPs 
Pharmacy Database File.  Independent pharmacies included dispensers with 
one to three locations operating under common ownership.  Chain 
pharmacies included dispensers with four or more locations operating 
under common ownership.  To obtain dispenser contact information, we 
used the NCPDP Pharmacy Database File and matched dispensers using 
their National Provider Identifier from PDE data.  NCPDPs Pharmacy 
Database File contains information about provider types, provider address, 
and ownership and affiliation information, among others.  We did not 
include in our sample specific types of dispensers that are not subject to 
DSCSA drug product tracing requirements, such as compounding 
pharmacies, which primarily handle exempt products. 
Hospital Pharmacies.  To select our random sample of hospital pharmacies, 
we selected only hospitals with an active provider status.  We categorized 
hospitals as small or large on the basis of the number of beds reported in 
POS data.  We removed hospitals that reported having zero beds.  The 
median number of beds was 84, so we defined the small group as those 
with 84 or fewer beds and the large group as those with more than 84 beds. 
Exhibit 5, on the next page, describes the number and type of dispensers in 
our final sample. 
   
 
32 Provider of Services data contains characteristics of hospitals, including the facilitys name 
and address, number of beds, and the type of Medicare services provided. 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               18 
OEI-05-16-00550   
 
Exhibit 5: Dispenser Sample 
Dispenser Size  Data Source  Sample Size 
Small retail pharmacies (i.e., independent pharmacies)  PDE  15 
Large retail pharmacies (i.e., chain pharmacies)  PDE  15 
Small, inpatient hospital pharmacies  POS  5 
Large, inpatient hospital pharmacies  POS  5 
   Total  40 
Source: OIG analysis and sampling of PDE and POS data sources, 2016. 
   
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               19 
OEI-05-16-00550   
APPENDIX C: Product Tracing Form 
 
   
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               20 
OEI-05-16-00550   
APPENDIX D: Packing Slip 
 
 
 
 
 
 
 
   
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               21 
OEI-05-16-00550   
APPENDIX E: Invoice 
 
 
   
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               22 
OEI-05-16-00550   
APPENDIX F: Agency Comments 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               23 
OEI-05-16-00550   
   
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               24 
OEI-05-16-00550   
ACKNOWLEDGMENTS 
Melissa Baker served as the team leader for this study.  Others in the Office 
of Evaluation and Inspections who conducted the study include Kayla Phelps 
and Sarah Vogel.  Office of Evaluation and Inspections staff who provided 
support include Althea Hosein, Seta Hovagimian, and Meghan Kearns. 
We also would like to acknowledge the contributions of other Office of 
Inspector General staff, including Eddie Baker, Christine Moritz, Berivan 
Demir Neubert, and Peter Taschenberger. 
This report was prepared under the direction of Thomas F. Komaniecki, 
Regional Inspector General for Evaluation and Inspections in the Chicago 
regional office, and Laura Kordish and Kelly Waldhoff, Deputy Regional 
Inspectors General. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               25 
OEI-05-16-00550   
ABOUT THE OFFICE OF INSPECTOR GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by Public 
Law 95-452, as amended, is to protect the integrity of the Department of 
Health and Human Services (HHS) programs, as well as the health and 
welfare of beneficiaries served by those programs.  This statutory mission is 
carried out through a nationwide network of audits, investigations, and 
inspections conducted by the following operating components: 
Office of Audit  The Office of Audit Services (OAS) provides auditing services for HHS, either 
by conducting audits with its own audit resources or by overseeing audit 
Services 
work done by others.  Audits examine the performance of HHS programs 
and/or its grantees and contractors in carrying out their respective 
responsibilities and are intended to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, 
abuse, and mismanagement and promote economy and efficiency 
throughout HHS. 
Office of Evaluation  The Office of Evaluation and Inspections (OEI) conducts national evaluations 
to provide HHS, Congress, and the public with timely, useful, and reliable 
and Inspections 
information on significant issues.  These evaluations focus on preventing 
fraud, waste, or abuse and promoting economy, efficiency, and 
effectiveness of departmental programs.  To promote impact, OEI reports 
also present practical recommendations for improving program operations.   
Office of  The Office of Investigations (OI) conducts criminal, civil, and administrative 
investigations of fraud and misconduct related to HHS programs, 
Investigations 
operations, and beneficiaries.  With investigators working in all 50 States 
and the District of Columbia, OI utilizes its resources by actively 
coordinating with the Department of Justice and other Federal, State, and 
local law enforcement authorities.  The investigative efforts of OI often lead 
to criminal convictions, administrative sanctions, and/or civil monetary 
penalties. 
Office of Counsel to  The Office of Counsel to the Inspector General (OCIG) provides general 
legal services to OIG, rendering advice and opinions on HHS programs and 
the Inspector 
operations and providing all legal support for OIGs internal operations.  
General 
OCIG represents OIG in all civil and administrative fraud and abuse cases 
involving HHS programs, including False Claims Act, program exclusion, and 
civil monetary penalty cases.  In connection with these cases, OCIG also 
negotiates and monitors corporate integrity agreements.  OCIG renders 
advisory opinions, issues compliance program guidance, publishes fraud 
alerts, and provides other guidance to the health care industry concerning 
the anti-kickback statute and other OIG enforcement authorities. 
 
Drug Supply Chain Security: Dispensers Received Most Tracing Information                                                               26 
OEI-05-16-00550