Mobile Barcode Scanning for DSCSA Compliance

More than a decade ago, the Drug Supply Chain Security Act (DSCSA) was enacted to create a more secure pharmaceutical supply chain in the US.

Its final phase was originally set to be fully implemented by November 27, 2023. However, the Food and Drug Administration (FDA) has exempted various stakeholders from enforcement into 2025 to prevent disruptions in the pharmaceutical supply chain.

In this article, we break down the DSCSA regulations and responsibilities. We’ll also explore the role mobile barcode scanning plays for distributors and dispensers.

Understanding the core of the DSCSA

The DSCSA was prompted by several incidents of counterfeit drugs entering the US pharmaceutical supply chain. Its chief goal is to enhance drug security, and it does so by mandating comprehensive product traceability and verification of supply chain stakeholders.

In the following, we’ll break down the core requirements of the DSCSA, what each stakeholder has to do, and the implementation timeline.

What are the main requirements of the DSCSA?

To achieve seamless traceability and product verification throughout all stages of the pharmaceutical supply chain, the FDA established the following principles for DSCSA compliance:

Serialization

Every package and homogeneous case of prescription drugs must have a Unique Product Identifier (UPI). The UPI must contain a National Drug Code (NDC), a unique serial number, a lot number, and the product expiration date. All this information must be printed both in human-readable text and as a machine-readable GS1 DataMatrix barcode.

Traceability

The DSCSA mandates that the movement and ownership of every pharmaceutical product must be traceable throughout the supply chain. For this, the data has to be shared securely and electronically through interoperable systems using the GS1 EPCIS standard.

To achieve this, it defines three types of product tracing information to be exchanged between trading partners at every transfer:

Transaction Information (TI): contains details about the prescription drug product and the specific transaction
Transaction History (TH): a record of all prior transactions for a product, documenting its chain of ownership throughout the supply chain
Transaction Statement (TS): a statement from the seller attesting to compliance with DSCSA requirements

Verification

Trading partners are required to quarantine and investigate products they suspect to be counterfeit or unsafe. They also have to notify the appropriate parties. To detect suspicious items, they are obliged to have systems for product identifier authentication.

Authorized Trading Partners

Only Authorized Trading Partners (ATP) can be involved in the manufacturing, repackaging, wholesale distribution, third party logistics, and dispensing of prescription drugs. To ensure this, all participants in the pharmaceutical supply chain must be licensed or registered with the FDA.

Electronic, interoperable system

All stakeholders must use a secure electronic system that is interoperable across partners for real-time sharing of product tracing and verification data. The FDA recommends usage of the GS1 EPCIS standard, which fulfills all electronic data exchange requirements of the DSCSA.

Recordkeeping

All transaction records must be stored and accessible for audits, inspections, and investigations by the FDA or other regulatory authorities for at least 6 years.

Who has to do what?

Now that we have looked at the core demands of the DSCSA, let’s walk through what different stakeholders are responsible for.

DSCSA requirement	Manufacturers	Repackagers	Wholesale distributors	Dispensers (pharmacies)	Third-party logistics providers (3PLs)
Affix Product Identifier to packages/cases	✓	✓	✗	✗	✗
Maintain Product Identifier information for 6 years	✓	✓	✗	✗	✗
Engage only with Authorized Trading Partners (ATPs)	✓	✓	✓	✓	✓
Receive electronic Transaction Information (TI) and Statement (TS)	✓	✓	✓	✓	✓
Provide electronic TI and TS to subsequent owners	✓	✓	✓	✓	✗
Maintain transaction data for 6 years	✓	✓	✓	✓	✗
Quarantine and investigate suspect products	✓	✓	✓	✓	✓
Notify FDA/trading partners of illegitimate products within 24 hours	✓	✓	✓	✓	✓
Retain investigation records for 6 years	✓	✓	✓	✓	✓
Verify product identifiers on returned salable products	✓	✓	✓	✓	✗
Respond to ATP verification requests within a specified timeframe	✓	✓	✓	✗	✗
Report licenses/registrations to the FDA annually	✓	✓	✓	✗	✓
Maintain license/registration with a state or federal authority	✓	✓	✓	✓	✓

Implementation timeline and penalties

Although the implementation timeline is already advanced, and enforcement in effect for most stakeholders, some have been granted more implementation time.

Let’s first review what should have already happened:

November 27, 2013: rolling introduction of requirements for manufacturer lot numbers, serialization, repackager and wholesaler compliance, authorized trading partner mandates, and responsibilities for data exchange and verification
November 27, 2023: official start date for the full interoperable electronic unit-level traceability requirements. All trading partners should now have systems in place to electronically exchange serialized data for prescription drugs.
November 27, 2024: a FDA-announced stabilization period suspended the enforcement of most requirements for a year after the start date. This allowed stakeholders additional time to get their systems operational.

In practice, stakeholders widely experienced technical challenges when implementing the new electronic data exchange and traceability systems. In October 2024, in response to these industry concerns, the FDA granted staggered enforcement exemptions into 2025 and 2026. With this, the FDA aimed to prevent disruptions in the pharmaceutical supply chain that could lead to drug shortages or delays in patient access to essential medications.

This resulted in a new timeline:

May 27, 2025: For manufacturers & repackagers
August 27, 2025: For wholesale distributors
November 27, 2025: For large dispensers (with 26 or more employees)
November 27, 2026: For small dispensers (with 25 or fewer employees)

After these dates, all entities in the drug supply chain are expected to comply fully with the DSCSA’s requirements.

If stakeholders fail to comply with DSCSA standards, the FDA can take enforcement actions, from warning letters and fines to license suspension and other regulatory penalties.

Building a robust DSCSA solution with mobile barcode scanning

As DSCSA implementation is already challenging, a solution must offer advanced capabilities that streamline operations, mitigate risks, and provide strategic advantages.

The FDA recommends using interoperable electronic systems that conform to the GS1 EPCIS standards, as this ensures compatibility across different technologies and companies. Considerations for self-built systems

Building compliance systems in-house involves developing or integrating a host of functionalities, including barcode scanning, data capture, serialization, secure data exchange, verification, and tracing.

Developers have to keep the following aspects in mind:

The system must be able to create, store, and share serialized product data securely.
It must support EPCIS event reporting, and the exchange of TI, TH, and TS mandated by the DSCSA.
It should seamlessly integrate with existing ERP, warehouse, and inventory management systems to maintain operational efficiency.
Security control and compliance monitoring functionalities are crucial to protect sensitive data and prove regulatory requirements are met.
Exceptions such as damaged products, counterfeits, or returns can occur, and the system must be able to identify, manage, and report them.

Integrating a mobile barcode scanner

Barcode scanning technology has long evolved beyond bulky, dedicated scanner devices. Advances in image-processing technology have enabled regular smart devices to become fast and accurate barcode scanners.

With modern barcode scanning software, they are capable of processing multiple barcodes at once and reliably reading barcodes in less-than-ideal conditions. Moreover, mobile barcode scanners provide operational flexibility by allowing scanning anywhere, anytime – at receiving docks, in warehouses, or at the pharmacy counter.

One such software is the Scanbot Barcode Scanner SDK. Its features and benefits make it ideal for DSCSA compliance solutions:

Rapid, accurate scanning: With the Scanbot SDK, smart devices can scan drug packaging and cases fast and accurately. Barcode damage or low lighting present no problem.
Barcode support: The SDK reads all common 1D and 2D barcodes, notably the GS1 DataMatrix code on DSCSA-compliant packaging. It also comes with GS1 barcode parsers.
Integration with existing systems: The SDK is well-documented and easy to integrate with existing systems. Technical support will assist you with any challenges you encounter along the way.
User-friendliness: The SDK’s highly customizable UI provides features such as user guidance and visual feedback. Barcode scanning is simple and reliable for any user, minimizing both errors and training time.
Security and offline performance: The SDK uses on-device processing, without any connection to third-party servers. This enables it to perform even in areas with poor connectivity, such as warehouses. No sensitive data is ever transferred to third parties.

Do you want to experience for yourself how the Scanbot SDK performs? Then try the free barcode scanner demo apps. Or start integrating today and request a 7-day trial license.

For any questions, contact our solution experts at sdk@scanbot.io.