FDA finalizes guidance on key definitions under the Drug Supply Chain Security Act


Mar. 16, 2023

With just months to go before the implementation of the Drug Supply Chain Security Act’s (DSCSA) enhanced verification provisions go into effect, the FDA has finalized a key guidance containing definitions of essential terms needed for companies to ensure compliance with the law, including which products would be “unfit for distribution” or be considered “diverted.” The final guidance also makes several key changes that address – and may alleviate – prior industry concerns.

Background on the Drug Supply Chain Security Act

  • The Drug Supply Chain Security Act (DSCSA) was enacted in 2013 as part of the Drug Quality and Security Act (DQSA), following several drug counterfeiting scandals in which falsified medical products entered the supply chain. To prevent similar occurrences – and to make it easier to identify the source of potential future intrusions – the DSCSA called for the creation of a ‘track-and-trace’ system that would give each drug product a unique identifier (either at the lot- or package-level) and require supply chain entities to record those identifiers as a product moved throughout the supply chain.
  • The system is intended to increase transparency and safety. Each entity in the supply chain (e.g., a wholesaler or pharmacy) would be able to see a valid chain of custody for a product. If something went wrong with a product (e.g., it was determined to be counterfeit), the FDA would be able to follow the chain of custody of the product back to its point of origin since each company would have records related to its receipt and movement.
  • Among the most important provisions of the law relates to requirements about what supply chain entities should do when they encounter either “suspect” or “illegitimate” products. Some of these requirements are already in place. For example, as of January 1, 2015, manufacturers needed to have in place systems to comply with requirements related to the management of suspect and illegitimate products, verification requests, and the maintenance of an electronic database.
  • The law requires that a trading partner, “upon making a determination that a product in the possession or control of the manufacturer is a suspect product, or upon receiving a request for verification from the Secretary that has made a determination that a product within the possession or control of a manufacturer is a suspect product,” needs to first quarantine that product and then “promptly conduct an investigation in coordination with trading partners, as applicable, to determine whether the product is an illegitimate product.”
  • But there are plenty of similar terms in the legislation for which there is less specificity. Take, for example, the term “unfit for distribution” – a term that is used twice in the DSCSA but is only loosely defined (“the product would be reasonably likely to result in serious adverse health consequences or death to humans”). Manufacturers wishing to comply with the DSCSA have a vested interest in understanding how the FDA defines these terms for the purposes of compliance, so that they may correctly identify problematic transactions.

Regulatory Context

  • The FDA has been working to define these terms to help manufacturers understand its expectations. In March 2018, the FDA released a draft guidance document on the definition of essential key terms used in the DSCSA, including the terms counterfeit, diverted, fraudulent transaction and unfit for distribution. That guidance was then revised in June 2021.
  • A counterfeit drug is defined as a “drug which, or the container or labeling of which, without authorization, bears the trademark, trade name, or other identifying mark, imprint, or device, or any likeness thereof, of a drug manufacturer, processor, packer, or distributor other than the person or persons who in fact manufactured, processed, packed, or distributed such drug and which thereby falsely purports or is represented to be the product of, or to have been packed or distributed by, such other drug manufacturer, processor, packer, or distributor.”
  • A diverted product is one that has “left the U.S. pharmaceutical distribution supply chain and is reintroduced in the United States in a transaction with a trading partner.” As the FDA notes, this could include product that “is dispensed to a consumer or patient and then reintroduced into the U.S. pharmaceutical distribution supply chain to a trading partner.” Alternatively, it may also be a product that is “labeled for sale in a non-U.S. market and that is introduced into the U.S. pharmaceutical distribution supply chain through a transaction with a trading partner.”
  • A diverted product is not considered to be on for which an Emergency Use Authorization (EUA) has been issued, a product obtained “as a result of FDA’s regulatory action to address a drug shortage,” is “from a consumer or patient who obtained the product from outside the U.S. pharmaceutical distribution supply chain,” or the trading partner obtains the drug product “through surveillance activities outside the U.S. pharmaceutical distribution supply chain.”
  • A stolen product is a product or package that “has been taken or removed without permission of the owner of the product.” This can include the whole product (combination of the drug in its packaging), the packaging of the product, and the removal of the some or all of the drug from its container or packaging.
  • A fraudulent transaction is one in which “the transaction information, transaction history, or transaction statement contains information knowingly falsified by a trading partner who has provided or received the information.”
  • Finally, a product that is unfit for distribution is one for which there is a “reason to believe or credible evidence shows that the product would be reasonably likely to result in serious adverse health consequences or death to humans.” This includes products violating federal law, products that are suspect or illegitimate, adulterated drugs, or products that are no longer saleable due to return, recall, damage, or expiry.

Industry reaction to the draft definitions guidance

  • While the document appeared to be mostly intuitive, it did raise some concerns for members of industry. For example, the Healthcare Distribution Alliance (HDA) noted that the document’s definition of products that are “unfit for distribution” could “unduly confuse when products are unfit for distribution but are not suspect or illegitimate.” HDA requested that the FDA clarify that not all products that are recalled or returned, for example, would cause a product to be considered suspect or illegitimate.
  • HDA also asked the FDA to recognize “principles regarding aggregation, inference, and suspect product investigations” that are included in another FDA guidance, which it said acknowledges the potential for data discrepancies. In short: “not all discrepancies immediately warrant launching of a suspect product investigation,” the group argued.
  • Another interesting point related to the FDA’s interpretation of a “stolen” product, with respect to its use as a “trigger for suspect and illegitimate product requirements,” which HDA argued was off-base. Specifically, HDA indicated that a wholesale distributor “only makes a determination that a product is suspect and illegitimate if that product is in the ‘possession or control of a wholesale distributor,’” and that the guidance – despite its logical conclusions – is inconsistent with the DSCSA on this matter since it appears to require an investigation regardless of who was last in control of the product. Similar concerns were raised by McKesson in its comments.
  • Another group, the Pharmaceutical Distribution Security Alliance (PDSA), asked the FDA to make several changes, including that it modify its definition of a “stolen” product to address instances in which a product is “temporarily lost” or for which there is a shortage of product shipped due to an operational error.

What’s New

  • The FDA unveiled a final version of the guidance on March 16. The final version makes relatively modest but important changes, including some that reflect industry concerns.
  • For example, the FDA has modified the definition of the term “diverted” to specify that it could include a scenario in which a “trading partner reintroduces into the U.S. pharmaceutical distribution supply chain [a] product after it was dispensed to a patient or otherwise removed from the U.S. pharmaceutical distribution supply chain.”
  • FDA now also specifies that a product would not be considered to have been diverted if a trading partner obtains the drug through specific surveillance activities, “including [if] the product was obtained by the trading partner from outside the U.S. pharmaceutical distribution supply chain, or the product was obtained by the trading partner from a consumer who obtained the product from outside the U.S. pharmaceutical distribution supply chain.” The agency doesn’t add any illustrative examples here, which makes it somewhat difficult to discern what it might mean by “surveillance activities” or the process of “obtaining” a product from a specific source. FDA also clarifies that a product granted an Emergency Use Authorization (EUA) would not be considered to be diverted.
  • A critical new addition in the final guidance was specifically asked for by industry and relates to products which may have been misplaced or lost, rather than stolen. The agency now explains that it “recognizes that product may be unaccounted for that does not meet this definition of stolen,” and therefore would not require a response by trading partners. Instead, “Trading partners who identify unaccounted-for product should use current company policies and procedures to look into the circumstances surrounding the lost or missing product to determine whether it has been stolen or is otherwise suspect or illegitimate product,” FDA explained, and referred sponsors to other DSCSA guidance documents on how to handle such situations.
  • The guidance also concedes that it “may not be immediately evidence whether product tracing information is knowingly falsified.” Rather, there can be initial confusion regarding whether something is accidentally incorrect, for example because of a clinical error or discrepancy, which “may not be indicative of a suspect product.” In these cases, FDA advises that first companies “take steps to determine whether the error can be resolved and whether the product is suspect or illegitimate.”
  • With respect to products that are unfit for distribution, the FDA now explains in the guidance that nonsaleable products that have expired are “frequently removed from the supply chain without triggering a suspect product investigation.” In other words, not all nonsaleable products are necessarily suspect. FDA advises that trading partners “use current company policy and procedure to look into the circumstances to determine whether the nonsaleable product rises to the level of suspect product.”


  • Industry will likely support the final guidance given the extent of the changes and the degree to which FDA conceded to its prior comments and requests. While not all comments were addressed specifically (such as addressing a specific use case), most have at least been addressed in a general way that may serve to alleviate the most acute concerns.
  • But the FDA has a bigger problem on its hands: It’s running out of time to finalize similar guidance documents. With just months to go before the November 27, 2023 deadline to have in place an “enhanced” track and trade verification system under the DSCSA, companies will have limited time to operationalize and implement systems based on whatever changes or recommendations the FDA makes. The FDA still has three additional draft DSCSA guidance documents left to finalize: One on identifying trading partners, a second on verification systems, and a third on enhanced drug distribution security at the package level. This guidance is also noteworthy for being by far the simplest DSCSA guidance that FDA has left to finalize, and so we wonder if FDA might be having bigger problems finalizing the other documents – or if they’re right around the corner.
  • One thing is clear: If the FDA waits too much longer to release its other final guidance documents, trading partners may not have sufficient time to make changes to their business logic, update their software, ensure all trading partners are using the same definitions, and conduct testing. That, in turn, could put pressure on the FDA to delay the enforcement of the DSCSA.
  • Something else that is interesting to us is that the guidance all but ignores the FDA’s final rule on drug importation plans – a type of activity that could raise significant questions about drug supply chain security and the presence of “suspect” products in supply chains that lack any identifying information under the DSCSA. While the final guidance’s language about a product that is “obtained by the trading partner from outside the U.S. pharmaceutical distribution supply chain” could apply to such products, it doesn’t mention anything about drug importation as part of an FDA-approved program, specifically.


To contact the author of this analysis, please email Alec Gaffney ( agaffney@agencyiq.com)
To contact the editor of this analysis, please email Laura DiAngelo ( ldiangelo@agencyiq.com)

Key Documents and Dates

Get an insider’s view on regulatory movements.

Sign up for AgencyIQ’s newsletters to receive exclusive regulatory updates and analysis impacting the life sciences or chemical industry.

Copy link
Powered by Social Snap