What Drug Serialization and Traceability Actually Require

Answer first: the package is the unit

Federal law requires an approved prescription drug to be traceable at the level of the individual package, not the pallet or the shipment. Each package carries its own identifier, and each transfer of ownership generates its own record.

The rules live in the Drug Supply Chain Security Act, enacted in November 2013, which phased its obligations in over a decade. The final and largest set took effect ten years after enactment, in November 2023.

Two things follow for a person buying medication. The system exists, so a legitimate approved product has a documented history behind it. And the system has a written exclusion, so not everything sold as a prescription medication sits inside it.

What a product identifier is made of

The law defines a product identifier as a standardized graphic. It has to appear in human-readable form and on a machine-readable data carrier conforming to standards from a widely recognized international standards development organization.

The graphic carries three things: a standardized numerical identifier, the lot number, and the expiration date. Two of those are familiar from any carton. The first one is the part that makes each package individual.

A standardized numerical identifier is the National Drug Code for that specific product, including its particular package configuration, combined with a unique alphanumeric serial number of up to twenty characters. That serial number is what makes one carton distinguishable from an identical carton beside it.

The unit being identified is defined too. A package is the smallest individual saleable unit that a manufacturer or repackager introduces into commerce and intends for individual sale to a dispenser.

The three documents that travel with a sale

Every transfer of ownership carries paperwork the industry calls the three Ts. They are transaction information, transaction history and transaction statement, and each is defined by statute.

Transaction information is a list of ten items. It includes the product's names, its strength and dosage form, its National Drug Code number, the container size and the number of containers. It also includes the lot number, the date of the transaction, and the shipment date where that falls more than a day later. The last two items are the business name and address of the seller and of the buyer.

Transaction history is a statement containing the transaction information for every prior transaction, going back to the manufacturer. It is the chain rather than a single link.

Transaction statement is a set of attestations by the party transferring ownership. It states that the party is authorized, and received the product from an authorized party. It states that the party received the information and statement from the prior owner, and had verification systems in place. And it states that the party did not knowingly ship suspect or illegitimate product, provide false transaction information, or alter the transaction history.

What verification means, and how fast it has to happen

Verification has a narrow statutory meaning. It is determining whether the product identifier on a package or sealed case corresponds to the standardized numerical identifier, or the lot number and expiration date, that the manufacturer or repackager assigned.

The law explicitly allows either method. Verification may be done by human-readable or machine-readable means, so a scanner is a convenience rather than a legal requirement.

There is a clock on the answer. When an authorized repackager, wholesale distributor or dispenser asks a manufacturer to verify a product identifier, the manufacturer must respond within twenty-four hours, or another reasonable time the agency sets for the circumstances.

If the identifier does not match, the response is not a shrug. The manufacturer must treat the product as suspect and investigate, and must tell the requester if it has reason to believe the product is illegitimate.

Suspect, illegitimate, and the twenty-four hour notice

The statute separates two levels of concern. A suspect product is one there is reason to believe may be counterfeit, diverted or stolen. It also covers a product that may be intentionally adulterated in a way that would cause serious harm, may be the subject of a fraudulent transaction, or otherwise appears unfit for distribution.

An illegitimate product is the same list of problems established by credible evidence rather than suspicion. The step between the two is an investigation, and quarantine is the statutory word for holding the product apart while that happens.

FDA states the reporting obligation in one line on its own hub page. A trading partner must notify the agency within twenty-four hours after determining that a product is illegitimate.

For pharmacies specifically, the investigation has a defined sample size. A dispenser verifying a suspect product must check the product identifier on at least three packages or ten percent of it, whichever is greater. Where there are fewer than three packages, all of them are checked.

Six years, and what the records are for

The retention period runs through the whole chain. Manufacturers, wholesale distributors, repackagers and dispensers must each keep transaction information, history and statements for at least six years after the transaction.

The same six years applies to investigations. Records of a suspect product investigation, and records of how an illegitimate product was disposed of, are kept for six years after that work concludes.

Those records exist to answer two kinds of question quickly. One is a recall. The other is an investigation into whether a specific product is suspect or illegitimate, and both can require reconstructing the chain back to the manufacturer.

A pharmacy may contract this out. The law lets a dispenser sign a written agreement with a third party, including an authorized wholesale distributor, to hold the records confidentially. The agreement does not relieve the pharmacy of its own obligations.

The electronic phase, and why it arrived slowly

The enhanced requirements that took effect in November 2023 are the ambitious part. They require the transaction information and statements to be exchanged in a secure, interoperable, electronic manner rather than on paper.

They also require the transaction information to carry the package-level product identifier for every package in the transaction, and require systems able to respond promptly to an agency request during a recall or an investigation. Anyone accepting a saleable return has to be able to match it to its own transaction records.

FDA then announced a stabilization period. In August 2023 the agency issued two compliance policy guidances giving trading partners an additional year, to November 2024, to implement and mature their electronic systems. It said it did not intend to enforce the enhanced requirements during that window.

The agency was blunt about what that was for. It said the period was not intended to justify delaying compliance efforts, and expected the time to be used to build and validate interoperable systems.

Exemptions have continued past that. FDA publishes a dated list of exceptions and exemptions it has issued on its own initiative, and the most recent entry on that list concerns small business dispensers and was issued in August 2026.

The category the law leaves out

The tracing requirements apply to what the statute calls a product, and that word is doing a great deal of work. It means a prescription drug in finished dosage form for administration to a patient without substantial further manufacturing.

The definition then excludes a list. Blood and blood components for transfusion, radioactive drugs and biologics, imaging drugs, certain intravenous products, medical gases, homeopathic drugs marketed under applicable guidance, and drugs compounded in compliance with the two federal compounding sections.

FDA restates the same list on its own tracing questions page, in plainer terms. It says the requirements do not apply to over-the-counter drugs, animal drugs, blood or blood components, radioactive drugs, imaging drugs, certain intravenous drugs, medical gases, certain homeopathic drugs, and lawfully compounded drugs.

That last item is the one that matters when a compounded medication is on the table. The serial number, the electronic transaction records and the six-year retention described here are not features a compounded preparation is missing. They are requirements the statute does not place on it.

This is not a claim that a compounded preparation is unsafe, and it is not a comparison of quality. It is a statement about which paperwork regime applies, which is a different question and a checkable one.

Two smaller facts worth carrying

The old system is gone. The pedigree provision added by the Prescription Drug Marketing Act, which required certain wholesalers to supply a statement identifying each prior sale of a drug, stopped being in effect in January 2015. Tracing replaced it.

And FDA does not publish forms for any of this. The agency states plainly that it has not established standardized forms for transaction information, history or statements, and instead issued guidance identifying standards for exchanging the information.

One consequence is that the format varies between trading partners. Another is that a company describing its own tracing paperwork is describing its own implementation, not a federal template you could look up and compare against.

What this changes about a question you can ask

For an approved product, the question is answerable. Ask which pharmacy dispenses it, and know that the pharmacy is required to have accepted it with tracing documentation and to hold that documentation.

For a compounded preparation, the tracing question does not apply, so asking it produces confusion rather than information. The useful questions there are about which pharmacy or outsourcing facility prepares it and on what basis it is being compounded.

Knowing which of those two conversations you are in is most of the value here. The systems are different by design, and a seller who blurs them is describing something other than what you are buying.