Is Your Pharmacy Complying with The Drug Supply Chain Security Act? Important Insights from the October OIG Work Plan Update

October 17, 2017

The Office of the Inspector General (“OIG”) for the U.S. Department of Health & Human Services released its monthly Work Plan update yesterday, which included a “Drug Traceability Test” to ensure that The Drug Supply Chain Security Act’s (DSCSA) drug product tracing requirements function as intended. The DSCSA requires trading partners to exchange tracing information when they take ownership of drugs, resulting in a record that can be used to investigate suspect and illegitimate drugs.[1]  These tracing requirements are intended to prevent the introduction of harmful drugs into the supply chain and to help identify and remove harmful drugs that may have already entered the supply chain. To test the effectiveness of the DSCSA tracing requirements, the OIG plans to evaluate the extent to which selected drugs can be traced from the dispenser back to the manufacturer.  This update is an important reminder for dispensers, such as hospital-based pharmacies, to review their internal practices to ensure that they are complying with both federal law and state product transfer laws.

Requirements of the DSCSA

The DSCSA requires that “[a dispenser] . . . prior to, or at the time of, each transaction in which the dispenser transfers ownership of a product (but not including dispensing to a patient or returns) shall provide the subsequent owner with transaction history, transaction information, and a transaction statement for the product, except that the requirements of this clause shall not apply to sales by a dispenser to another dispenser to fulfill a specific patient need….”[2] “Specific patient need” is defined as “…the transfer of a product from one pharmacy to another to fill a prescription for an identified patient.” [3] Importantly, specific patient need does not include the transfer of a product from one pharmacy to another for the purpose of increasing or replenishing stock in anticipation of a potential need.[4] Thus, the DSCSA product tracing requirements must be followed when pharmacies transfer/sell products to increase or replenish stock.

Other Federal and State Requirements

Dispensers should also review the volume of their product transfers to ensure that they are properly registered with the DEA as either dispensers or distributors.[5]  A pharmacy may only distribute controlled substances to other pharmacies or providers, without being registered as a distributor, if the following conditions are met:

  1. The receiving entity is registered under The Controlled Substances Act (“CSA”) to dispense controlled substances.
  2. The distribution is recorded by the distributing entity in accordance with 21 C.F.R. § 1304.22(c) and the receipt is recorded by the receiving entity in accordance with 21 C.F.R. § 1304.22(c).
  3. The distribution of Schedule II controlled substances is documented on an official order form (DEA Form 222) or the electronic equivalent.
  4. The distributing entity complies with the “Five Percent Rule,” meaning the total number of dosage units of all controlled substances distributed by a pharmacy may not exceed five percent of all controlled substances dispensed by the pharmacy during a calendar year.  The pharmacy is required to register as a distributor if the total controlled substances distributed exceed five percent.[6]

Similarly, Virginia law states that a pharmacy “may engage in wholesale distributions of small quantities of prescription drugs without being licensed as wholesale distributors when…distributions of controlled substances do not exceed five percent of the gross annual sales of prescription drugs by the relevant permitted pharmacy or such wholesale distributions of Schedules II through V controlled substances do not exceed five percent of the total dosage units of the Schedule II through V controlled substances dispensed annually by the relevant permitted pharmacy.”[7]


The Work Plan – which can be found on Hancock Daniel’s website – sets forth the OIG’s fiscal year priorities in its oversight of HHS programs and grants, including audits and evaluations that are planned or underway.  The Work Plan provides valuable insights into the OIG’s current regulation and enforcement areas, so providers and entities participating in HHS programs or receiving funds from HHS grants will be well served by keeping an eye on updates.  We recommend that providers closely review the Work Plan and any monthly updates to identify additional areas of focus for compliance efforts.

Given the OIG’s recent interest in the DSCSA’s tracing requirements, we would also recommend reviewing your pharmacy’s product transfer procedures to ensure that they are compliant with both federal and state law. If you have any questions about the OIG’s new Work Plan update or if you need assistance assessing your organization’s compliance program, please contact Mary Malone or a member of Hancock Daniel’s Compliance team.


[1] 21 USC § 360eee-1(d)(1)(A)(ii).

[2] Id.

[3] 21 USC § 360eee(19).

[4] Id.

[5] DEA Pharmacist’s Manual, 2010 edition, p. 54, available at:

[6] Id.

[7] Va. Code § 54.1-3535.02(A) (emphasis added).



Print Friendly, PDF & Email