FDA Issues Final Guidance on Supply Chain Verification Systems

At a Glance

• The FDA issued final guidance on the duties of prescription drug manufacturers, repackagers, distributors and dispensers regarding supply chain verification systems.
• The guidance includes expectations regarding quarantine and investigation of suspect product, disposition of illegitimate product and related notification requirements.

In December 2023, the Food and Drug Administration (FDA) issued a final guidance, “Verification Systems Under the Drug Supply Chain Security Act for Certain Prescription Drugs,” explaining the agency’s interpretation of the statutory responsibilities on manufacturers, repackagers, wholesale distributors and dispensers (“trading partners” or “TPs”) to establish and maintain certain supply chain verification systems. This guidance addresses how verification systems should handle quarantine and investigation of suspect product, disposition of illegitimate product and related notification requirements.

The guidance specifies that standard operating procedures (SOPs) should be part of TP verification systems. We take this as an admonition not to rely solely on electronic systems. SOPs should be designed to ensure that TPs make “consistent, effective and timely determinations” that product is suspect. FDA recommends focusing on drugs that TPs “[have] reason to believe [are] counterfeit, diverted, stolen, intentionally adulterated, the subject of a fraudulent transaction, or [otherwise] unfit for distribution,” i.e., that would meet the statutory definition of suspect products in Section 581(21) of the Food, Drug, and Cosmetic Act (21 U.S.C. 360eee (21)). The agency further recommends that TPs revisit the scenarios listed in the June 2021 Suspect Product and Notification guidance.

If FDA believes a TP owns or otherwise controls, e.g., holds physical custody of a suspect product, it may request verification of the product identifier. Receiving such a request from FDA, or from another TP, triggers the receiving TP’s responsibility to quarantine and, if applicable, to work with other TPs to investigate the validity of the product. Generally speaking, an investigation involves reviewing transaction history/transaction information records (TH/TI) and validating a standardized numerical identifier (SNI) at the package level. See enforcement discretion guidances, including for wholesalers and dispensers extending enforcement discretion to November 2024.

To be sufficiently robust, FDA suggests TPs must conduct investigations promptly and with adequate coordination with trading partners. Trading partners should share their investigative information. Notably, the agency appears to commit to the idea that TPs may rely on a manufacturer’s or a repackager’s investigations without fear of agency enforcement if that reliance proves misplaced.

Core requirements of a manufacturer’s investigation and a repackager’s investigation include validating the TH/TI in its possession, verification of the product identifier at the package level, active communication with trading partners and use of appropriate laboratory standards, all as applicable. The agency specifies its interpretation that, for both manufacturer and repackager, this validation includes (1) confirmation that internal records for the transaction show an NDC and lot number that correspond to the information assigned to the suspect product and (2) verification of the product identifier through confirmation that the NDC, serial number, lot number and expiration date of the product identifier imprinted upon or affixed to the package or homogenous case of the suspect product corresponds to the information originally assigned to the product by the manufacturer or repackager, as applicable.

Similarly, FDA recommends wholesale distributors and dispensers validate TH/TI in their possession, including by confirming that the NDC and lot number information corresponds to the information assigned to the product received. They should also verify the product identifier with the manufacturer or repackager by confirming that the imprinted or affixed information matches the SNI or lot number and expiration date that the manufacturer or repackager assigned to the product. Dispensers do get a reprieve here in that their responsibility for verifying product identifiers ends after the greater of three packages or 10% of suspect product (or all packages if there are fewer than three). However, if the lot numbers do not match, dispensers must contact the manufacturer or repackager. If a TP determines a product to be illegitimate, the investigation includes an analysis by trading partners as to how the product came to be in their possession or control and how to prevent it happening again.

FDA encourages all TPs to periodically evaluate their systems for conducting investigations. We interpret this to mean that, on inspection, FDA could issue a 483 observation if the investigator does not find evidence of such reevaluations. Generally speaking, we suggest clients conduct these reevaluations whenever there is evidence suggesting a need to do so and minimally, once every year. FDA calls out the importance of considering the risk of suspect product entering the U.S. pharmaceutical distribution supply chain and the scenarios listed in the June 2021 Suspect Product and Notification guidance.

The guidance also addresses how to handle what the agency has dubbed a “cleared product notification,” the statutorily required notification to the agency that a product that has been cleared after a suspect product investigation. Once FDA’s DSCSA portal is up and running, this will change; for now, the TP to whom FDA made its request for verification should submit a cleared product notification to drugnotifications@fda.hhs.gov. Beginning with a subject line of “Cleared Product Notification,” the email should include full identification of the product (see guidance page 12 for all elements to include), date of FDA’s request for verification, the name of the FDA office and/or employee making the request, and a summary of the investigation, including the reason it was deemed suspect in the first place, the date the product was cleared, and the name and position of the employee or officer representing the trading partner who cleared the suspect product.

Keep all records of suspect product investigations for at least six years after the conclusion of the investigation, regardless of whether FDA requested verification. Make sure the record includes a clear explanation of how the trading partner reached the decision that the suspect product was not, in fact, illegitimate.

FDA notes that a quarantine system must be robust enough to ensure no further distribution. We read the guidance to say that the TP(s) with physical custody of product must physically quarantine the suspect product. Additionally, all TPs should use electronic quarantine systems to help ensure the product is not inadvertently distributed further.

Disposition of illegitimate product refers to removal of the product from the supply chain and, as with suspect product investigations, requires collaboration with TPs as appropriate. With quarantine of illegitimate product, a “best practice” of an electronic quarantine system is to identify product received that has the same product information (i.e., TI or same data elements in its product identifier, particularly the serial number) as the illegitimate product.  

Remember to include SOPs “detailing the systems and processes for disposition of illegitimate product that is within [your] possession or control” as part of your overall DSCSA verification system. One of those SOPs should specify who is authorized to release a product from quarantine. FDA provides examples of staff members it recommends as appropriate to be authorized to release a product from quarantine, such as a member of a manufacturer’s or repackager’s quality unit, a wholesale distributor’s facility manager, or a dispenser’s “pharmacist-in-charge.”  

Upon request of the manufacturer, FDA, or another appropriate official, TPs are required to take, quarantine and provide samples of illegitimate product. FDA notes that manufacturers have a responsibility to assist TPs in disposition of illegitimate product and that the agency expects them to inform TPs in a timely manner whether a product sample is needed for further physical examination or laboratory analysis before the investigation can be completed. FDA commits itself to providing such timely requests.  

Any samples should be representative of the illegitimate product, of an amount/quantity sufficient for proper laboratory examination/analysis and maintained and appropriately stored so that the condition of the product will be preserved until it is collected. Notably, FDA explains that retained samples should also be appropriately labeled and stored to preserve their identity and provides a detailed example that we encourage TPs to model, including that it be “identified and labeled as a retained sample of illegitimate product for a specific investigation, and a log identifying each person who handled the product, identifying the date they handled it and describing the manner in which they handled it, should be maintained, and should accompany the sample when it is submitted for testing.”

Keep all records of disposition of illegitimate product for at least six years after the conclusion of the investigation. These should include records about contractors hired to disposition the illegitimate product and sample retention.

DSCSA requires TPs to have systems for notifying FDA and other TPs of illegitimate product. Manufacturers also have the duty to notify for products that carry a high risk of illegitimacy, such as when there is a “specific high risk that could increase the likelihood that illegitimate product will enter the supply chain” or as determined by FDA in guidance. This includes a duty to terminate notifications in consultation with FDA. FDA refers industry to its Suspect Product and Notification guidance for more on this. Once TPs receive notifications of illegitimate product, they must identify all illegitimate products in their respective possession or control, including any that is subsequently received.

The guidance addresses the statutory requirement for responding to requests for verification and processing saleable returns. Manufacturers and repackagers receiving such requests for verification must provide a clear response within 24 hours of receipt or in “other such reasonable time.” FDA will make the determination whether the response was provided within a “reasonable time” based on the circumstances. The agency specifies in the guidance that it interprets the 24-hour requirement to mean a manufacturer or repackager should provide a “rapid response” with no later than one business day being a best practice. In other, very limited circumstances (such as power outages, transportation infrastructure disruptions or local regional disruptions,  FDA says only that it expects a good faith effort to provide a rapid response and that it understands the TP may need to follow up with additional information at a later date.

If the TP cannot verify product identifier, it must treat it as suspect product and notify the requesting TP if they have reason to believe the product is illegitimate and may provide additional information about that. Requesting TPs should not distribute or dispense product until they receive a response to the request for verification of the product identifier. FDA says these systems “should be integrated with SOPs and business practices used to identify suspect product and illegitimate product.”

Lastly, verification systems of TPs (excluding dispensers) must have systems in place that will allow them to process saleable return products that they intend to further distribute. (Dispensers may return product, saleable and non-saleable, without providing TH/TI or transaction statement. See FDA’s Enhanced Drug Distribution Security Guidance.) These must include provisions for verifying the product identifier, including the SNI, on each sealed homogenous case or, if the case is open, on each package. These products are subject to the regular requirements regarding identifying and handling suspect products, including investigations. The agency acknowledges that TPs may use the same systems for verification of saleable returns as they do for verification of product identifiers of suspect product at the package level.  

The guidance finalizes the revised draft guidance “Verification Systems Under the Drug Supply Chain Security Act for Certain Prescription Drugs,” issued on March 10, 2022.