Research
The electronic trail a drug package has to carry
Federal law requires three documents to move with a prescription drug at every change of ownership, and a barcode on the package that ties a unit to a lot. None of it is addressed to a patient.
Three documents, at every change of ownership
A separate federal scheme governs prescription drugs as they move between businesses. It works by making three documents travel with the product.
They are the transaction information, the transaction history and the transaction statement. Each is a defined term with defined contents.
The obligation attaches by role. Manufacturers, repackagers, wholesale distributors and dispensers each have their own version of it, and an entity that is two of those complies with both.
This is not the same instrument as the drug origin statement in the older wholesale distribution regulations, which is covered separately on this site. The two schemes sit in different bodies of law.
What the transaction information contains
The list is itemized in the statute, which makes it checkable rather than a matter of practice.
It carries "the proprietary or established name or names of the product," "the strength and dosage form of the product," "the National Drug Code number of the product," and "the container size."
It also carries "the number of containers," "the lot number of the product," and "the date of the transaction." The shipment date goes in as well if it is more than 24 hours after the transaction.
The last two items name the parties: "the business name and address of the person from whom ownership is being transferred," and the same for the person receiving it.
What the transaction statement asserts
The statement is a set of assertions rather than a description of goods, and reading the list tells you what the scheme is worried about.
The transferring entity states that it is authorized, and that it "received the product from a person that is authorized as required under the Drug Supply Chain Security Act."
Three of the assertions are about knowledge. The entity "did not knowingly ship a suspect or illegitimate product," "did not knowingly provide false transaction information," and "did not knowingly alter the transaction history."
It also states that it had systems and processes in place to comply with the verification requirements. So the statement is partly about the goods and partly about the seller's own controls.
The identifier printed on the package
The physical half of the scheme is a mark on the package, and its contents are specified.
A product identifier is "a standardized graphic that includes, in both human-readable form and on a machine-readable data carrier" the required data.
That data is "the standardized numerical identifier, lot number, and expiration date of the product." So a unit-level serial number, its batch and its expiry all sit in one mark.
The carrier is specified too. The data "shall be included in a 2-dimensional data matrix barcode when affixed to, or imprinted upon, a package," with a linear or two-dimensional code for a homogeneous case.
Suspect product is a defined term
The scheme has two escalating categories, and the lower one turns on a reason to believe rather than proof.
A suspect product is one for which there is reason to believe it "is potentially counterfeit, diverted, or stolen," potentially intentionally adulterated, or potentially the subject of a fraudulent transaction.
A fourth branch is broader: a product that "appears otherwise unfit for distribution such that the product would result in serious adverse health consequences or death to humans."
The response is prescribed. The holder quarantines the product until it is cleared or dispositioned, and promptly investigates in coordination with trading partners.
The investigation, and how much of a lot gets checked
The investigation has named steps, and one of them puts a number on how much physical checking is enough.
For a dispenser, it includes verifying whether the lot number of a suspect product corresponds with the lot number for that product.
It then includes "verifying that the product identifier, including the standardized numerical identifier, of at least 3 packages or 10 percent of such suspect product, whichever is greater."
Where there are fewer than three packages, all of them are checked. Records of the investigation are kept for not less than six years after it concludes.
Illegitimate product, and a twenty-four-hour clock
The higher category is defined by credible evidence rather than a reason to believe, and it triggers the fastest deadline in the section.
An illegitimate product is one for which credible evidence shows it "is counterfeit, diverted, or stolen," is intentionally adulterated so as to cause serious harm, or "is the subject of a fraudulent transaction."
On determining that it holds one, a dispenser dispositions it, helps trading partners disposition any it does not hold, and retains a sample for examination on request.
Then the notification. The dispenser must "notify the Secretary and all immediate trading partners" that may have received it, "not later than 24 hours after making such determination."
What a dispenser owes, and who is excused
The dispenser rules are the closest part of this scheme to a person buying medication, and they are still not addressed to that person.
A dispenser "shall not accept ownership of a product, unless the previous owner prior to, or at the time of, the transaction, provides transaction history, transaction information, and a transaction statement."
It captures those records and must "maintain such information, history, and statements for not less than 6 years after the transaction." A written agreement may put a third party in charge of keeping them, without relieving the dispenser.
One exception is broad and worth knowing. The tracing and verification requirements "shall not apply to licensed health care practitioners authorized to prescribe or administer medication under State law." The same goes for licensed individuals under their direction, dispensing in the usual course of practice.
How fast the records have to appear
Response times are set by role, and they are short.
A request may come from a federal or state official during a recall, or to investigate a suspect or illegitimate product. A manufacturer responds "not later than 1 business day, and not to exceed 48 hours, after receiving the request."
A dispenser gets longer: "not later than 2 business days after receiving the request," or another reasonable time set by the agency.
Ten years after the statute's date, that window narrows again to 24 hours for manufacturers, wholesale distributors and repackagers.
The system that had to become electronic
The scheme was built in phases, with the last one turning it into a package-level electronic system.
On the date ten years after the statute, the transaction information and statements "shall be exchanged in a secure, interoperable, electronic manner." The information also has to include the product identifier for each package in the transaction.
Systems for verifying product at the package level become required, along with systems to reconstruct the transaction information back to the manufacturer on request.
Returns tighten too. A person accepting a saleable return "may accept saleable returns only if such person can associate the saleable return product with the transaction information and transaction statement associated with that product."
What a reader can take from this
The scope has to be said plainly. These documents move between manufacturers, distributors, repackagers and dispensers, and nothing in the section entitles a patient to see any of them.
What it changes is what a package should look like. A product inside this scheme carries a two-dimensional barcode holding a unit serial number, a lot number and an expiration date, in human-readable form as well.
It also supplies precise words for things usually described loosely. Suspect and illegitimate are defined terms here, with different evidence thresholds and different consequences.
And one structural point transfers to any purchase. The statement a seller signs is largely about its own systems and its own knowledge, which is a different thing from a test result about the goods.
Key takeaways
- Three defined documents move with a prescription drug at each change of ownership between businesses.
- The transaction information is itemized, down to lot number, container size and the addresses of both parties.
- The transaction statement is mostly assertions about the seller's authorization, knowledge and systems.
- A product identifier holds a unit serial number, lot number and expiration date, in a barcode and in readable text.
- Suspect product turns on a reason to believe; illegitimate product turns on credible evidence.
- An illegitimate product triggers notice to the agency and immediate trading partners within 24 hours.
- A dispenser may not accept a product without the three documents, and keeps them for at least six years.
- Prescribing practitioners dispensing in the usual course of practice are excepted from the tracing and verification rules.
Frequently asked questions
What are the three documents that travel with a prescription drug?
Transaction information, transaction history and transaction statement. The information is an itemized description of the goods and the parties. It covers product name, strength and dosage form, national drug code, container size, number of containers, lot number and transaction date, plus the business names and addresses on both sides. The history is the chain of that information back through previous transactions. The statement is a set of assertions by the entity transferring ownership about its authorization, its knowledge and its systems.
What is a product identifier?
A standardized graphic on the package that carries, in both human-readable form and a machine-readable data carrier, the standardized numerical identifier, the lot number and the expiration date of the product. On a package the data goes in a two-dimensional data matrix barcode; on a homogeneous case a linear or two-dimensional code may be used. Verification may be done by human-readable or machine-readable methods.
What is the difference between suspect and illegitimate product?
The evidence threshold and the consequences. Suspect product is product for which there is reason to believe one of four things. That it is potentially counterfeit, diverted or stolen. That it is potentially intentionally adulterated, or potentially the subject of a fraudulent transaction. Or that it otherwise appears unfit for distribution in a way that would cause serious harm. It is quarantined and investigated. Illegitimate product is product for which credible evidence shows those things, and it triggers disposition, sample retention and notification of the agency and immediate trading partners within 24 hours.
Does a pharmacy have to keep these records?
Yes. A dispenser may not accept ownership of a product unless the previous owner provides the transaction history, information and statement. It must then capture and maintain them for not less than six years after the transaction. A dispenser may enter a written agreement for a third party to hold those records confidentially on its behalf, but it keeps a copy of the agreement and is not relieved of the obligation.
Who is excused from these requirements?
The tracing and verification requirements do not apply to licensed health care practitioners authorized to prescribe or administer medication under state law. Nor do they apply to other licensed individuals under their supervision or direction, dispensing or administering in the usual course of professional practice. There are also processes for waivers on grounds of undue economic hardship or emergency medical reasons. Separate processes cover exceptions where a container is too small to bear a product identifier, and exemptions for other products or transactions.
Can a patient ask to see any of this?
No provision in the section gives a patient that right. The documents move between manufacturers, repackagers, wholesale distributors and dispensers, and the requests the statute contemplates come from federal or state officials during a recall or an investigation. What the scheme does put in reach of an ordinary reader is the package itself. Inside this system it carries a two-dimensional barcode holding a serial number, a lot number and an expiration date, printed in human-readable form as well.
Sources
Each document below is named as it names itself, with the date printed on that document rather than the day it was read.
- Title 21 United States Code section 360eee-1, Requirements — the product tracing, product identifier, authorized trading partner and verification duties by role, including the manufacturer duties at (b), the dispenser duties and the practitioner exception at (d), the enhanced interoperable electronic tracing that takes effect ten years after November 27, 2013 at (g), and the narrowed response window at (m) — Office of the Law Revision Counsel, U.S. House of Representatives, September 2026
- Title 21 United States Code section 360eee, Definitions — dispenser at (3), illegitimate product at (8), product identifier at (14), quarantine at (15), suspect product at (21), the ten itemized elements of transaction information at (26), the seven assertions making up a transaction statement at (27), and verification at (28) — Office of the Law Revision Counsel, U.S. House of Representatives, September 2026