Updated August 27, 2025 | A practical guide for pharmacy compliance, pharmacy trust, pharmacy security, and pharmacy staff readiness

If you’ve ever tracked a package on its journey to your doorstep, you already understand the spirit of the Drug Supply Chain Security Act (DSCSA). Every scan, every hand‑off, every exception—captured. As of August 27, 2025, we’ve reached another DSCSA milestone: the exemption period for wholesale distributors has ended. The next mile‑markers are squarely about pharmacies:

• November 27, 2025 — Dispensers with 26 or more full‑time employees must fully meet the enhanced, package‑level requirements

• November 27, 2026 — Small dispensers (25 or fewer pharmacists/techs, as of Nov 27, 2024) remain exempt from certain requirements until this date.

In this post, we’ll keep the analogy simple: think of DSCSA like modern package tracking—only the “packages” are prescription drugs, and your pharmacy is a smart hub that protects patients by making sure what arrives is exactly what was sent. We’ll answer the questions pharmacists and pharmacy staff are asking right now, show why T2 replaced T3, clarify what is and isn’t required of dispensers, and outline how RxPost is prioritizing compliance with audit‑ready workflows and expanded PMS integrations—so your team can work confidently and efficiently.

The Big Picture: DSCSA as Package‑Tracking for Medicines

Imagine your pharmacy as a highly organized package hub:

• The label on each package is the drug’s product identifier (GTIN/NDC, serial number, lot, expiration) encoded in a 2D barcode.

• The shipping record that travels digitally with each hand‑off is Transaction Information + Transaction Statement (TI/TS)—together, often called T2.

• The old paper manifest that used to be appended to every package is Transaction History (TH)—and it has been retired because the industry is moving to secure, interoperable electronic exchange that lets us look up history when needed, rather than carry it around each time.

The FDA recommends the GS1 EPCIS standard to enable that electronic exchange—think of it as the data language that lets all hubs talk to each other. 

Mile‑Markers You Need to Know

• Reached: August 27, 2025 — Exemption period ends for wholesale distributors. This matters to your pharmacy because it raises the bar for data quality and exception handling at receipt.

• Up next: November 27, 2025 — Dispensers with 26+ FTE must operate with package‑level, interoperable data exchange (the “enhanced” DSCSA requirements).

• Small dispenser runway: November 27, 2026 — Small dispensers are exempt from certain requirements until this date but should keep implementing now.

FDA emphasizes that exemptions avoid supply disruptions but are not a reason to delay implementation. 

Why T2 Replaced T3 (and Why That’s a Good Thing)

T3 meant every change of ownership carried TI + TH + TS—including a Transaction History that stacked up like a paper trail of all prior stops. That’s like printing every prior scan from the package’s life on the outside of the new shipping label.

With DSCSA’s enhanced, interoperable exchange, we now operate on T2—just TI + TS—because the history is discoverable electronically through standardized systems. It’s like checking a carrier’s live tracking system instead of stapling every old receipt to the box. FDA’s interoperability guidance and the public‑private DSCSA governance work both focus on TI/TS exchange and recommend GS1 EPCIS as the standardized way to move that data reliably. 

Bottom line: T2 streamlines the documentation without sacrificing traceability, because package‑level data is queryable when you need it, rather than carried on every shipment.

Key Dispenser Exemptions You Should Actually Use (and Not Overuse)

Two common scenarios lighten the documentation load:

1. Dispensed to a patient. If a product is dispensed to a patient, DSCSA product tracing obligations for that hand‑off do not apply.
   
   

2. Dispenser‑to‑dispenser sale to fulfill a specific patient need. When you transfer product to another pharmacy to fill a prescription for an identified patient (not for stock), that transaction is exempt from product tracing. FDA defines “specific patient need” narrowly; it doesn’t cover replenishing stock. (Visit sections 581(19) and 582(d)(1)(A)(ii) of the FD&C Act for more information.)

Those two carve‑outs align with the law’s intent: they’re not “wholesale” activity and therefore not subject to pedigree/transaction history rules.

Forward‑looking note: Even though the law exempts tracing for “specific patient need” transfers, RxPost supports optional T2 interoperability between pharmacies for trust and audit‑readiness. We are actively coordinating with DSCSA solution providers to enable this once the industry clears the immediate deadlines—after November 27, 2025. 

First Responders / EMS: What the FDA Actually Says

You may have heard, “A T3 is required to EMS, but EMS doesn’t have to accept it.” The more accurate FDA position (since 2017): FDA does not intend to take enforcement action if a dispenser transfers directly to a first responder without providing product tracing provided the dispenser captures and maintains the tracing information and can provide it to the first responder or FDA upon request within two business days. The policy also notes that first responders may lack systems to accept/maintain that data, and FDA won’t take action against them for that. In short: keep the records; be ready to share; EMS does not have to receive T3/T2 for the hand‑off. 

Is Barcode Scanning Required? No—but It’s the Proven Way to “Scan on Receipt”

There’s no DSCSA clause that says “thou shalt barcode scan.” What DSCSA requires are systems to verify product identifiers for suspect/illegitimate product, to transact with authorized partners, and to exchange/maintain TI/TS data. Scanning is the most reliable, least error‑prone way to do those things at scale—like a carrier scanning parcels at every dock to catch misroutes immediately. FDA’s guidance addresses verification systems and recommends GS1 EPCIS for interoperable exchange; scanning the 2D barcode is simply how those systems work best in real life. 

Practical Q&A—Using the Package‑Tracking Analogy

Q: Is barcode scanning a DSCSA requirement?
A: No. But if you don’t scan, you’re doing manual checks of product identifiers and reconciling TI/TS by hand. That’s time‑consuming and invites human error. In “package‑hub” terms: you can type in every tracking number—but you’ll catch fewer exceptions than a quick scan at the dock. FDA expects robust verification systems and accurate exchange; scanning is the most efficient way to achieve both. 

Q: Do I still need to verify if I only order through my wholesaler?
A: Yes. You must do business only with authorized trading partners, maintain and retrieve TI/TS, and have systems to investigate/quarantine suspect product and verify product identifiers when appropriate. Your wholesaler being compliant doesn’t remove your obligations; your hub still has to reconcile its incoming “packages” and escalate exceptions. 

Q: I was told I don’t need to barcode scan to be compliant—is that true?
A: Technically true—there’s no scanning mandate. But operationally, scanning is the best practice for 100% verification at receipt (does what arrived match TI/TS? does the product identifier scan cleanly?). Without scanning, you must design an equivalent manual process that still finds mismatches and counterfeit risks—hard to do consistently under real‑world workload. 

Q: Our facility can’t absorb more scans. How can we stay compliant?
A: Rethink the workflow, not the goal. In hub terms, you want one efficient scan per package at the right step—not multiple redundant scans downstream. 

Q: Is “partial verification” (spot checks or tote‑level scans) good enough?
A: It’s risky. DSCSA expects you to detect and resolve TI/TS and identifier mismatches; PDG exception guidance makes clear that when TI/TS is missing or doesn’t match, product should be quarantined until resolved. 

Q: Which products are exempt from DSCSA?
A: DSCSA does not apply to certain categories (e.g., OTC products, certain IV drugs, medical gases, radioactive/imaging agents, lawfully compounded drugs). FDA’s product‑tracing FAQ lists the categories and links to the statutory definitions; consult that list when questions arise.

Q: Do I need to track drugs under Emergency Use Authorizations (EUAs)?
A: Not automatically. During a declared public health emergency, some activities may be treated as “emergency medical reasons,” which can trigger exclusions/exemptions for certain distributions for the duration of the emergency. EUAs themselves don’t blanket‑exempt all DSCSA obligations—always check FDA’s current public health emergency guidance and any waiver/exception/exemption in effect.

Q: Does DSCSA apply to EMS transactions?
A: FDA’s first responder policy says the Agency does not intend to take action if a dispenser transfers product without providing T3/T2 to first responders so long as the dispenser captures and maintains the tracing information and can provide it on request. First responders aren’t required to accept or maintain it for those hand‑offs. Plan your records accordingly.

How RxPost Helps: Compliance First, Audit‑Ready by Design

RxPost continues to prioritize pharmacy compliance, trust, and security—and to reduce staff burden—by aligning our product roadmap with DSCSA’s package‑level reality:

1. PMS integrations that matter. We’re expanding our Pharmacy Management System integrations so receipt verification events, TI/TS associations, and exception outcomes flow into the records your staff already lives in. This reduces toggling, copy‑paste, and missed steps—key to creating audit‑ready processes with fewer clicks.
   
   

2. Optional T2 data for patient‑need transfers. Even though DSCSA exempts product tracing for specific patient need transfers, we support an optional T2 exchange between pharmacies to strengthen pharmacy‑to‑pharmacy trust and keep your audit story clean. We plan to pick up these solution‑provider conversations after November 27, 2025, when the dispenser milestone hits.
   
   

3. Vendor data confidence. We are actively working on validating EPCIS data accuracy and completeness before enabling pharmacy feeds. This capability isn’t live yet, but our goal is to “flip the switch” only once vendor data consistently supports day-to-day receiving and exception workflows.

Our goal: protect patients, uphold pharmacy trust, and keep pharmacy staff focused on care—not paperwork.

A Simple, Staff‑Friendly Checklist (Keep It by the Receiving Bench)

At the dock (arrival):

• Capture the product identifier (scan when possible); verify NDC/GTIN, serial, lot, expiry.

• Reconcile TI/TS: make sure what arrived matches the digital “shipping record.”

• Flag exceptions immediately and quarantine affected product until resolved.

In your systems (every day):

• Store and be able to retrieve TI/TS for six years (per DSCSA) and keep verification logs.

• Document exception resolution (replacement EPCIS, corrected TI/TS, or return).

• Maintain standard work so every receiving step has an owner and a timestamp.

For special cases:

• Dispensed to a patient or specific patient‑need transfers to another pharmacy: know these are tracing‑exempt events—but keep robust internal records anyway.

• First responders/EMS: keep the tracing info on your side and be ready to provide within two business days upon request.

• Public health emergencies: check current FDA guidance on emergency medical reasons and any active waivers/exemptions.
  
  

What Changes for Larger Dispensers on November 27, 2025?

If your pharmacy has 26 or more full‑time employees, this is your go‑live for the “enhanced” requirements. In practice, that means:

• Interoperable, electronic TI/TS exchange (EPCIS recommended) with your immediate trading partners.

  
  

• Reliable package‑level verification systems (especially when investigating suspect product).

  
  

• Exception management discipline so mismatches are quarantined and traced to closure

  
  

• A clean audit story—from how you accept ownership to how you resolve anomalies.

If you’ve already adopted a “scan‑at‑receipt + reconcile TI/TS + quarantine exceptions” rhythm, you’re there in spirit. Now it’s about eliminating manual cracks and closing the loop between receiving, your PMS, and your audit records. 

Small Dispensers: Use Your Extra Year Wisely (Through Nov 27, 2026)

If your organization qualifies as a small dispenser (25 or fewer pharmacists/techs as of Nov 27, 2024), FDA’s exemption buys you time until Nov 27, 2026—but not an excuse to wait. Build the habits now: authorized‑partner checks, single‑touch receiving, TI/TS reconciliation, and clean exception handling. That way, when the mile‑marker arrives, you’ll simply keep doing what already works. 

Why This All Builds Pharmacy Trust & Security

Patients don’t see EPCIS files or TI/TS—but they feel the result: confidence that their medication is legitimate and safe. Payers and health‑system partners notice, too. Pharmacies that run like modern package hubs—verifying everything, documenting exceptions, resolving issues fast—project trust. And for pharmacy staff, a well‑integrated, single‑touch workflow reduces stress, clicks, and callbacks, letting teams stay focused on care instead of wrangling paperwork.

That’s the heart of pharmacy security: people + process + proof.

Further Reading

• FDA Waivers & Exemptions Beyond the Stabilization Period — including the 2025/2026 mile‑markers and the small dispenser exemption. U.S. Food and Drug Administration

• FDA Product Tracing FAQ — definitions, exemptions (e.g., OTC, certain IVs, imaging, compounded), and the recommendation to use GS1 EPCIS. U.S. Food and Drug Administration

• FDA Guidance: Transactions with First Responders — how to handle EMS hand‑offs without tripping over tracing rules. U.S. Food and Drug Administration

• PDG TI/TS Exchange Blueprint — practical details on TI/TS exchange and exception handling that align with industry best practice. PDG

• NCPA DSCSA Resources — overview materials and links for dispensers. NCPA

Closing: Keep Scanning Like a Smart Hub

DSCSA doesn’t exist to make your day harder. It exists so that a patient’s “package” is always the right package—authentic, traceable, and safe. As the industry passes this wholesale milestone and heads into the dispenser mile‑markers of November 27, 2025 and November 27, 2026, the pharmacies that thrive will operate like the best package hubs: one clean scan, a tight exception loop, and an audit story that writes itself. RxPost is here to help you get—and stay—there.

Questions about your setup? We’re happy to talk through your operation and share practical ways to tighten workflows, expand PMS integrations, and prepare for the November checkpoints.

Still looking for more information? Register for an upcoming DSCSA solution provider webinar to stay current on industry guidance and best practices.