DSCSA: A Closer Look At The Six-Year Record-Keeping Requirement

??????????The Drug Supply Chain Security Act (DSCSA) contains record-keeping requirements for drug manufacturers, wholesale distributors, repackagers and dispensers that begin on January 1st.  All companies must keep a copy of the Transaction Information (TI), Transaction History (TH), and Transaction Statements (TS) they receive and those they send for at least six years.  In addition, manufacturers and repackagers must also retain knowledge about the “product identifier” on each unit they sell into the supply chain for a period of six years after the date it was sold.  Companies who perform investigations into suspect product must also keep records of their process and the outcome for six years.

There are a few implications of these record-keeping requirements.  Let’s take a look at some of them. 

The purpose of retaining all this information is so that it can be retrieved and serve as a data source for investigations into suspect product (see “The FDA’s Draft Guidance on Suspect Product, and Farewell Columbus”) over the ensuing six years.  For example, wholesale distributors must respond to requests for information from the FDA…

“…or other appropriate State or Federal official in the event of a recall or for the purpose of investigating a suspect product or an illegitimate product, a wholesale distributor shall, not later than 1 business day, and not to exceed 48 hours, after receiving the request or in other such reasonable time as determined by the Secretary, based on the circumstances of the request, provide the applicable transaction information, transaction history, and transaction statement for the product.”  DSCSA 582(c)(1)(C)  see “The Drug Supply Chain Security Act Explained”.

The same type of provision exists for each type of company in the supply chain (except dispensers are given two days to respond).

Even if you are not the direct target of a particular investigation…or prosecution…you may still be called upon to contribute data about the shipments you have made over the last six years whenever you supplied product to, or received product from, someone who is the target.  Their data had better match your data, where your data may be considered the basis of truth and the target company’s data may be viewed with suspicion.  In a case like this, you may be called upon to provide the TI, TH and TS for more than just one product or one shipment.  You may need to supply all of that data for that particular supplier or customer over a period of months.

I can imagine, “…based on the circumstances…” that you might be asked for the TI, TH and TS in the following ways.  Provide all transaction data involving:

  1. company “XYZ” over the period “begin date” to “end date”
  2. product “WXY” and lot number “ABC”
  3. product “VWX” over the period “begin date” to “end date”
  4. company “XYZ” and product “WXY” over the period “begin date” to “end date”
  5. company “XYZ”, product “XYZ” and lot number “ABC”
  6. company “XYZ”, product “WXY” and lot number over the period “begin date” to “end date”

You might be able to imagine other types of requests.  In any case, your ability to retrieve this data within one day (two days for pharmacies) will need to include all of the forms and formats you expect to send and receive over time.  That is, if you start sending or receiving paper TI, TH and TS and some Electronic Data Interchange (EDI) Advance Ship Notice (ASN) versions of that data in January, and then in two years you add some exchange of EPCIS-based transaction data, you will need to be able to search all of these data repositories to fulfill these requests.

Even after you stop sending or receiving a particular form of transaction data, you will need to be able to search and retrieve data from the repository of that type for another six years.  See “DQSA: How Should Transaction Data Be Exchanged?” and “DQSA: Getting To Electronic Transaction Data Exchange”.

I recently asked a person who works for a small manufacturer if they have plans for implementing this record-keeping requirement, and he said, “Oh, we already do tape backups of all our data.”  Hmmm.  A “tape backup”?

Oracle supports cancer research. Click here to learn more.
Oracle supports cancer research. Click here to learn more.

It seems to me that this requirement is beyond the capability of a simple “tape backup” system.  Because of the type of queries you might be faced with, I don’t think you will want to restore data from tape and then search for the requested data, repeating until you are sure you found it all.  Instead, I think you will want some way to query a database for the location of the requested data, and then perhaps restore only the one tape that contains the needed data (or open the one box of paper documents needed).  This approach requires a level of intelligence that most tape backup systems do not have.

Up until now, the usefulness of EDI ASNs was fairly short.  After the product reflected on a given ASN was received into inventory and matched with the supplier’s invoice, the ASN wasn’t really needed.  Most companies probably keep them around for some period of time, but probably not for six years.  Starting in January, those ASNs that are used to transmit the required TI, TH and TS will fall under the six year data retention requirement of the DSCSA for both the sender and the recipient.  And these are the documents you will need to retrieve based on the future “requests for information”.

Don’t be confused by the language “…not later than 1 business day, and not to exceed 48 hours, after receiving the request…”.  This simply covers what must happen over a weekend.  For example, if the FDA (or State Board of Pharmacy, or U.S. Justice Department…) request for information arrives at 3pm on Friday, May 22, 2015, unless the requester relaxes this requirement in that specific case, you will need to respond by 3pm on Sunday, May 24, (48 hours later) even though it is a holiday weekend (Memorial Day).  I assume they will not do something like that unless lives are in danger, but at least the law allows them to do it in any case.

If I am reading these provisions correctly, the FDA could request an even faster response time, again “…based on circumstances…”.  Imagine a time-critical investigation where the health of a large number of people may be at stake, perhaps.

The bottom-line implication of all this is that companies should be ready to quickly and accurately retrieve any of the TI, TH and TS they generate and receive based on a wide range of parameters beginning in January.  And I don’t think you should rely on a simple tape backup system to meet this regulatory requirement.

What type of system are you developing to meet this requirement?  Leave a comment below.

Dirk.