Suspect product, illegitimate product: the DSCSA procedure your pharmacy needs on paper, small-dispenser exemption or not.

"FDA pushed the small pharmacy exemption to 2027. So we don't have to worry about DSCSA until then, right?"

A pharmacist-in-charge asked me that after FDA's August notice came out. The headline was "exemption extended," and most people stopped reading there.

The honest answer is that the exemption is narrow. It covers the electronic, package-level tracing pieces and one verification step inside the suspect product investigation. It does not cover quarantine, the investigation itself, the 24-hour notice when a product turns out to be illegitimate, or the six years of records. Those have applied to dispensers since 2015. If a case of something odd shows up at your back door tomorrow, the law already tells you what to do, and the Board's self-assessment asks whether you are doing it.

Two definitions drive everything

The statute uses two words that sound alike and trigger very different duties. FDA's guidance, Drug Supply Chain Security Act Implementation: Identification of Suspect Product and Notification (June 2021, Revision 1), restates both from section 581 of the Food, Drug, and Cosmetic Act.

A suspect product is one where there is "reason to believe" it is potentially counterfeit, diverted, or stolen; potentially intentionally adulterated such that it would result in serious adverse health consequences or death; potentially the subject of a fraudulent transaction; or otherwise unfit for distribution in a way that could cause serious harm.

An illegitimate product is one where "credible evidence shows" the same things.

That shift from "reason to believe" to "credible evidence" is the whole procedure in miniature. Suspicion puts the product on a quarantine shelf and starts an investigation. Credible evidence starts the clock on notifications.

What should make you suspicious

FDA's guidance lists scenarios that "could significantly increase the risk" of suspect product, and says the list is illustrative, not exhaustive. The ones I see matter most in community pharmacy are:

• The source. Buying from a source new to you, an unsolicited offer from someone you do not know, or an internet purchase from an unknown seller. FDA also flags a supplier that is "reluctant to provide a transaction history" or does not do so in a timely manner, and paperwork with misspellings or missing information.

• The product. Drugs in high demand, drugs with a history of counterfeiting or diversion (the guidance names HIV, antipsychotic, and cancer drugs as examples), drugs that are or have been in shortage, and anything offered at a price that is "too good to be true."

• The package. A label with misspellings or a different color, font, or image than usual; unusual adhesive residue; a missing lot number or expiration date; missing visible security features such as holograms, color-shifting ink, neckbands, or watermarks.

• The dosage form. A tablet with a different shape, color, or imprint, an unusual odor, chipped coatings, or smeared imprints.

The guidance also says to examine the shipping container (broken or repaired seals, missing or mismatched inserts) and to consult the manufacturer during any investigation, because the manufacturer is "usually the best able to assess the authenticity and quality of a product."

None of this requires a scanner. It requires someone at receiving who knows what to look for and what happens next.

When something is suspect: quarantine and investigate

The dispenser requirements are in 21 USC 360eee-1(d). Paragraph (d)(4) begins with the phrase that matters for a procedure: beginning not later than January 1, 2015, "a dispenser shall have systems in place" to comply with what follows.

Under (d)(4)(A)(i), once you determine a product in your possession or control is suspect, or FDA tells you it has made that determination, you must:

• "quarantine such product within the possession or control of the dispenser from product intended for distribution until such product is cleared or dispositioned"; and

• "promptly conduct an investigation in coordination with trading partners, as applicable, to determine whether the product is an illegitimate product."

Paragraph (d)(4)(A)(ii) says what the investigation includes: verifying the lot number; verifying the product identifier on at least 3 packages or 10 percent of the suspect product, whichever is greater (or all packages if there are fewer than 3); validating any transaction history and transaction information you have; and "otherwise investigating."

If the product clears, (d)(4)(A)(iii) says you promptly notify FDA "if applicable" and the product may be dispensed. Either way, (d)(4)(A)(iv) requires you to keep records of the investigation "for not less than 6 years after the conclusion of the investigation."

When it is illegitimate: disposition and the 24-hour clock

Paragraph (d)(4)(B) takes over once you determine, in coordination with the manufacturer, that the product is illegitimate. Then you must:

• disposition the illegitimate product in your possession or control;

• take reasonable and appropriate steps to help a trading partner disposition illegitimate product you do not hold;

• retain a sample for examination or laboratory analysis if the manufacturer or FDA asks; and

• under (d)(4)(B)(ii), notify FDA and "all immediate trading partners that the dispenser has reason to believe may have received such illegitimate product" no later than 24 hours after making the determination.

  
  

The guidance explains that the immediate trading partners to notify would include those you sold the drug to and, in some cases, the one you bought it from.

There are two more duties people forget. Under (d)(4)(B)(iii), when you receive a notice from FDA or a trading partner that a product is illegitimate, you identify all of that product in your possession, including product that arrives later, and run the suspect product steps on it. Under (d)(4)(B)(iv), once you decide, in consultation with FDA, that a notice you sent is no longer needed, you promptly tell the trading partners you notified that it has been terminated. And (d)(4)(B)(v) requires disposition records for at least 6 years.

How the FDA notice actually gets filed

FDA's page Notify FDA of Illegitimate Products says notifications go through the 3911 platform in CDER NextGen, which it calls "the agency's preferred method," or by completing Form FDA 3911 and emailing it. FDA acknowledges the notice and assigns an incident number, which you reference in all later correspondence, including a request to terminate.

Termination is the one part of this guidance that is binding: section IV.B "has binding effect, where indicated by the use of the words must, shall, or required." The FDA page adds that whoever made the notification requests termination and must include the incident number.

Practical point: you do not want to be creating a CDER NextGen account at 4:45 on a Friday with a 24-hour clock running. Decide in advance who files and confirm they have access.

What the 2027 exemption covers, precisely

FDA's notice, DSCSA Exemptions from Certain Requirements Under Section 582 of the FD&C Act for Small Business Dispensers Until November 27, 2027, was issued August 6, 2026. It defines a small business dispenser as one whose owning corporate entity has a total of 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. (We covered how to count that headcount in an earlier post.)

For the suspect and illegitimate product rules, the exemption reaches only "the requirements under section 582(d)(4)(A)(ii)(II) and (B)(iii) of the FD&C Act for dispensers to verify the product identifier of the statutorily designated proportion of suspect or illegitimate product." That is the 3-packages-or-10-percent identifier check. The next sentence of the notice is the one to underline: "Small business dispensers are still obligated to meet all other verification requirements of section 582(d)(4) of the FD&C Act."

The rest of the notice covers the electronic tracing requirements under section 582(g)(1), and it says "the exemptions described below do not apply to other requirements in section 582."

So a small pharmacy relying on the exemption still quarantines, still investigates, still validates the paperwork, still notifies within 24 hours, and still keeps six years of records. It just does not have to verify product identifiers on that sample of packages until November 27, 2027.

California runs a second clock

Business and Professions Code section 4107.5 says that if a pharmacy "has reasonable cause to believe that a dangerous drug or dangerous device in, or having been in, its possession is counterfeit or the subject of a fraudulent transaction," it "shall notify the board within 72 hours of obtaining that knowledge."

Notice the trigger. The federal 24-hour notice runs from a determination that the product is illegitimate. California's 72-hour notice runs from reasonable cause to believe the product is counterfeit or part of a fraudulent transaction, which can arrive earlier, while you are still investigating. A pharmacy can owe the Board a notice before it owes FDA one.

I have not found a dedicated Board form for this, so your procedure should simply name who contacts the Board and how that contact is documented.

The Board asks about this by name

The Board's Community Pharmacy Self-Assessment, form 17M-13 (approved 1/27/2026), item 2.2, cites 21 USC 360eee-1 and asks whether "the pharmacy complies with Drug Supply Chain Security Act provisions." The PIC signs that form under penalty of perjury. A "yes" there is hard to defend if nobody can describe what happens to a suspect bottle.

One scope note. Under 360eee-1(d)(5), the product tracing and verification requirements in (d)(1) and (d)(4) do not apply to licensed practitioners authorized to prescribe or administer, and those under their supervision, who dispense or administer in the usual course of professional practice. This post is written for pharmacies, not that exception.

What the written procedure should say

The statute says you "shall have systems in place." The guidance assumes trading partners have them. Here is how I lay one out with clients:

• Who decides "suspect." Name the role, usually the PIC, with a backup. Staff at receiving should know they can flag; the designated person decides.

• The triggers. Pull the FDA scenarios above into a one-page receiving checklist.

• The quarantine location. A specific, labeled shelf or bin physically separated from saleable stock, with a log entry for each item placed there and the date.

• The investigation steps. Check the transaction information and statement you received against the product, check lot and expiration, contact the supplier and the manufacturer, and record every call and email. Note whether you are relying on the small-dispenser exemption for the identifier check.

• The decision and the clocks. Who makes the illegitimate determination, who files the 3911 within 24 hours, who notifies immediate trading partners, and who notifies the Board within 72 hours under 4107.5.

• Incoming notices. Who receives FDA and supplier notices, and how you search your stock for affected product, including later deliveries.

• Disposition and termination. How product is held for sampling, how it is disposed of, and how a termination request is made with the incident number.

• Records. Where the investigation and disposition files live and how you keep them for at least six years.

Underneath all of it sit the (d)(1) and (d)(3) basics. Under (d)(1)(A), you do not accept ownership without the transaction information and transaction statement, and you keep what you need to investigate a suspect product for at least 6 years after the transaction. Under (d)(1)(D), you produce that information within 2 business days of a request from FDA or a state official in a recall or investigation. Under (d)(3), your trading partners may only be authorized trading partners.

If you want a procedure like this written for your pharmacy and keyed to the 17M-13, it fits alongside the rest of our pharmacy policies and procedures work.

And if you are reading this with a questionable delivery already on the counter, call me before you decide what it is. Reach out if you have any questions or concerns.

Sources

• 21 U.S.C. 360eee-1(d), dispenser requirements, including (d)(1) product tracing, (d)(3) authorized trading partners, (d)(4) verification and (d)(5) practitioner exception (Cornell LII).

• FDA, Guidance for Industry, Drug Supply Chain Security Act Implementation: Identification of Suspect Product and Notification (June 2021, Revision 1), sections I to IV.A.

• FDA, Notify FDA of Illegitimate Products (web page), including the 3911 platform in CDER NextGen and termination of notifications.

• FDA, DSCSA Exemptions from Certain Requirements Under Section 582 of the FD&C Act for Small Business Dispensers Until November 27, 2027 (issued August 6, 2026).

• Business and Professions Code section 4107.5, as published in the Board's 2026 Pharmacy Lawbook.

• California State Board of Pharmacy, form 17M-13 (approved 1/27/2026), item 2.2.

General information from a consultant pharmacist, not legal advice. Statutes and guidance change; everything above was checked against the official source on the date of publication.