DSCSA FOR PHARMACIES

DSCSA 2D Barcode and Scanning: What Pharmacies Actually Need

By MaltexiPublished October 21, 2026

Drug cartons with a DSCSA 2D barcode next to a handheld scanner.

The DSCSA 2D barcode is the small square on every drug package, and it causes more worry than it should. Picture the delivery tote landing on your counter. Your technician picks up a carton, tries the old scanner, and gets nothing. Then comes the question every owner hears sooner or later. "Do we have to scan every single one of these now?"

Short answer: no law says you must scan every package. But that doesn't mean the code is irrelevant. It matters today in one specific way, and it matters more in 2027.

Let's start with what's inside that square. Then we'll cover what you must do now, where scanning helps, and what changes in 2027.

DSCSA Technology Explained: 2D Codes, EPCIS, Portals and Connectors

What's inside the DSCSA 2D barcode?

The Drug Supply Chain Security Act (DSCSA) calls it the product identifier. Drug makers must put one on each package, and on a package it goes in a 2D data matrix barcode. Many pharmacists call it the "QR code." It isn't technically a QR code, but it works in a similar way.

The law defines the product identifier as a graphic in both human-readable and machine-readable form. It holds four pieces of data.

Data	What it tells you
NDC	What the product is, down to the package size
Serial number	Which exact package this is
Lot number	Which batch it came from
Expiration date	When it expires

The serial number is the new part for most people. A lot covers many packages, but a serial number covers one. That's what lets each package be checked on its own.

Your duty today: only handle product that has one

Here's the rule that already applies to you. Since November 27, 2020, a pharmacy may only engage in transactions involving product that has a product identifier. It's in section 582(d)(2) of the FD&C Act, and the small dispenser exemption doesn't cover it.

This isn't just a technicality. In April 2026, FDA cited a Texas medical spa, treated as a DSCSA dispenser, for buying from unauthorized sources and for handling product without a product identifier. You can read more in our post on DSCSA enforcement and penalties.

So the daily habit is simple. Look for the code when product arrives. If a package has no 2D barcode, set it aside, don't dispense it, and call your supplier. If anything else about it looks wrong, follow your suspect product steps.

Do you have to scan every package?

No. FDA guidance recommends that buyers confirm the electronic tracing data matches the product they receive. FDA does not require you to scan every package on receipt.

That recommendation sits in FDA's guidance on enhanced drug distribution security at the package level (January 2024, Revision 1). The guidance also allows "inference" for sealed cases. If a case arrives with the maker's original seal intact, you can rely on the case data instead of opening it to check each package.

And for small pharmacies, even that recommendation belongs to the electronic requirements. Pharmacies with 25 or fewer full-time pharmacists and technicians, counted at the company level as of November 27, 2026, are exempt from those requirements until November 27, 2027. You still may not accept product without transaction information and a transaction statement. Our post on the small dispenser exemption explains who qualifies.

DSCSA Compliance for Small Pharmacies: Free Training (2026 Rules). Short video lessons + a printable checklist → Get free access

How might receiving look in 2027?

Example (fictional): Leo's pharmacy gets a tote with one sealed case and 28 loose packages. The sealed case holds twelve inhaler cartons. His wholesaler sends the transaction data for all of them electronically.

The sealed case still has the maker's seal, so Leo relies on the case data and leaves it closed. For the 28 loose packages, his process confirms that the data he received matches what's in the tote. He might scan them, or his system might match them another way. FDA leaves the method to him.

One carton has no 2D barcode at all. Leo sets it aside and calls his wholesaler before it goes anywhere near a shelf. That last step is the one he already does today.

What scanner do you need?

The law doesn't name a scanner, and FDA lets each company choose its own technology. In practice, an old 1D laser scanner can't read a 2D code, which is why the "QR code" won't scan at some counters. A 2D imager can, and so can many phones. That's handy when you need to check a package that looks suspect.

So you may not need new hardware today. If you buy a scanner, make sure it reads 2D data matrix codes. Lesson 10 of the free training shows how the code, the data and the scanner fit together.

GLN and EPCIS: two terms that come with the barcode

Once you start reading about the 2D barcode, two more terms show up quickly. Here's what each one means for you.

EPCIS is a data standard for sending tracing data between companies. FDA recommends, but does not require by law, the GS1 EPCIS standard for electronic DSCSA data. Its standards guidance from September 2023 explains why.

A GLN (Global Location Number) is a number that identifies your location. DSCSA does not require a GLN. Your wholesaler may ask for one as a business requirement. FDA says so in its product tracing FAQ. Many pharmacies already have one through their wholesaler, so ask before you buy one. Our post on what your wholesaler portal covers lists more questions to ask.

What changes in 2027

FDA has extended its small-dispenser exemption until November 27, 2027. After that date, the serial number moves into the data itself. The transaction information you receive will include the product identifier for each package. You'll also need systems to verify a package and to answer requests.

That's when the 2D barcode and the electronic data finally meet. To receive that data, you need a connection with each trading partner. A DSCSA connector, such as Connect RX by Maltexi, connects your pharmacy to your trading partners for electronic DSCSA data. Before you choose any tool, see what to ask a DSCSA software vendor.

FAQ

Do I have to scan every package under DSCSA? No. FDA guidance recommends confirming that the electronic data matches the product you receive. It does not require you to scan every package on receipt.

Is the DSCSA 2D barcode the same as a QR code? Not technically. It's a 2D data matrix code. Many pharmacists call it a QR code, and a 2D scanner or many phones can read it.

What's in the DSCSA product identifier? Four pieces of data: the NDC, a unique serial number, the lot number and the expiration date.

Can I accept a package without a 2D barcode? No. Since November 27, 2020, pharmacies may only engage in transactions involving product that has a product identifier.

Do I need a GLN for DSCSA? DSCSA does not require one. Your wholesaler may ask for one as a business requirement for electronic data exchange.

The short version

The 2D barcode holds the NDC, serial number, lot and expiration date. Today, you must only handle product that has one. No law makes you scan every package, and FDA allows inference for sealed cases. In 2027, the same data arrives electronically for each package, so start planning that connection now.

Know what to check today. Be ready for 2027. → Get the free DSCSA training

DSCSA rules can change. Always confirm the latest requirements on FDA.gov. This is educational content, not legal advice.

Sources

← All DSCSA articles