DSCSA Compliance Checklist for Pharmacies (Free PDF)
Picture a quiet Thursday after close, when you finally sit down to write a DSCSA compliance checklist. You have a pile of wholesaler emails, two FDA letters you meant to read, and a sticky note that just says "DSCSA?" in your own handwriting. You know the rules matter. You're just not sure which ones apply to your pharmacy today, and which ones can wait.
That's exactly what a checklist should sort out, and there's a good reason to do it now. In April 2026, FDA sent a warning letter to a Texas medical spa that it treated as a DSCSA dispenser. FDA compared the spa's purchase records with its patient records, and the numbers didn't match. It cited the spa for buying from sources that were not authorized trading partners, and for handling product without a product identifier. It also noted that the spa's reply had no written procedures for checking a partner's status.
A good checklist gives you the two things that spa was missing: a clear routine, and proof that you follow it. Let's build one in three steps, then look at how to test yourself and where to get the free PDF.
What a DSCSA compliance checklist should cover
The law behind all of this is the Drug Supply Chain Security Act (DSCSA). For pharmacies, most of its rules sit in section 582(d) of the FD&C Act. A newer electronic layer sits in section 582(g)(1). Most of the confusion comes from mixing those two layers up. So a useful checklist splits the work into three parts: find your deadline, do what applies today, and get ready for the electronic part.
Step 1: Find your deadline
Your deadline depends on one number. Count the full-time pharmacists and pharmacy technicians at the company that owns your pharmacy, across all of its stores, as of November 27, 2026. FDA uses the IRS definition of full-time: an average of at least 30 hours a week, or 130 hours a month. Cashiers, drivers and billing staff don't count.
If the total is 25 or fewer, FDA's August 6, 2026 letter gives you until November 27, 2027 for the electronic requirements. Here's how the cases break down.
| Your count | Electronic requirements apply from |
|---|---|
| 25 or fewer on November 27, 2026 | November 27, 2027 |
| 25 or fewer in 2024, but 26 or more on November 27, 2026 | November 27, 2026 |
| 26 or more in 2024, and still 26 or more | Already in effect (FDA's exemption for this group ended November 27, 2025) |
Example (fictional): Grace owns two pharmacies under one company. She has four full-time pharmacists, nine full-time technicians, and three technicians who work about 20 hours a week. Her count is thirteen, because the part-timers fall under the 30-hour line. So she writes "2027" at the top of her checklist, next to the date of the FDA letter she follows.
Whatever your number is, write it down with the date you counted. Our guide to the small dispenser definition covers the tricky cases.
Step 2: Do what applies today
This is the part that surprises people. The small dispenser exemption covers the electronic layer and one step in suspect-product checks. It doesn't cover the rest, so every pharmacy should already be doing the following. The middle column is what you'd show if someone asked.
| What you do | What to keep as proof | Where it comes from |
|---|---|---|
| Buy from and sell to authorized trading partners only | A license or registration check for each supplier (how to check) | §582(d)(3) |
| Accept product only with its transaction information (TI) and transaction statement (TS) | The TI and TS for each purchase | §582(d)(1)(A)(i) |
| Keep TI and TS for at least six years | Your records, or a copy of the written agreement if a third party stores them | §582(d)(1)(A)(iii) and (B) |
| Handle only product that carries a product identifier | A receiving routine that flags packages without one | §582(d)(2) |
| Quarantine and investigate suspect product promptly | A written procedure, plus investigation records kept six years | §582(d)(4)(A) |
| If you determine a product is illegitimate, notify FDA (Form FDA 3911) and the immediate trading partners you believe may have received it within 24 hours (step by step) | FDA's incident number and your records | §582(d)(4)(B) |
| Respond to FDA or state requests during a recall or investigation within two business days | A named person who can pull the records fast | §582(d)(1)(D) |
Two terms in that table do a lot of work. TI is the record of what you bought, from whom, and when, including the lot number. TS is the seller's statement that it's authorized and followed the rules for that sale. One older term you can drop: since November 27, 2023, transaction history is no longer required.
DSCSA Compliance for Small Pharmacies: Free Training (2026 Rules). The printable PDF, plus one short video for each step → Get free access
Step 3: Get ready for the electronic part
Now for the electronic layer. By your deadline, you'll need to exchange TI and TS with your partners in a secure, electronic way. The data will include the product identifier of each package. You'll also need systems to verify product, answer requests and help trace a product back. If you're a small dispenser, the exemption gives you time for this, not a reason to wait. In its 2026 letter, FDA strongly urges small dispensers to keep working toward full compliance.
A simple plan looks like this:
- Ask your wholesaler how and when it will send electronic DSCSA data (what the portal covers).
- Decide how you'll receive and store data from every partner, including secondary wholesalers and drop-ship orders.
- Compare vendors on price and setup time (seven questions to ask).
- Test the connection early, while nothing is at stake.
A DSCSA connector, such as Connect RX by Maltexi, connects your pharmacy to your trading partners for electronic DSCSA data. Whatever you choose, testing it this winter is far easier than testing it in November 2027.
How to run a DSCSA audit checklist on yourself
A checklist only helps if it matches what happens at your counter. So once a year, run three quick tests.
First, pick a purchase from two years ago and find its TI and TS. Time how long it takes. The two-business-day rule for official requests applies to you today, so a search that takes all afternoon is a warning sign.
Next, list every supplier you used this year, including secondaries and drop-ship orders. Then check each one's license or registration and save the result.
Finally, ask the newest person on your team where a suspect bottle goes. If they can't point to the quarantine shelf, your written procedure needs another look. If you want to know what's at stake when these checks fail, read our post on DSCSA enforcement and penalties.
Get the free PDF
The checklist PDF puts all of this on three pages. Page one helps you find your deadline and lists what's required today. Page two covers the electronic part, with a plan for a 2026 deadline and one for 2027. Each item carries its legal reference. Page three is a records sheet: your suppliers, where your records live, and who answers FDA. It comes with the free video training, where each short lesson covers one step.
FAQ
Is there a DSCSA compliance checklist for pharmacies? Yes. Ours follows three steps: find your deadline, do what applies today, and prepare the electronic part. The free PDF puts each item on one line, with its legal reference.
Where can I find DSCSA guidelines as a PDF? FDA posts its DSCSA letters and guidance documents as PDFs on FDA.gov, such as the August 6, 2026 exemption letter. Our checklist sums up what those rules mean for a pharmacy on two pages.
What should a DSCSA audit checklist include? Authorized trading partners, TI and TS kept for six years, product identifiers, and a suspect-product procedure. It should also cover the 24-hour notice for illegitimate product and answers to official requests within two business days.
If I'm a small dispenser, do I still need a checklist? Yes. The exemption covers the electronic layer and one verification step. Everything else in the table above applies to your pharmacy today.
How long do I keep DSCSA records? At least six years. A third party, like your wholesaler, can store them under a written agreement, but you remain responsible.
The short version
Count your full-time pharmacists and technicians as of November 27, 2026 to find your deadline. Then make sure the duties that apply today are in place, with proof on file. Finally, start on the electronic part early, and test yourself once a year with the three quick checks.
Know what to do today. Be ready for 2027. → Get the free DSCSA training
DSCSA rules can change. Always confirm the latest requirements on FDA.gov. This is educational content, not legal advice.
Sources
- FDA, DSCSA exemptions for small business dispensers until Nov 27, 2027 (Aug 6, 2026).
- FDA, Exemptions under the DSCSA (page updated Aug 26, 2026).
- FDA, Warning letter to Pure Indulgence Aesthetics (Apr 1, 2026).
- FDA, Drug Supply Chain Security Act (main page).
- FD&C Act §582, 21 U.S.C. 360eee-1.
- FD&C Act §581, 21 U.S.C. 360eee (definitions).