Supply Chain Tracing and the Duty to Verify

Counterfeit and diverted medicines enter a legitimate supply chain through a transaction that nobody examined closely. The tracing requirements answer that by making each transfer of ownership generate a record and each counterparty a credential to be checked. The duties are allocated by role, and they are continuous rather than periodic.

What must travel with the product

Two documents accompany each change of ownership. Transaction information identifies the product and the transfer: the proprietary or established name, the strength and dosage form, the national drug code, the container size and number of containers, the lot number, the transaction date and shipment date, and the business name and address of the person from whom and to whom ownership is being transferred.

The information travels with the product in the sense that it must be provided to the buyer, not that it rides in the carton. In practice it moves electronically, in a standardized message format, and the receiving firm has to be able to ingest, associate and retain it against the physical shipment. A firm that receives data it cannot match to the goods on its dock has received nothing useful, and reconciliation failures are where most tracing problems begin.

The transaction statement is a set of assertions by the transferor. It states that the entity is authorized, that it received the product from an authorized trading partner, that it received the accompanying transaction information and statement, that it did not knowingly ship suspect or illegitimate product, that it had systems and processes to comply with the verification requirements, and that it did not knowingly provide false transaction information or alter what it received.

Authorized trading partners

The second structural rule is that firms may deal only with authorized trading partners. Authorization means the status the law requires for that role: registration for manufacturers and repackagers, licensure for wholesale distributors and third-party logistics providers, and licensure for dispensers. A transaction with an unauthorized counterparty is a violation regardless of whether the product was genuine.

This converts counterparty diligence into a compliance function. Firms verify licenses at onboarding and re-verify them, because a license that lapses mid-relationship makes every subsequent shipment non-compliant. The discipline resembles the counterparty screening required in other regulated trade, described in end-use, end-user and red flag screening, and the failure modes are the same: stale data, unverified intermediaries, and a purchasing function that treats price as the only variable.

Product identifiers and package-level verification

Packages carry a product identifier containing a standardized numerical identifier, made up of the national drug code and a unique serial number, together with the lot number and expiration date, in both human-readable and machine-readable form. The serial number is what makes verification possible at the level of an individual package rather than a lot.

The identifier also changes what a recall can reach. Under a lot-based system, an action against a defective lot pulls back every unit of that lot wherever it went, because nothing distinguishes one package from another. Serialization allows a firm to establish that particular packages were affected and where they were shipped, which narrows the action and shortens the time it takes to close.

Verification duties attach at defined points. A firm must verify the product identifier on a suspect product at the package level, including the serial number, before further distribution. Saleable returns must be verified before they re-enter the supply chain, which is the control that closes the most exploited entry point in the older system. Requests from the agency or from appropriate officials for tracing information must be answered within the period the statute allows.

Responding to suspect and illegitimate product

Suspect product is product for which there is reason to believe it is potentially counterfeit, diverted, stolen, intentionally adulterated so as to cause serious adverse health consequences, the subject of a fraudulent transaction, or otherwise unfit for distribution such that it would result in serious health consequences. The response is prescribed: quarantine and promptly investigate, including validating the transaction history and verifying the identifier.

Where the investigation clears the product, it may return to inventory with the determination documented. Where it does not, the product is illegitimate, and a different set of duties applies. The firm quarantines the product, works with the manufacturer to determine appropriate disposition, and notifies the agency and immediate trading partners it believes may have received the product, within the period the statute specifies. A later determination that the product is no longer illegitimate is communicated as a termination of the earlier notification.

The practical checklist for a receiving firm is short: confirm the counterparty is authorized, confirm the shipment matches its transaction information, verify identifiers where verification is required, quarantine anything that does not reconcile, document the investigation and its outcome, and retain the records for the required period. Those records are also what makes a field action workable, because locating affected units depends on knowing where they went, as discussed in recalls, corrections and removals. The systems that generate and retain the data fall within the same electronic records expectations examined during the inspections described in quality systems and inspections, and the identifying information on each package is itself labeling governed by labeling content and change requirements.