DSCSA Compliance for Compounding Pharmacies in Telehealth

What DSCSA Is and Why It Matters for Telehealth

The Drug Supply Chain Security Act (DSCSA) is a federal law enacted in 2013 that establishes a framework for tracing prescription drugs through the U.S. distribution system from manufacturer to dispenser. Its primary goal is preventing counterfeit, stolen, and contaminated drugs from reaching patients. Every entity in the chain — manufacturer, repackager, wholesale distributor, third-party logistics provider, and dispenser — has specific obligations to maintain and exchange transaction documentation, respond to FDA verification requests, and quarantine suspect products. For DSCSA compliance compounding pharmacy telehealth relationships, understanding exactly where each party falls in this chain is the first step toward building a defensible compliance program.

Telehealth clinics that prescribe compounded medications sit at the end of two overlapping supply chains. The first is the commercial pharmaceutical supply chain: the drugs, APIs (active pharmaceutical ingredients), and excipients that the compounding pharmacy purchases from licensed distributors. The second is the patient-specific dispensing chain: the compounded preparations that the pharmacy produces and ships directly to patients. DSCSA requirements apply differently to each chain, and the failure to understand the distinction is the single most common source of compliance gaps in telehealth-compounding relationships. These supply chain obligations exist alongside the HIPAA data security requirements that govern how patient prescription information is transmitted to and stored by compounding pharmacies.

The DSCSA was implemented in phases over a 10-year period. The final phase — requiring full electronic, interoperable tracing at the package level — was scheduled for November 2023 but was extended to November 2024 after FDA granted a one-year stabilization period following industry requests. As of 2026, full interoperability requirements are in effect, meaning trading partners must be capable of providing and receiving transaction data electronically in a standardized format and must be able to trace any product through the supply chain within the mandated response windows.

503A vs 503B: The Critical Distinction

Before mapping DSCSA obligations, you must understand the regulatory distinction between the two types of compounding pharmacies, because their DSCSA treatment differs substantially.

Table 1: 503A vs 503B compounding pharmacy comparison for DSCSA and telehealth contexts

Most telehealth peptide, TRT, and HRT clinics work exclusively with 503A pharmacies, because their model is patient-specific: a provider writes a prescription for a named patient, the pharmacy compounds to that prescription, and the pharmacy ships directly to the patient. This is the 503A model. Some larger clinics also maintain relationships with 503B facilities for office-administered compounds or to purchase pre-formulated units for in-clinic use. The DSCSA obligations for each relationship differ, and clinics should understand both. Prescriptions routed through 503A pharmacies for controlled substances like testosterone must also comply with the DEA's corresponding responsibility requirements, which impose independent documentation obligations on both the prescriber and the dispensing pharmacy.

DSCSA Requirements by Pharmacy Type

503A Pharmacy DSCSA Obligations

A 503A compounding pharmacy functions primarily as a dispenser under DSCSA. Its obligations center on the commercial drug products it receives — the APIs, excipients, and sometimes finished drug products it purchases from licensed distributors or wholesalers. These obligations include:

• Receiving and retaining transaction information (TI), transaction history (TH), and transaction statements (TS) for all incoming eligible drug products
• Verifying that suppliers are authorized trading partners
• Responding to FDA product tracing requests within 24 hours
• Maintaining records for six years from date of receipt
• Quarantining and investigating suspect products
• Reporting illegitimate products to FDA within 24 hours of determination

The patient-specific preparations that a 503A pharmacy compounds and dispenses to patients are not subject to DSCSA serialization or downstream tracing requirements, because they are not commercial drug products with NDC numbers entering the wholesale distribution system. However, the pharmacy's internal records of what it compounded, for whom, using which lot-numbered ingredients, are subject to state board of pharmacy recordkeeping requirements and, in cases of adverse events or FDA investigations, may be reviewed by federal inspectors.

503B Outsourcing Facility DSCSA Obligations

503B facilities have more complex DSCSA obligations because they operate as both dispensers (for what they receive) and in some respects as manufacturers or distributors (for the finished preparations they produce and sell). Key obligations include everything that applies to 503A pharmacies, plus:

• Potential obligations to provide TI, TH, and TS to purchasers when shipping finished preparations
• More rigorous lot and batch recordkeeping aligned with cGMP requirements
• FDA registration and regular inspection readiness
• Product identifier requirements on labels for applicable products
• Stricter documentation of the supply chain for all incoming materials

How Telehealth Clinics Fit Into the Supply Chain

Telehealth clinics occupy different DSCSA roles depending on whether they are receiving commercial drug products for office use or simply facilitating patient-specific dispensing by a pharmacy.

Scenario 1: Pure Prescription Facilitation

In the most common telehealth model, the clinic's provider writes a prescription, and the 503A pharmacy fills and ships directly to the patient. The clinic never takes physical possession of any drug product. In this scenario, the clinic has no direct DSCSA obligations as a trading partner for that transaction — the dispensing chain runs directly from pharmacy to patient. However, the clinic must maintain prescription records as part of its own state licensing obligations, and it has indirect compliance responsibilities in selecting and monitoring its pharmacy partners.

Scenario 2: Clinic Receives and Dispenses

Some telehealth clinics, particularly those with in-person or hybrid models, receive drug products from 503B outsourcing facilities for in-clinic administration. In this case, the clinic is a dispenser under DSCSA and must:

• Receive TI, TH, and TS with each shipment
• Verify the 503B facility is a registered outsourcing facility
• Maintain all transaction records for six years
• Have suspect product procedures in place
• Be able to respond to FDA tracing requests within 24 hours

Scenario 3: Mixed Model

Many clinics operate a mixed model: they facilitate patient-specific 503A prescriptions for most patients, and also maintain a small in-clinic inventory of 503B products for initiating treatment at the point of consultation. Each transaction type carries its own obligations, and the clinic's compliance program must address both.

Transaction Documentation: TI, TH, and TS

The three core DSCSA transaction documents are the backbone of supply chain traceability. Every clinic and pharmacy that receives eligible drug products must collect and retain all three.

Table 2: DSCSA transaction documentation requirements for compounding pharmacy and telehealth dispenser relationships

Prior to the November 2024 interoperability deadline, trading partners could exchange these documents in paper or electronic formats of their choosing. Post-2024, the expectation is electronic exchange in standardized formats (GS1 EPCIS or equivalent), enabling system-to-system verification. Many compounding pharmacies and small clinics are still catching up to this requirement.

What Counts as an "Eligible Drug Product"

DSCSA applies to "product" as defined in the statute: a prescription drug in finished dosage form for human use that is manufactured by or for a manufacturer or repackager. This definition excludes:

• Blood, blood components, tissues, and cellular therapies
• Radiopharmaceuticals
• Imaging drugs
• Combination products classified as devices
• Products compounded by a licensed pharmacist or physician pursuant to a patient-specific prescription (503A preparations)

The exclusion for 503A patient-specific preparations is significant: if a 503A pharmacy ships a compounded semaglutide injection kit to a patient, that preparation is not an "eligible drug product" subject to DSCSA serialization and tracing as a commercial product. However, the semaglutide API that the pharmacy purchased from a distributor to make that preparation is an eligible drug product, and the pharmacy must have received proper TI/TH/TS for that API purchase.

Lot Tracking and Serialization Requirements

Lot-Level Tracking for Compounding Pharmacies

Even where full DSCSA serialization does not apply to compounded preparations, state pharmacy boards and FDA's cGMP standards for sterile compounding require rigorous lot tracking at the batch level. For sterile preparations, USP <797> requires that compounding records identify:

• The names and lot numbers of all ingredients used
• The quantity of each ingredient
• The date of compounding
• The identity of the compounder and verifying pharmacist
• The assigned lot number for the finished preparation (if batch-compounded)
• Beyond-use date (BUD)
• Results of quality control tests (potency, sterility, endotoxin)

Telehealth clinics should request that their 503A pharmacy partners provide lot and batch information at the preparation level for every order, even if not strictly required by DSCSA. This documentation protects the clinic in the event of a patient adverse event, an FDA inquiry, or a voluntary recall by the pharmacy.

Serialization Requirements Under DSCSA

Serialization — the assignment of a unique alphanumeric identifier to each saleable unit of a drug product — is the cornerstone of the DSCSA's interoperable tracing system. For commercial drug products, manufacturers were required to begin applying product identifiers (PI) containing: a standardized numerical identifier (SNI/NDC), a serial number, a lot number, and an expiration date in a 2D data matrix barcode by late 2017 (manufacturers) and subsequent years for wholesalers and dispensers.

For compounding pharmacies, serialization requirements interact with the eligible drug product definition:

• 503A patient-specific preparations: Not subject to product identifier/serialization requirements as finished products. However, the pharmacy must track lot numbers of incoming ingredients.
• 503B finished preparations: Products sold to purchasers by 503B facilities may require product identifiers depending on whether they meet the definition of "eligible drug product." FDA guidance has been evolving, and 503B facilities should consult their regulatory counsel on current requirements.
• Commercial drugs dispensed by compounding pharmacies: If a compounding pharmacy also dispenses commercial (non-compounded) drug products, those products are fully subject to DSCSA product identifier and serialization requirements.

Suspect and Illegitimate Product Handling

DSCSA creates a tiered framework for responding to drug products that may be counterfeit, diverted, stolen, subject to fraudulent transaction, intentionally adulterated, or unfit for distribution. Understanding this framework is essential for both compounding pharmacies and telehealth clinics that receive drug products.

What Makes a Product "Suspect"

A product is suspect if there is reason to believe it may be counterfeit, diverted, stolen, subject to fraudulent transaction, intentionally adulterated, or unfit for distribution. Triggers include:

• Transaction documentation that is missing, incomplete, or inconsistent
• Packaging that is damaged, tampered with, or inconsistent with manufacturer specifications
• Product that was not sourced through authorized channels
• Information from FDA or a trading partner that the product may be illegitimate
• Verification failures when scanning product identifiers
• Abnormal pricing (significantly below market rate without explanation)

The Required Response Process

When a suspect product is identified, the entity (compounding pharmacy or telehealth clinic) must:

1. Quarantine immediately: Segregate the product from inventory so it cannot be dispensed or administered. Physical quarantine (separate locked area) or electronic quarantine (system block) are both acceptable, but there must be no possibility of patient contact during investigation.
2. Investigate: Determine whether the product is illegitimate. This typically involves contacting the supplier for documentation, verifying product identifiers through the manufacturer's system, and reviewing transaction documentation.
3. Notify FDA within 24 hours if investigation confirms the product is illegitimate. Notification is made via MedWatch (FDA Form 3500) or by contacting FDA's Office of Criminal Investigations. Use FDA Form 3911 (Illegitimate Product Notification).
4. Notify the immediate trading partner who supplied the suspect product, within 24 hours of determining illegitimacy.
5. Maintain all records of the investigation for six years.

State Board of Pharmacy Requirements

DSCSA sets federal minimum requirements, but state boards of pharmacy layer additional obligations on top of them. The interaction between federal and state requirements creates the full compliance picture for compounding pharmacy telehealth relationships.

Where State Requirements Exceed Federal

Several states have enacted drug pedigree or supply chain laws that go beyond DSCSA in specific ways:

• California: The California Drug Pedigree Law has historically been among the most stringent. California also imposes specific licensure requirements on out-of-state pharmacies shipping into the state and requires drug pedigree documentation that aligns with but sometimes exceeds DSCSA.
• Florida: Florida law requires pharmacies to verify their wholesale distributor purchases against state-maintained authorized distributor lists and maintains its own drug wholesale distributor permit requirements.
• Texas: The Texas State Board of Pharmacy imposes inspection and record-keeping requirements on sterile compounding facilities that go beyond federal USP <797> standards in some respects.
• New York: New York has licensure requirements for out-of-state pharmacies that dispense to New York patients and imposes specific compounding oversight requirements.

Multi-State Licensing for Telehealth Pharmacies

A compounding pharmacy serving a telehealth clinic's national patient base must hold a non-resident pharmacy license in every state to which it ships. Each state license renewal triggers an opportunity for state inspectors to review compliance with both state and federal requirements. Telehealth clinics should confirm that their pharmacy partners hold active licenses in all states where clinic patients reside, and should audit this on an annual basis.

FDA Enforcement Trends: Post-Semaglutide

FDA enforcement of compounding pharmacy regulations entered a new era with the semaglutide crackdown of 2024-2025. Understanding where enforcement is focused helps telehealth clinics assess their own risk exposure.

The Semaglutide Shortage Exception and Its Collapse

Under DSCSA Section 503A, compounding pharmacies may compound drugs that appear on FDA's drug shortage list. From approximately 2022 through early 2024, semaglutide (the active ingredient in Ozempic and Wegovy) was on the shortage list, which allowed 503A pharmacies to compound it and 503B facilities to produce it in bulk. FDA's determination in October 2024 that the shortage had resolved — and its subsequent March 2025 determination specifically regarding tirzepatide — eliminated the shortage-based exemption for these compounds.

Compounding pharmacies that continued to compound semaglutide after the shortage determination without qualifying under a different exemption (such as producing a fundamentally different dosage form for a patient with a documented clinical need) faced:

• FDA warning letters demanding immediate cessation
• Injunctions obtained in federal court against specific facilities
• Seizure actions for product in inventory
• Referrals to state boards for license proceedings

Telehealth clinics that were ordering compounded semaglutide from pharmacy partners who received warning letters are at indirect risk: their prescribing patterns are visible in the pharmacy's records, and FDA investigators reviewing a pharmacy's patient records may scrutinize the clinic's prescribing volume and documentation practices.

Current FDA Enforcement Focus Areas

Beyond semaglutide, FDA enforcement activity in 2025-2026 has concentrated on:

• BPC-157 and peptide compounds: FDA has classified certain peptides (including BPC-157) as not eligible for compounding under 503A because they are not components of FDA-approved drugs. Clinics ordering BPC-157 from compounding pharmacies should assess their legal exposure.
• Inadequate transaction recordkeeping: Warning letters have cited pharmacies for failure to retain TI/TH/TS documentation for incoming drug products, or for purchasing from unauthorized distributors.
• Potency and sterility failures: FDA inspections of sterile compounding facilities have found significant rates of USP <797> compliance failures, particularly for beyond-use date assignment and environmental monitoring.
• Copy compounding: Compounding pharmacies that produce copies of commercially available drugs without a valid exemption (documented allergy to a commercial product ingredient, documented clinical need for a different dosage form, or active shortage) face increasing enforcement attention.

Technology Solutions for DSCSA Tracking

The complexity of DSCSA documentation — collecting TI/TH/TS, maintaining lot-level records, managing suspect product workflows, responding to FDA inquiries within 24 hours — makes manual management untenable at any meaningful scale. The following categories of technology solutions address different aspects of the compliance challenge.

Pharmacy Management Systems with DSCSA Modules

Most enterprise pharmacy management systems (PMS) used by 503A and 503B facilities include DSCSA compliance modules that automate TI/TH/TS collection, maintain electronic records, and generate audit reports. Look for systems that support GS1 EPCIS data formats for interoperable electronic tracing, barcode scanning for product identifier verification, automated lot number capture at receiving, integration with FDA's Verification Router Service (VRS) for product verification, and configurable alert workflows for suspect product identification.

Track-and-Trace Platforms

Dedicated DSCSA track-and-trace platforms serve larger pharmacy networks and distributors. These systems maintain complete transaction histories across the supply chain and provide the electronic exchange infrastructure that the 2024 interoperability requirements demand. For compounding pharmacies at significant volume, a standalone track-and-trace platform integrated with the PMS provides the most complete compliance coverage.

Telehealth Platform Integration

For the telehealth clinic itself, the relevant technology is the clinical platform that manages prescriptions, tracks pharmacy orders, and maintains patient records. A purpose-built telehealth platform should provide:

• Electronic prescription transmission with tamper-evident audit trails that satisfy both HIPAA's six-year retention and DSCSA's documentation requirements
• Order status tracking integrated with pharmacy systems
• Lot number capture from pharmacy shipment confirmations, linked to patient records
• Pharmacy partner credentialing records (licenses, inspection history, TI/TH/TS confirmation)
• Suspect product workflow triggers and documentation templates
• Six-year record retention with export capability for FDA requests

Generic EHR systems and practice management software designed for traditional clinical settings rarely include these compounding-specific features. This is one of the primary reasons telehealth specialty clinics need purpose-built platforms rather than repurposed general-purpose tools.

Common Compliance Gaps in Telehealth-Compounding Relationships

Based on FDA inspection findings and enforcement patterns, the following are the most frequently cited compliance failures in telehealth-compounding relationships:

Gap 1: No Pharmacy Partner Vetting Process

Clinics often select compounding pharmacy partners based on price, speed, or informal referrals without conducting structured vetting. A defensible pharmacy partner program requires verification that the pharmacy holds valid state licenses in all states where the clinic's patients are located, confirmation of registration status (for 503B facilities), review of FDA inspection history and any warning letters or consent decrees, confirmation that the pharmacy maintains adequate insurance, and a written business associate agreement (BAA) for HIPAA compliance alongside any DSCSA-specific contractual provisions.

Gap 2: Missing or Incomplete TI/TH/TS for Clinic-Received Products

Clinics that receive drug products from 503B facilities for in-office use often fail to collect or retain the required transaction documents. Staff may sign for shipments without requesting the accompanying documentation, or documentation may be filed in paper form without a systematic retention and retrieval process.

Gap 3: No Lot-Level Tracking in Patient Records

Even where DSCSA does not strictly require it, best practice is to document in the patient's record the lot number (and, if available, the beyond-use date) of every compounded preparation dispensed. In the event of a pharmacy recall, this documentation enables the clinic to identify which patients received affected product and initiate appropriate follow-up. Without it, a recall response requires contacting all patients who received any prescription from the affected pharmacy in the relevant time period — a far more disruptive and resource-intensive process.

Gap 4: No Written Suspect Product Procedure

Many small and mid-size clinics and pharmacies have not documented their suspect product response procedure. Staff do not know what to do if they receive a shipment with tampered packaging, missing documentation, or notification from a trading partner that product may be suspect. The absence of a written procedure is itself a cited deficiency in FDA inspections.

Gap 5: Failure to Audit Pharmacy Compliance Annually

Pharmacy partners' compliance status changes: licenses expire, warning letters are issued, ownership changes, FDA inspections find deficiencies. Clinics that conduct initial vetting but never re-audit may continue to rely on pharmacy partners whose compliance posture has deteriorated significantly since the original vetting.

Gap 6: Using Non-DSCSA-Compliant Purchasing Channels

Some clinics or their pharmacy partners purchase drug products from unauthorized distributors or through secondary market channels that do not provide proper TI/TH/TS. This is particularly common in situations where a specific compound is difficult to source or where price pressure is intense. Purchasing from unauthorized sources is a direct DSCSA violation and creates counterfeit product risk.

DSCSA Compliance Checklist