21 U.S.C. § 360eee–1 — Requirements

(a) In general If you're a manufacturer, repackager, wholesale distributor, or dispenser, you must follow the rules in this section for your role in any deal involving a prescription drug ("product"). If you fit more than one of those categories, you follow all the rules that apply to you, but you don't have to do the same task twice. Initial standards: The Secretary of Health and Human Services (called "the Secretary" throughout) had to work with manufacturers, repackagers, distributors, dispensers, and other industry stakeholders to draft guidance on how everyone should format the "transaction information" (details about a drug's sale), "transaction history" (the paper trail of past sales), and "transaction statement" (proof a seller followed the rules), in paper or electronic form, and had to consider standardized documentation and ways to share lot-level data. That guidance had to line up with standards under section 355e and with a format set by a recognized international standards group. Before writing it, the Secretary had to collect public comments for at least 60 days. The final standards had to be published within 1 year of November 27, 2013. Waivers, exceptions, and exemptions: Within 2 years of that date, the Secretary had to create, by guidance, ways for companies to ask for relief: a waiver if following the rules would cause serious economic hardship or in a medical emergency (including a declared public health emergency); an exception if a drug's package is too small to fit all the required label information, with a process for the Secretary to grant it and for manufacturers or repackagers to request it; and an exemption the Secretary can grant for other products or transactions. These waivers, exceptions, and exemptions must be reviewed and renewed every two years. Any guidance about them had to take effect no later than 180 days before manufacturers had to start putting identifiers on packages. Self-executing requirements: Unless the law says otherwise, these requirements are enforceable even if the Secretary never writes additional regulations or guidance. Grandfathering: The Secretary had to finalize guidance, within 2 years, on whether drugs already in the supply chain without a product identifier could be exempted from that requirement. For any drug that entered the supply chain before January 1, 2015: authorized trading partners don't have to supply certain specific pieces of transaction information from before that date (the lot number, initial transaction date, and initial shipment date); the "transaction history" paper trail starts fresh with whoever owned the drug on that date; and that owner doesn't have to prove they received transaction information or a transaction statement from an earlier owner. Licenses: Until separate wholesale-distributor licensing rules (under section 360eee–2) take effect, "licensed" or "authorized" for a wholesale distributor just means it holds a valid license under state law. Similarly, until third-party logistics provider licensing rules (under section 360eee–3) take effect, those providers count as "licensed" unless the Secretary has found — and publicly announced — that they don't use good handling and distribution practices. Label changes: A company can report label changes made only to add the product identifier in its regular annual establishment report to the Secretary, instead of filing something separate. Product identifiers: Unless the Secretary allows other technology by guidance, the required data must appear in a 2-dimensional data matrix barcode on packages, and in a linear or 2-dimensional data matrix barcode on homogeneous cases (cases holding only one product). The identifier can be checked either by a person reading it or by a machine scanning it. (b) Manufacturer requirements Starting no later than January 1, 2015, before or when a manufacturer transfers ownership of a drug, it must give the next owner the transaction history, transaction information, and a transaction statement, all in a single document, on paper or electronically. It must also capture and keep that information — including lot-level information — for at least 6 years after the sale. If the Secretary or another official asks for this information because of a recall, or to investigate a suspect or illegitimate product, the manufacturer must hand it over within 1 business day, and never more than 48 hours, unless the Secretary sets a different reasonable deadline. Starting no later than 4 years after November 27, 2013, manufacturers must provide this information electronically, not on paper — except they may keep using paper when dealing with a licensed prescriber, or someone supervised by one, who dispenses the drug in the normal course of practice. Product identifier: By that same 4-year mark, manufacturers must affix or imprint a product identifier on every package and every homogeneous case meant for a commercial transaction, and keep records of that identifier for at least 6 years after the transaction. A package that already has a required standardized numerical identifier doesn't also need a separate unique device identifier. Authorized trading partners: Starting no later than January 1, 2015, a manufacturer's trading partners may only be authorized trading partners. Verification: By January 1, 2015, manufacturers need systems in place to handle two situations. For a "suspect" product (one that might be fake or otherwise illegitimate), whether the manufacturer identifies it or the Secretary flags it, the manufacturer must quarantine it away from product meant for distribution, and promptly investigate with trading partners — validating transaction records and, starting 4 years after enactment, verifying the product at the package level, including its standardized numerical identifier. If the investigation clears the product, the manufacturer must promptly tell the Secretary, if applicable, and may then distribute the product. Either way, investigation records must be kept for at least 6 years. For an "illegitimate" product, the manufacturer must, consistent with its own systems, quarantine it, disposition it, take reasonable steps to help trading partners disposition any they hold, and keep a sample for testing if the Secretary or manufacturer asks. It must notify the Secretary and any trading partners it believes may have received the bad product within 24 hours of determining the product is illegitimate — and also within 24 hours of learning of a "high risk" that a product is illegitimate (a term the Secretary can further define by guidance). If a manufacturer receives a notice from the Secretary or a trading partner about illegitimate product, it must identify all such product it holds, including product it later receives, and follow the same quarantine-and-investigate steps. Once the Secretary agrees a notification is no longer needed, the manufacturer must promptly tell everyone it originally notified that the notice has ended. Disposition records must be kept for at least 6 years after the disposition concludes. Starting 4 years after enactment, if another authorized repackager, distributor, or dispenser asks the manufacturer to verify a product it believes the manufacturer made, the manufacturer must respond within 24 hours (or another reasonable time the Secretary sets) confirming whether the product identifier, including the standardized numerical identifier, matches what it actually affixed. If it doesn't match, the manufacturer must treat the product as suspect and investigate as described above; if it has reason to believe the product is illegitimate, it must say so when responding. Manufacturers may build or use a secure electronic database to help meet these verification duties, but that doesn't excuse them from also responding to requests made by means other than the database. Returns: Starting 4 years after enactment (except as grandfathered under subsection (a)(5)), before reselling a returned product, a manufacturer must verify the product identifier, including the standardized numerical identifier, on each sealed homogeneous case, or on each package if it's not in a sealed case. A manufacturer may return a nonsaleable product to the manufacturer, repackager, the wholesale distributor it was purchased from, or a person acting for them (including a returns processor), without providing transaction information. (c) Wholesale distributor requirements Starting no later than January 1, 2015, a wholesale distributor can't accept ownership of a drug unless the previous owner gives it the transaction history, information, and statement first, as applicable. If the distributor bought directly from the manufacturer (or the manufacturer's exclusive distributor, or a repackager that bought directly from the manufacturer), then when it resells the product it must give the buyer a statement confirming that direct-purchase chain, plus the transaction history and information — though that history and information don't need to include the lot number, the initial transaction date, or the initial shipment date from the manufacturer. If the buyer is a dispenser, all of this goes in one document, paper or electronic; if the buyer is another wholesale distributor, it can be a mix of self-generated paper, electronic data, or information the manufacturer already put on the package. If the distributor did not buy directly from the manufacturer that way, it must instead give the buyer, before or at each transaction, a full transaction statement, history, and information that follows the guidance format from subsection (a)(2). In that case, the history only needs to start with the distributor described above who bought directly from the manufacturer — but the distributor passing it along must tell the buyer it received a "direct purchase" statement from that earlier distributor. Distributors must capture and keep all of this information — including lot-level data — for 6 years, and must keep it confidential, sharing it only with the Secretary or another official, as needed to comply with the rules above, or under a written trading-partner agreement described below. Returns: Until 6 years after November 27, 2013 (except as grandfathered), a distributor may accept a saleable return from a dispenser or repackager under whatever terms they agree to, and resell it without providing the transaction history; for later sales, the history simply starts over with that distributor. Starting 6 years after enactment (except as grandfathered), a distributor may accept such a return only if it can match the product to its transaction information and statement; for later sales, the history starts with the distributor that accepted and verified the return, and dates can be left out if they aren't reasonably available. A distributor may always return nonsaleable product to where it came from, or to a person acting for them (including a returns processor), without providing this paperwork. If the Secretary asks for information because of a recall, or to investigate a suspect or illegitimate product, the distributor must respond within 1 business day, and never more than 48 hours, unless the Secretary sets a different reasonable deadline. Starting 6 years after enactment, a distributor may disclose transaction information (including lot-level data), history, or statements to the next buyer under a written agreement between them — this doesn't limit any of the other rules above. Product identifier: Starting 6 years after enactment, a distributor may deal in a product only if it carries a product identifier (except as grandfathered). Authorized trading partners: Starting no later than January 1, 2015, a distributor's trading partners may only be authorized trading partners. Verification: By January 1, 2015, distributors need the same kind of suspect-product and illegitimate-product systems described for manufacturers: quarantine and investigate suspect product with trading partners, verifying at the package level starting 6 years after enactment (except as grandfathered); notify the Secretary if cleared; keep investigation records 6 years. For illegitimate product, in coordination with the manufacturer: quarantine, disposition it or help others disposition theirs, keep a sample if asked, notify the Secretary and affected trading partners within 24 hours, respond to and eventually terminate notifications received from others, and keep disposition records 6 years. Distributors may use a secure electronic database for this, but must still respond to requests made another way. Starting 6 years after enactment, before reselling a returned product, a distributor must verify the product identifier the same way manufacturers do. (d) Dispenser requirements Starting July 1, 2015, a dispenser (such as a pharmacy) can't accept a drug unless the previous owner provides transaction history, information, and a statement first. When the dispenser sells the drug onward — other than dispensing it to a patient or handling a return — it must pass along the same three items to the next owner; this passing-along duty does not apply when one dispenser sells to another dispenser just to fill a specific patient's need. Dispensers must capture and keep this information (including lot-level data if they received it) for at least 6 years, as needed to investigate a suspect product. A dispenser may hire a third party — including an authorized wholesale distributor — under a written agreement to keep this information confidentially on the dispenser's behalf. The dispenser must keep a copy of that agreement, and hiring someone else doesn't remove the dispenser's own legal responsibility. Returns: A dispenser can return a saleable product to the trading partner it got it from without providing the transaction paperwork. It can return a nonsaleable product to the manufacturer, repackager, the wholesale distributor it bought from, a returns processor, or a person acting for them, the same way. If the Secretary asks for information because of a recall, or to investigate a suspect or illegitimate product, the dispenser has 2 business days to respond (or another reasonable time the Secretary sets), in paper or electronic form, and doesn't have to include the lot number or the initial transaction or shipment dates unless it already received that information from the manufacturer or distributor. Until 4 years after enactment, the Secretary had to give a dispenser extra time only for lot-level information it received on paper, had to limit requests to the 6 months before the request, and — for a recall — could request information only if the recall involved a serious health risk or death. Product identifier: Starting no later than 7 years after November 27, 2013, a dispenser may deal in a product only if it carries a product identifier (except as grandfathered). Authorized trading partners: Starting no later than January 1, 2015, a dispenser's trading partners may only be authorized trading partners. Verification: By January 1, 2015, dispensers need systems for suspect products — quarantine, then promptly investigate with trading partners. Starting 7 years after enactment, that investigation must include checking whether the lot number matches, and checking the product identifier (including the standardized numerical identifier) on at least 3 packages or 10% of the suspect product, whichever is greater, or all packages if there are fewer than 3 — plus validating the dispenser's own transaction records and otherwise investigating. If cleared, the dispenser tells the Secretary, if applicable, and may then distribute or dispense the product; investigation records are kept 6 years. For illegitimate product, in coordination with the manufacturer, the dispenser must disposition it, take reasonable steps to help trading partners disposition theirs, and keep a sample if the manufacturer or Secretary asks. It must notify the Secretary and affected trading partners within 24 hours of determining a product is illegitimate, respond the same way to notices it receives from others, and tell everyone it notified once a notification is terminated, in consultation with the Secretary. Disposition records are kept 6 years. Dispensers may use a secure electronic database to help meet these duties. Exception: None of the tracing duties in paragraph (1) or the verification duties in paragraph (4) apply to a licensed prescriber, or someone under a prescriber's supervision, who dispenses or administers the drug in the normal course of professional practice. (e) Repackager requirements These closely mirror the manufacturer rules, and apply to the kind of repackager defined in section 360eee(16)(A) unless noted. Starting no later than January 1, 2015, this repackager can't accept a drug without first getting transaction history, information, and a statement; must pass the same along when it resells the drug; and must capture and keep that data (including lot-level information) for 6 years. Returns: This repackager can return nonsaleable product to where it came from, or a person acting for them (including a returns processor), without the paperwork. A different kind of repackager — defined in section 360eee(16)(B), typically one repackaging for a hospital or health care entity — can likewise return saleable or nonsaleable product without the paperwork, on behalf of the entity that owns the product, under whatever agreement they have. If the Secretary asks for information for a recall, or to investigate a suspect or illegitimate product, this repackager must respond within 1 business day, and never more than 48 hours, unless the Secretary sets a different reasonable deadline. Product identifier: Starting no later than 5 years after enactment, this repackager must affix or imprint a product identifier on packages and cases, keep that identifier data 6 years, deal only in identified product (except as grandfathered), and keep records for 6 years linking its own identifier to the one the original manufacturer assigned. A package with a required standardized numerical identifier doesn't also need a unique device identifier. Authorized trading partners: Starting January 1, 2015, this repackager's trading partners may only be authorized trading partners. Verification: By January 1, 2015, this repackager needs the same suspect-product system (quarantine, investigate, verify at the package level starting 5 years after enactment unless grandfathered, notify if cleared, keep 6-year records) and illegitimate-product system (in coordination with the manufacturer: quarantine, disposition, assist trading partners, retain a sample, notify within 24 hours, respond to and terminate notices, keep 6-year records) as manufacturers. Starting 5 years after enactment, it must respond within 24 hours to verification requests from other authorized companies, treating a mismatched identifier as suspect and flagging any belief the product is illegitimate. It may use a secure database, but must still handle requests made another way. Starting 5 years after enactment, it must verify the product identifier on any returned product before reselling it. (f) Drop shipments A wholesale distributor that never physically handles or stores a drug — it just arranges a "drop shipment" straight from the manufacturer, repackager, or another distributor to the dispenser — is exempt from almost all of this section. It still must handle illegitimate-product notification duties (the notify, respond-to, and terminate steps in subsection (c)(4)(B)(ii)-(iv)). The exemption only applies if the company actually shipping the drug includes that drop-shipping distributor's contact information in the transaction information and history, and sends the transaction information, history, and statement straight to the dispenser. Just handling administrative tasks — like processing orders or payments — does not, by itself, count as "handling," distributing, or storing the product. (g) Enhanced drug distribution security Starting on the date 10 years after November 27, 2013, a stricter, fully electronic, package-level tracing system takes effect: transaction information and statements must move through secure, interoperable electronic systems built to the standards in guidance issued under subsection (h)(3) and (4); every transaction's information must include the product identifier for each individual package; systems must let everyone verify products at the package level (which may use grouping of packages, called "aggregation," and reasonably inferring their contents, called "inference," under the relevant guidance); systems must let companies promptly respond with transaction information and statements when the Secretary asks during a recall or a suspect/illegitimate-product investigation; and companies must be able to promptly gather information to trace a product's history back to the manufacturer, both for the Secretary's requests and for an authorized trading partner's own investigation, done securely to protect confidential and trade-secret information. Anyone accepting a saleable return must have systems to match the return to its transaction information and statement before accepting it. Compliance: A dispenser may still use a written third-party agreement to keep records confidentially, as under subsection (d), without being relieved of its own duties. The Secretary must also provide alternative ways to comply, including: special timelines for small businesses (including dispensers with 25 or fewer full-time employees) if the standard rules would cause undue economic hardship; and a process for a dispenser to request a waiver from these requirements if they would cause undue economic hardship, reviewed and renewed every two years. Assessment: The Secretary had to hire an independent consulting firm to assess whether small dispensers (25 or fewer employees) could realistically do interoperable, electronic package-level tracing — including whether the needed software and hardware are accessible, whether they're too expensive, and whether they can be integrated into existing business practices like working with wholesale distributors. That firm had to agree to consult with small dispensers while doing the assessment, which had to be completed by 8½ years after enactment. The Secretary had to publish the assessment's scope of work for comment before starting, publish the finished assessment for comment within 30 days of receiving it, and hold a public meeting on it within 180 days. Procedure: When writing any regulation under this section, the Secretary must skip the normal rulemaking shortcut in section 553 of title 5 and instead: avoid requiring specific business systems; build in alternate compliance methods, small-business timelines, and waivers as described above; consider pilot-project results (including private ones using aggregation and inference), public meetings and related guidance, the public-health benefit versus cost of any new rule, the diversity of the supply chain (large and small businesses alike), and the small-dispenser assessment; issue a proposed rule with the regulation's text; take comments for at least 60 days; and publish the final regulation in the Federal Register at least 2 years before it takes effect. (h) Guidance documents The Secretary must issue several rounds of guidance to help the industry move toward secure, electronic, package-level tracking, in order to enhance drug distribution security and protect public health. Within 180 days of November 27, 2013, guidance had to help trading partners spot a "suspect" product — identifying risk scenarios, recommending how to make that determination quickly — and had to set out the process for ending illegitimate-product notifications under subsections (b), (c), (d), and (e). Any later revision of this guidance must follow the procedure below. Guidance on "unit level tracing" — covering when the supply chain can efficiently infer what's inside a case, pallet, or tote without opening or individually scanning it, plus other methods (including verification, aggregation, and inference, and package security features) to enhance secure package-level tracing while protecting confidential and trade-secret information — had to be finalized within 18 months of a public meeting on the system attributes needed for subsection (g). Guidance on standards for interoperable electronic data exchange — updating the guidance from subsection (a)(2) — had to be finalized within 18 months of a public meeting on interoperable standards, so that it recommends real standards matching an internationally recognized format, considers standards under subsection (a)(2) and section 355e, creates one uniform tracing process, and protects confidential and trade-secret information. Except for the very first suspect/illegitimate-product guidance described above, any guidance issued or revised under this subsection or subsection (g) must follow this process: publish a Federal Register notice for at least 30 days announcing a draft; post the draft online and make it available in hard copy; take comments and consider them; revise the draft as appropriate; publish another 30-day Federal Register notice announcing the final version; post the final version online and in hard copy; and give it an effective date no earlier than 1 year after it becomes final. (i) Public meetings The Secretary must hold at least 5 public meetings on supply-chain safety and security and take comment, the first no earlier than 1 year after November 27, 2013, prioritizing topics that feed into the guidance under subsection (h)(3) and (4) and taking all reasonable steps to protect confidential and trade-secret information. Across these meetings, the Secretary must cover: how well the industry is building toward unit-level tracking, including its effect on patient access to medicine, scalability across product lines, and the ability of different-sized businesses to use product identifiers; what systems are needed to support subsection (g), including standards for secure electronic data exchange; best practices in each part of the supply chain; the costs and benefits of this section, including its impact on each sector and on public health; whether full electronic package-level tracing is feasible, cost-effective, and needed; the systems needed to use product identifiers, including verification, aggregation, and inference; the technical and legal tools needed for an interoperable electronic system; the impact of added requirements on patient safety, drug supply, cost, regulatory burden, and timely patient access; and any other topic the Secretary decides is appropriate. (j) Pilot projects The Secretary must establish one or more pilot projects, with authorized manufacturers, repackagers, distributors, and dispensers, to explore and test ways to enhance supply-chain safety and security. These projects must build on efforts already underway as of November 27, 2013, take into account earlier pilot projects (including ones using aggregation and inference), and inform the guidance under subsection (h)(3) and (4). The Secretary must make sure, taken as a whole, that the pilot projects include participants representing every part of the supply chain, both large and small businesses. They must be designed to: use the product identifier to trace a product, which may include verifying it (using aggregation and inference where relevant); improve each sector's technical ability to comply with tracing systems; identify what system features are needed to meet this section's requirements; and complete any other task the Secretary sets. (k) Sunset Starting on the date 10 years after November 27, 2013, three specific things stop applying: the general duty to provide and receive "transaction history" under this section; the particular return rules in subsections (b)(4)(E), (c)(1)(B)(i), (d)(1)(C)(i), and (e)(4)(E); and, for lot-level information only, the requirements in subsection (c)(1)(A)(v)(II) and (c)(1)(D). (l) Rule of construction The requirements about the regulation-writing procedure in subsection (g)(4), the public meetings in subsection (i), and the pilot projects in subsection (j) cannot be used as a condition, ban, or excuse to block or delay the enhanced-security rules in subsection (g) from taking effect on schedule. (m) Requests for information Starting on the date 10 years after November 27, 2013, when the Secretary or another appropriate official asks a manufacturer, wholesale distributor, or repackager for information under subsections (b)(1)(B), (c)(1)(C), or (e)(1)(C), the response deadline becomes 24 hours, unless the Secretary sets a different reasonable time based on the circumstances of the request.