Legal & Regulatory

Traceability

Trade & Brand Protection

Brand & Product Security

Business and Finance

Containers & Shippers

Devices

Software

Cold Chain

Commercial Channels

Artificial Intelligence

Digitalization

Real World Data

Data & Technology

Manufacturing & Packaging

Supply Chain

Logistics & Transportation

Commercialization

Pricing

Trade & Channel

Market Access

Opinion

Adherence

HUB Services

Patient Assistance Programs

Patient Support

News

Pharma Pulse

Publications

Brand Insights

Webcasts

Resources

Conferences

Conference Coverage

Conference Listing

Events

Videos

Podcasts

Editorial Podcasts

Subscribe

Business strategies and top news in the biotech / biopharma industry, including market access, supply chain distribution and more.

About Us

Advertise

Editorial

Contact Us

Do Not Sell My Personal Information

Privacy Policy

Terms and Conditions

Pharmaceutical Commerce

Instagram

Facebook

LinkedIn

Threads

Soundcloud

Spotlight

Digital Editions

Security

Topics

Data and Technology

Legal and Regulatory

Supply Chain Logistics

1rem

The history behind the Drug Supply Chain Security Act (DSCSA)

The latest DSCSA exemptions and what that means for trading partners

How this piece of legislation and AI are able to intertwine

Nicholas Saraceno offers an overview of the legislation and how it impacts the pharma supply chain.

Nov. 27 is Here: What Does That Mean for DSCSA?

 interview, Dave DeJean, Systech’s VP of global strategic accounts, dives into:

The valuable lessons he’s learned along the way, given his three and half decades of experience at Systech

An overview of the Drug Supply Chain Security Act (DSCSA), including its three main pillars

How he would interpret this “Stabilization Period” that the FDA provided this past summer, and what he pharma industry do now during this period in order to avoid penalties later

Whether or not he anticipates the FDA implementing any other sort of delays in the near future in order to help remedy these issues/challenges surrounding the enactment of DSCSA

Podcast is available directly on SoundCloud.

Dave DeJean provides his expert insight on lessons he’s learned from his plethora of time in the industry, along with an outlook on where the pharma supply chain stands in adhering to the Drug Supply Chain Security Act (DSCSA). 

Complying With the DSCSA

Despite challenges surrounding communication overload, drug shortages, and cybersecurity risks, this term is revolutionizing medication management and patient care through the use artificial intelligence and predictive forecasting. 

The Digital Transformation Reshaping Hospitals and Medication Management

The program intends to address supply chain challenges surrounding product safety, traceability, and counterfeiting. 

Merck KGaA Unveils Cyber-Physical Trust Platform

The Drug Supply Chain Security Act was a major coverage area for Pharma Commerce in 2024. 

Popular DSCSA Pieces Throughout the Year

In the quest for achieving full traceability, the exemption applies to certain trading partners under the Act, and postpones enforcement of final compliance requirements while acknowledging progress and ongoing challenges.

Understanding the FDA's Exemption for DSCSA Compliance

The now-11-year odyssey to track drugs by item through the supply chain will be under a regulatory exemption for up to two years.

Facing Potential Drug Shortages, FDA Delays Enforcement of DSCSA Compliance Deadline, with Stipulations

Peer Exchange: The Future of RFID and Supply Chain Management (Episode 6)

 roundtable discussion, Nicholas Saraceno, editor of 

 and the peer exchange’s moderator, alongside a panel of experts, discussed the role of radio frequency identification (RFID) technology in the pharmaceutical and healthcare sectors. RFID is a technology that utilizes radio waves to automatically collect and transfer data, providing efficient tracking and tracing of products. This discussion covers the potential and challenges of RFID in the industry.

The panel consisted of Matt Campasano, Managing Director, Criterion Consulting; Sean O’Hearen; Founder & Principal Consultant, 1

 Line Partners; Tim Marsh, Founder & Head of Strategy, MDB; and Bahar Aliakbarian, PhD, Associate Professor, Sr. Director of R&D, Axia Institute (at Michigan State University).

Each expert brought unique perspectives on RFID’s applications, including brand protection, traceability, and supply chain efficiency.

Campasano highlighted RFID’s value in pharmaceutical traceability, particularly in relation to the Drug Supply Chain Security Act (DSCSA). RFID offers significant operational efficiencies in warehousing, as it eliminates the need for line-of-sight scanning and speeds up product verification, saving both time and resources.

The discussion also explored the fluctuating adoption of RFID over the past two decades. Marsh provided historical context, explaining that while RFID technology showed promise for improving supply chain operations and patient safety, it faced challenges, particularly in the early 2000s. High costs and reliability issues led to disillusionment, with many RFID installations being dismantled. Furthermore, the lack of widespread adoption of RFID by wholesalers, who required the majority of products to be tagged for it to be effective, hampered progress.

Today, RFID is making a gradual comeback in the pharmaceutical industry, primarily driven by regulatory compliance needs and the growing need for improved product traceability. However, its widespread adoption remains limited by cost concerns and the lack of clear, immediate value for all stakeholders.

In the final part of this roundtable discussion, a panel of subject matter experts discuss what the future holds for this technology, why end-to-end visibility is necessary in healthcare, and the opportunities for greater RFID adoption that lie ahead.

The Gap in DSCSA Readiness 

, Joe Lipari, direct of product management for Systech, dives into how the Drug Supply Chain Security Act (DSCSA), signed into law by President Obama in 2013, has actually been in development for nearly two decades, with earlier state-level efforts like California’s e-Pedigree push. Initially, the full implementation deadline was set for Nov. 27, 2023, marking the completion of serialization and traceability across the pharmaceutical supply chain. However, due to industry readiness issues, the FDA introduced a “stabilization period” to allow for testing and system adjustments. The stabilization period, meant to iron out bugs, turned into a series of delays, and the implementation date has been pushed back multiple times.

In October 2023, the FDA announced another delay, introducing a phased approach to DSCSA compliance. Manufacturers now have until May 2025 to meet requirements, wholesale distributors until August 2025, and mid-to-large dispensers until November 2025. Small dispensers, defined as those with 25 or fewer employees (including pharmacists and pharmacy technicians), have an extended deadline of November 2026. This phased approach allows different parts of the supply chain to comply gradually, but the full implementation will not be realized until at least 2026.

The FDA’s latest exemption allows eligible trading partners that have either completed or documented efforts to complete data exchange connections to be given some leeway in enforcement. This continues the trend of delays and phased compliance, highlighting ongoing challenges in fully implementing the DSCSA across the industry.

Lipari also explains the penalty for non-compliance, the likelihood that these deadlines put forth by the FDA will be met, and more.A transcript of Lipari’s conversation with

What do you believe the likelihood is that these deadlines put forth by the FDA will be met?

The funny thing is, we were having this conversation back in August and September. The HDA [Healthcare Distribution Allinace] does their Traceability Seminar in DC every year. You have the FDA there and a lot of different legal entities there, and that question continues to be asked of, what are you guys going to do? The answer was, no, there will not be any more delays. And a month later, we have the announcement. History has sort of shown us that any dates within the DSCSA implementation framework are subject to change.

If I was a betting man. I’d have to look at the track record of this implementation and say that I'm not sure if any of the dates will hold. But I mean, from my experience with Systech, we are more on the manufacturing side. A majority of our serialization customers are Big Pharma, mid-, mid-tier pharma. With our traceability platform, we have manufacturers, we have distributors, we have repackagers, CMOs. There is whole breadth of trade partners, but the manufacturers, for the most part, are ready. They've been serializing product for quite some time. They have systems in place to do verification. They have systems in place to handle tracing requests. They have systems in place to electronically share data. You hear from the wholesale distributor—from a KPI perspective—the wholesale distributors ramping up their enablement across their DCs.

In the beginning, you heard numbers and by the end of the stabilization period, definitely those numbers all went in the right direction, as far as how much was enabled, and then furthest downstream, you get to the dispensers. That's really where I think the main problem with readiness lies, and it's a tough space.

In the US, there's something to the tune of 90,000 different dispense locations. That ranges from the CVS and Costcos of the world—which are massive corporations—all the way to your mom and pops, those little pharmacies. I have one in my town, and they're independently owned, a single location, but that doesn't mean they're not exempt from DSCSA. They are the same prescription serialized drugs that are flowing through those facilities, just like CVS. It’s a tough space because of how many different types and the wide range of business types that exist in that space. There was a clear message that the dispense side was not going to be ready. If this thing did get pushed through, [there may have been] calls for patient safety, and what happens with quarantine product if you can't meet the letters of the law? I get that side of it, but there's a piece of me that feels we've been talking about this since 2013, and so how much further can we kick this can down the road?

In the final part of his video interview with Pharma Commerce Editor Nicholas Saraceno, Joe Lipari, director of product management, Systech, predicts the probability that these DSCSA compliance deadlines put forth by the FDA will be met.

Consequences of Non-Compliance 

Lipari also explains the penalty for non-compliance, the likelihood that these deadlines put forth by the FDA will be met, and more.

A transcript of Lipari’s conversation with

What is the penalty for stakeholders who don’t comply with the DSCSA?

The FDA does take action against supply chain trade partners. There’re implications of non-conformance to disciplinary action. There’re warning letters—they publicly post those warning letters on websites, so there's some negative press that comes along with that for the trade partner. You could have products that could quarantine. You could have seizures. You could have court-ordered injunctions; civil, criminal penalties if it got really far down the line. There’s sort of a full range of disciplinary actions that the FDA can take.

DSCSA doesn't change that. It just adds a few others to this list. The questionaround the industry is, because it's an enforcement discretion saying the law went into law, the law is the law, and the dates in the law are the dates in the law. We're choosing not to enforce some of the requirements on the specific dates. There's always that notion of, will the FDA make an example out of somebody? It hasn't happened.

Is it an option on the table? Sure. But in reality, I think you know the language that you have successfully completed, you have made documented [efforts]. It's really tough to enforce that. I think the general sort of feeling in the industry is that this is just a broad exemption. Here's some new dates, and take it for what it's worth.

In the second part of his video interview with Pharma Commerce Editor Nicholas Saraceno, Joe Lipari, director of product management, Systech, comments on what the repercussions are for failing to comply with the DSCSA.

Navigating DSCSA Delays

Could you describe the latest state of DSCSA implementation guidelines?

Like you said, Obama signed it into law in 2013, so we're talking that far back. Even prior to that, we're talking mid 2000s, where, prior to it being federal law, there were individual states that were kind of doing their own thing. There was a big California e-Pedigree push where there was some serialization and aggregation, but very local at the state level. It’s been around coming up on almost 20 years, right of some sort of US serialization push. Originally, the goal line was Nov. 27, 2023. That’s when full implementation—soup, the nuts, everything—would have gone live. Obviously, what happened was, with the state of readiness in the industry, the FDA announced what they called a stabilization period, which was meant to be a time to where all of the trade partners were flexing and testing all the systems they had in place, and that's the key word. Stabilization has a very specific meaning.

You're supposed to be stabilizing the existing systems in place, working out the bugs. Well, you can't stabilize something if you don't have a system in place, so unfortunately, the stabilization period really wound up being a proverbial “kick the can down the road.” There’s been a few up to this point, so DSCSA implementation in general has seen its fair share of delays, whether that be enforcement or non-enforcement, whatever verbiage you want to use. There's been multiple delays in this thing since the beginning.

The stabilization period was really meant for a time when everyone was to work out the kinks in the system so that we could all go live the 27th of November. That didn't happen. We had the announcements back in October—which were the latest round of announcements—where the FDA came out and gave a broader exemption to the industry. This really applied to—this is the language in the exemption—eligible trading partners who have either successfully completed or made documented efforts to complete these connections and data exchange with their trade partners.

Now, we can have a conversation about that language, because how do you enforce something that, but what that really meant was that it was a phased approach. FDA came out and said, hey, listen, we're going to take a step back. We're going to do a phased approach, starting from the front of supply chain to the back of supply chain, where you have your manufacturers that now have until May of 2025, you have your wholesale distributors that now have until August 2025, and now you have your mid-to-large dispensers that have until next November of 2025, so a full year. You have this phased approach for those categories.

The other piece, which was in June, was the announcement about small dispensers, defined as 25 or fewer employees. There's language in there too, which was under some scrutiny within the industry, because it's the corporate entity. The corporate entity that owns the dispenser has a total of 25 or fewer full-time employees, licensed pharmacists, and pharmacy techs. Small dispensers now have until Nov. 27, 2026, so the full breadth of this thing, as it is today, is not going to be realized now for another two years for all the different personas in the supply chain. That's kind of the latest state of implementation timelines.

In the first part of his video interview with Pharma Commerce Editor Nicholas Saraceno, Joe Lipari, director of product management, Systech, describes the latest state of DSCSA implementation guidelines.

Peer Exchange: RFID Technological Obstacles (Episode 2)

The panel consisted of Matt Campasano, Managing Director, Criterion Consulting; Sean O’Hearen; Founder & Principal Consultant, 1st Line Partners; Tim Marsh, Founder & Head of Strategy, MDB; and Bahar Aliakbarian, PhD, Associate Professor, Sr. Director of R&D, Axia Institute (at Michigan State University).

In the second part of this roundtable discussion, key opinion leaders discuss the potential technological challenges surrounding RFID, and the likelihood of not only utilizing this tech at the item level but for product security purposes as well. 

Peer Exchange: An Overview of RFID Within the Pharmaceutical Industry (Episode 1)

In the first part of this roundtable discussion, a panel of subject matter experts introduce themselves, while discussing why the pharma supply chain sees value in this technology and why its use has fluctuated over the past decade.

The Dangers Surrounding Bits and Bytes

, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, outlined the top mistakes healthcare organizations make in software development and maintenance from a security standpoint, including a lack of incident response plan; inadequate data encryption; absence of multi-factor authentication; neglecting security development lifecycle (SDL) practices; infrequent security updates and patching; and ignoring regulatory compliance. Bernstein emphasized that proactive security measures and regulatory compliance are essential for healthcare software management. He also dove into some of the most common cyber threats companies are facing, and how he envisions those threats changing over the next decade.

A transcript of Bernstein’s conversation with

How do you envision these cyber threats evolving over the next decade?

Nico, one of the areas where we may see increased activities over the next 10 years is when it comes to geopolitical tensions. Some of these wars that we're observing on the news every night could spill over into cyber warfare situations where you have a smaller country with less of an arsenal—in order to compete with its adversary—going out and carrying out these asymmetric warfare attacks where they're targeting critical infrastructures. That would include healthcare, government services, transportation, the water and utility systems, and then also things like the power grid and the financial and banking system. This is very concerning because these types of attacks can very quickly lead to cascading consequences, which are very difficult to recover from. I think it's safe to say that we may see bullets and bombs replaced with bits and bytes in the coming years, and it's something you know, that's very scary but also realistic.

In the final part of his video interview with Pharma Commerce Editor Nicholas Saraceno, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, forecasts how cyber threats could potentially evolve over the next decade. 

Safeguarding Customer Data 

What are some of the most common cyber threats companies are facing, and how can they best protect their customers’ data?

No matter what authority you're talking to—whether it's a practitioner, somebody that's inside of an organization, performing security, even law enforcement and other authorities—everybody says that 90% of the successful data security compromises involve some type of human error. Somebody clicks on a link, they open an attachment that has a malicious payload, they go to a watering hole site, they're tricked into giving up their username and password, and they say that 90% of these attacks happen because of some type of human error. The first thing that's really important is providing education to your staff, and it should be everybody from the person at the front door, all the way up to the CEO. Everybody needs security education. Everybody has to understand that security is a matter of strategic importance for the organization, and that security will always enable the organization's success. People also need to understand the importance of not being promiscuous with their devices, and treating their communications especially like they would treat their home.

You wouldn't go away during the weekend and leave your front door open or your windows open. You want to have it secure. If your doorbell rang at four in the morning, you wouldn't just open it up without verifying who’s at the door, so these attacks typically come through communication channels, such as email, text messaging, and other communication channels. For that reason, everybody needs to be vigilant about it, and you're only as secure as your weakest link. Any one mistake can create chaos within an organization. That's the first thing. If you look at some of the attacks that we see over and over, they're the same type of attacks, especially on healthcare. If you look at healthcare, there's a lot of attack surface, a lot of different devices, disparate devices, people connecting from everywhere. Everything's running over IP. There's a lot of data. There's a lot of money involved and a lot of money changing hands. There are a lot of participants. There's a lot of communications in which these attackers insert themselves into.

The other thing in healthcare is that there are lives at stake. Attackers know this, and for that reason, they're delivering these ransomware attacks often, and it's really plaguing the whole industry right now. The reason is that the attackers know that the healthcare organizations will pay the ransom. That’s another very dominant attack that we see. The second one especially in healthcare, is that there are a lot of transactions. There's a lot of money involved and a lot of participants, which opens up opportunities for these attackers to insert themselves into these communications.

The second most dominant type of attack is business email compromises and wire fraud. The FBI says that about 50% of all monies that are stolen by cyber criminals are the result of wire fraud and business email compromises. It's very important to have good controls in place, to have good processes and procedures in place when money's changing hands, and to have great partners too. That's probably the next thing on the list: knowing who you're doing business with. You're only as secure as your weakest partner that has access to your data, so you can have all the security controls in the world, all of the greatest talent on your team, and the best budgets, but if you're sharing data with third parties and they're not doing the same in terms of securing that data, then you could end up in a lot of trouble.

In the second part of this video interview with Pharma Commerce Editor Nicholas Saraceno, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, outlines some of the common cyber threats faced by healthcare companies.

Safeguarding Customer Data

Expecting the Unexpected

, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, outlined the top mistakes healthcare organizations make in software development and maintenance from a security standpoint, including a lack of incident response plan; inadequate data encryption; absence of multi-factor authentication; neglecting security development lifecycle (SDL) practices; infrequent security updates and patching; and ignoring regulatory compliance.  Bernstein emphasized that proactive security measures and regulatory compliance are essential for healthcare software management. He also dove into some of the most common cyber threats companies are facing, and how he envisions those threats changing over the next decade.

What are the top mistakes healthcare organizations make when building and maintaining their software?

I think one of the most significant errors that healthcare organizations make is neglecting security by design and privacy by design principles, so when I look at those top five mistakes, I'm going to apply them to a security perspective. There may be other things, like user testing and other non-security related issues that are important too. These are security focused. First is lack of an incident response plan and having procedures there. Security incidents and events are always going to occur, so it's critical to have a plan and procedures that'll govern what activities should take place when a breach occurs. A good incident response plan will also identify key stakeholders inside and outside of the organization, including law enforcement. Inside would be people like the C-Suite, HR, corporate counsel, etc. Having an incident response plan is critical, because there are always going to be security incidents and events, and if you don't have one, you're in big trouble. The other part of that is having a partner to help you respond if you don't have internal capabilities.

The second one is inadequate data encryption. I think if you look at healthcare software, it often handles sensitive data, including PHI [protected health information]. Failing to implement strong encryption for data that's in transit and at rest is a big mistake. You want to make sure that your sessions, those communications and that this data is not going to be stolen, snooped, or leaked in any way. The third one is really the most impactful piece. When I look at the security investigations that we perform, over and over, we come into a situation where there's a breach, and we determined very quickly that multi-factor authentication was not implemented. Multi-factor authentication is a very simple solution. If these organizations are building applications without it and we’re not requiring it at the end user side, they're making a big mistake. Many of these breaches could be avoided. These compromises could absolutely be avoided if there was multi-factor authentication offered as a feature.

The fourth one is just SDL security practices. When bringing an application or software to the marketplace, it's very critical to have independent security penetration tests performed on those applications before you bring those applications into live production environments. What I mean by that is we do application security penetration tests to see what type of deficiencies, vulnerabilities, and flaws may exist within the software before they are put into production. The other thing is not performing just security tests, but also performing secure code reviews. There’s a saying that says the code never lies, and it's true. If you perform secure code reviews, static reviews, and dynamic reviews, it's a critical part of this, and you'll always identify the flaws, the vulnerabilities, and deficiencies that will allow attackers to access those applications in an unauthorized manner, leak data, and really create chaos on your application.

The other part of the application security process is that as these applications are updated, when new releases are made, it's critical to review those code modules of those updates. Whether they're security updates, functionality updates, if you're not reviewing those code modules as they're put into production, you're making a big mistake. That's four, I've got two more. The fifth one would be just lack of regular security updates and patching. Failure to apply regular updates and patches to software will leave it vulnerable to known exploits, so it has to be done often. Every day, there are new critical vulnerabilities being announced. If you're not patching the software, you're making a big mistake. That's five. I just want to throw in a sixth one, which is really also equally important to the others, and maybe more important in a lot of ways.

When we work with clients, they hire us for two reasons. One is to secure their infrastructure, their applications, and software, but two is to comply with the regulatory mandates that govern them. If you look at regulatory compliance, it has to be on your top list of priorities to be in compliance with the various legal and regulatory mandates that may affect you. In healthcare, it’s HIPAA here in the US. Over in the EU, you have GDPR, and having an expert, trusted advisor can help the organization avoid the pitfalls of being out of compliance with these regulations, but definitely don't ever neglect compliance.

In this video interview with Pharma Commerce Editor Nicholas Saraceno, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, explains the top mistakes healthcare organizations make when building and maintaining their software.

WEE request process

 Could you describe what the Waiver, Exception or Exemption (WEE) request process entails?

So essentially, under the statute, there are different conditions that a member of the supply chain can claim. For instance, if some requirement causes them undue economic hardship—that’s just on example—they can apply for a waiver, exception, or exemption. There are some parameters that are put out by FDA in their guidance on this, which is all available on their website. HDA is also going to have a compilation of all the guidance that the FDA has done, to put everything in one place and walk people through so that you can know what to do, such as if you need a WEE, here are the steps. Here's where to go on the FDA website.

The way that you do it on the FDA website, it's through their portal, NextGen. It looks a little daunting, but I think it's been pretty much simplified. When you're applying for a waiver, exception, or exemption, you need to really spell out why you need it, what you need it for; if there is a time period you think you're going to be ready for compliance in six months—be more narrow—and then also describing the problem, describing why you can't meet that particular requirement, essentially providing justification for why you need this exemption.

 What other sessions or topics at the Traceability Seminar are you looking forward to?

FDA speaking is always sort of the number one, and it's funny, sometimes they say new, exciting things, and sometimes they just provide reassurance or reiterate what they've put out, or clarifications. It's just a time for them to be in front of our members and the attendees of the conference, so that's always good. We also have a couple different panels this year.

For instance, we have a legal panel tomorrow afternoon with some lawyers who practice in this space, in which we’re trying to get their perspective on what they're hearing from clients. And that's always interesting, because sometimes, it uncovers different issues that—at the trade association level—we might not be aware of, and that every day trading partners might not have heard of. It's just interesting to see the perspective of different folks, along with what kinds of problems or issues companies are going to them to try and help them solve.

In the final part of her interview with Pharma Commerce Editor Nicholas Saraceno, Elizabeth A. Gallenagh, General Counsel and Senior Vice President, Supply Chain Integrity, Healthcare Distribution Alliance, discusses the WEE request process itself, while also providing her thoughts on other sessions that have garnered her attention.  
  


Brand & Product Security

Latest News