DSCSA VRS Compliance Documentation Guide for Pharmacies

How Pharmacies Should Use VRS Tools to Document DSCSA Compliance

Pharmacies and dispensers became subject to DSCSA enhanced drug distribution security requirements on November 27, 2024. As of that date, pharmacies must verify product identifiers, authenticate trading partners, and maintain electronic records of all transactions involving prescription drugs. The verification routing service (VRS) is the DSCSA infrastructure layer that routes verification requests between trading partners — and pharmacies must document their use of VRS tools to demonstrate compliance during inspections and audits.

Regulatory Background

The Drug Supply Chain Security Act (Public Law 113-54) established a phased implementation timeline for electronic track-and-trace requirements. The final phase, which took effect in November 2024, requires dispensers to:

• Verify product identifiers at the package level before dispensing (21 U.S.C. § 360eee-1(d)(1)(C))
• Respond to verification requests from authorized trading partners within 24 hours (21 U.S.C. § 360eee-1(d)(1)(D))
• Maintain electronic transaction records for six years (21 U.S.C. § 360eee-1(d)(1)(E))

VRS is not mandated by statute. However, FDA guidance documents and industry practice have established VRS as the de facto mechanism for routing verification requests in the U.S. pharmaceutical supply chain. Without a VRS connection, pharmacies cannot practically fulfill their obligation to respond to verification requests from wholesale distributors, repackagers, or other authorized trading partners.

What VRS Does in DSCSA Compliance

A verification routing service acts as an intermediary that connects disparate systems across the supply chain. When a trading partner initiates a verification request — for example, a wholesaler receiving returned product from a pharmacy — the VRS routes that request to the appropriate entity based on the product's serialized Global Trade Item Number (GTIN) and serial number.

For pharmacies, VRS enables two critical compliance activities:

Inbound verification: When a pharmacy receives product, it can query the VRS to verify that the product identifier matches the manufacturer's serialization data. This confirms product authenticity and detects potential diversions or counterfeits.

Outbound verification response: When a pharmacy returns product to a wholesaler or transfers product to another dispenser, the receiving party may initiate a verification request. The pharmacy must respond through the VRS within 24 hours, confirming or denying possession of that serialized unit at the time of the transaction.

Documentation Requirements

FDA inspection guidance for DSCSA compliance focuses on whether a pharmacy can demonstrate that it has systems and processes in place to fulfill its verification obligations. VRS documentation falls into three categories:

1. System configuration records: Documentation proving the pharmacy has an active VRS connection. This includes VRS provider contracts, system integration logs, and confirmation that the pharmacy's unique identifier (typically its DEA number) is registered in the VRS network.

2. Transaction-level verification records: Logs showing that the pharmacy successfully transmitted or received verification requests through the VRS. Each record should include the GTIN, serial number, lot number, expiration date, transaction date, and the identity of the requesting or responding party.

3. Exception handling records: Documentation of how the pharmacy responded when a verification request failed. DSCSA regulations require pharmacies to quarantine product and investigate discrepancies when verification results do not match expected data (21 U.S.C. § 360eee-1(d)(4)(A)).

State boards of pharmacy may impose additional recordkeeping requirements. For example, California Business and Professions Code § 4163.2 requires California pharmacies to maintain DSCSA records "in a readily retrievable manner" and to produce them within 24 hours of an inspection request.

What ColdChainCheck Data Shows About VRS Readiness

ColdChainCheck tracks 1,275 wholesale drug distributors, 3PLs, and cold chain providers across 51 jurisdictions. Of these entities, 1,234 hold active FDA registration — a baseline requirement for any entity handling prescription drugs subject to DSCSA. However, FDA registration does not capture VRS connectivity or serialization system implementation.

The average compliance score in the ColdChainCheck directory is 51/100. This score reflects verified licensure, accreditation, and regulatory standing — but does not yet include VRS participation as a scored dimension, because VRS provider data is not publicly available through a consolidated federal or state database. Only 63 entities hold NABP accreditation (formerly VAWD), which requires demonstrable compliance with DSCSA serialization and verification requirements as part of the accreditation audit process. This represents less than 5% of tracked entities.

The compliance score distribution shows 919 entities in the "Fair" tier (40-59 points). These entities typically hold active state licenses and FDA registration, but lack NABP accreditation or have gaps in publicly verifiable compliance signals. For pharmacies conducting trading partner due diligence, this distribution suggests that most wholesale distributors have baseline regulatory standing, but additional verification is needed to confirm VRS connectivity and DSCSA systems readiness.

Practical Steps for Pharmacies Using ColdChainCheck

• Cross-reference VRS connectivity against regulatory standing: Before onboarding a new wholesale distributor or 3PL, check the entity's compliance score in the ColdChainCheck directory. A score below 40 may indicate expired licenses or enforcement actions that signal broader compliance gaps. Request written confirmation of VRS participation and ask which VRS provider(s) the entity uses.

• Prioritize NABP-accredited trading partners: The 63 NABP-accredited entities in the directory have undergone third-party audits confirming DSCSA systems compliance, including serialization and verification capabilities. Filter the directory by NABP accreditation status when qualifying new trading partners for high-value or controlled substance transactions.

• Monitor enforcement actions that may signal VRS gaps: ColdChainCheck tracks 73 entities with FDA recalls on record. While not all recalls relate to DSCSA violations, entities with recent enforcement actions may have weaker systems for verification and traceability. Review the enforcement history before finalizing trading partner agreements.

• Document due diligence for audit readiness: During state board or FDA inspections, pharmacies must demonstrate that they verified their trading partners' authorization under DSCSA (21 U.S.C. § 360eee-1(d)(4)(B)). Use ColdChainCheck compliance score reports as one component of a documented trading partner qualification process. For methodology and related DSCSA guidance, see the ColdChainCheck compliance guides.

Disclaimer: This article is provided for informational purposes only and does not constitute legal or regulatory advice. Pharmacies should consult qualified legal counsel and verify all compliance requirements with the relevant federal and state authorities.