DSCSA Portals and Inference Won’t Cut It,
Pharmacies Must Prepare for Real Verification
By Matt Campasano, Principal Consultant, Criterion Consulting
Executive Summary
With DSCSA enforcement for dispensers set to begin in November 2025, pharmacies still have time to prepare, but not to waste. Many are relying on low-cost portals or inference-based receiving practices to meet compliance requirements. While these approaches may seem sufficient now, they won’t withstand regulatory scrutiny under full enforcement. Pharmacies that act now to implement real-time, one-to-one verification supported by experienced partners can protect patients, preserve operational flow, and remain compliant with both the letter and spirit of the law.
The Window to Act Is Closing
The Drug Supply Chain Security Act (DSCSA) was built to secure the U.S. pharmaceutical supply chain by requiring complete, serialized product traceability from manufacturer to dispenser. Dispensers — pharmacies, hospitals, clinics — are the final point of entry before product reaches patients. And starting November 27, 2025, they will be required to verify both the product and their trading partners as part of receiving.
The good news is that enforcement hasn’t started yet. Pharmacies still have time to get it right. But the practices some organizations are using today — namely, DSCSA portals and inference-based receiving — won’t be sufficient once enforcement begins.
Portals and Inference, Common but Incomplete
In an effort to stay ahead of the deadline, some pharmacies have turned to quick solutions: DSCSA portals that allow staff to log in and search serial numbers, and inference-based receiving that assumes product is correct based on tote-level serialized shipping container code (SSCC) labels or purchase order counts. These methods may seem efficient or compliant on paper, but they both fall short of what the law truly requires.
Portals don’t enforce action. They offer access to data, but no guarantee that anyone is reviewing it at the moment product is received. Inference assumes that what should be in the box is what’s actually in the box, without ever scanning the serialized labels inside. Neither approach satisfies the expectation of one-to-one, real-time product verification, and neither will meet the standard once enforcement begins.
The Risk of Waiting Too Long
The recent FDA warning letter to Sterling Distributors shows how enforcement could look in the future. Sterling was found to have distributed product without proper licensure and without providing required serialized data. Though enforcement in that case focused on the distributor, it revealed a concerning truth: if pharmacies don’t actively verify the data they receive, non-compliant or illegitimate product can reach patients undetected.
It’s not about whether pharmacies are doing something wrong today. It’s about whether they will be ready when the law is enforced. If the same practices continue past November, those same pharmacies may be held responsible for receiving and dispensing unverifiable product. And without systems in place to perform real-time verification, there won’t be a defense.
What DSCSA Really Requires
DSCSA doesn’t mandate that pharmacies only try to verify products. It requires that they actually follow through with verifying the products. That means verifying serialized identifiers against the EPCIS data received, confirming the trading partner is licensed, and taking immediate action if data is missing, mismatched, or unavailable.
That level of compliance isn’t possible through portals or visual inspection alone. It requires a receiving process that integrates product scanning and verification into day-to-day operations. Pharmacies that fail to establish this before November may find themselves unable to receive product, or worse, subject to enforcement action.
A Better Approach, Real-Time Tools, and Expert Support
Real compliance doesn’t have to mean massive software rollouts or complex custom integrations. What pharmacies need is a practical, real-time verification solution that fits their operations, something that supports one-to-one scans at receiving, and offers actionable responses at the point of use.
The technology is within reach. Lightweight verification tools that integrate with EPCIS and Verification Router Service (VRS) infrastructure are emerging. These tools could operate on handheld devices or workstations, enforce scan-and-verify workflows, and connect pharmacies to the serialized product data provided by their upstream partners.
Even more promising are platforms that use web-resolvable URLs to enable serialized data access without system integration, and digital credentialing tools that authenticate trading partners automatically. These innovations are not yet widely implemented, but they offer a path forward for pharmacies that can’t justify large-scale enterprise solutions.
To get there, pharmacies need the right guidance. That’s where DSCSA compliance experts and Level 4 serialization and traceability service providers come in. Working with a partner like Criterion means creating processes that align with DSCSA expectations and workflow realities, ensuring readiness, reducing disruption, and protecting patients.
What Pharmacies Should Be Doing Now
The November 2025 enforcement deadline is not the time to start verifying product; it’s the time to already be doing it. Pharmacies should begin evaluating their current practices and asking key questions:
Are we verifying serialized product at receiving?
Can we confirm that each product and trading partner is legitimate and licensed?
Are we relying on assumptions or manual workarounds that won’t withstand enforcement?
If the answer to any of those is uncertain, now is the time to act. Implementing a scan-based receiving process takes planning. Building SOPs, training staff, and configuring tools takes time. And it’s far better to uncover gaps today than to face enforcement issues in November.
Final Thoughts
The point of DSCSA was never just to generate data. It was to ensure that the right product, from the right supplier, reaches the right patient safely, securely, and with full traceability. Portals and inference don’t fulfill that mission. Pharmacies still have time to build something that does.
Avoiding risk tomorrow starts with real preparation today. Work with a partner who understands the law, the technology, and your operations. Build a process that works now, so you’re not scrambling when it counts.
Contact us today to schedule a call and learn more.