How it works
DSCSA steps happen in the orders, receipts and deliveries your team already uses.
Receive
EPCIS is the GS1 standard FDA recommends for exchanging tracing data.
- Upload the supplier's EPCIS 1.2 XML file on the purchase order or receipt; its units show as expected. Files naming the wrong buyer or seller are refused.
- One DataMatrix barcode scan captures GTIN, serial, lot and expiry, with a keyboard-wedge scanner or the Barcode app (Enterprise add-on). Scanning a sealed case's SSCC label receives the units the file lists for it, once staff confirm the seal.
- Differences become discrepancies due in 10 business days, as FDA recommends (weekends skipped, not holidays), with the lots quarantined. The receipt isn't blocked.
- A missing Transaction Statement is flagged; the stock is held until staff record where they got it.
Verify
Check who you trade with, and where returned units came from.
- A license register with verification source and evidence. Your staff verify each license; a reminder comes 30 days before expiry.
- Manufacturers and repackagers need a valid FDA registration; wholesalers, third-party logistics providers (3PLs) and dispensers need a valid state license. DEA alone never counts. You can also require FDA annual licensure reporting from wholesalers and 3PLs, off by default.
- DSCSA orders and transfers, including portal orders and online payments, are refused when the partner isn't authorized.
- Returned serials must match units you shipped to that customer, then wait in Returns to Verify for a manager. The check uses your own shipment records, not a VRS (Verification Router Service) query to the manufacturer.
Store
Every saleable unit gets its own record.
- A package-level ledger: GTIN, serial, lot, expiry and case SSCC per unit, with its movement history. Products stay lot-tracked; the ledger adds the serial level.
- A quarantined lot comes off open reservations and can't ship; each quarantine and release is logged with a reason. It still counts in forecasts.
- Counts and scrapping ask for serials; the Ledger vs Stock report shows lots where ledger and on-hand differ.
- At go-live, scan the serials of stock you already hold. Until then, that stock can't ship.
Ship
Validating a delivery creates your customer's documents once and keeps them; drop shipments get none (the shipping supplier provides the data).
- A numbered document with transaction information, history and Transaction Statement, frozen at validation. Its T3 PDF, which holds all three, is rendered once and never regenerated.
- An EPCIS 1.2 XML file listing each unit individually (no case aggregation). None for lot-level shipments or when GLN (location), address or NDC (drug code) data is missing; the document is then flagged.
- Customers you invite to your portal download their files one by one, or all at once as zip files of up to 250 documents each. You can also attach them to the delivery email (off by default).
- Exempt small dispensers: flag the customer and record the attestation; deliveries can go out at lot level until the end date you set (see Deadlines).
Respond
Requests from FDA or other federal or state officials in a recall or a suspect or illegitimate product investigation must be answered within 24 hours, or another reasonable time FDA sets; FDA considers one business day generally appropriate.
- Log requests from FDA, state authorities or trading partners with a 24-hour due time and an overdue filter.
- Search by serial, lot, product or date range. For returns, use serial or lot; date ranges can miss some movements.
- Build one zip: stored documents, statement evidence, an index with a SHA-256 checksum per file, and every movement of every unit. Your staff send it.
EPCIS data exchange
FDA recommends the GS1 EPCIS standard but doesn't mandate one technology; its examples include email and web portals that use EPCIS. Rx Tracking's exchange is file-based: you upload supplier files, and customers download theirs or get them by email.
- Files are EPCIS 1.2 XML, following the GS1 US DSCSA guideline (Release 1.3), which builds on EPCIS 1.2. Tests validate the output against the GS1 EPCIS 1.2 schemas.
- No AS2 file exchange, VRS or API integration with trading partners.
Suspect and illegitimate product
Suspect product must be quarantined and promptly investigated with trading partners. Illegitimate product must be reported to FDA (Form FDA 3911) and to immediate trading partners that may have received it, within 24 hours of the determination.
- Any edition: lot quarantine blocks reserving and shipping.
- Investigations built on Odoo Quality alerts (Enterprise add-on) record the determination time, the 24-hour notification deadline for illegitimate product, FDA and partner notification dates and termination dates. Your staff notify; the module tracks.
- Find Trading Partners lists who received or supplied the lot (Enterprise add-on).
- A prefilled Form FDA 3911 data sheet for your staff to enter into FDA's system (Enterprise add-on); not the official form, and not submitted electronically.
Records
Transaction information and statements must be kept for at least six years.
- Posted documents can't be edited or deleted by anyone. A SHA-256 hash chain with gapless numbering seals them; Verify Document Integrity re-computes it.
- Six-year retention is fixed in code. Legal hold on one document or many, with a reason; monthly CSV export of ledger movements and licenses.
- Optional write-once copy in your own Amazon S3 (or S3-compatible) bucket, with Object Lock for 6 to 30 years. Shipping never waits for the upload.
- Activity history on documents, licenses and trace requests.
See these steps on your workflow
We'll run a receipt, a delivery and a trace request in Odoo.