FDA Extends Certain DSCSA Exemptions for Small Pharmacies: What the Additional Year Means

The Food and Drug Administration has given qualifying small pharmacies another year to implement certain enhanced drug distribution security requirements under the Drug Supply Chain Security Act.

On August 6, 2026, FDA announced that small dispensers, along with their trading partners where applicable, will receive exemptions from certain requirements through November 27, 2027. The prior exemption period was scheduled to end on November 27, 2026.

For independent and community pharmacies still working through technology, data exchange, staffing, and trading partner challenges, the additional year is meaningful. It is not, however, a suspension of DSCSA compliance.

The exemption applies only to specific enhanced drug distribution security requirements. Other DSCSA responsibilities remain in effect, and FDA is continuing to urge small dispensers to make progress toward full implementation.

Which Pharmacies Qualify?

For purposes of the new exemptions, FDA considers a dispenser to be a small dispenser if the company that owns the dispenser has 25 or fewer full time employees who are licensed pharmacists or qualified pharmacy technicians as of November 27, 2026.

This means the analysis is based on the company that owns the pharmacy, not necessarily the employee count at one individual pharmacy location. Organizations operating multiple locations should therefore examine their ownership structure and total number of qualifying employees before concluding that the exemption applies.

Qualifying small dispensers do not need to submit an application or notify FDA to use the exemption. A pharmacy should still document its eligibility internally and be prepared to explain the basis for relying on it.

What Has Been Extended?

The exemptions apply to certain enhanced security requirements involving interoperable, electronic, package level product tracing.

During the exemption period, qualifying small dispensers and, where applicable, their trading partners may continue using existing methods for certain activities that would otherwise require fully interoperable electronic systems. These include aspects of:

• Exchanging transaction information and transaction statements electronically

• Including package level product identifiers in transaction information

• Conducting product verification at the package level

• Responding to government requests for transaction information during recalls or investigations

• Gathering transaction information back through the supply chain

• Processing certain saleable returns

The exemption also covers specific product identifier verification requirements when a qualifying pharmacy investigates suspect or illegitimate products. It does not eliminate the pharmacy’s other investigation and verification responsibilities.

What the Exemption Does Not Cover

The extension should not be treated as a general waiver from DSCSA.

Pharmacies must still purchase prescription drugs from authorized trading partners. They must maintain applicable transaction records, identify and investigate suspect products, quarantine products when appropriate, and notify FDA and relevant trading partners when illegitimate products are discovered.

Pharmacies must also maintain policies and procedures that allow employees to recognize and respond to products that may be counterfeit, diverted, stolen, adulterated, or otherwise unfit for distribution.

The additional year changes the timeline for certain enhanced electronic requirements. It does not erase the underlying obligation to protect the integrity of the drug supply chain.

Why FDA Granted More Time

FDA granted the additional exemption while an independent assessment examines whether small dispensers can feasibly implement interoperable, electronic tracing at the package level.

That assessment will evaluate the technology and software available to small pharmacies, including whether existing systems are accessible, functional, and economically feasible. FDA is encouraging small dispensers to complete its assessment survey by September 22, 2026. A small dispenser may designate another organization, such as a consultant, to complete the survey on its behalf.

The survey gives independent pharmacies an opportunity to document the practical difficulties they encounter, including system costs, integration problems, staffing limitations, data quality issues, and dependencies on wholesalers or technology vendors.

How Pharmacies Should Use the Additional Year

The safest approach is to treat the extension as an implementation period, not a waiting period.

A pharmacy relying on the exemption should first document why it qualifies. That documentation should identify the ownership entity, the relevant employee count, and the methodology used to determine which employees are included.

The pharmacy should then evaluate its current DSCSA capabilities. This includes confirming whether it can receive and retrieve transaction information, identify its authorized trading partners, investigate suspect products, quarantine inventory, respond to information requests, and preserve the required records.

Pharmacies should also speak with their wholesalers, buying groups, and technology providers. A pharmacy may qualify for an exemption while one or more of its trading partners operate under different requirements. Understanding how each party will transmit, receive, store, and retrieve information can help prevent purchasing disruptions and inventory delays.

Written policies should reflect what the pharmacy is actually doing today. Employees responsible for purchasing, receiving, returns, inventory management, and product investigations should understand those procedures and know when a problem must be escalated.

Finally, pharmacies should keep records of their implementation efforts. Contracts, vendor communications, training records, system testing, written procedures, corrective actions, and internal assessments can help demonstrate that the pharmacy used the exemption period responsibly.

The Legal and Operational Risk Has Not Disappeared

DSCSA compliance is not solely a technology project. It involves vendor contracts, licensing, purchasing controls, record retention, employee training, product investigations, and relationships with trading partners.

A pharmacy that waits until the exemption is about to expire may discover that its software cannot communicate effectively with a wholesaler, its transaction data cannot be retrieved promptly, or its written policies no longer reflect its operations. Those problems can affect more than regulatory compliance. They can interrupt purchasing, delay returns, create audit exposure, and ultimately affect patient access.

FDA’s extension gives qualifying small pharmacies valuable time to address those risks. The best use of that time is to build a compliance program that is both operationally workable and legally defensible.

Lanton, Lanton & Sosa Law PLLC advises pharmacies, healthcare organizations, and other regulated businesses on compliance, contracting, audits, licensing, reimbursement, and operational risk. Organizations evaluating the DSCSA exemption should assess both their eligibility and the steps necessary to reach full compliance before the exemption ends.

This article is provided for general informational purposes and does not constitute legal advice.

Mergers and Acquisitions Are Not About the Deal

Most M&A conversations begin with momentum. A buyer is interested, a seller is ready, the valuation makes sense, and the timeline is moving. From the outside, it looks like progress. What is actually happening is a change in direction. There is a moment in these deals that does not get enough attention, when everything still looks clean on paper. Then one question shifts the conversation. What actually changes the day after this closes? Not in theory, in practice. Contracts start to behave differently under new ownership. Revenue that felt stable begins to depend on relationships that may not carry over the way everyone expected. Regulatory exposure shows up in places that were easy to overlook when everything was still in a data room.

That is usually where the pace slows, not because the deal is wrong, but because something important has not been fully seen yet. Most deals close. Fewer hold together the way they were expected to. The issues tend to surface later, when a contract does not perform the way it was assumed or when a regulatory requirement becomes operational instead of theoretical. By then, the deal is already done and the room to adjust is smaller.

The work I focus on now starts earlier. It begins with understanding how the business actually functions before the deal takes shape, where revenue is coming from, how it is protected, and where the pressure points are. That perspective changes the outcome. The deal becomes something the business can actually operate inside of after it is done. Mergers and acquisitions are inflection points where capital, regulation, and operations all meet at once. When those elements are aligned, the business moves forward with clarity. When they are not, the friction shows up over time.

Most businesses do not need more deal activity. They need a clearer view of what happens after they move. That conversation usually starts earlier than people expect.