DSCSA for ASCs: What the FDA Delay Changes

On August 6, 2026, FDA extended its Drug Supply Chain Security Act exemption for small dispensers to November 27, 2027. Most surgery centers do qualify as small dispensers, and not every rule is delayed with the exemption. The rest of DSCSA did not change. Buying from authorized trading partners, keeping transaction records for six years, responding to suspect product, and responding to recalls all apply to an ASC today. Compounded medications are excluded from this.

This article is general information for ASC leaders, not legal advice. DSCSA interpretation, state pharmacy law, and licensure requirements vary. Confirm the center's position with counsel.

FDA also opened an assessment of small dispensers and asked for responses to the survey by September 22, 2026. The agency contracted an independent firm to study whether small dispensers can feasibly run electronic package-level tracing and whether the technology is affordable and interoperable with wholesaler systems. A pharmacist consultant or other designee can complete it on the center's behalf. Surgery centers are exactly the facilities whose economics and workflows that study should reflect, and the survey is the only channel through which they get counted.

Is an ASC a dispenser, and does it qualify as a small dispenser?

These two questions get grouped together, but they are not the same question. The first decides whether DSCSA impacts the center at all. The second decides whether the enhanced tracing piece is on hold until November 27, 2027. A center can be a dispenser and still qualify for the exemption, which is the position most freestanding ASCs are in.

Is an ASC a dispenser under DSCSA?

The statute defines a dispenser to include "any other person authorized by law to dispense or administer prescription drugs." Administer is written into the definition. A surgery center administering prescription drugs would also be considered a dispenser. That is the plain-language reading, and it is the one to plan around.

The counterargument rests on the exception at 582(d)(5): "Notwithstanding any other provision of law, the requirements under paragraphs (1) and (4) shall not apply to licensed health care practitioners authorized to prescribe or administer medication under State law or other licensed individuals under the supervision or direction of such practitioners who dispense or administer product in the usual course of professional practice."

That provision takes away 582(d)(1) product tracing and 582(d)(4) verification for qualifying practitioners and supervised licensed individuals.

State licensure changes the answer

There is no single national answer, because states classify the ASC's drug operation differently. For example, Texas licenses the ASC pharmacy as a Class C institutional pharmacy under the Board's institutional pharmacy rules. Florida classifies the usual ASC permit as a Modified Class II institutional pharmacy, and requires an institutional permit for drugs stocked, stored, administered, compounded, or dispensed in the institution.

In these states the pharmacy is an entity rather than an individual practitioner. That makes the 582(d)(5) argument the weakest, yet it can still hold. Check your center's own license class before adopting any national position.

Then does it qualify as a small dispenser?

FDA's definition is specific. A facility is small dispenser if the corporate entity that owns the dispenser has a total of 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians, counted as of November 27, 2026. Full-time follows the IRS standard: an average of at least 30 hours of service per week, or 130 hours per month.

Two words in that definition decide the answer, and there is a third trap.

The first is pharmacists or pharmacy technicians. Most freestanding surgery centers clear the threshold without effort.

The second is corporate entity that owns. The count happens at the owner, not at the facility. For most management company-affiliated centers this is not a problem, because each center is typically held in its own LLC. Hospital system ownership is where it becomes different: a center majority owned by a system can sit inside an entity with far more than 25 licensed pharmacists and technicians. Those centers should get the number from corporate compliance in writing rather than assuming it at the facility level.

What DSCSA requires, and what APP recommends

The first six are federal requirements for a center being treated as a dispenser. The last three are Ambulatory Pharmacist Partners recommendations: sensible evidence practices that no statute spells out. None of it requires additional software tools.

1. Buy only from authorized trading partners Federal, 582(d)(3)

Confirm that wholesalers hold a valid license in the state that ships to the center, and check FDA's wholesale distributor and 3PL licensure reporting. This matters most when someone sources outside the primary and secondary sources during a shortage.

2. Accept only product bearing the required product identifier Federal, 582(d)(2)

A dispenser may transact in product only where it is encoded with the required product identifier, subject to statutory exemptions. This does not apply to compounded medications.

Most credible distributors are not allowed to sell product without the required product identifier, because doing so would make them non-compliant.

3. Receive and retain transaction information and statements Federal, 582(d)(1)

Six years of easily retrievable records is statutory requirement and covers: transaction information (purchases, sales, transfers, disposal), suspect product investigation records from when the investigation concludes, illegitimate product disposition records when disposition concludes.

4. Produce those records within two business days Federal, 582(d)(1)(D)

On a request tied to a recall or a suspect product investigation, a dispenser has two business days to respond. Test that retrieval path once, before it is needed. Two business days is not enough time to discover that the only person with portal credentials left last year.

5. Keep a working suspect and illegitimate product policy Federal, 582(d)(4)

Quarantine, investigate, document. On determining that product is illegitimate, notify FDA and affected trading partners within 24 hours, through the CDER NextGen 3911 platform or by emailing Form FDA 3911.

The center's pharmacist should be able to build this policy. If not, an APP pharmacist can.

6. Respond to recalls and to FDA or state requests Federal

Log every recall notice, including the ones that do not apply. A log showing the notice was reviewed and no affected lots were held is stronger evidence than silence. You already should have a policy for this in place.

7. Verify suppliers and keep the evidence APP recommendation

Verification that leaves no documentation is not verification. A dated note naming who checked which license, when, and against what source covers your butt. Re-check annually.

8. Know where the DSCSA data lives, and test retrieval APP recommendation

The statute allows a dispenser to have a third party maintain tracing data under a written agreement. The dispenser retains that agreement and remains responsible for its obligations. "Our wholesaler has it" is not an answer; someone at the center should be able to retrieve it and show that access works.

Get a short written confirmation from each distributor covering authorized trading partner status, what tracing information it provides, how the center accesses it, how long it stays available, what happens when the account closes or the center changes distributors, and how records can be exported. The post-termination piece is not statutory language, it is a risk control. Losing portal access does not end the center's obligation, which is the whole reason to ask.

9. No sourcing from unverified or unauthorized sellers APP recommendation

Borrowing from another facility, accepting product from a physician's office, or buying from an unfamiliar broker during a shortage carries DSCSA, state pharmacy, and controlled substance consequences. The question is whether the trading partner is authorized and the transaction meets DSCSA requirements. Run it by your pharmacist before it happens.

What a center does not need to do

Scanning every package at receipt, reconciling serial numbers by hand, recording DSCSA data in the patient chart, tracking the vial through administration, or standing up a second database that duplicates what the wholesaler already holds.

Do ASCs need a GLN?

Not under DSCSA. FDA answers this question directly in its product tracing FAQ: DSCSA does not require a specific location identifier such as a Global Location Number, and "your trading partner may ask you to obtain a GLN, which is a data element of EPCIS, as a business requirement to facilitate data exchange using EPCIS."

So both halves need saying. "The ASC needs a GLN because of DSCSA" is wrong. "The wholesaler may require a GLN to exchange EPCIS data" is a reality. Some distributors will obtain and assign one at no charge, so ask before paying GS1 US. It belongs on the wholesaler onboarding checklist, not on the compliance risk register.

For a standard ASC, DSCSA is sourcing and documentation

FDA describes DSCSA as an electronic, interoperable system to identify and trace certain prescription drugs at the package level as they move through the supply chain, and states that product tracing, product identifier, authorized trading partner, and verification requirements apply to trading partners, including manufacturers, repackagers, wholesale distributors, and dispensers. A surgery center authorized by law to dispense or administer prescription drugs falls inside that definition of dispenser.

Ambulatory Pharmacist Partners' assessment is that a center administering medications in the ordinary course of surgical care does not need to build a complex internal enhanced tracing program so long as it is not acting beyond ordinary administration. A center needs to be able to prove legitimate sourcing, maintain the required documentation, and respond correctly when product is suspect, illegitimate, or recalled.

What FDA changed on August 6, 2026

FDA extended its exemption for small dispensers, and where applicable their trading partners, from November 27, 2026 to November 27, 2027. The stated reason is to give the agency time to finish its small dispenser assessment, publish the report for public comment, and hold a public meeting. Nothing has to be filed. Small dispensers and their trading partners who use the exemption do not need to submit anything to FDA or inform the agency.

The most useful part for a surgery center is that a qualifying small dispenser may continue relying on its current methods for providing, capturing, and maintaining transaction information and transaction statements, for verification activities, for responding to regulator information requests, and for gathering required transaction information. Invoices, packing slips, a distributor portal, and an existing electronic system all remain acceptable. Nobody has to scan a vial.

Requirement	Status for a qualifying small dispenser
Enhanced electronic, interoperable, package-level tracing (582(g)(1))	Exempt through November 27, 2027
Verifying the product identifier on the designated proportion of suspect or illegitimate product (582(d)(4)(A)(ii)(II), (B)(iii))	Exempt through November 27, 2027
All other verification duties under 582(d)(4)	In force now
Trading partners must be authorized (582(d)(3))	In force now
Product must be encoded with a product identifier (582(d)(2))	In force now
Capture and retain transaction information and statements for six years (582(d)(1))	In force now

FDA states the exemptions do not apply to the other requirements of section 582, and that small dispensers are still obligated to meet all other verification requirements of section 582(d)(4).

Frequently asked questions

Did FDA delay DSCSA until 2027?

No. FDA granted qualifying small dispensers a further exemption from specified requirements of section 582(g)(1) and parts of 582(d)(4) through November 27, 2027. FDA states the exemptions do not apply to the other requirements of section 582.

Are ambulatory surgery centers exempt from DSCSA?

No. There is no blanket ASC exclusion. A surgery center authorized by law to administer prescription drugs falls within the statutory definition of a dispenser. Many ASCs do qualify for the small dispenser exemption, but that exemption covers only enhanced electronic tracing and two narrow verification clauses.

Does a surgery center qualify as a small dispenser?

Most do. FDA counts full-time employees licensed as pharmacists or qualified as pharmacy technicians at the corporate entity that owns the dispenser, as of November 27, 2026, with a threshold of 25 or fewer. Management company-affiliated centers held in their own LLC usually clear it; hospital system owned centers should confirm the count at the owning entity and how much ownership the hospital system has.

Does the exemption mean a qualifying center can keep using paper and its distributor portal?

Yes. FDA permits qualifying small dispensers to continue relying on current methods for providing, capturing, and maintaining transaction information and statements, for verification, and for responding to regulator requests, through November 27, 2027.

Does an ASC need a GLN for DSCSA?

No. FDA states DSCSA does not require a specific location identifier such as a GLN, while noting a trading partner may ask for one as a business requirement to facilitate EPCIS data exchange. Ask the distributor before purchasing one.

How long must DSCSA transaction records be kept?

Six years, on three separate clocks: transaction information and statements six years from the transaction, suspect product investigation records six years from when the investigation concludes, and illegitimate product disposition records six years from when disposition concludes. Records must be producible within two business days of a request.

Sources

• FDA, Exemptions under the Drug Supply Chain Security Act (content current as of August 6, 2026)
• FDA, DSCSA Exemptions from Certain Requirements Under Section 582 for Small Business Dispensers Until November 27, 2027
• FDA, DSCSA Assessment of Small Dispensers and the assessment survey (responses requested by September 22, 2026)
• FDA, DSCSA Product Tracing Requirements FAQ (GLN and location identifier question)
• 21 USC 360eee-1, Requirements (FD&C Act section 582), including 582(d)(1) through (d)(5) and 582(g)(1)
• 21 USC 360eee, Definitions, including dispenser and the transaction exclusions at (24)(B)
• FDA, Enhanced Drug Distribution Security at the Package Level, final guidance, August 2023
• FDA, Notify FDA of Illegitimate Products and Form FDA 3911
• FDA, Check Licensure of Wholesale Drug Distributors and 3PLs
• ASCA, Drug Supply Chain Security Act
• State licensure: Texas Board of Pharmacy institutional pharmacy (Class C) rules at 22 TAC §291.76; Florida Modified Class II institutional pharmacy under Fla. Stat. ch. 465.