Tracing

The DSCSA requires tracing in a way that is secure, electronic, interoperable, confidential, and takes place among ATPs or in collaboration with regulators. The XATP Compliance Suite meets these requirements in accordance with the FDA public-private partnership.

This article covers the tracing workflows available via the DSCSA Portal. For information about our standalone tracing application, see the article on the Electronic Interoperable Tracing Module. For more general information about tracing, see our introductory article.

DSCSA Portal Roles #

The XATP Magic Portal makes it easy for manufacturers to receive and manage requests and reports from direct and indirect ATPs including pharmacies, wholesalers, and third-party logistics providers. It includes two roles:

• Host: The portal owner, such as a manufacturer. The Host has access to the XATP Dashboard, which includes ticket views for all Portal workflows.
• Guest: External users such as pharmacists and wholesalers. Guests can submit requests and reports in the Portal.

Trace Workflow Overview #

At a high level, a standard trace workflow through the portal is as follows:

1. Guest enters the portal. (More information about Portal invites and registration can be found here.)
2. Guest submits a Trace Request. (The Guest must be a validated ATP in order to submit a request through the Portal. More information about ATP validation can be found here.)
3. Host receives a notification email.
4. Host reviews Trace Request.
5. Host submits Trace Response.
6. Guest receives a notification email.

Submitting a Trace Request #

Once logged into the Portal, the Guest can click the New Request button and select “Trace.”

The Guest provides the following information:

Field	Description	Example Data	Mandatory
Department Name	The Guest’s name or their company department.	–	Y
Preferred Contact Method	Phone or email. If the Guest selects email, the Guest account email is used. Otherwise, a phone number may be entered.	Email	Y
GLN	GS1 Global Location Number.	360152004869	N
Investigation ID	Internal identifier for Guest’s reference.	–	N
Response Type Requested	This may be Transaction Information, All Known Owners, or Last Known Owners.	Transaction Information	Y
Investigation Reason Attestation	The reason for the request. This may be Suspect Product Investigation, Illegitimate Product Investigation, Recalled Product Investigation, Compliance Audit, or Health Authority Inspection.	Compliance Audit	Y
Investigation Circumstances	Any additional notes.	–	N
Pre-Existing Incident Number	If available, the Form 3911 incident number assigned by the FDA.	–	N
Product ID	GTIN or NDC. To facilitate a more efficient response, GTIN is recommended.	00360152154861 (GTIN)	Y
Serial Number	The serial number of the product.	30086	Y
Test?	Yes or no. Test requests may be submitted as to support “fire drill” exercises between trading partners.	No	Y
Product Data	Any files or other supporting documentation which might support the trace investigation.	–	N

For more information about these fields, see the PDG Blueprint Chapter 5.

Receiving a Trace Request #

Once a Trace Request is submitted through the Portal, all of the Host users receive an email notification. Log into the XATP Dashboard and navigate to the Portal tab to submit a response. Since the ATP status of the Guest was validated previously, no ATP validation step is needed.

Submitting a Trace Response #

To get started, review the trace information submitted. In particular, the GTIN or NDC along with the serial number can be used to support a lookup in your source documentation (e.g. EPCIS repository). Once you find the relevant transaction information and transaction statement, fill out the fields below. Example information is provided below for reference.

Category	Field	Value	Description
Drug Information	Drug Name	ProTracin	Name of the medication.
	NDC	6015-2154-86	National Drug Code.
	GTIN	00360152154861	Global Trade Item Number.
	Strength	5mg	Concentration of the active ingredient.
	Dosage Form	Tablets	Physical form of the medication (e.g., tablet, capsule).
	Container Size	50	Number of dosage units per container.
	Number of Containers	1	Total number of containers in the shipment.
	Lot Number	M001-1	Batch or lot number of the product.
	Expiration Date	11-30-2026	Date after which the product should not be used.
Ownership From	Ownership From GLN	360152004869	Global Location Number identifying the previous owner.
	Ownership From Company Name	ArthiMax Pharma	Name of the company from which ownership is transferred.
	Street Address	808 Pine Road	Address of the company from which ownership is transferred.
	City	Summit
	State / Province	NJ
	ZIP / Postal Code	87127
	Email Address	arthimax@example.com
	Phone Number	1-123-122-1234
	Digital Address (URI)	arthimax@example.com	Email address or API endpoint suitable for submitting trace requests and responses.
Ownership To	Ownership To GLN	812330250150	Global Location Number identifying the new owner.
	Ownership To Company Name	KC Pharmacy	Name of the company to which ownership is transferred.
	Street Address	202 Cedar Street	Physical address of the new owner.
	City	Gramercy	City where the new owner is located.
	State / Province	LA	State or province where the new owner is located.
	ZIP / Postal Code	70052	Postal code of the new owner’s location.
	Email Address	kcpharma@example.com	Email contact for the new owner.
	Phone Number	1-321-221-4321
	Digital Address (URI)	arthimax@example.com
Other Info	Was this a drop shipment?	No	Indicates whether the shipment was a drop shipment directly to the end customer.
	PO associated with Transaction	XYZPO189	Purchase Order number related to the transaction.
	Transaction Statement	Seller has complied with each applicable subsection of FDCA Sec. 581(27)(A)-(G).	Statement asserting compliance with the law.
	Date of Shipment	12-04-2023	Date the product was shipped.
	Date of Transaction	[Leave blank]	The actual date of the ownership transfer. Leave blank if it was the same day as the shipment.
	Trace Request Recipient Email	requestor@example.com	Email address to which trace requests should be sent.

Receiving a Trace Response #

Once the Trace Response is submitted by the Host, the Guest receives a notification email. The email includes a file attachment with the PDG-compliant trace response and a presentation of the Host’s OCI-compliant DSCSA credentials to ensure security, Interoperability, and confidentiality. If the Guest has their own PDG-compliant trace solution, the file attachment can be uploaded to their solution to authenticate and log the response.