Tracing

The DSCSA requires tracing in a way that is secure, electronic, interoperable, confidential, and takes place among ATPs or in collaboration with regulators. The XATP Compliance Suite meets these requirements in accordance with the FDA public-private partnership.

This article covers the tracing workflows available via the DSCSA Portal. For information about our standalone tracing application, see the article on the Electronic Interoperable Tracing Module. For more general information about tracing, see our introductory article.

DSCSA Portal Roles #

The XATP Magic Portal makes it easy for manufacturers to receive and manage requests and reports from direct and indirect ATPs including pharmacies, wholesalers, and third-party logistics providers. It includes two roles:

  • Host: The portal owner, such as a manufacturer. The Host has access to the XATP Dashboard, which includes ticket views for all Portal workflows.
  • Guest: External users such as pharmacists and wholesalers. Guests can submit requests and reports in the Portal.

Trace Workflow Overview #

At a high level, a standard trace workflow through the portal is as follows:

  1. Guest enters the portal. (More information about Portal invites and registration can be found here.)
  2. Guest submits a Trace Request. (The Guest must be a validated ATP in order to submit a request through the Portal. More information about ATP validation can be found here.)
  3. Host receives a notification email.
  4. Host reviews Trace Request.
  5. Host submits Trace Response.
  6. Guest receives a notification email.

Submitting a Trace Request #

Once logged into the Portal, the Guest can click the New Request button and select “Trace.”

The Portal Trace Request form.

The Guest provides the following information:

FieldDescriptionExample DataMandatory
Department NameThe Guest’s name or their company department.Y
Preferred Contact MethodPhone or email. If the Guest selects email, the Guest account email is used. Otherwise, a phone number may be entered.EmailY
GLNGS1 Global Location Number.360152004869N
Investigation IDInternal identifier for Guest’s reference.N
Response Type RequestedThis may be Transaction Information, All Known Owners, or Last Known Owners.Transaction InformationY
Investigation Reason AttestationThe reason for the request. This may be Suspect Product Investigation, Illegitimate Product Investigation, Recalled Product Investigation, Compliance Audit, or Health Authority Inspection.Compliance AuditY
Investigation CircumstancesAny additional notes.N
Pre-Existing Incident NumberIf available, the Form 3911 incident number assigned by the FDA.N
Product IDGTIN or NDC. To facilitate a more efficient response, GTIN is recommended.00360152154861 (GTIN)Y
Serial NumberThe serial number of the product.30086Y
Test?Yes or no. Test requests may be submitted as to support “fire drill” exercises between trading partners.NoY
Product DataAny files or other supporting documentation which might support the trace investigation.N

For more information about these fields, see the PDG Blueprint Chapter 5.

Receiving a Trace Request #

Once a Trace Request is submitted through the Portal, all of the Host users receive an email notification. Log into the XATP Dashboard and navigate to the Portal tab to submit a response. Since the ATP status of the Guest was validated previously, no ATP validation step is needed.

An example Trace Request with Trace Response form.

Submitting a Trace Response #

To get started, review the trace information submitted. In particular, the GTIN or NDC along with the serial number can be used to support a lookup in your source documentation (e.g. EPCIS repository). Once you find the relevant transaction information and transaction statement, fill out the fields below. Example information is provided below for reference.

CategoryFieldValueDescription
Drug InformationDrug NameProTracinName of the medication.
NDC6015-2154-86National Drug Code.
GTIN00360152154861Global Trade Item Number.
Strength5mgConcentration of the active ingredient.
Dosage FormTabletsPhysical form of the medication (e.g., tablet, capsule).
Container Size50Number of dosage units per container.
Number of Containers1Total number of containers in the shipment.
Lot NumberM001-1Batch or lot number of the product.
Expiration Date11-30-2026Date after which the product should not be used.
Ownership FromOwnership From GLN360152004869Global Location Number identifying the previous owner.
Ownership From Company NameArthiMax PharmaName of the company from which ownership is transferred.
Street Address808 Pine RoadAddress of the company from which ownership is transferred.
CitySummit
State / ProvinceNJ
ZIP / Postal Code87127
Email Addressarthimax@example.com
Phone Number1-123-122-1234
Digital Address (URI)arthimax@example.comEmail address or API endpoint suitable for submitting trace requests and responses.
Ownership ToOwnership To GLN812330250150Global Location Number identifying the new owner.
Ownership To Company NameKC PharmacyName of the company to which ownership is transferred.
Street Address202 Cedar StreetPhysical address of the new owner.
CityGramercyCity where the new owner is located.
State / ProvinceLAState or province where the new owner is located.
ZIP / Postal Code70052Postal code of the new owner’s location.
Email Addresskcpharma@example.comEmail contact for the new owner.
Phone Number1-321-221-4321
Digital Address (URI)arthimax@example.com
Other InfoWas this a drop shipment?NoIndicates whether the shipment was a drop shipment directly to the end customer.
PO associated with TransactionXYZPO189Purchase Order number related to the transaction.
Transaction StatementSeller has complied with each applicable subsection of FDCA Sec. 581(27)(A)-(G).Statement asserting compliance with the law.
Date of Shipment12-04-2023Date the product was shipped.
Date of Transaction[Leave blank]The actual date of the ownership transfer. Leave blank if it was the same day as the shipment.
Trace Request Recipient Emailrequestor@example.comEmail address to which trace requests should be sent.

Receiving a Trace Response #

Once the Trace Response is submitted by the Host, the Guest receives a notification email. The email includes a file attachment with the PDG-compliant trace response and a presentation of the Host’s OCI-compliant DSCSA credentials to ensure security, Interoperability, and confidentiality. If the Guest has their own PDG-compliant trace solution, the file attachment can be uploaded to their solution to authenticate and log the response.