Why it is needed
The one prescription supply chain with no chain of custody, by design.
A record with one author is a claim. A record with three is evidence. Until today a pharmacy published a record about a unit and hoped the patient saved it. Nobody wrote down who received the vial, whether it was still in date when it was drawn, or where it went if it was not. The regulators noticed this summer, and they said so in writing.
Drug Supply Chain Security Act, section 581(13).
The federal definition of a traceable product excludes a drug compounded in compliance with section 503A or 503B. Every manufactured prescription drug carries a serialized package and a transaction record that passes from hand to hand. Compounded medicine carries neither, by statute.
NABP, 29 July 2026.
The National Association of Boards of Pharmacy named the gaps it will now build standards around, in its own words: the absence of supply-chain traceability tools for compounded products, and the difficulty of verifying the bulk substances from which compounded medications are made. It is also building a national adverse-event clearinghouse for compounded medicine.
FDA, updated 1 September 2026.
As of 31 May 2026 the agency had 990 adverse-event reports on compounded semaglutide and more than 730 on compounded tirzepatide. It reports fraudulent products whose labels name compounding pharmacies that do not exist, and counterfeit units found inside the legitimate supply chain.
22 Texas Administrative Code 291.133(d)(13)(A)(vi).
A pharmacy compounding sterile preparations must hold a written procedure for preparation recall. USP General Chapter 797 carries the same requirement, alongside complaint handling and adverse-event reporting. Both assume the pharmacy can say who received a lot.
Indiana Senate Bill 282, 2026.
Medical spas register with the state from 1 January 2027, and the bulk-substance rules for the compounded preparations they administer are written into the statute.
Minnesota HF 2779, 2026.
Compounded medicine administered in a clinic must come from a licensed pharmacy with a patient-specific justification on file.
ASHP Guidelines on Outsourcing Sterile Compounding Services.
A hospital pharmacy that buys from a 503B outsourcing facility is told to qualify the vendor and keep the records that show it did. The receiving side carries the burden.
One record, three hands, one scan each.
Custody is not a second artifact. The Seal stays the record and the Passport stays the proof. What changes is who may write to the record and who it can reach. Seven events, named plainly: released, shipped, received, administered, returned, recalled, reported. Every event on a unit carries the hash of the one before it, so a line cannot be tidied after the fact without the break showing.
Release.
Nothing changes at the bench. The lot clears, the Evidence Passport is minted, the Seals print. The release slip that already goes in the box now carries a shipment code: one code for the box, one Seal per unit.
The door.
The clinic scans the slip. Every unit in the box lands on its desk with the pharmacy's paperwork attached. A box that carries no Seal is typed in from the packing slip in thirty seconds, marked no record on file, and the ask goes to that pharmacy. Either way the desk shows accept or hold, with the reasons, before the box goes in the fridge.
Administration.
The clinic scans the vial as it is drawn. The administration line is written: unit, lot, date, the clinic's own reference. The patient's phone shows the chain. The log a board asks a clinic to produce fills itself.
Recall.
The pharmacy declares once. Every clinic holding the lot sees the recalled units named on its desk and is emailed. Every patient who saved a unit is notified. The pharmacy sees which clinics have opened the notice and which have not.
The report.
An adverse event is filed from the unit's own record, with product, lot, pharmacy and dates already in place. The clinic states what it saw and sends it. The pharmacy learns that a report exists on one of its units. Patient identity stays with the clinic.
Four numbers a pharmacy could not get anywhere else.
The Custody view sits under Prove and deliver. Every other figure a pharmacy holds is about what it made. These four are about where it went.
- Unaccounted: units shipped and not yet received or returned, by lot and by clinic. The number a recall procedure assumes the pharmacy can state.
- Off path: a Seal read at a clinic it was never shipped to, read twice, or read after it was administered. A fact about scans, stated as such, with the pharmacy told first.
- Expiring on a clinic shelf: units received, not administered, inside fourteen days of use-by. The pharmacy warns the clinic before an inspector finds the vial.
- Recall notices not yet opened: which clinics holding a recalled lot have not yet read the notice on their desk.
The same view issues a numbered custody statement per lot: released through administered, unaccounted stated, the chain verified, readable at a public address with no account. It is what a board asks for under a recall procedure, and what a buyer's contract can ask for by name. The full event record exports as CSV or JSON, so a pharmacy's own system can read it.
A binder and a gate, for nothing.
A clinic, medical spa, or telehealth practice opens On hand: every unit in the fridge by lot, with the pharmacy's paperwork behind it. Today shows four stacks: arrived and awaiting a decision, expiring within fourteen days, recalled and not yet read, and waiting on paperwork. The desk takes every shipment, sealed or not. A pharmacy that has not sealed its box is visibly weaker on its own customer's screen, and the ask has already gone out in the clinic's name.
- The door decision states its reasons: paperwork on file or not, use-by clear or not, a recall reported or not, the pharmacy on Veritura or not.
- Administration is one scan per unit. The clinic's reference is the clinic's own. No patient name or chart ever enters Veritura, so no agreement is needed to start.
- An adverse-event report is drafted from the unit's record in the shape the national clearinghouse will expect, and the clinic sends it.
Two more lines on the vial's page.
The same code the patient already scans now carries the middle hand: received by the clinic, with the date, and administered, with the date. The clinic's brand name and nothing else. No score, no posture word, no patient.
Why a record from an interested party can be the standard of truth here.
Because no line in it is Veritura's. Each hand signs its own line. The lines are chained. Anyone can verify a statement without an account, and no record on file is a legitimate state the market learns to read. The event vocabulary and the export are published, so a wholesaler, a board, or a rival can read a Veritura record. A buyer can put one sentence in a supplier agreement: for each lot delivered, a certificate of analysis and a custody record the buyer can verify without an account, stating units released, received, and unaccounted.
What it does not do
Documents, never the medicine.
- Custody says who held a unit and what the paperwork established. It never says a preparation is safe, effective, or approved, and it is not a certificate of analysis.
- Off path is a fact about where and when a Seal was read. The words diverted, counterfeit, and stolen do not appear anywhere in the product. The pharmacy draws the conclusion.
- No patient identity is stored. The patient claims their own record by scanning.
- Nothing shipped is retired. Custody is the roof over the Passport, the Seal, the order channels, the recall net, and the two agents.
The public record this note stands on.
- DSCSA
- Federal Food, Drug, and Cosmetic Act section 581(13), definition of product, and the NCPA note of 15 August 2023 on the compounding exclusion
- NABP
- Press release of 29 July 2026 on the adverse-event clearinghouse and model state language; Inside Health Policy on the SAFE Drugs Act
- FDA
- Concerns with unapproved GLP-1 drugs used for weight loss, page updated 1 September 2026; counterfeit Ozempic alert
- Texas
- 22 Texas Administrative Code 291.133, pharmacies compounding sterile preparations
- USP
- General Chapter 797, quality assurance, recalls, complaints, and adverse-event reporting
- Indiana
- Senate Bill 282, 2026 session
- Minnesota
- HF 2779, 2026 session
- ASHP
- Guidelines on Outsourcing Sterile Compounding Services