On 12 June 2024 the FDA issued a letter exempting small business dispensers from certain requirements in section 582 of the FD&C Act until 27 November 2026, re-issued on 12 July 2024 with clarifying edits. It was framed as breathing room — additional time to stabilise operations before implementing the enhanced requirements.
It has been widely read as “DSCSA does not apply to small pharmacies yet.” That is not what it said, and the gap between the two readings is where the exposure sits.
What the exemption actually covered
Mostly the enhanced drug distribution security requirements of §582(g)(1) — the package-level, electronic, interoperable obligations. That is a real and demanding slice, and it is the slice a small pharmacy is least equipped to build.
One item sits outside §582(g)(1), and it is the detail almost every summary of this letter drops. The exemption also reaches §582(d)(4)(A)(ii)(II) and (d)(4)(B)(iii) — the requirement to verify the product identifier of the statutorily designated proportion of suspect or illegitimate product in your possession. FDA closes that same bullet by narrowing it: “Small business dispensers are still obligated to meet all other verification requirements of section 582(d)(4) of the FD&C Act.” So the suspect-product duty did not pause. One sampling step inside it did.
Beyond those, nothing else in §582 was in scope: “The exemptions described herein do not apply to other requirements in section 582 of the FD&C Act.” Dealing only with authorised trading partners, keeping transaction information and statements, responding to a tracing request, quarantining and investigating suspect product — all of it ran throughout.
Nor does relying on the exemption involve filing anything: “Small dispensers and their trading partners who utilize these exemptions do not need to submit anything to FDA.” FDA recommends telling your trading partners you are relying on it. That recommendation is the whole administrative footprint — which is precisely why nobody has a record of having made the decision.
So a pharmacy that stopped thinking about DSCSA in June 2024 has been carrying obligations the whole time it believed it had been let off. When the exemption lapses in November, that is not the start of the obligation. It is the end of the one part that was paused.
The 25-employee threshold is not per store
A “small dispenser” is one where the corporate entity that owns the dispenser has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians.
Five things follow, and each catches people out:
- It counts across the whole entity. Three stores of nine qualified staff each is 27, not nine. Multi-store owners are routinely over the line without knowing it.
- It counts a specific population — licensed pharmacists and qualified technicians. Not front-of-shop staff, not delivery drivers, not bookkeeping.
- It is counted as of 27 November 2024, not today. FDA fixes the date in a footnote — “The total number of employees as of November 27, 2024” — and that cuts both ways. A pharmacy that has hired past 25 since then did not lose the exemption. A pharmacy that has shrunk below 25 since then never had it.
- “Full-time” has a definition, and it is the IRS one. FDA cites it directly: an employee averaging at least 30 hours of service per week, or 130 hours of service per month. Two half-time technicians are not two employees for this count, which is how pharmacies talk themselves over a line they are under.
- It is a status you should be able to evidence, dated, rather than a conclusion someone reached once. If you were never exempt, none of the pause applied to you at any point.
What an inspector actually asks for
Not your serialization data. Your wholesalers move that, and it lives in their systems. The question is whether you can produce the written record around it — the part almost no independent pharmacy can generate on the spot:
- A dated determination of your exemption status, with the basis for it.
- A trading-partner verification log — who you buy from and how you established they are authorised.
- Standard operating procedures, dated, for handling suspect and illegitimate product.
- A tracing response runbook: what happens, and who does it, when a request arrives.
- Training attestation, and a retention plan covering the six-year requirement.
None of this needs a platform. It needs to exist, be dated, and be findable — which is exactly what does not happen when the work is deferred to the deadline.
Where DoseTrace fits
DoseTrace is not an EPCIS or serialization platform and does not try to be. It produces the nine-document binder above from a 15-minute intake, flat fee $499, one time, no subscription.
Check your exemption status free on the home page — including the entity-wide employee count, which is the part most owners get wrong. Contact reaches a person.
For the other half of the question — what the six lettered obligations of §582(g)(1) actually require of you the morning the exemption lapses — see what changes on 27 November 2026.
If you are weighing a track-and-trace platform against documentation — and being quoted for both — see what a pharmacy is actually buying when it buys DSCSA compliance.
Re-verified 30 July 2026 against the FDA small-business-dispenser exemption letter of 12 July 2024, which is now the source for every figure on this page. Two corrections on record. A version of this page dated the non-exempt obligations to 27 November 2023; that date could not be substantiated and was removed on 28 July 2026. Until 30 July 2026 this page also said the exemption covered §582(g)(1) and nothing else — it was read off FDA’s separate 9 October 2024 letter, which governs other trading partners. The small-dispenser letter also exempts one sampling step under §582(d)(4), and it carries an as-of date and a definition of “full-time” that the other document does not. Both are now stated above. DoseTrace is not a law firm and nothing here is legal advice.