Beginning not later than January 1, 2015, a dispenser shall have systems in place to enable the dispenser to comply with the following requirements:
``(A) Suspect product.--
``(i) In general.--Upon making a determination that a product in the possession or control of the dispenser is a suspect product, or upon receiving a request for verification from the Secretary that has made a determination that a product within the possession or control of a dispenser is a suspect product, a dispenser shall--
``(I) quarantine such product within the possession or control of the dispenser from product intended for distribution until such product is cleared or dispositioned; and
``(II) promptly conduct an investigation in coordination with trading partners, as applicable, to determine whether the product is an illegitimate product.
``(ii) Investigation.--An investigation conducted under clause (i)(II) shall include--
``(I) beginning 7 years after the date of enactment of the Drug Supply Chain Security Act, verifying whether the lot number of a suspect product corresponds with the lot number for such product;
``(II) beginning 7 years after the date of enactment of such Act, verifying that the product identifier, including the standardized numerical identifier, of at least 3 packages or 10 percent of such suspect product, whichever is greater, or all packages, if there are fewer than 3, corresponds with the product identifier for such product;
``(III) validating any applicable transaction history and transaction information in the possession of the dispenser; and
``(IV) otherwise investigating to determine whether the product is an illegitimate product.
``(iii) Cleared product.--If the dispenser makes the determination that a suspect product is not an illegitimate product, the dispenser shall promptly notify the Secretary, if applicable, of such determination and such product may be further distributed or dispensed.
``(iv) Records.--A dispenser shall keep records of the investigation of a suspect product for not less than 6 years after the conclusion of the investigation.
``(B) Illegitimate product.--
``(i) In general.--Upon determining, in coordination with the manufacturer, that a product in the possession or control of a dispenser is an illegitimate product, the dispenser shall--
``(I) disposition the illegitimate product within the possession or control of the dispenser;
``(II) take reasonable and appropriate steps to assist a trading partner to disposition an illegitimate product not in the possession or control of the dispenser; and
``(III) retain a sample of the product for further physical examination or laboratory analysis of the product by the manufacturer or Secretary (or other appropriate Federal or State official) upon request by the manufacturer or Secretary (or other appropriate Federal or State official), as necessary and appropriate.
``(ii) Making a notification.--Upon determining that a product in the possession or control of the dispenser is an illegitimate product, the dispenser shall notify the Secretary and all immediate trading partners that the dispenser has reason to believe may have received such illegitimate product of such determination not later than 24 hours after making such determination.
``(iii) Responding to a notification.--Upon the receipt of a notification from the Secretary or a trading partner that a determination has been made that a product is an illegitimate product, a dispenser shall identify all illegitimate product subject to such notification that is in the possession or control of the dispenser, including any product that is subsequently received, and shall perform the activities described in subparagraph (A).
``(iv) Terminating a notification.--Upon making a determination, in consultation with the Secretary, that a notification is no longer necessary, a dispenser shall promptly notify immediate trading partners that the dispenser notified pursuant to clause (ii) that such notification has been terminated.
``(v) Records.--A dispenser shall keep records of the disposition of an illegitimate product for not less than 6 years after the conclusion of the disposition.
``(C) Electronic database.--A dispenser may satisfy the requirements of this paragraph by developing a secure electronic database or utilizing a secure electronic database developed or operated by another entity.