Systems Engineering Perspective of E-Pedigree Systems

Transcription

1 Systems Engineering Perspective of E-Pedigree Systems By Ankur Sinha Bachelor of Engineering, Delhi College of Engineering, University of Delhi, 1997 SUBMITTED TO THE SYSTEM DESIGN AND MANAGEMENT PROGRAM at MIT Sloan School of Management & Engineering Systems Division in Partial Fulfillment of the Requirement for the Degrees of Master of Science in Engineering and Management at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY May Ankur Sinha All rights reserved. The author hereby grants to MIT permission to reproduce and to distribute publicly paper and electronic copies of this thesis document in whole or in part in any medium now known or hereafter created. Signature of Author: Ankur Sinha May 21st, 2009 Certified by: David Simchi-Levi Professor of Engineering Systems Division Co-Director, LFM/SDM Thesis Supervisor Accepted by: Pat Hale Director System Design and Management Program

2 this page has been intentionally left blank 1-2 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

3 Systems Engineering Perspective of e-pedigree Systems By Ankur Sinha SUBMITTED TO THE System Design and Management Program at MIT Sloan School of Management & Engineering Systems Division in Partial Fulfillment of the Requirement for the Degrees of Master of Science in Engineering and Management at the Massachusetts Institute of Technology Abstract According to reports, global revenues from counterfeit drugs will amount to nearly $75 billion by the year Anti-counterfeiting of drugs has taken the center stage in United States, and various efforts are being undertaken by Food and Drug Administration (FDA) and notably, the state of California to ensure that the supply chain of the pharmaceutical industry is not intercepted with fake drugs. To counter the ubiquitous problem of counterfeiting, measures have been discussed by stakeholders in the pharmaceutical industry and the United States Government. Efforts are underway at national, regional and state levels for timely implementation of anti-counterfeiting strategies. One of the measures recommended by regulatory agencies like FDA and California Board of Pharmacy (Ca BOP), includes documentation of the hand-off of drug, from one supply-chain stakeholder to another. Ca BOP, mandates maintaining of e-pedigree containing information resulting in change of ownership of each drug through the supply chain of that particular drug. Implementation of this requirement requires creation and adoption of technologies by drug manufacturers, distributors, wholesalers and pharmacies to better document, track & trace, and authenticate the drugs being sold to the consumers. In the recent years, various technologies like RFID have been used in managing the supply chain of various industry verticals. This thesis makes an attempt to take a systems approach to understand the needs of the supply chain and the technologies available to meet the requirements of various industries. It is important to mention that there are two needs in the supply chain industry for the 1-3 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

4 adoption of various technologies. These are 1) Regulatory Compliance Needs Pharmaceutical industry has seen the emergence of e-pedigree laws to 2) Enhancing Revenue Generation. This thesis makes an attempt to create various assessment tools and framework for technology adoption and strategy. Various agencies have launched standards for serialization and data carrier technologies and this thesis attempts to study the standards, recommend architectural frameworks, and system implementation models for a few industry verticals. The thesis closely examines the regulatory needs of the pharmaceutical industry to meet the e-pedigree requirements in California and other states mandated by FDA. Cost benefit analysis was performed for recommendations of technology adoption strategy. An architectural framework and systems model has been provided to meet the e-pedigree requirements of US drug supply chain industry. Thesis Advisor: Prof. David Simchi-Levi Professor of Engineering Systems Division Co-Director, LFM/SDM Thesis Supervisor 1-4 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

5 Acknowledgements Karmanye vadhikaraste ma phaleshu kadachna Karmaphalehtur bhurma te sangostvakarmani. You have a right to perform your prescribed duty, but you are not entitled to the fruits of action. Never consider yourself the cause of the results of your activities, and never be attached to not doing your duty. This thesis is in partial fulfillment of the requirements for the degree of SDM. Let me start by saying that it was a pleasure to be part of the SDM curriculum and working with some of the finest Professors, faculty, staff and the rich and diversified spectrum of students who form the yearly cohort. First, I would like to thank Prof. David Simchi-Levi, for giving the opportunity to work on the e- Pedigree research project. Incidentally the project gave me a wonderful opportunity to work with David, one of the leading supply chain experts all over the world. I also thank him for the trust and confidence exhibited during the research project, which allowed me to meet the goals set forth for the project. My sincere and honest thanking goes to Pat Hale, Director of the SDM Program, who was the motivation behind various endeavors I had undertaken during my stint at the program. Pat continuously encouraged leadership and entrepreneurship efforts undertaken, and was the key factor for my contributions to out of the curriculum bounds. Pat also motivated me to ensure that I finished my academic responsibilities. He was one of the few people who understood the challenges that had surfaced during my stint, and in his own way, proved to a strong and respectable impetus, for me to reach the end of the tunnel. It also gives me a great honor to thank my father, Late Mr. Ashwani Kumar Sinha. All along the time we spent together, my father was someone who had lit the candle for me to find a path in darkness. During my childhood, he taught me math and science, and later on in life, advised to make key decisions. He also taught that some of the decisions come with risk, and at times to be able to fulfill your dreams or passion, it ought to be the way taken. To quote from my blog, My father was a role model for all of us, a brilliant man, with a degree in engineering, law and management, he worked as a General Manager of a public sector engineering company. Thanks to the engineering interest in the 1-5 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

6 family, my brother and I opted for engineering careers as well. My father always wanted me to go for a master s degree, and it would have been a proud moment for him to see his son graduate. February of 2008, he passed away, but I think his blessings, and his teachings and most important his love, has helped me reach to this point. I owe a lot to him. I also want to thank my mother Sushila Sinha for giving me all the love and support for me to be able to do well in life, and particularly reach my goals at MIT. I also want to thank my family members Shilpi, Shweta, Anshuman, Sonika, Karunesh, Runa, Varun for being an integral part of my life and thoughts. Without their presence or thoughts and actions, I would have been nowhere where I stand today. I want to thank all my friends, for being the support, providing company and giving me inspiration and motivation to thrive in this wonderful yet at times pressure based environment at MIT. Special thanks to Bhaskaran Muralitharan, Vijay Shilpiekandula, Vivek Raghunathan, Abishek, Nikhil, Leigh, Bharat. February of 2008, I also started playing cricket, and later formed the MIT Cricket Club. Outside of the academic life, the club became an important part of my life. The club members and cricket players provided me the joy and enthusiasm that fuelled my productivity at research. All members of Blue team, Red team, organizers, supporters and anyone and everyone who I had contact with, let me take this opportunity to tell you that you made a positive difference to the existence of life. Without Vivek Jaiswal, things would not have been as exciting as they turned out to be, so consider my thanks. My special thanks to SAO and Jed Wartmann for being the sponsor and catalyst for organization of tournaments, special cultural events and Bollywood movie nights at MIT. Once again, without all the fun and extra-curricular activities, my stint would not have been as exciting. Yours, Ankur Sinha 1-6 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

7 Table of Contents Abstract Acknowledgements Table of Contents Table of Figures Table of Tables Chapter 1 Introduction Overview Objectives Research Approach Chapter 2 System Requirements: A Definition Background Counterfeiting Anti-counterfeiting Requirements Overview Stakeholder Identification E-Pedigree Requirements and Drivers California Regulatory Requirements Federal Requirements International Requirements Business Drivers Chapter 3 System Requirements Analysis: Industry s Emerging Response Overview Industry Analysis Chapter 4 Technology: Building Block Solutions and Standards Serialization Serialization Standard Digital Mass Serialization Digital Mass Encryption Data Carrier Options Data Carrier Comparison Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

8 4.4.3 RFID Systems Electronic Product Code (EPC ) and EPC Standards EPC EPC Infrastructure and EPC Information Services (EPCIS) EPCglobal Architecture Framework E-Pedigree and E-Pedigree Standards Drug Pedigree Messaging Standard (DPMS) Architectural Standards DPMS only (Model A) DPMS + EPCIS (integration) (Model B) DPMS + EPCIS (interoperability) Model C Model D (EPCIS only) Summary of Models Development Status of Standards Chapter 5 Systems Architecture: Portfolio of Options Model ZERO (0) Model A Model D Model C Model B Conclusion Chapter 6 Cost Analysis Overview Technology Cost Comparison RFID and Bar Code Cost Process for Cost-Benefit Analysis Conclusion Chapter 7 Adoption Strategy and Recommendation Chapter 8 Conclusions and Future Work Bibliography Appendix 1: E-Pedigree Use-cases for the Supply Chain Appendix 2: Requirements Survey for Pharmaceutical Manufacturers of Biologics based drugs Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

9 Appendix 3: Distributors Order Fulfillment Appendix 4: Distribution Center Sales Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

10 This page has been intentionally left blank 1-10 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

11 Table of Figures Figure 1-1 Research approach Figure 2-1 Counterfeit drug cases (FDA) [Source: US Food and Drug Administration] Figure 2-2 Simple Supply Chain Structure Figure 2-3 Complex Supply Chain Structure Figure 4-1 Digital Mass Serialization Figure 4-2 Digital Mass Encryption Figure 4-3 Typical RFID Supply Chain System Figure 4-4 EPC Structure Figure 4-5 EPC Infrastructure Figure 4-6 EPCglobal Architecture Framework Figure 4-7E-Pedigree - Simplified Document Model Figure 4-8 E-Pedigree - Simplified Event Data Model Figure 4-9 DPMS - Innermost Component Figure 4-10 DPMS - Manufacturer to Wholesaler transfer Figure 4-11 Architectural standard - Model A Figure 4-12 Architectural standard - Model B Figure 4-13 Architectural standard - Model C Figure 4-14 Architectural standard - Model C Figure 4-15 Architectural standard - Model C Figure 4-16 Architectural standard - Model D Figure 5-1 Architecture - Model ZERO Figure 5-2 Model A - first level architecture Figure 5-3 Model A - Middle layer architecture Figure 5-4 Model A - flow Figure 5-5 Model D - first level architecture Figure 5-6 Model D - Middle layer architecture Figure 5-7 Model D - middle layer architecture Figure 5-8 Model C - first level architecture Figure 5-9 Model C middle layer architecture Figure 5-10 Model B - middle layer architecture Figure 6-1 RFID Market: Tag Prices (world) (source: Frost and Sullivan) Figure 6-2 Supply Chain Process View (Manufacturer-Distributor) Figure 6-3 Manufacture-Distributor Process View (with RFID) Figure 7-1 e-pedigree Timeline Figure 7-2 Staged approach implementation Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

12 This page has been intentionally left blank 1-12 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

13 Table of Tables Table 2-1 Stakeholder(s) and Stakeholder Groups Table 3-1 Industry recommended RFID and Bar code standards Table 3-2 Emerging Industry Response Comparison Table 4-1 GS1 standards Table 4-2 GS1 Barcode Symbols Table 4-3 Manufacturers Barcode Profile Table 4-4 RFID frequencies Table 4-5 Bar Code and RFID Comparison Table 4-6 EPC Data elements Table 4-7 e-pedigree Architectural standards Table 4-8 Summary of pedigree architecture standards Table 4-9 Architectural models and requirements traceability matrix Table 4-10 Development status of standards Table 5-1 Architecture options serialization based Table 5-2 Architecture options serialization + e-pedigree standards based Table 6-1 Market Restraints in order of impact (Europe), Table 6-2 Data carrier options - cost assumptions Table 6-3 Data-carrier options - cost comparison Table 6-4 General RFID benefits Table 6-5 Options for cost analysis Table Distribution Center Product Picking Profile: Table 6-7 RFID and Bar Code Cost comparison Table 6-8 Process benefits comparison Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

14 This page has been intentionally left blank 1-14 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

15 Chapter 1 Introduction 1.1 Overview Plasma Protein Therapeutics Association (PPTA) 1 is a conglomerate of the leading plasma protein based drug manufacturers of North America. The group is the primary advocate of global plasma collectors and manufacturers of plasma based therapeutics. PPTA members produce medicines which are used to cure immune deficiencies, bleeding disorders, alpha-1 antitrypsin deficiency, burns and shock. The PPTA members work with various stakeholders of the pharmaceutical supply chain including distributors, hospitals, patient groups, regulatory agencies and policymakers. PPTA Global members include Baxter Bioscience, Biotest Pharmaceuticals, CSL Behring, Grifols, Kedrion Spa, Octapharma and Talecris Biotherapeutics. The group also has North American and European groups, which has some additional members not listed above. Due to the recent legislative requirements to prevent counterfeiting, the association has been working with FDA and MIT to help them with technology strategy, and business. 1.2 Objectives The goal of the e-pedigree project was to assist PPTA in two broad areas. First, in developing a response to the FDA s request for comments regarding standards for Standardized Numerical Identifier, Validation, Track and Trace, and Authentication for Prescription Drugs, and developing a response to the FDA s request for information regarding technologies for Prescription Drug Identification, Validation, Track and Trace, or Authentication. And secondly in designing and specifying a system that will meet the requirements of the California legislation requiring e-pedigree and channel integrity. The broad objectives of the PPTA project included: 1) Assist PPTA in shaping the requirements to be established by FDA and the California Pharmacy Board. 2) Facilitate discussions among the stakeholders in three dimensions: a. Horizontally among the PPTA members. b. Vertically including distributors, pharmacies and hospitals. 1 Plasma Protein Therapeutics Association Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

16 c. Globally with an international perspective. Develop and orchestrate a strategy incorporating technology and processes for meeting FDA SNI requirements and California e-pedigree and channel integrity requirements as well as meeting the needs and requirements of the individual PPTA members. Specify a Solution Architecture encompassing technology, IT and database requirements to meet FDA and California requirements. 1.3 Research Approach The approach taken for the project was a systems engineering approach to the fundamental problem of counterfeiting. Requirements gathering, documentation formed the first stage of the research. This included research of journals, articles, federal dockets, legislative mandates California Board of Pharmacy, and industry stakeholders. The analysis phase comprised of through requirement analysis, review of technology building blocks like RFID and barcode. Experience of the author was beneficial for analysis and design of system architectures. Figure 1-1 Research approach Experience Requirement Gathering Business Drivers Analysis of System Technology Options Analysis of System Architecture Cost Analysis Legislative Drivers Survey Strategy Experience Recommendations Future Work 1-16 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

17 Also, cost analysis methods were used to determine the right strategy for adoption. Survey was sent out to the industry stakeholders, interviews were held with technology solutions providers, and face to face meetings were held with organizations responsible for standardization of architectures. The next phase was to gather all this information, and formulate set of recommendations to be adopted. Also during this process, future work tasks were identified Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

18 Chapter 2 System Requirements: A Definition 2.1 Background Counterfeiting of drugs has been a problem that has gained attention in the recent years. In United States, various Federal and State based initiatives have been launched to tackle the problem of counterfeiting. Additionally, global efforts are underway to create a network of secure supply chain pharmaceutical industry. Due to its impact on patient health, safety of patients, and also the damage caused to brand names, regulatory agencies together with the pharmaceutical corporations are investing time and money, for a comprehensive resolution and timely rectification of the problem. 2.2 Counterfeiting According to Centre for Disease Control (CDC), counterfeited drugs are drugs that are not authentic and have been manufactured using incorrect quantities, or incorrect ingredients, to either reduce the potency, or nullify the potency of drugs altogether. Addition of harmful ingredients could also lead to counterfeiting, and may cause serious health affects amongst the patient population. As counterfeiters have started working cross borders, the counterfeited drugs have become difficult to identify, and have become a public health risk for people across all communities and borders. According to Food and Drug Administration (FDA) (Figure 2-1), the number of drug cases opened by the Office of Criminal Investigation (OCI) has arisen sharply in the past 5-7 years. Figure 2-1 Counterfeit drug cases (FDA) [Source: US Food and Drug Administration] 2-18 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

19 The impending problem of counterfeiting, has led to increased stakeholder interests to resolve the problem at hand. 2.3 Anti-counterfeiting Anti-counterfeiting refers to the measures taken to prevent counterfeiting of drugs. According to (Food and Drug Administration, 2009) report, comprehensive measures need to be taken to prevent counterfeiting of drugs. Some of the measures recommended by the report are: 1. Implementation of new technologies to protect drug supply chain. 2. Adoption and enforcement of anti-counterfeiting laws and regulations by various US states. 3. Increase in criminal penalties to deter counterfeiting 4. Adoption of secure business practices by all participants in the drug supply chain 5. Education of consumers, patients and health professionals. 6. Collaboration with global stakeholders to prevent global counterfeiting of drugs. 2.4 Requirements Overview Requirements gathering, its definition and subsequent analysis are an integral part of system engineering projects. This section of the document details the key stakeholders, requirements of e- Pedigree system, analysis of the stakeholder interviews and commentary, and use-cases of the system. 2.5 Stakeholder Identification Stakeholders are individuals, groups or institutions who have a vested interested in the outcome/implementation or the approach taken in a project or a system. Stakeholder interests should be considered in defining the goals of a project. (Crawley). A typical supply chain structure in the pharmaceutical industry is shown in Figure 2-2. The structure and the simplified operation of the chain attempts to identify the key stakeholders of the system. As shown in Figure 2-2, and according to (Health Strategies Consultancy LLC, 2009), pharmaceutical manufactures (M) manage the distribution of drugs from their facilities to wholesale distributors and in some cases directly to pharmacies (P), retail pharmacy chains, health plans and hospital chains. Manufactures may also make direct shipments to Government agencies and plans, like Veteran Affairs (VA) and Vaccines for Children (VFC). Manufacturers largest 2-19 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

20 customers are wholesale distributors (W). Manufactures play an important role in the safety of the pharmaceutical supply chain. They provide labeling of products in an effort to identify the drugs produced within their manufacturing location. As shown in Figure 2-3, Wholesale distributors purchase pharmaceutical products from manufacturers and make shipments to a variety of customers like pharmacy chains, through retail and mail orders, nursing homes, long-term care and other medical facilities. Medical facilities include community clinics, physician offices and diagnostic labs. Some of the wholesalers specialize in the sale of special products like biologics 2. According to (Health Strategies Consultancy LLC, 2009), in the past, wholesale distributors confined their distribution operations to those of a traditional distributor, and formed the link between pharmacies and manufactures. But in the recent times, wholesale distributors have entered into specialized services. They are engages in drug repackaging, electronic order services, reimbursement support and drug buy-back programs 3. 2 Biologics include a wide range of medicinal products such as vaccines, blood and blood components, allergenics, somatic cells, gene therapy, tissues, and recombinant therapeutic proteins. Biologics can be composed of sugars, proteins, or nucleic acids or complex combinations of these substances, or may be living entities such as cells and tissues. [source: Wikipedia] 3 Drug buy-back programs are run by manufactures and facilitated by distributors. This allows pharmacies to stock up near expiration drugs, and return the unused stock back to the manufacturers through the distributor Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

21 Figure 2-2 Simple Supply Chain Structure 2-21 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

22 hospital Wholesale Distributor (W) Community Clinics Pharmaceutical manufacturer (M) Distributor (D) hospital pharmacy Wholesale Distributor (W) Health centers Government agencies (VA, VFC) Health centers Figure 2-3 Complex Supply Chain Structure The above two structures highlight some of the key stakeholders involved in the pharmaceutical supply chain system, namely, manufacturer, wholesale distributors, hospitals, pharmacy, health centers, community clinics, and government agencies. Pharmacies, health centers and government agencies form the last tier of the supply chain. Pharmacies are responsible for stocking up the prescription drugs, and their dispending to the customers. Pharmacies maintain adequate levels of stock of drugs to meet a pre-determined customer service level. As outlined above, there are various kinds of pharmacies in the supply chain. They are independent pharmacies, chain-drug stores, pharmacies in super-markets, mailorder pharmacies. Some purchase drugs from wholesale distributors while some purchase it 2-22 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

23 directly from the manufacturers. There are specialty pharmacies which specialize in dispensing of drugs like biologics. Table 2-1 Stakeholder(s) and Stakeholder Groups Stakeholders Large Manufacturers Manufacturers of Biologics Stakeholder Group Anticounterfeiting interest Cost Increase interest Manufacturer High High Pfizer Example PPTA members Distributors Distributor High Low (shortterm) Large Distributors Decrease (long-term) McKesson, Baxter Retail Pharmacy Dispenser High Low Walgreen Hospital Pharmacy Large Solution Providers Small Solution Providers Technology Solution Providers High Oracle, IBM SupplyScape State Regulatory Agencies Food and Drug Administration High Medium (short-term) Low (longterm) California Board of Pharmacy Florida Board of Pharmacy Patient Groups Patient Groups High None Insurance Companies Insurance Companies Low None Shipping companies Logistics Provider Low Low Fedex Ups 2-23 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

24 2.6 E-Pedigree Requirements and Drivers As of today, there are both Federal and State laws that shape the e-pedigree requirements landscape. California Board of Pharmacy (Ca BOP) came up with strict e-pedigree requirements, and mandated unique serialization on every saleable unit of drug in the State of California. Drug sale units sold today have an expiration date and a lot number. The implementation of the laws would require addition of a serial number on these units. To better understand the requirements of the e-pedigree systems, a comprehensive requirements analysis of the regulatory and the business requirements was performed. The following sections detail the high level requirements, understanding of which were essential for strategic technology and business recommendations California Regulatory Requirements California s Board of Pharmacy has outlined the high level requirements for the pharmaceutical drug pedigree s composition and the functional requirements associated to its creation and update. The following sections detail these high level requirements Definition of Pedigree According to (Pharmacy, California Business and Professions Code - section 4034), Pedigree means a record in electronic form containing information regarding each transaction resulting in a change of ownership of a given dangerous drug, from sale by a manufacturer, through acquisition and sale by one or more wholesalers, manufacturers, or pharmacies, until final sale to a pharmacy or other person furnishing, administering or dispensing the dangerous drugs. The pedigree shall be created and maintained in an interoperable electronic system, ensuring compatibility throughout all stages of distribution Structure of e-pedigree According to (Pharmacy, California Business and Professions Code - section 4034), a pedigree shall include ALL of the following information. The source of the dangerous drug, including the name, the federal manufacturer's registration number or a state license number as determined by the board, and principal address of the source. The trade or generic name of the drug, the quantity of the dangerous drug, its dosage form and strength, the date of the transaction, the sales invoice number, the container size, the number of containers, the expiration dates, and the lot numbers Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

25 The business name, address, and the federal manufacturer's registration number or a state license number as determined by the board, of each owner of the dangerous drug, and the dangerous drug shipping information, including the name and address of each person certifying delivery or receipt of the dangerous drug. 1. A certification under penalty of perjury from a responsible party of the source of the dangerous drug that the information contained in the pedigree is true and accurate Change of Ownership As per (Pharmacy, California Business and Professions Code - section 4034) and the change of ownership requirements for documenting e-pedigree, a single pedigree shall include every change of ownership of a given dangerous drug from its initial manufacture through to its final transaction to a pharmacy or other person for furnishing, administering, or dispensing the drug, regardless of repackaging or assignment of another National Drug Code (NDC) Directory number Tracking Level and Granularity Per California, Board of Pharmacy s directive, a pedigree shall track each dangerous drug at the smallest package or immediate container distributed by the manufacturer, received and distributed by the wholesaler, and received by the pharmacy or another person furnishing, administering, or dispensing the dangerous drug Returns and Re-packaging As per California Board of Pharmacy, any return of a dangerous drug to a wholesaler or manufacturer shall be documented on the same pedigree as the transaction that resulted in the receipt of the drug by the party returning it Audit and Inspection As per (Pharmacy, California Business and Professions Code - section 4084), inspectors can inspect any drug or device which is believed to be adulterated, misbranded, or counterfeit. The California law does not however, detail any specific requirement for the e-pedigree system to furnish the e- Pedigree transaction history for inspection needs. The above, rather brief list, contains the key provisions and requirements of the California law Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

26 2.6.2 Federal Requirements In the month of April , Congressman Buyer and Congressman Matheson introduced the bill H.R. 5839, commonly known as Safeguarding America's Pharmaceuticals Act of 2008'. According to this bill 5, U.S Food and Drug Administration should implement a common and systematic framework for uniform implementation of e-pedigree systems across the nation. This move was primarily to ensure that there are no system related loopholes, or interfacing issues that would prevent a complete stoppage of issues of adulteration, diversion and other forms of counterfeiting of drugs. The bill also laid out track and trace requirements for the entire pharmaceutical supply chain industry. The following sections detail the high level requirements listed in the bill Tracking Level and Granularity As per H.R. 5839, sec 5 (A) i, no later than 18 months after the enactment of the Safeguarding America s Pharmaceuticals Act of 2008, Secretary shall submit a report evaluating the feasibility and operational efficiency of adopting security technologies like RFID/Barcode nanotechnology or other promising track and trace technology throughout the prescription drug supply chain. Contrary to California Board of Pharmacy laws and regulations surrounding e-pedigree system, this section of the bill, lays out a full track and trace requirement for the supply chain. The report shall also assess the cost-effectiveness and benefits of such applying such technologies to item, case and pallet level Unique Serialized Identifier As per H.R. 5839, sec 5 (A) (iii), no later than March 27, 2010, Secretary shall announce the development of standardized numerical identifier Risk based System As per H.R. 5839, sec 5 (B) (i), no later than March 27, 2010, Secretary shall develop 1) the criteria for determining whether a drug is at high risk for counterfeiting or diversion 2) A list of prescription drugs that are at high risk of diversion of counterfeiting. No more than 18 months after the publication in the Federal Register, manufactures producing the high risk drugs shall apply a 4 To amend the Federal Food, Drug, and Cosmetic Act to improve the safety of drugs, Mr. BUYER (for himself, Mr. MATHESON, Mr. ROGERS of Michigan, and Mr. GENE GREEN of Texas) introduced the following bill; which was referred to the Committee on Energy and Commerce. The bill is also known or cited as Safeguarding America's Pharmaceuticals Act of 2008' Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

27 standardized unique numerical identifier. Other drugs shall follow the serialization timetable according to the guidelines published by the Secretary. Passage of this bill would imply a risk based approach to handling the needs of anti-counterfeiting Track and Trace System As per H.R. 5839, sec 6, the Federal Food Drug, and Cosmetic Act (21 U.S.C. 353),shall be amended. As a result of this amendment, there will be drug identification and tracking system through which manufacturers, distributors, wholesalers and dispensers will be able to authenticate the distribution history of any prescription drug which has a unique identification number Standards As per H.R. 5839, sec 6, FDA shall be responsible for establishing standards for interoperable databases through which manufacturers, distributors and dispensers would be able to authenticate the distribution history Patient Privacy The e-pedigree implementation will be compliant to Health Insurance Portability and Accountability Act of 1996 (HIPAA) Uniform National Standards After enactment of the bill, no State may establish its own rule regarding distribution history, unique serial numbers, or drug identification and tracking systems. This section of the bill lends to the uniformity of the standards, and will create a nationwide standardized implementation of the e- Pedigree system International Requirements World Health Organization (WHO) has recognized that counterfeiting of drugs is an international health problem, and a special task force, IMPACT has been created to deal with the problem. At an international level, IMPACT recognizes that there is lack of co-ordination amongst stakeholders, and any kind of a systemic technological intervention should allow global exchange of information to detect and prevent counterfeiting. Due to the global nature of the problem, there are various international needs and requirements to have a global information sharing system. This kind of a capability should be accommodated in a comprehensive e-pedigree, drug identification and Track and Trace solution Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

28 2.6.4 Business Drivers In many industries, and including pharmaceutical industry, firms that are part of the supply chain system hold inventories (Simchi-Levi, Kaminsky, & Simchi-Levi, 2008). Managers spend time to effectively manage the supply chain by reducing their inventory levels. Some of the benefits related to e-pedigree solutions have been listed below. One of the biggest business drivers for the e-pedigree system is the motivation of supply chain stakeholders, primarily distributors, to implement the data sharing and management systems. This is beyond the regulatory and compliance needs as laid out by the FDA or the California/Florida BOP. Effective data sharing and management across the supply chain, would help in effective inventory management. This also leads to improved service levels, and reduction in carrying costs (Center for Healthcare Supply Chain Research, 2009). Prevention of counterfeiting also helps in brand enhancement of manufacturers Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

29 Chapter 3 System Requirements Analysis: Industry s Emerging Response 3.1 Overview There have been numerous published responses to California s Board of Pharmacy s e-pedigree directives. These responses and reports have been contributed by pharmaceutical drug distributors, drug manufacturing companies, associations and groups of pharmaceutical industry firms and lastly, the technology and solution providers in the e-pedigree space. To better understand the implications of the high level requirements published by the California Board of Pharmacy, and to delve into various business and technology strategies pertinent to the United States firms affected by the California legislature, we have analyzed the approaches as suggested by the responses of key players to the FDA request for information. It is imperative to mention that there is no broad consensus amongst the various stakeholders for a unified and standardized approach to the systemic problem of anti-counterfeiting and the emerging responses to e-pedigree implementation. In the next steps of this effort, MIT will further explore these various standardized and non-standardized approaches being suggested, and undertake the design of a system that best meets the requirements of the California law for member companies of the PPTA. The following section of the document attempts to highlight the key solutions/strategies which are relevant for consideration of ANY e-pedigree solution for the industry. 3.2 Industry Analysis In order to come up with a standardized approach to e-pedigree system, Federal Drug Administration (FDA) released dockets to invite comments from the industry. This was to ensure that the various stakeholders are in agreement of the technologies and standards associated with the system, in a direct or indirect way. Comments were received from manufacturers, distributors, large and small, pharmacies, and technology solution vendors. Comments received from McKesson, California Board of Pharmacy, Cardinal Health and technology vendors like Oracle and SupplyScape were reviewed. After analysis of the comments, it was clear that There was no consensus amongst the stakeholders on a unified common approach to implement e- Pedigree system. There were no ratified standards in place for implementation of the system. There were multiple architectural options available Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

30 Table 3-2 lists the comparative information of the industry stakeholders. The analysis was performed based on the commentary posted by the industry. Most players in the industry clearly support the GS1 standards for the Standard Numerical Identifier. In particular, the California Board of Pharmacy strongly encourages the FDA to adopt the GS1/EPCglobal identifier Global Trade Item Number (GTIN). The adoption of SGTIN-96, which is the version applicable to serialization of drug products using RFID, is particularly encouraged by the California Board. This standard allows the incorporation of the NDC into the SNI and that approach is also supported by most players within the industry. Most respondents to the FDA did not support including lot and expiration data in the identifier but preferred having that information separate. In terms of the data carrier technology, the California Board, distributors and HDMA strongly support RFID. Amgen and the Biotech Industry Association raised substantial concerns regarding the impacts of radio energy waves on biologics. Both strongly urged the FDA to sponsor research into this area. This could in fact be a key sticking point in implementation. It is clear that no one favors an RFID based system for most prescription medicines and a 2D data matrix for biologics. This would require tremendous duplication of effort in terms of RFID readers and 2D scanners as well as the interoperable data systems. Pharmaceutical manufacturers, distributors and technology solution providers have also come up with recommended RFID tag standards. Table 3-1 Industry recommended RFID and Bar code standards Item Level Case Level (Homogenous) Case Level (Mixed) Pallet Level RFID format RFID UHF Gen 2; SGTIN-96 format RFID UHF Gen 2; SGTIN-96 format UHF Gen 2 with a SSCC-96 encoded EPC value. RFID UHF Gen 2 with a SSCC- 96 encoded EPC value. Alternative format GS1 Data Matrix, ECC200 A1(01) + A(21) data encoded Human readable A1(01) + A1(21) Linear bar code with GS1 Code 128 encoding concatenated AI (01) GTIN + AI (21) serial number for cases large enough to have linear bar codes. The GTIN should have the NDC encoded. Bar Code with Linear GS1 Code 128 encoding AI(00) SSCC-18. Linear GS1 Code 128 encoding AI(00) SSCC Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

31 Table 3-2 Emerging Industry Response Comparison Distributors California Board of Pharmacy Characteristic (Recognizable vs Random) McKesson NDC + manufacturer s serial number Cardinal Health manufacturer s serial number + unique serial number Product Type Header No No Uniqueness Internal serial number management system Internal serial number management system Level of SNI Item, Case and Pallet Item, Case and Pallet Readabilit y Machine, Human (optional) Machine, Human (optional) Lot Number/ Batch Number Not included Not included Pharma Manufacturer Standards and Technology Providers HDMA NDC + manufacturer s serial number Pfizer NDC + manufacturer s serial number GS1 SupplySc ape Oracle Structured data format. (No mention of NDC) Unique number (No mention of NDC) manufacturer s serial number + unique serial number No No No No No Internal manufacturer serial number management system Internal manufacturer serial number management system Serial number managed by manufacturer Serial number managed by manufacturer Item, Case and Pallet Item, Case and Pallet Item, Case and Pallet Item, Case and Pallet Machine and Bar Code Machine and Bar Code Machine and Human Machine and Bar Code Machine and Human Not included Not included Not Included Not Included Not Included 3-31 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

32 Chapter 4 Technology: Building Block Solutions and Standards One of the key goals of the project, and the pharmaceutical industry is to outline the technology and the architecture to meet the requirements of anti-counterfeiting and e-pedigree. To be able to architect a solution that would meet the goals set forth earlier, it is important that we delve into the fundamentals or the building blocks of the technology. Additionally to be able to understand how these building blocks will fit to form the architecture, we will also review the standards that have been implemented till date, or are being formulated for an effective integration of the technologies involved. 4.1 Serialization Both Federal and California Board of Pharmacy s requirements for e-pedigree require pharmaceutical drugs to have a unique serial number. The process of affixing a unique identification number to every item is called serialization. The serialized number itself could be stored in a Radio Frequency Identification (RFID) tag, a bar code, or on the package itself. There are various options available for serialization. This section details the Serialization techniques, the issues revolving around the serialization of drugs, and also the strategies and recommendations for this process Serialization Standard Serialization of unique numbers is based on an encoding standard. The standard defines the way in which the information is stored or encapsulated in the unique numerical identifier (UNI) or Serialized Numerical Identifier (SNI). The leading organizing which has contributed towards standardization of the numerical identifiers has been GS1 ( GS1 has created a series of standards in an effort to improve the supply chain system. Standards for identification of an item are Global Trade Item Number (GTIN), Serial Shipping Container Code (SSCC), Global Returnable Asset Identifier (GRAI) and Global Location Number (GLN). Standards for classification are Global Product Classification (GPC). Standards for Information are Global Data Dictionary (GDD) and Application Identifiers (AI) Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

33 Table 4-1 GS1 standards Business Need Identification Information Classification Standard Global Trade Item Number (GTIN) Serial Shipping Container Code (SSCC) Global Returnable Asset Identifier (GRAI) Global Location Number (GLN) Global Data Dictionary (GDD) Application Identifiers (AI). Global Product Classification (GPC) Of all the standards listed, GTIN is of the most importance to us. GTIN numbers can be used for uniquely identifying a product/item in the supply chain. Any item that has a price tag associated with it, and is sellable within the chain can be a candidate for GTIN based serialization. GTIN format will carry the master data, and based on the GTIN number itself, information about the product can be retrieved from a database, a bar code, an Electronic Product Code (EPC) tag or sent through an electronic message (GS1-GTIN). Additionally GTIN numbers can be used globally to identify an item. This lays the foundation for any kind of global item data sharing and exchange. GTIN has been widely accepted in the Fast Moving Consumer Goods (FMCG) sector GTIN GTIN number comprises of a) Company Prefix b) Item Reference Number and c) Check digit. Checkdigit is used for security and integrity validation of the GTIN number. There are 4 versions of GTIN number GTIN-8, GTIN-12, GTIN-13 and GTIN-14. GTIN-8, GTIN-12 and GTIN-13 are used for storing item numbers, whereas GTIN-14 can be used for cases/pallets that contain items which are sellable. Items within cases and pallets cannot use GTIN-14 format of encoding the master data. GTINs are widely being used in businesses. The number can be used to retrieve or store, price information, shipment information, record of sale or product information itself. GTIN can be used in retail stores or warehouses, in GS1 bar code or GS1 EPC tag. 4.2 Digital Mass Serialization Mass serialization is the process of generating unique numeric or alphanumeric number and assigning the number to each saleable unit (item, case or pallet). The numbers can be generated in a sequential, random or pseudo-random manner (Confederation of Indian Industries (CII)). Figure 4-33 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

34 4-1 shows the process of digital mass serialization. Mass serialization codes can be generated by third party solution vendors and transferred to manufacturer. The codes can be grouped in batches, and the generated batch stored in a database, which is maintained by the manufacturer or the technology solution provider. The code can be pre-printed on labels which can be affixed to the product, or the code could be printed directly on the packaging material. These numbers can also be carried by RFID or bar code symbols. The codes are verified by end-consumers or at the point of sale. Codes can be read visually if they are printed directly, and can be read using bar code scanner if the bar code data carrier option is used. 2D bar-codes can also be read by mobile phones that have in-built bar code reader 6. The code can be transferred through text-message, web based portal or through automated telephonic means. The process of authentication involves verification of the number in the database. If the number is present in the repository, then it means that the product is authentic else it is a counterfeited product. Mass serialization, and the resulting verification of the product empowers consumer to verify the product (Confederation of Indian Industries (CII)). In addition to the supply chain stakeholder based security personnel, guarding and validating the authenticity of the drug, a huge customer base is added to the validation group, and thereby increases the vigilance initiatives. The mass serialization system should have business rules to accommodate the following: Flag duplicate validation of the product from multiple consumers. Flag failed authentication of product. 4.3 Digital Mass Encryption Digital Mass Encryption (DME) is very similar to Digital Mass Serialization. However in DME, a database is not required for persistence of unique serial numbers. The unique serial numbers generated are encrypted using cryptographic algorithms. The algorithm is also required for decryption of the encrypted number. This technology was coined by Kezzler AS, a Norwegian company, and has been used by the firm to protect the supply chain from counterfeiting issues. 6 Nokia Mobile barcode reader Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

35 Figure 4-1 Digital Mass Serialization Technology Solution Provider 1. Generation of Unique Numbers Unique Number Unique Number 2. Persistence to Database Database 5. Verification 3. Transfer of Batch Numbers Pharmaceutical manufacturer Wholesaler Distributor Pharmacy 4. Production Process 5. Verification Customers To ensure that the code is not authenticated more than once, business rules should be built into the DME system. However to ensure that regulators or enforcement agencies can authenticate the product, more than once, and also to ensure that their authentication is not counted as a valid authentication, business rules should be built into the system. Multiple failures of authentications should lead to flagging, and thus would provide manufacturers with key information about the counterfeited product. Figure 4-2 shows the high level process to implement a DME system. Both DMS and DME technologies are cost-effective solutions for the counterfeiting issue. The technologies on a standalone basis do not meet the requirements of track and trace, but provide a potent means to prevent counterfeiting cases. Both the technologies can use data carrier options of bar code or RFID, or just the printing of the code on the package itself Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

36 Figure 4-2 Digital Mass Encryption 1. Generation of Unique Numbers Technology Solution Provider Unique Number Unique Number Encryption Encrypted Unique Number Encrypted Unique Number 5. Verification 3. Transfer of Batch Numbers Pharmaceutical manufacturer Wholesaler Distributor Pharmacy 4. Production Process 5. Verification Customers 4.4 Data Carrier Options For any kind of serialization of a unique identifier, we need a data carrier to hold the identifier. Options that have been widely considered for carrying SNI are a) Barcode and b) RFID. In the next few sections, let s look at the standards and types of barcodes available. Also we will closely examine the types of RFID. It would also be important to highlight the differences of the technologies under question Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

37 Barcode GS1 has many types of bar codes, and their applicability depends on the business need. For example, if the barcode is to be scanned at Point of Sale(POS) only, then EAN/UPC symbol should be used. If bar code is to be printed with variable information like serial numbers, lot numbers and/or expiration dates, then GS1-128, GS1 DataBar(RSS), or GS1 DataMatrix should be used (GS1- Barcode). Table 4-2 GS1 Barcode Symbols Business Need Standard Sample [source: GS1] Features Point of Sale (POS) needs and high volume scanning requirements. EAN/UPC Mostly for Retail POS needs Cannot be used beyond POS needs. GS1 DataBar (RSS) GS1-128 (previously known as EAN/UCC- 128) 1. Omnidirectional (for POS) 2. 12/13/8 numeric 3. GTIN-12/13/8 applications 1. Smaller than EAN/UPC and can additional information like lot number, expiration date and serial number. 2. Omnidirectional (for POS) and non-omnidirectional variants. 3. GTIN - 8,12,13,14 1. Good for hard to mark products 1. Can carry all GS1 identification keys. 2. Not omnidirectional aplhanumeric capacity 4. Carries Application identifiers Cannot be used beyond POS needs. Specified for healthcare items. ITF-14 GS1- DataMatrix 1. Can only carry GTIN keys. 2. Can be printed directly on corrugated cartons. 3. Interleaved 2 of Not omnidirectional 4. GTIN - 12,13, numeric 1. Based on scanning using cameras Numeric capacity Alphanumeric capacity 4. Camera based scanning 5. Carries Application identifiers 6. Unique GS1 identifier Composite 1. 2D-linear symbol 4-37 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

38 Component 2. Used with linear bar code like RSS or GS Barcodes have been in used in Consumer goods industry as well as the healthcare industry for quite some time now. As shown in Table 4-3, pharmaceutical manufacturers have been tagging the cases and pallets with linear and in some cases even 2 Dimensional (2D) barcodes. Table 4-3 Manufacturers Barcode Profile Branded/Generic Manufacturer Barcoding Profile in Year 2007 Provide bar coding on finished products (%) 87% Barcode Symbologies Used: Barcode Symbols Provided: Linear (at the case level) 100% EAN/UCC Interleaved 2 of 5 26 Reduced Space Symbology (RSS)/Databar 33 Two-dimensional symbology (at the item level) 4 Data Matrix 4 Other 0 Source: Center for Healthcare Supply Chain Research RFID Serialized numbers can be stored electronically in an RFID. Even though RFID technology has existed for more than a decade, in the past 5-7 years, RFID has gained importance, and has been highlighted as a technology to revolutionize the supply chain industry (Laran RFID, 2004). In , Walmart required top suppliers to tag the shipping creates and pallets with RFID ( David H. Williams, 2004). The tags stored Electronic Product Code (EPC), and were going to be used for tracking of cases and pallets in Walmart s distribution center and as the products were shipped to stores. RFID uses radio frequency transmission to identify tags. The radio based communication happens between a reader, also called an interrogator, and a transponder, which is a silicon chip connected to an antenna. The chip with the antenna is called a tag. Tags are called active tags if they are powered by a battery or a passive tag if they are powered by reader field. The communication 4-38 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

39 frequency used depends on the application and ranges from 125 KHz to 2.45 GHz (Laran RFID, 2004). Table 4-4 lists the RFID tags operating under different frequencies. UHF tags and HF tags are well suited for the pharmaceutical supply chain product identification requirements. Table 4-4 RFID frequencies Low Frequency High Frequency Ultra High Microwave (LF) (HF) Frequency (UHF) Read Range < 0.5m ~1m ~4-5m ~1m Power Passive Passive Active and Passive Active and Passive Source Usage Access Control Smart Cards, Payment, Item Level Tagging Supply chain case and pallet tagging, toll collection Toll Collection, Real time location of goods Data Carrier Comparison The two data carrier options are constantly compared for their advantages and disadvantages in supply chain item identification implementations. Table 4-5 lists some of the key differences that should be considered by policy and decision makers before adoption of one technology over the other. Table 4-5 Bar Code and RFID Comparison Bar Code RFID Readability Line of Sight Technology Tag information can be scanned from various angles Bar codes are not re-writable RFID tags are re-writable Cannot be read in bulk Can be read in bulk Can limit the speed of Have higher operational efficiency operations Labor intensive Not labor intensive Cost Cost of bar code ~1-2c Cost of RFID tag is ~7c-15c and up RFID Systems A typical RFID tag based system is show in Figure 4-3. The internal memory in tags, also called EEPROM, is used to store the identification number, or some amount of manufacturing data for the item. When the items tagged with RFID tags are passed through readers, be it shelf or handheld reader, the tags transmit the data back to the reader. The reader collects the information and sends 4-39 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

40 it to the controller or the event manager. Note that scanning of the item data is considered as one type of an event. Multiple readers can be connected to the controller, and can send it continuous read information of the tags. The reader, tag data and the tag itself are classified as the Physical Layer (show in green). Thus the, physical layer is primarily responsible for the reading and writing of tag information from and to the tag itself. Controller and Event manager are classified as the Middle Layer of the system. Middle layer (show in blue), also has the repository or the information server, which stores the tag data. After the tag data is received the filter component of Middle Layer filters out duplicate reads, and sends the unique tag information to the logger. The logger is responsible for persistence of the tag information in the database. Also shown in the RFID based system is the business layer (grey color), which is nothing but the business software applications like Warehouse Management System (WMS), Supply Chain Management system (SCM) and Inventory Management System (IMS). Business Layer and the Middle Layer interface and interact through the Enterprise Application Integration (EAI) layer. EAI layer forms the connector architecture of the overall system under consideration, and allows third parties, stakeholders and trading partners to exchange information for their business needs Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

41 Figure 4-3 Typical RFID Supply Chain System 4-41 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

42 4.5 Electronic Product Code (EPC ) and EPC Standards One of the key deterrents for adoption of RFID technology has been the cost of the tag. In the year 1999, Auto-Id lab was found at MIT, with an objective to make the tag architecture simpler and less expensive. The group completed its task and in the year 2003, transferred its technology and work to EPCGlobal. Now, let s study the EPC code, and standards and architectures associated with EPCGlobal EPC Electronic Product Code is similar to UPC, and ranges from 64 bits to 256 bits. Figure 4-4 shows the structure of an EPC number. The key difference between EPC and UPC is that EPC has bits allocated to store a unique serialization number/identifier. Due to this, EPC is well suited for item tagging and identification needs in the supply chain. EPC Manager contains the manufacturer s number. Object class bit storage is used to represent the class/group of an item. This is similar to the Stock Keeping Unit (SKU) number. Header represents the length of the code itself. Header of 01 represents 96bit EPC number. Figure 4-4 EPC Structure EPC Number Header EPC Manager Object Class Serial Number 0-7 bits 8-35 bits bits bits EPC Infrastructure and EPC Information Services (EPCIS) EPC allows items and products to be uniquely identified. Electronic Product Code Information Services (EPCIS) lays out the standard for an infrastructure that allows sharing of EPC, and information derived from EPC s unique identifier. One of the key goals of this standard is to allow the data sharing across trading partners and enterprises, and also within an enterprise. EPCIS defines the data sharing standards, the capture and the query standards for storing and retrieving EPC data, but EPCIS does not specify the data storage or persistence standards or even standards for service operations (EPCGlobal-EPCIS-1.0 Standard). These service operations are typically the 4-42 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

43 meat of the middle layer of enterprise architectures. While custom implementations of database, persistence strategies and the middle layer, fuels competition amongst technology solution providers, standardization of interfaces enables ease of data sharing and ensures compatibility amongst various stakeholders of the information gathering and sharing. Figure 4-5 shows high level use-case and standards map of the EPC information services. Step 1 denotes an EPC event, whereby a product is shipped from the manufacturer s location to the distribution center, either owned by the manufacturer or another trading partner in the chain. The item is tagged with EPC code, either in the form of GS1 s GTIN or SSCC code. EPC Events represent the What, Where, Why and When of the product information. What component of the code, defines the product and helps in identification and retrieval of product information. Why component defines the business step or the operation, for instance the shipping/receiving or loading events. Where component defines location of the product. When component defines the time of the event occurrence. Table 4-6 EPC Data elements What Data Element Information Example Product Information EPC Business Transaction Why Business Event Business Step (business operation taking place at the time of the event) Disposition (status of the product after the event) Where Location Read Point location Business Location When Time Event Time Record Time Shipping, Receiving, Loading Sellable, In Progress, Destroyed 4-43 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

44 Figure 4-5 EPC Infrastructure 4-44 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

45 4-45 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

46 4.5.3 EPCglobal Architecture Framework EPCglobal architecture framework is a collection of interrelated standards for hardware, software and data interfaces together with core services with a common goal to enhance the supply chain through the use of Electronic Product Codes (EPCs). Figure 4-6 describes the flow of events in an EPCIS based application, capturing data from the repository, and receiving access requests from an EPCIS based requesting application. The diagram depicts the standards, the protocols and the various key components of a typical EPCIS application to capture and query EPC information. Reading tag data is the first step of the EPC information collection. Readers collect the data, and send the raw data to the Filtering and Collection components of the middle layer. Filter and Collection interface, also called the ALE interface is responsible for transmitting the filtered data to the capturing application. As described earlier in the RFID infrastructure section, filtered data is the data that has the duplicates excluded. The Capture application forms the business interface to applications requiring the tag data. The Capturing application is business aware and implements the business use-cases. Some examples of Capturing applications in a supply chain are conveyer belt related application or a shipping and loading application. In a shipping and loading application, the Capturing application may be associated with more than one Filtering and Collection systems. This leads to complex business rule implementations for the application. The capturing application then forwards the tag data to an EPCIS enabled data repository. EPC global architecture framework (EPCGAF) works with many EPCIS interfaces. These are, the EPCIS Capture Interface, which allows capturing of the real time data, either from the Capturing application to the data repository or real-time push of data to trading partners. EPCIS Query Control Interface is used to retrieve and look-up EPC related data in the EPCIS enabled repository. EPCIS Accessing applications are nothing but special business applications. These applications compose the business layer. This was covered in the RFID system architecture, and illustrated in Figure 4-3. An example of EPCIS Accessing applications is Warehouse Management Systems (WMS). Applications that have the high level architecture similar to shown in Figure 4-6, but are outside the network of enterprise s architecture and location are called Trading Partners Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

47 Figure 4-6 EPCglobal Architecture Framework 4-47 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

48 4.6 E-Pedigree and E-Pedigree Standards As outline in the Also, cost analysis methods were used to determine the right strategy for adoption. Survey was sent out to the industry stakeholders, interviews were held with technology solutions providers, and face to face meetings were held with organizations responsible for standardization of architectures. The next phase was to gather all this information, and formulate set of recommendations to be adopted. Also during this process, future work tasks were identified Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

49 System Requirements: A Definition chapter, E-pedigree is one of the recommended Federal and State solutions to lower counterfeiting incidents in United States. E-pedigree requires stakeholders to electronically authenticate the receipt or shipment of drugs, during the process of sell/buy or transport. Due to the regulations set forth by California Board of Pharmacy, and the impending need of a standardized approach to e-pedigree implementation, EPCglobal came up with standards to be followed for any kind of e-pedigree system. To satisfy the requirements listed in California Board of Pharmacy law, two kind of e-pedigree implementations have emerged. One is the document model, which is based on XML implementation, and the other event data based implementation. As shown in Figure 4-7, there is a transfer of xml document between trading partners. Manufacturer creates the initial XML root document, and electronically sends the document to the Wholesaler. This process continues through the supply chain, till the drug item/case reaches the end-point in the supply chain, namely the dispenser or the pharmacy. At every node in the chain, the history of the distribution of the item can be easily ascertained from the xml document. The XML document itself has a nested structure, which delineates the nodes and the distribution information at each node. Additional information about the XML document is detailed in the explanation of the standards for e-pedigree. Figure 4-7E-Pedigree - Simplified Document Model XML XML XML M W D P Product shipment Product shipment Product shipment Event based models use the business events, and related EPC information to compile the e- Pedigree. A simplified model is show in Figure 4-8. All supply chain trading partners, manufacturers (M), distributors (D), wholesalers (W) and Pharmacy (P), store EPC event data information. No trading partner has the distribution history in its entirety. Information storage is distributed across the stakeholders. To generate the e-pedigree, distribution history of the drug is to be determined. This is done by sending query requests to a directory service, which locates the history of the drug through the chain, and aggregates the data or sends pointers to the query service such that it can do 4-49 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

50 the aggregation by making explicit EPC data related calls to the trading partner. This kind of abstraction ensures that the proprietary nature of data resides with the parties for which it holds the maximum value, and unnecessary data sharing is not required. This model is something that is of high relevance to the distributors of the chain. Figure 4-8 E-Pedigree - Simplified Event Data Model Directory Service EPC Data EPC Data EPC Data EPC Data M W D P Product shipment Product shipment Product shipment Based on these two high level model implementations, two standards have emerged for E-Pedigree implementations. These are Drug Pedigree Messaging Standard (DPMS) and EPCIS based standards. According to (EPCGlobal), DPMS standard ratification complies with California Board of Pharmacy e-pedigree requirements. DPMS was initially coined by SupplyScape and due to a joint collaboration between SupplyScape and EPCglobal, the standard was released for industry usage and adherence to regulatory compliance Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

51 4.6.1 Drug Pedigree Messaging Standard (DPMS) After its initial document creation, DPMS looks like an XML tree structure. XML tree can be appended with child nodes, and can thereby encapsulate the distribution history information. DPMS standard does not specify how pedigree document is transferred from one trading partner s enterprise system to another. However, whatever the means of communication chosen, the pedigree document s security and integrity should be maintained. The document shall be transferred as an immutable document, and the document shall conform to a push based transfer. The Initial Pedigree, which takes the innermost content of the pedigree document can take two forms. The forms have been shown in the following diagram Figure 4-9. Initial pedigree, which is initiated by the manufacturer, or the repackaged Pedigree, which could be initiated by a wholesaler for a repackaged item, comprises of Item information, product information and the serial number, which acts as the unique identifier of the item/case/pallet. Figure 4-9 DPMS - Innermost Component Item Info initialpedigree Item Info Product Info Serial Number Innermost Pedigree form 1 lot quantity Product Info Drug Name Manufacturer Repackaged Pedigree Item Info Product Info Serial Number Innermost Pedigree form 2 Nested information breakdown Outside of the innermost component is the pedigree wrapper element. Pedigree element contains a signed pedigree which represents the chain of custody of the drug under question. At any given point in time, the pedigree element contains the shippedpedigree or receivedpedigree element, together with the signature for shipment or receipt of the pedigree. As shown in Figure 4-10, Manufacturer makes a material shipment of cases or pallets to the Wholesaler. The initial pedigree component is encapsulated within the shippedpedigree element. Wrapper pedigree element has a signature element from the Manufacturer. After the electronic transfer of the pedigree document to 4-51 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

52 the Wholesaler, the initial pedigree document is wrapped up with the receivedpedigree and the pedigree elements. Figure 4-10 DPMS - Manufacturer to Wholesaler transfer initialpedigree Item Info Product Info Serial Number pedigree receivedpedigree (id = Rped-1) Document Info pedigree shippedpedigree (id = Sped-1) Document Info Manufacturer pedigree shippedpedigree (id = Sped-1) Document Info initialpedigree Item Info Product Info E-Pedigree Transfer initialpedigree Item Info Product Info Serial Number Transaction Info Item Info Signature Info Signature(Mfg. signs Sped-1) Serial Number Transaction Info Item Info Product shipment Signature Info Recipient Info Signature(Mfg. signs Sped-1) Signature Info Signature(Mfg. signs Sped-1) Wholesaler This process of pedigree creation at every stage of the supply chain continues till the drug reaches the pharmacy or the end point of the chain Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

53 4.7 Architectural Standards Serialization and data carrier technologies and standards, and also the e-pedigree systems and technologies form the building blocks of any kind of architectural implementation of e-pedigree solutions. E-pedigree architectural standards can be categorized into 4 types. Table 4-7 e-pedigree Architectural standards Type of Model Model A Model B Model C Model D Standard DPMS only DPMS + EPCIS (integration) DPMS + EPCIS (interoperability) EPCIS only The models represent various combinations of the two fundamental e-pedigree standards, namely DPMS and EPCIS. Additionally, the combinations have varied levels of integration and interfaces implementation. Architectures also differ in ease of implementation, maintenance, cost of implementation and scalability. It is important to mention, that from a standards perspective, development and evaluation efforts are underway for the EPCIS models to insure adherence to the regulatory compliance requirements. The following section attempts to detail the architectural standards DPMS only (Model A) Model A provides a pedigree compliance model for sending and receiving e-pedigree data using the DPMS standard. In this model, pedigrees are created and transmitted using only DPMS. With itemlevel serialization implemented at the manufacturer, the DPMS-only system can meet the California requirements and provide a straightforward model for adhering to the outlined requirements. Figure 4-11 depicts high level pedigree workflow across the stakeholders of a pharmaceutical supply chain network. The manufacturer initiates the workflow creating the pedigree. This pedigree is then sent to the wholesaler in a DPMS message format. The wholesaler receives the pedigree and appends the wholesaler pedigree information (receiving and shipping) to the original message structure. As the product moves from the wholesaler to the retailer, the DPMS message is sent from the pedigree application at the wholesaler end to the retailer. Only the retailer has the final and complete pedigree Ankur Sinha, Systems Design and Management (SDM), M I T May 2009

54 The pedigree workflow requires the trading partners to establish a means of transport mechanism and have a trading partner agreement and decision for each connection. The transport could be through means of a point-to-point connection. Some of the standard protocols used for the transfer are AS2, FTP, HTTP(s), fax and . AS2 is the recommended standard and is the most commonly used standard for the transport. Model A is a compliant model with all known US pedigree laws, and represents the baseline understanding of the pedigree requirements. This model however requires all trading partners to have the capability to receive and send DPMS messages which is almost trivial since it can be accomplished via or EDI. Figure 4-11 Architectural standard - Model A DPMS + EPCIS (integration) (Model B) Model B provides a pedigree compliance system for sending and receiving pedigree data electronically using, only DPMS messages. In this sense, the model B system is similar to Model A. The difference in Model B is that for some participants, the pedigree creation and updating data may be obtained via an EPCIS system that feeds the relevant data into a DPMS e-pedigree application. Error! Reference source not found.depicts the high level architecture of model B. As illustrated in the diagram, each participant can have two means of creating and updating the e- Pedigree either through a DPMS capture application or through an EPCIS system. For example, as in Model A, the manufacturer s DPMS based e-pedigree application (shown in orange), receives the pedigree data (shown in solid blue), in the form of serialized item information, shipment/receipt information and drug information, directly from the capture application and creates the DPMS e- Pedigree. In the alternative approach, an EPCIS application (shown in red) can receive EPCIS event 4-54 Ankur Sinha, Systems Design and Management (SDM), M I T May 2009