A FREQUENTZ WHITE PAPER: Meeting Traceability Regulations In The World s Two Largest Pharmaceutical Markets Frequentz. All rights reserved.

Transcription

1 Meeting Traceability Regulations In The World s Two Largest Pharmaceutical Markets

2 Introduction John Schultz Regulations mandating the serialization and tracing of pharmaceuticals in the supply chain have been sweeping the world. These mandates were first implemented to fight reimbursement fraud in smaller markets such as Italy and Turkey. The number of markets imposing these requirements continued to grow through the early 2000s until, in 2011, the European Commission enacted the Falsified Medicines Directive (FMD). 1 To protect consumer safety, the FMD required the development and adoption of another regulation that provides details for implementing two types of safety features on all drug packages. This other regulation, published on February 9, 2016 and known as the Delegated Regulation (DR), 2 mandated the addition of a unique identifier in human- and machinereadable forms, along with an anti-tamper device. Enforcement of these regulations is primarily the responsibility of the E.U. Member States, with European Commission oversight and assistance provided by the European Medicines Agency (EMA). In the interim between the passage of the E.U. FMD and the DR, the U.S. Congress enacted the Drug Supply Chain Security Act (DSCSA), 3 signed into law by President Obama on November 27, DSCSA enforcement is primarily the responsibility of the Food and Drug Administration (FDA), with state governments also enforcing some provisions. Remarkably, in the span of five years the world s two largest pharmaceuticals markets have enacted regulations that will have a profound effect on the pharmaceutical supply chain operations of these markets and the companies that operate within them. Generally speaking, the wholesale distributors and pharmacies that operate within these two supply chains do not do business in both the U.S. and the E.U. But many drug manufacturers do. Ideally, manufacturers would like to be able to deploy a single technology solution that enables compliance in these two regions. Both E.U. and U.S. regulatory frameworks must be considered when developing a solution that delivers the highest efficiency at the lowest cost. 4 What follows is our analysis of these two massive pharmaceutical markets that is rooted in our daily involvement in those markets. We attempt to describe the markets, measure the comparisons and emphasize the critical components all leading to an understanding of things you might think about as you implement in the U.S. and E.U.

3 A Direct Comparison: The E.U. vs U.S. Regulations Fortunately, there are many similarities between the pharma traceability regulations in the E.U. and the U.S.. But there are also differences. Meeting both sets of regulations with a single solution requires attention to both the similarities and the differences. Purpose The purpose of both E.U. and U.S. regulations is to protect patients from receiving illegitimate medicines from their physician or pharmacist. While the purpose is the same, the implementations have significant differences, as we will see below. General Approach The differences in operations between the U.S. and E.U. supply chains lead directly to a difference in the general approach taken by each market s pharma serialization and tracing regulations. In light of the number of languages, the amount and importance of repackaging, and the existence of parallel trade in the E.U. market, the FMD/DR protects patients by focusing on the last possible point in the supply chain the point of dispense or administration. The approach is referred to as Authentication at the Point of Dispense, or POD Authentication. It is also referred to as a bookend approach. At the beginning of the supply chain, manufacturers must apply and document unique identifiers on their drug packaging. Then, at the end of the supply chain, pharmacies must authenticate those unique identifiers with the manufacturer prior to dispensing.

4 In the E.U., the FMD establishes a common approach to protecting patients from illegitimate pharmaceutical products an approach each of the member states is obligated to follow and enforce. E.U. member states have the option, up to a point, of creating additional requirements. In the U.S., the DSCSA establishes a single approach, enforced by state and federal governments alike, to protecting the pharmaceutical supply chain from the introduction of illegitimate products. Unlike their counterparts in the E.U., state governments in the U.S. may not create additional requirements that exceed those of the DSCSA. Rollout (Timeline) U.S. and E.U. regulations specify how and when companies in their supply chains must implement their respective requirements. The E.U. FMD/DR will be rolled out in a big bang on February 9, 2019, the date on which drug manufacturers must begin applying a unique identifier to all of their unit-level packages. 5,6 On this date, dispensers in 25 of the 28 E.U. member states must begin authenticating all drugs that have the unique identifier, and must do so before dispensing or administering drugs to a patient. Belgium, Italy and Greece are given an extra six years to begin following the FMD/DR because these countries have existing pharmaceutical supply chain security programs of some kind. In contrast, the U.S. DSCSA defines a long rollout with multiple deadlines and escalating requirements over an 8-year period between 2015 and Key dates include: n January 1, 2015: By this date, all trading partners in the supply chain had to be licensed and could do business only with other licensed trading partners. In addition, drug manufacturers, repackagers and wholesale distributors were required to begin exchanging standardized lot-based transaction documentation whenever drug ownership changed in the supply chain. This last requirement was deferred until May 1, n July 1, 2015: By this date, dispensers were required to begin exchanging the same standardized lot-based transaction documentation as the other companies. This requirement was deferred until March 1, 2016 except for emergency responders, which are exempt until further notice. 8,9 n November 27, 2017: On this date, manufacturers must begin applying the DSCSA unique product identifier to the smallest saleable packages and homogeneous cases of prescription drugs introduced into the supply chain. 10,11 Manufacturers must also begin electronically transmitting the transaction documentation to wholesale distributors and dispensers (except individual practitioners). Manufacturers must offer trading partners a service they can use to verify DSCSA product identifiers at the lot- and serial number-level. 12 n November 27, 2018: On this date, repackagers must begin applying the DSCSA unique product identifier to the smallest saleable packages and homogeneous cases of prescription drugs introduced into the supply chain. Repackagers are permitted to engage in transactions involving only those drugs with a DSCSA unique product identifier. 13 n November 27, 2019: After this date, wholesale distributors are permitted to engage in transactions involving only those drugs with a DSCSA unique product identifier. Wholesale distributors must begin verifying the DSCSA unique product identifier on all saleable returns. n November 27, 2020: After this date, dispensers are permitted to engage in transactions involving only those drugs with a DSCSA unique product identifier. On this date, dispensers must also begin verification of the DSCSA unique product identifier on 10% of any suspect product. n November 27, 2023: On this date, all trading partners must begin operating under the requirements established by the FDA that implement the Enhanced Drug Distribution Security (EDDS) phase.

5 Unique Product Identifier Both E.U. and U.S. regulations require drug manufacturing authorization holders (including repackagers) to apply by a certain date a unique product identifier on every drug package at the smallest unit distributed to pharmacies. Under the E.U. s FMD/DR, the unique identifier is one of the two safety features that must be applied by the manufacturer or repackager to all drug packages. The other safety feature is an antitampering device. The unique identifier is composed of the following data elements that must appear on the product packaging in human-readable form and be encoded into a Datamatrix barcode: 14 n Product code n Unique serial number n National drug registration number (in member states that require one) n Lot number n Expiration date The unique serial number must be generated by a deterministic or a non-deterministic randomization algorithm where [t]he probability that the serial number can be guessed shall be negligible and in any case lower than one in ten thousand. Under the U.S. DSCSA, the product identifier is composed of the following data elements that must applied by the manufacturer or repackager on the product packaging of the smallest individual saleable unit in human-readable form and be encoded into a Datamatrix barcode: 15 n Standardized Numerical Identifier, which is composed of: National Drug Code Unique serial number n Lot number n Expiration date There is no requirement to randomize the serial number, but there is also no prohibition against doing so. Companies wishing to take a consistent approach may choose to randomize in both markets. Verification Both the FMD/DR and the DSCSA require, under certain conditions, that various downstream trading partners verify the unique product identifier. There are, however, some important differences in the definition of verification between the E.U. and U.S. regulations. 16 These differences result in significant variations in implementation. Under the FMD/DR, verification is performed by checking the integrity of the anti-tampering device and comparing the unique identifier with the legitimate unique identifiers that the manufacturer or repackager store in a system of repositories. Companies in the E.U. pharma supply chain have joined together to create a system of repositories known as the European Medicines Verification Organisation (EMVO). This organization has designed and is implementing the system that all members of the E.U. supply chain will use to verify drugs in accordance with the FMD and DR. The EMVO has created a template for use in creating the regional hubs that will hold the data necessary to verify drugs marketed in a given region. Under the DSCSA, verification is performed by determining whether the product identifier affixed to or imprinted upon a package or homogeneous case corresponds to the standardized numerical identifier or lot number and expiration date the manufacturer or the repackager has assigned to the product. Before November 27, 2023 verification may be performed electronically or visually. Beyond that, the DSCSA does not prescribe exactly how this verification may be done. It does require that between 2017 and 2023 drug manufacturers (and repackagers between 2018 and 2023) must respond to verification requests within 24 hours. Prior to November 27, 2023, the FDA will provide guidance on how it may modify verification to support the new EDDS that will begin on that date. FMD/DR verification must be performed by persons authorised or entitled to supply medicinal products to the public at the time the drug is provided to the public. But it may also be performed by wholesale distributors when dealing with medicinal products at higher risk of being falsified.

6 DSCSA verification must be performed by anyone in the supply chain who determines that a drug is suspect. In addition, after November 27, 2019 wholesale distributors (and repackagers after November 27, 2018) must verify all saleable returns. After November 27, 2020 dispensers must verify at least 10% of any suspect product in their possession. Aggregation Aggregation is data that describes parent-child packaging relationships using unique serial numbers for units and all higher-level packaging and shipping containers. It is very useful for allowing companies in the supply chain to understand the units that are contained within those higher-level packages and shipping containers without opening them. For this to be done successfully, the aggregation data must be very accurate. 17 Neither E.U. nor U.S. regulation require the capture and use of aggregation data, although both mention the concept. The E.U. Delegated Regulation allows wholesale distributors to verify at either the item-level or a higher aggregated-code level those products that are at a higher risk of being falsified. This allows for the simultaneous verification of multiple unique identifiers. That is, wholesale distributors may use aggregation data to infer the units they are verifying. 18 The DSCSA mentions only the potential use of aggregation and inference during the EDDS, which begins on November 27, In fact, the DSCSA leaves the decision up to the FDA, which must make its determination after considering input from stakeholders and the public over the next five to six years. However, whether or not aggregation will be allowed or required for compliance at that time may be irrelevant. Larger wholesale distributors have already strongly requested that drug manufacturers provide them with aggregation data to help them meet their November 2019 requirement to verify all saleable returned drugs. 19 Many drug manufacturers have indicated that they intend to provide the data. 20

7 Decommissioning Decommissioning is the act of disassociating the unique serial number from a specific trade item instance. This would typically be done after the item is no longer sellable for example, when the item has been: n Destroyed n Stolen n Lost n Consumed Because of the FMD/DR design, it will be vitally important that all serial numbers used on medicines are ultimately decommissioned after any of those events, including at the point of dispense or administration. 21 One of the checks during the verification process is to determine if the serial number on a product has been decommissioned. Those that have been decommissioned will fail to verify, which is exactly what should happen after the events listed above. 22 Under the DSCSA, decommissioning is not necessary, at least prior to the start of the EDDS phase in The DSCSA s definition of verification cares only about whether the manufacturer actually produced the product in question with the serial number in question. There is no concept in the DSCSA of commissioning or decommissioning serial numbers. After 2023 it is possible and, perhaps, likely that there will be a need for dispensers and others to decommission product serial numbers. But we will not know that for certain until the FDA provides regulations related to the EDDS sometime prior to that phase. 23 Data Exchange Both U.S. and E.U. regulations require the sharing of data that was previously kept private. Under the FMD/DR, no data will be exchanged directly between trading partners. But data will still move. Manufacturers must pass data to the repository system where it can be used to verify the authenticity of a drug at the point of dispense and elsewhere. This data includes all fields of the full unique identifier plus the list of the regions where the manufacturer intends the drug to be marketed. Technically, this is a commissioning event, but the regulation does not use that term. The active status of drugs established in the repositories by a commissioning event will be changed when any party in the supply chain uploads a decommissioning event. Of course, data is also exchanged with the system of repositories whenever a verification event is performed. Under the DSCSA, the data that is exchanged moves from the seller to the buyer whenever a change of ownership occurs within the supply chain. This data includes information about the drug and transaction (Transaction Information, TI ), 24 a statement about the accuracy and completeness of the data exchange (Transaction Statement, TS ) 25 and, in some instances, the history of the previous transactions (Transaction History, TH ). 26 In order to support potential investigations into suspect or illegitimate product, a copy of this data must be retrievable by both the seller and buyer for a period of six years after the transaction occurs. A third party may hold this data on behalf of the buyer and/or seller. After the start of the EDDS in 2023, the exchange of data will change to reflect the architecture the FDA will select over the next few years with the help of stakeholders and the public.

8 Use of GS1 Standards Neither E.U. nor U.S. regulations specify the use of GS1 standards 27 to implement supply chain-wide or individual company requirements. However, both sets of regulations are designed to enable the use of these standards if the parties in the supply chain elect to do so. This can be seen in the definitions of the product code and serial number in each regulation, both of which conform exactly to the way GS1 Global Trade Item Numbers (GTIN) and GS1 serial numbers are designed to work 28,29. Fortunately, the industry appears to be working collectively to make use of these standards for both supply chain-wide and individual-company requirements for serialization. For U.S. lot-based requirements, Electronic Data Exchange (EDI) Advance Ship Notices (ASNs) are widely being used for formatting and exchanging the transaction documentation. 30 For all electronic exchange of serialized data under both regulations, the data format used will conform to GS1 s Electronic Product Code Information Services (EPCIS) standard. 31 In the E.U., the European Medicines Verification Organisation (EMVO) is expected to make their data-communication specification public as soon as beta testing is complete, perhaps in Many companies and organizations in the industry have pressed for EPCIS data formatting, and many expect it to be used. In the U.S., the industry has strongly embraced the use of EPCIS to format the serialization-based data that will be exchanged as early as as part of DSCSA compliance. Conclusion Manufacturers who market drugs in both the European Union and the United States must soon comply with both the Falsified Medicines Directive/Delegated Regulation in the E.U. and the Drug Supply Chain Security Act in the U.S. Manufacturers must take into consideration the differences between the two regulations highlighted in this paper. This is especially true when the same packaging lines will be used to package products for both markets. There are enough similarities between the required E.U and U.S. unique product identifiers that these manufacturers should find it possible to comply with both regulations by implementing a single solution. That solution must make extensive use of GS1 standards, particularly EPCIS. Works Cited 1. European Commission, DIRECTIVE 2011/62/EU OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL, Official Journal of the European Union, June 8, 2011, 2. European Commission, Official Journal of the European Union, October 2, 2015, (official publication date: February 9, 2016), 3. U.S. Congress, H.R. 3204, The Drug Quality and Security Act, see Title II, The Drug Supply Chain Security Act within H.R beginning on page 13 of this copy. Signed by U.S. President Barak Obama on November 27, pkg/bills-113hr3204enr/pdf/bills-113hr3204enr.pdf 4. Rodgers, Dirk, Meeting U.S. and E.U. Drug Serialization Requirements With A Single Solution, RxTrace, February 15, 2016, 5. Rodgers, Dirk, Insufficient Transitional Measures Doom The FMD-EUDA, RxTrace, November 23, 2015,

9 6. Rodgers, Dirk, More Concerns With The FMD/EUDR Big Bang Start, RxTrace, May 16, 2016, more-concerns-with-the-fmdeudr-big-bang-start.html/ 7. Rodgers, Dirk, FDA Postpones Enforcement of DSCSA Transaction Data Exchange Until May 1, RxTrace, December 26, 2014, 8. Rodgers, Dirk, FDA Extends Dispenser Delay in DSCSA Enforcement, RxTrace, October 29, 2015, com/2015/10/fda-extends-dispenser-delay-in-dscsa-enforcement.html/ 9. Rodgers, Dirk, FDA Limits Ongoing Dispenser Enforcement Discretion To First Responders, RxTrace, February 29, 2016, Rodgers, Dirk, InBrief: The Smallest Individual Saleable Unit In The DSCSA, RxTrace, June 8, 2015, com/2015/06/inbrief-the-smallest-individual-saleable-unit-in-the-dscsa.html/ 11. Rodgers, Dirk, The DSCSA Product Identifier On Drug Packages, RxTrace, May 4, 2015, Rodgers, Dirk, Drug Verification: EU Vs US, RxTrace, March 7, 2016, Rodgers, Dirk, Who Is A DSCSA Repackager?, RxTrace, November 3, 2014, Rodgers, Dirk, The Unique Identifier in the EU Delegated Act, RxTrace, August 24, 2015, the-unique-identifier-in-the-eu-delegated-act.html/ 15. Rodgers, Dirk, The DSCSA Product Identifier On Drug Packages, RxTrace, May 4, 2015, Rodgers, Dirk, Drug Verification: EU Vs US, RxTrace, March 7, 2016, Rodgers, Dirk, Pharma Aggregation: How Companies Are Achieving Perfection Today, RxTrace, March 26, 2012, rxtrace.com/2012/03/pharma-aggregation-how-companies-are-achieving-perfection-today.html/ 18. Rodgers, Dirk, EU FMD: Aggregation Is Not Mandated, But It Will Be Necessary, RxTrace, March 28, 2016, com/2016/03/eu-fmd-aggregation-is-not-mandated-but-it-will-be-necessary.html/ 19. Rodgers, Dirk, Aggregation > Chargeback Accuracy > ROI, RxTrace, October 19, 2015, aggregation-chargeback-accuracy-roi.html/ 20. Rodgers, Dirk, 2015 RxTrace U.S. Pharma Traceability Survey Results, Sponsored by Frequentz, March 23, 2016, frequentz.com/news_media/download-survey-2015/ 21. Rodgers, Dirk, More Concerns With The FMD/EUDR Big Bang Start, RxTrace, May 16, 2016, more-concerns-with-the-fmdeudr-big-bang-start.html/ 22. Rodgers, Dirk, EU FMD: Aggregation Is Not Mandated, But It Will Be Necessary, RxTrace, March 28, 2016, com/2016/03/eu-fmd-aggregation-is-not-mandated-but-it-will-be-necessary.html/ 23. Rodgers, Dirk, The Coming Battle Over Decommissioning At The Pharmacy, RxTrace, January 12, 2015, com/2015/01/the-coming-battle-over-decommissioning-at-the-pharmacy.html/ 24. Rodgers, Dirk, DSCSA: Transaction Information, RxTrace, March 17, 2014,

10 25. Rodgers, Dirk, DSCSA: Transaction Statement, RxTrace, March 31, 2014, Rodgers, Dirk, DSCSA: Transaction History, RxTrace, March 24, 2014, Rodgers, Dirk, GS1 Publishes Version 16 Of Their General Specifications And Why You Should Care, RxTrace, January 25, 2016, Rodgers, Dirk, The Unique Identifier in the EU Delegated Act, RxTrace, August 24, 2015, the-unique-identifier-in-the-eu-delegated-act.html/ 29. Rodgers, Dirk, The DSCSA Product Identifier On Drug Packages, RxTrace, May 4, 2015, Rodgers, Dirk, Is An ASN Really The Best Way to Pass Lot-Based DSCSA Transaction Data?, RxTrace, February 16, 2015, GS1, EPCIS and Core Business Vocabulary (CBV), GS1 website, accessed May 18, 2016, Rodgers, Dirk, Will EPCIS Event Exchange Replace EDI ASNs for DSCSA Someday?, RxTrace, April 8, 2015, rxtrace.com/2015/04/will-epcis-event-exchange-replace-edi-asns-for-dscsa-someday.html/ 33. Rodgers, Dirk, HDMA DMC Serves Sizzling Steak With A Small Side Of Snake Oil, RxTrace, March 14, 2016, rxtrace.com/2016/03/hdma-dmc-serves-sizzling-steak-with-a-small-side-of-snake-oil.html/ 34. Rodgers, Dirk, From Lot to Serialization Traceability, Frequentz website, March 2015, download-form-white-paper-lot-serialization-based-traceability/ About Frequentz Frequentz is a global leader and champion of end-to-end visibility, offering comprehensive traceability, serialization and information management technologies. Its transformative tools bolster businesses and brand reputations by improving productivity, product quality, and profitability. To accomplish this, Frequentz provides valuable insight into end-to-end supply chains and critical business processes by collecting, storing, and analyzing serialized life history data. Applications of its software are currently used in the life sciences, agricultural, fishery and sustainability, retail, and automotive industries worldwide to promote intelligent analytics and consumer safety. For more information visit For more information, contact us at info@frequentz.com 3960 Fabian Way Palo Alto, California