Epedigree in the Pharmaceutical Supply Chain

Strategies for securing the supply chain is of growing importance to the pharmaceutical industry. These efforts have largely focused on anticounterfeiting measures and related track-and-trace technologies to ensure the chain of custody of a finished drug product from a pharmaceutical manufacturer to distribution points engaged in the sale of the product. As the technical and regulatory considerations for electronic pedigree (ePedigree) begin to evolve, the industry is also evaluating strategies to exchange information and improve the audit trail earlier in the supply chain for raw materials and other pharmaceutical ingredients.

JOHN FOXX/GETTY IMAGES

Regulatory requirements for ePedigree

Under the Food and Drug Administration Amendments Act (FDAAA) of 2007, which was signed into law on Sept. 27, 2007, the Secretary of the Department of Health and Human Services (HHS) is required to develop standards and identify and validate effective technologies for purposes of "securing the drug supply chain against counterfeit, diverted, subpotent, substandard, adulterated, misbranded, or expired drugs." The law further requires the Secretary to develop a standardized numerical identifier to be applied to a prescription drug at the point of manufacturing and repackaging at the package or pallet level sufficient to facilitate the identification, validation, authentication, tracking, and tracing of the drug no later than 30 months from the enactment of FDAAA (1).

To meet these legislative requirements, FDA sought public comment on the standards and technologies for ePedigree of prescription drugs. During the public comment period, which ended May 19, 2008, the agency requested information on radio-frequency identification (RFID) technologies, encrypting technologies, and nanotechnologies and their strengths and weaknesses for identification, validation, track and trace, or authentication. The agency also requested information on the utility of these technologies in ePedigree, the cost of their implementation and use, their interoperability, and the development of related standards (1, 2).

FDA is in the process of analyzing the information provided and is researching several options received. The agency says it is working toward meeting the March 2010 deadline for developing a standardized numerical identifier, but cannot provide specific deadlines for developing standards for validation, authentication, and track-and-trace systems as well as addressing promising technologies, but says it "will work toward meeting these goals as quickly as it can."

In addition to FDA, states such as California and Florida are moving forward with state requirements for ePedigree. California enacted a drug-pedigree law that mandated serialization, electronic pedigree, and track-and-trace systems in 2004, with an initial effective date of Jan. 1, 2007. Additional state legislation in 2006 moved the effective date to Jan. 1, 2009. Earlier this year, the California Board of Pharmacy, the state agency primarily responsible for implementing the state's ePedigree law, exercised authority delegated to it by the 2006 legislation to further extend the effective date for the implementation of the ePedigree requirements to Jan. 1, 2011 (3).

In providing comment on FDA's request for information on ePedigree technologies and standards, the California State Board of Pharmacy identified two possible technologies: 2D (data matrix) barcodes and RFID tags. The board recommended RFID be the industry standard and that 2D barcodes only be used as a backup technology (3). In terms of standards, the board recommended that the Global Trade Item Number (GTIN) developed by GS1/EPCglobal, two organizations involved in developing industry-driven standards for the electronic product code (EPC) to support the use of RFID. The board specified that GTIN is already in use and approved by the FDA for marking pharmaceutical products (4). "We particularly encourage adoption of the SGTIN-96, which is the version applicable to serialization of drug products using RFID tag technology as the data carrier," said the board in its comments (4).

In recommending RFID, the California State Board of Pharmacy said RFID tags are less easily counterfeited or duplicated than are other data carriers, including 2D barcodes. "This is true not only because the technology itself is not as easily replicated as e.g., a printable 2D barcode, but also because RFID (EPC) tags are typically given a unique identifier (e.g., Tag ID) by the tag manufacturer that confirms its authenticity and additional level of security from widespread duplication or counterfeiting," said the board in its comments (3). The board also noted that RFID is a non-line-of-sight technology, which allows unit-, case-, and pallet-level tags to be read from varying distances and through several levels of packaging (3).

For these reasons, the board sees RFID as more readily adaptable. RFID technology would "permit mass serialization and item-level track and trace of drug products throughout the US supply chain without requiring either: a significant disruption of present practices and a dramatic increase in processing times due to the opening of every case or container; or interference on such a large scale that mass serialization/item-level tracking mandates lose much of their salience," said the board (3).

RFID may have other advantages such as the extensibility of RFID (EPC) tags for optimizing capabilities such as by adding extra data to the tag, adding sensors for temperature, pressure, light, allowing for the distinctions between "active" (smart) and "passive" (dumb) tags, and permitting a variety of frequencies, read ranges, and sizes to be used. The board noted that there are already marketable products that incorporate RFID tags into or under labels and into or under packaging materials (3).

In addition to California, Florida enacted its own electronic pedigree requirements in 2006 that duplicate the paper-based records within an EDI (electronic data interchange) transaction (5).

As federal and state authorities evaluate ePedigree standards and technologies, industry members point to the need to unify ePedigree requirements. "Congress should pass legislation that would enable FDA to establish industry-wide implementation dates for federal pedigree standards," said Mike Rose, vice-president of supply-chain technology at Johnson & Johnson (New Brunswick, NJ) in testimony before the US Senate Committee on the Judiciary in June 2008. "The FDA should be encouraged to work with state and international regulators to develop effective, practical pedigree and track and trace standards for the United States and globally." He added that the complexity of multiple pedigree laws may result in fraudulent or counterfeit pedigrees, which underscores the need for federal standard ePedigrees (6).

The ePedigree movement reached an important milestone in 2007 with the ratification of the EPCglobal Drug Pedigree Messaging Standard. The standard provides a data format that complies with all state and federal government regulations and allows trading partners to send and receive data in a secure, interoperable manner, using existing data-transfer technologies. The standard's security mechanisms ensure that data cannot be forged without easy detection, while interoperability provisions ensure that pedigrees are understandable by all trading partners, regardless of ePedigree vendor (7).

Proposed legislative requirements for ePedigree

As the regulatory authorities access ePedigree, Congress is also taking action. Earlier this year, Reps. Steve Buyer (R-IN) and 12 additional members of the US House of Representatives introduced a bill, "Safeguarding America's Pharmaceutical Act of 2008" (H.R. 5839) to establish federal requirements for a closed-loop, track-and-trace pedigree system using item-level serialization. The bill specifies that no state or nonfederal body can establish a pedigree system separate from the federal standards (8). As of press time, the bill had been referred to the House Committee on Energy and Commerce.

In late July, the House Committee on Energy and Commerce also issued a revised discussion draft to the Food and Drug Administration Globalization Act of 2008. The revised discussion draft provides additional requirements for quality risk-management plans and for electronic statements for the chain of supply of a drug. The purpose of the discussion draft is to be provide a basis for debate on possible legislation, which is not yet introduced. The committee issued the original discussion draft in April 2008.

The revised discussion draft proposes registered establishments that are involved in the "manufacture, preparation, propagation, compounding, or processing of a drug" to provide the HHS Secretary, upon request, "an electronic statement identifying each prior sale, purchase, or trade of the drug, including each prior sale, purchase, or trade of its ingredients and raw materials." The electronic statement would include the date of the each such prior sale, purchase, or trade, the names and addresses of all parties to each such transaction, and any other information required by the Secretary by regulation (9).

Although ePedigree requirements for pharmaceutical ingredients is now only a subject of discussion, consideration on how to electronically secure the custody of a drug earlier in the supply chain to include raw materials and other pharmaceutical ingredients is of growing importance. "In order to ensure paperless compliance throughout the pharmaceutical supply chain, manufacturers need a better way to improve business processes and maintain end-to-end visibility, enable product authentication, and ensure data integrity across all transactions," says Robert Pease, director of marketing of Hubspan (Seattle, WA), a provider of on-demand integration tools and services.

Tools for integration

Connectivity and interoperability between suppliers and their customer are two issues to consider when trying to create an custody-tracking solution. "Companies face the need to share data and increase visibility within the supply chain but are reluctant to increase their investment in technology," says Pease. "Making an additional investment in eCommerce infrastructure often means increased costs and resource drain as a result of building an in-house solution or burdening existing systems for connecting a company with its trading partners."

Enterprise-resource planning (ERP), EDI, enterprise application integration (EAI), and other business-to-business applications may be used to link systems together. As the complexity of the supply chain increases, however, a supplier has to consider how these systems can be linked. "Companies may find themselves having to decide among undesirable alternatives," says Pease. These alternatives may include the following:

• Change business relationships, discontinue and/or restrict distribution, or assume additional risks

• Continue existing supply-chain relationships while adding manual processes that increase costs and delay delivery

• Implement complex, expensive hardware and software solutions that require dedicated information technology resources that may not scale.

"No company wants to disrupt business processes, introduce delivery delays, increase operating expenses, and potentially reduce revenue," says Pease. "Organizations' legacy systems such as EDI and flat-file transfer are no longer enough. Low-level connections that only transfer batch files between applications and trading partners are giving way to smart networks that incorporate diverse integration functionality that provide integration with business processes and ERP systems," he says.

Instead, Pease points to the value of software-as-a-service (SaS) delivery model. SaS is a delivery model for business-processes integration among trading partners. Figure 1 outlines a custody-tracking solution. The hosted, managed service allows suppliers to send and receive documents electronically without having to make an additional investment in e-commerce infrastructure or upgrading existing systems. The product custody data is transmitted straight to their respective backend systems. The solution can be delivered as a portal or as a fully integrated service to translate and validate data to make it readily usable by in-house systems. To maintain data integrity throughout the supply chain, the offering should provide a central repository to ensure the safety of data so that the products' custody information can be tracked across the supply chain, without impacting trading partners' IT infrastructures and business processes, explains Pease.

Figure 1 (COURTESY OF HUBSPAN.)

The SaS model is an alternative to deploying cross-enterprise integration software or developing an in-house solution. Rapid deployment, accessibility, flexibility, and scalability are advantages of such an approach, says Pease. A typical deployment may be operational in several weeks. All participants should be able to communicate via a single connection and may use a platform using business-to-business applications, EAI, ERP systems or a secure portal for tracking transactions. The solution can also add process-automation features such as generating e-mail notifications in the case of incomplete or incorrect transactions. Transactions can either be resubmitted or corrected manually via the secure portal. The system also creates an audit trail and a searchable archive of critical data.

Other solutions

Specialized vendors are offering applications to assist in meeting ePedigree and supply-chain requirements. For example, SupplyScape (Woburn, MA) introduced in June 2008 Nexus-enabled applications and services to its product serialization and supply-chain optimization solutions. Nexus is a network-based data-sharing and collaboration platform to facilitate interoperability within trading networks.

Axway (Scottsdale, AZ) offers its "Synchrony" supply chain integrity suite as a solution for supply-chain management among life-science companies and its trading partners. The product includes capabilities for data-integrity assurance, ePedigree, business-activity monitoring, and trade- activity management, and track-and-trace functionality.

In July 2008, rfXcel (San Ramon, CA) release its "Everest" track-and-trace platform for ePedigree and serialization compliance and business analytics. In January 2008, Acsis (Marlton, NJ) released "PharmaTrak 2.0," a preconfigured, serialized track-and-trace solution developed for pharmaceutical manufacturers, co-manufacturers, and distributors The software is designed to manage serialized drug products in warehouse and distribution centers to support the ability to generate ePedigree documents, automate product movement and transfers, as well as support track, trace, and product authentication through the supply chain.

References

1. FDA, "Standards for Standardized Numerical Identifier, Validation, Track and Trace, and Authentication for Prescription Drugs; Request for Comments" (Docket No. FDA-2008-N-0120), Fed. Reg. 73 (55), 14988–14991, Mar. 20, 2008.

2. FDA, "Technologies for Prescription Drug Identification, Validation, Track and Trace, or Authentication; Request for Information" (Docket No. FDA-2008-N-0121), Fed. Reg. 73 (55), 14991–14992, Mar. 20, 2008.

3. California State Board of Pharmacy, "Response of the California State Board of Pharmacy, Docket No. FDA-2008-N-0120, Standards for Standardized Numerical Identifier, Validation, Track and Trace, and Authentication for Prescription Drugs; Request for Comments" (Sacramento, CA, May 12, 2008), available at http://

, accessed Aug. 4, 2008.

4. California State Board of Pharmacy, "Response of the California State Board of Pharmacy, Docket No. FDA-2008-N-0121 Technologies for Prescription Drug Identification, Validation, Track and Trace, or Authentication; Request for Information" (Sacramento, CA, May 12, 2008), available at http://

, accessed Aug. 4, 2008.

5. P. Faber, "RFID Strategy—Pharmaceutical EPedigree—Biggest Supply Chain Topic of 2008," Industry Week, Jan. 21, 2008.

6. M. Rose, "Testimony before the Senate Judiciary Committee" (Washington, DC, June 17, 2008), available at http://judiciary.senate.gov/pdf/08-06-17Mike_Rose_Testimony.pdf, accessed Aug. 4, 2008.

7. P. Spellman, "EPedigree to the Next Degree," Pharm. Exec. 28 (3), 32–34 2008.

8. G. Koroneos, "Congress to Consider National ePedigree Standards," Pharm. Exec. (online), Apr. 30, 2008, available at http://pharmexec.findpharma.com/pharmexec/News/Congress-to-Consider-National-ePedigree-Standard/ArticleStandard/Article/detail/512999, accessed Aug. 4, 2008.

9. House Committee on Energy and Commerce, "Revised Discussion Draft of the Food and Drug Administration Globalization Act of 2008" (Washington, DC, July 24, 2008), available at http://energycommerce.house.gov/FDAGlobalAct-08/RevisedFDAGA.DraftDrugSafetyTitle.072908xml.pdf, accessed Aug. 4, 2008.