Securing the Supply Chain With RFID

Nearly a year and a half after the US Food and Drug Administration relaxed labeling regulations to allow pharmaceutical manufacturers to test new electronic product codes in an effort to curb counterfeiting, industry has been abuzz with pilots, roll-outs, and questions.

By November 2004, three major drug suppliers—Pfizer, Purdue Pharma, and GlaxoSmithKline—had announced plans to begin affixing labels embedded with radio frequency identification (RFID) codes to drugs highly susceptible to diversion. FDA also published a compliance policy guide for industry on implementing RFID studies and pilot programs.

The classes of RFID tags.

"When FDA saw that the number of counterfeit drugs entering the domestic supply chain was increasing, former FDA commissioner Mark McClellan asked us to look at ways to further secure the safety and integrity of drugs as they move through the supply chain," says Elisa Bernstein, FDA senior advisor for regulatory policy. "We looked at all the different options that were available and all of the different emerging technologies showed a lot of promise as ways to secure the drug supply chain."

According to the agency's report, "Combating Counterfeit Drugs," issued in February 2004, counterfeit drug investigations have increased to more than 20 per year since 2000, after averaging only five per year through the late 1990s (1). Increasingly, these investigations have involved well-organized criminal operations that seek to introduce counterfeit finished drug products into the legitimate US drug distribution system. These fakes may closely resemble legitimate drugs yet contain contaminants, improper dosages, subpotent or superpotent ingredients, or only inactive ingredients.

"For Pfizer, this whole initiative is a patient safety initiative, because we're trying to address the counterfeiting of our pharmaceutical products," says Peggy Staver, director of trade product integrity for Pfizer US Pharmaceuticals (New York, NY, www.pfizer.com). "So we're talking about how can we best enable a track-and-trace capability to try and prevent the interjection of counterfeits into the supply chain."

Why RFID?

Unlike the retail supply chain, which relies on RFID predominantly for inventory control, there are three distinct uses for RFID in the pharmaceutical supply chain. RFID-enabled electronic product codes (EPCs) can be used to identify product, authenticate product, and create additional layers of security around a product.

EPC codes can track and trace a product throughout the supply chain by means of tiny microchips embedded in the product packaging. These tags can be affixed to the package or woven into the label; newer tags are being built into the rims of test tubes. Companies such as Wal-Mart and Target have mandated that their top 100 distributors, many of them pharmaceutical suppliers, implement a pallet-level RFID system to easily scan product as it comes through bay doors or on the conveyor belt. Pharmaceutical manufacturers are now taking RFID to the next level by bypassing pallet-level scanning and tagging each drug package individually for added security and identification.

Creating an airtight supply chain

Purdue Pharma (Stamford, CT, www.pharma.com) has shipped more than two hundred thousand bottles of Oxycontin through the supply chain with 100% product code readability, according to J. Aaron Graham, vice-president and chief security officer at Purdue Pharma. This is part of a pilot program with wholesale distributor H.D. Smith (Springfield, IL, www.hdsmith.com) to test-drive an e-pedigree protocol on containers of Oxycontin, a powerful pain reliever. In this scenario, H.D. Smith receives an advance pedigree notice listing all product set to ship. When the distributor receives the shipment, it can reconcile what it has received by scanning the EPC-tagged containers and comparing the actual shipment to the initial manifest. If all the information is identical, a hand scanner is used to print a digitally encrypted signature showing that the distributor received what was sent. H.D. Smith's supply chain eventually will have a fully authenticated and digitally encrypted electronic pedigree that follow the movement of product from the time the tags are placed on the bottle all the way to the pharmacy.

"If somebody were to try to introduce a product at a parallel point in the supply chain, we would know right away, because all of a sudden that would pop up in a place where we know our bottle wasn't," Graham explains. "So we can immediately notify the FDA, and the National Association of Boards of Pharmacy, or the board of pharmacy in that state. They could detain the bottle immediately and then work backwards with the person who possesses it to find out where they got it."

Viagra control

By the end of 2005, Pfizer expects to have tagged all bottles of the company's most-counterfeited drug, Viagra, for distribution in the United States. As of August, the company was in the designing and testing phase of the project. "Our goal is to apply, read, and write to RFID tags on our packaging line and learn more about managing all of the unique electronic product codes that we will have associated with each bottle we produce," Staver explains.

Pfizer's strategy is to enable an authentication capability that will allow people at each step in the distribution chain to read an EPC number, and confirm that it is, in fact, the valid EPC number that was issued. "We're also addressing a lot of the communication requirements around not only informing the public of our plans but also addressing privacy concerns," Staver says.

Pfizer staff said that the company paid close attention to properly managing the flow of data and generating unique numbers for every bottle produced. They had to understand how to gather information as tags are commissioned on the packaging line. The information on every single bottle must be securely stored until the product is shipped. "Basically, we're planning to capture information at two points: when the tag is commissioned online, and then when the product is shipped from one of our distribution centers to the customer," Staver says. "So there are two key points where we'll be capturing information, but we need to manage the data and be able to read and write to these RFID tags online."

A true electronic pedigree

By using RFID technology to create an electronic pedigree, pharmaceutical manufacturers can track the whereabouts of all product traveling through the supply chain.

One of the challenges today is that according to the Prescription Drug Marketing Act, any institutional pharmacist or gray market wholesaler—even a corrupt one—is considered an authorized distributor of record. When a pharmacist purchases a drug from a manufacturer, he or she becomes an authorized dealer of record (ADR) and is expected to place an ADR stamp on the bottom of each invoice. The stamp suffices as a paper trail or pedigree, allowing criminals to purchase product from a wholesaler or another country and stamp the whole invoice with an ADR signature, creating a fraudulent paper trail, Graham explains.

To combat this problem, manufacturers are implementing electronic pedigree software systems that can read the digital license plate on an RFID tag and then manage that information using a middleware software package supplied by companies such as SAP. A digital signature is added every time a package is scanned through the system.

"The RFID tag would actually have the identification on the tag itself. It would talk to the software program that would capture at each point in the supply chain where the product is," says Mikael Ahlund, director of RFID in healthcare at Texas Instruments (Dallas, TX, www.ti.com).

FDA views the electronic pedigree as one of several measures that need to be implemented in the supply chain. "It's not the be-all, end-all answer to counterfeit drugs," Bernstein says. "It's one very important measure so that there is greater assurance of where that product has been and where it's going through the supply chain, and that you know that it's been in the hands of legitimate, licensed wholesalers or the original manufacturer as it passes from entity to entity."

Hack-proof chips

So what would stop counterfeiters from hacking RFID chips and randomly placing fake product into the supply chain? According to Ahlund, RFID tags such as the ones provided by Texas Instruments, are nearly counterfeit proof. Each chip contains an individual code that is only decipherable by the manufacturer. In addition, each chip can be programmed with a private key that is then distributed only to the manufacturer and the pharmacy. If the keys do not match up at the pharmacy, then the product has been tampered with.

"RFID is used to authenticate the validity of the product," says Krish Mantripragada, director of RFID business development at SAP (Newtown Square, PA, www.sap.com). "We are building a variety of levels of security and hierarchy based on authentication technology. So when manufacturers move goods from point A to B, they can validate the product."

With an electronic tracking system in place, manufacturers can spot whether a duplicate or unknown EPC number appears in the supply chain. "These are examples that can raise alarms to start an investigation process," Mantripragada says.

Total recall

Electronic product scanning can make product recalls more effective. Experts say that today many manufacturers struggle to complete a recall because they can't locate every contaminated item. With electronic product data, manufacturers have both lot and item level traceability at their disposal.

The same data also can be used to begin the reconciliation process and enable chargebacks and rebates. The prices consumers pay for drugs vary greatly from one channel to another. According to Mantripragada, the track-and-trace technology allows companies to gather cost data and determine how much is owed to each distribution channel, rather than doing a blanket chargeback to wholesalers and pharmacies.

The high cost of chips

Although RFID offers long-term benefits for pharmaceutical companies, there are still a few problems inherent to the technology. The biggest hurdle is the steep price of microchips. Drug manufacturers with ties to Wal-Mart were forced to tag their products at the pallet level with RFID chips as part of the retailer's mandate to have its top 100 distributors RFID-ready by January 2005. But to tag product at the item level, manufacturers will have to spend millions to upgrade from a two-cent barcode to a 25-cent microchip.

"Certainly [RFID tags are] more expensive than a simple bar code," Graham says. "But, you know, at the end of the day we've done the math at Purdue and we said, 'Okay, what's the return-on-investment on RFID for us?' Clearly it's a matter of patient safety. How do you put a value on a human life? So if you're talking 30 cents or 40 cents a tag for a 100-count bottle, if you can't justify 30 or 40 cents, you'd better reevaluate your entire business model."

Prices might also drop as tags evolve. Staver says she hasn't seen prices decrease according to predictions, however. "So I think cost will be an issue until it decreases significantly," she says.

Innovatum (Sugar Hill, GA, www.innovatum.com) President Ardi Betmanghelidj explains that although RFID is cost-prohibitive for most item-level tagging, it does make sense for high-priced drugs such as Viagra, which can cost $50 to $70 for a single-unit container. "But for many other medicines, it is way out of line cost-wise to tag an item with an RFID," Betmanghelidj says.

Rough waves

RFID technology has hit a few stumbling blocks on the path from drawing board to pilot project. Certain liquids and metals block ultra-high frequency (UHF) radio waves, a problem intrinsic to radio frequency technology. Explains Carol Mooney, marketing manager at West Pharmaceuticals (Lionville, PA, www.westpharma.com), "West started looking at RFID and we quickly realized that UHF wasn't a viable solution for parenteral drug packages because we had water to deal with in the liquid serum drugs."

West decided to incorporate a 13.56-MHz high frequency (HF) tag that has a much higher read rate than UHF and can withstand the challenges of pharmaceutical processes such as sterilization in an autoclave. The company is using RFID in flip-off seals on vials. "By placing the RFID within the flip-off seal, essentially all the tags are facing up so the user can get a 100% read rate in a non-line of sight inspection mode," Mooney says.

In Pfizer's pilot, the company decided to use HF labels for product tagged on the item level and UHF chips on the pallet and case level. "There's the whole standard setting process going on with EPC Global right now trying to help the industry align and define some [RFID standards]," Staver says. "But for those of us who are kind of out here in the front, we're trying to gain some hands-on experience in a couple different areas that will help make some of these decisions [more well-informed]."

FDA is also researching how RFID might affect the integrity of particular liquid products or biological products that have unstable protein structures. More important, an FDA advisory team is trying to determine if certain radio frequencies could raise the temperature of a drug product, thereby affecting its stability. "We just want to know whether there is an effect, so we've asked the companies to do some studies on their products, and we've also done some research here within FDA," Bernstein explains.

FDA officials are asking industry—meaning the pharmaceutical manufacturers—to prove that exposure over time, over different ranges and energy levels, doesn't degrade the efficacy, purity, or safety of sensitive biologics.

"When the FDA issued the guidance on RFID and pilot studies in pharmaceuticals, it specifically said that the guidance excluded biologics," Mooney says. "So although it doesn't exclude parenteral products it does exclude biologics. And that's where you're talking about the sensitive and unstable peptide-and protein-based drugs." West is currently engaged in pilots with a major pharmaceutical customer who is looking at the effects of RFID exposure on temperature and product stability.

RFID alternatives

Although many pharmaceutical companies and FDA administrators feel that using electronic product codes is a positive step in securing the supply chain, some vendors advocate cheaper and more-efficient label alternatives such as 2D bar coding. Many companies are implementing RFID solutions in the pharmaceutical supply chain because of its ability to capture multiple assets at one time, and for its electronic pedigree component. Says Roger Hecker, vice-president of product marketing at Visidot (Hod Hasharon, Israel, www.visidot.com), "However, there are several technological challenges with RFID and cost challenges, but more importantly, the accuracy rates that have been experienced with EPC/RFID have not been satisfactory, certainly not for a pharmaceutical supply chain."

Visidot is touting its 2D bar-coding solution as a more-accurate method of labeling. Two-dimensional bar codes are standard bar codes that can store more data than linear bar codes and also have error-correction imbedded in the tags themselves. Using a high-resolution imager, pharmaceutical companies can capture a still shot of the 2D bar code and then send the image to a processor to be read. Coding software scans the image pixel by pixel, finds all the data matrix codes, and decodes them with extremely high accuracy. Visidot claims an average accuracy above 99.7%, over millions of reads.

According to Innovatum, manufacturers can maintain an electronic pedigree by upgrading to an electronic database to use with cost-effective 2D and traditional barcodes. This would bridge the gap until RFID accuracy is improved. "I've heard estimates that we are two to ten years away from having a reliable RFID tag/infrastructure to be able to manage through RFID some of these pedigree issues," Betmanghelidj says.

The downside to 2D and traditional bar-coding is that the product must be in line-of-site to register on a scanner, making item-level scanning very difficult. With RFID, a scanner need only scan the case, and the tags on each individual container are registered.

The waiting game

Some pharmaceutical manufacturers aren't rushing to pilot a full-blown RFID solution. Wyeth Pharmaceuticals (Madison, NJ, www.wyeth.com), for example, has developed a corporate strategy to analyze the benefits of the technology to patients. "We're in the midst of learning about the technology so that we can bring it to patients to secure the supply chain that brings the drugs to them, and at the same time assist patient drug access by doing it cost effectively," says Ed Orme, assistant vice-president of global packaging services at Wyeth.

Wyeth has organized its RFID strategy around three tests designed to evaluate how its suppliers of goods and services are currently using the technology. "We're talking to a number of suppliers who are looking to integrate RFID into their packaging components, whether it's corrugated or plastic bottles, those types of things," says Tom Pizzuto, director of RFID strategy and technology at Wyeth. The company also is looking at what third party logistics providers are doing with RFID, as well as how Wal-Mart is handling RFID in the retail channel.

"Currently we're looking at retrofitting a packaging line and then sending down or pulsing down bottles on that line to be RFID tagged," Pizzuto says. "This [trial] will give us an opportunity to master the engineering challenges of putting tags on bottles at 200 bottles per minute." Wyeth is researching what those challenges are in terms of read rates, middle-ware management of the devices, and back-end integration of its enterprise systems.

Upcoming mandates

While FDA has yet to issue guidelines or mandates requiring manufacturers to use RFID, several states have already issued legislation. The state governments in Indiana and Florida have mandated e-pedigrees for July 2006 for approximately 30 subject drugs, and California has made similar requirements for an electronic pedigree by January 2007. "I don't care if you're a wholesaler or manufacturer or pharmacy," Graham says. "[Manufacturers] want to make sure that they can ensure that that prescription medicine that patients pick up is authentic, efficacious, and safe."

The FDA, however, is quick to quiet rumors of future e-pedigree mandates as they pertain to RFID. "Right now our [job] is not to regulate RFID," Bernstein says. "We just regulate the product. That's where our authority lies, in the product itself. I'm not sure what the future holds, but right now, we feel that, because the technology is so new and emerging that we needed to let everything work itself out and see where it goes."

"The industry is coming to the conclusion, as well as the belief and hope, that there will be two sets of standards issued by EPC Global, meaning there's going to be an HF standard and a UHF standard," Mooney says. "If you take a look at the history of the bar code, I think it took maybe 30 years for a standard to be set. Hopefully we've learned something as an industry, and hopefully standard-setting won't take 30 years for RFID."

References

1. US Food and Drug Administration, Combating Counterfeit Drugs: A Report of The Food and Drug Administration (FDA, Rockville, MD, Feb. 2004), http://www.fda.gov/oc/initiatives/counterfeit/report02_04.html (accessed Aug. 19, 2005)