Lots of people are focused on the Drug Supply Chain Security Act, in the United States right now, because the original serialization deadline is coming up at the end of November. Of course, that deadline will not be enforced by the FDA, per their recent draft guidance. But the “big bang” date of the Falsified Medicines Directive (FMD) in the European Union (EU) is right around the corner so anyone marketing drugs there should not get distracted. We are now past the 18-month mark. You still have time to upgrade your packaging lines and deploy an enterprise serialization solution to meet the requirements of the law but you don’t have any time to waste.
OVERVIEW OF THE FALSIFIED MEDICINES DIRECTIVE
The FMD itself is a relatively brief, 14-page legal document that is directed at the EU Member States. There are currently 28 Member States, including the United Kingdom (UK), which will eventually leave the EU, but, interestingly, the UK intends to continue participating in the FMD. And there are other countries outside the 28 member states who have also announced their intention to participate, including Switzerland, Iceland, Liechtenstein and Norway. It’s a big pharmaceutical market, second only to the United States.
The FMD was enacted by the European Commission in 2011. It lays out the logical and legal justification for taking Union-wide action against falsified medicines, and then it directs the EU Member States to enact standardized regulations to protect the supply chain from falsified medicines.
Most importantly, it directs the passage of, a “delegated act”, to require “safety features” on prescription drug packages. The FMD did not provide any clue what a “safety feature” was, but it always referred to them in plural…as in, multiple features on each package.
And what are those safety features used for? Here is what the FMD says:
“Those safety features should allow verification of the authenticity and identification of individual packs, and provide evidence of tampering.”
From that explanation, you can see that at least two features would be necessary.
OVERVIEW OF THE DELEGATED REGULATION
Remember, the FMD was enacted in 2011 and it directed the passage of a “delegated act”. It took them another four years to develop the “delegated act”, but it finally become official on February 9, 2015. It is a 27-page regulation that explains that there must be two safety features on each package of drugs and it provides the details of those features. It also explains the “system of repositories” in detail, and the obligations and responsibilities of these entities:
- National Competent Authorities
- Marketing Authorization Holders
- Wholesalers (including repackagers)
- Persons authorized or entitled to supply medicinal products to the public, or what we normally call “pharmacies”, or “dispensers”
- Parallel Traders, and,
- The European Medicines Verification Organization (EMVO), although the Delegated Regulation does not use that name.
It just refers to the organization as a
“…non-profit legal entity or non-profit legal entities established in the Union by manufacturers and marketing authorisation holders of medicinal products bearing the safety features.”
And, those entities
“…shall consult at least wholesalers, persons authorised or entitled to supply medicinal products to the public and relevant national competent authorities.”
And about the costs: They said,
“Wholesalers and persons authorised or entitled to supply medicinal products to the public are entitled to participate in the legal entity or entities referred to in paragraph 1, on a voluntary basis, at no cost.”
And if that weren’t clear enough, they then said:
“The costs of the repositories system shall be borne by the manufacturers of medicinal products bearing the safety features…”
The Delegated Regulation is packed with very useful information, and it is well-written, which makes it fairly, easy to understand.
Figure 1: FMD timeline
Here is the timeline showing when the original FMD and Delegated Acts were enacted, and when the “big bang” effective date is, relative to today’s date. The reason February 9, 2019 is sometimes referred to as a “Big Bang” is to draw a distinction between the way the DSCSA is designed in the US, and the way the FMD is designed in the EU. The DSCSA is a 10-year-long series of milestones with slowly escalating requirements. In contrast, the FMD and Delegated Regulation really have only one milestone, and that’s February 9, 2019. That’s when everything needs to start. All at once. The “big bang”.
A DEEPER LOOK AT THE DELEGATED REGULATION
As was said above, the Delegated Regulation is where all the details are, and it is well written and easy to understand, at least in many places. Let’s take a closer look at some of its provisions.
Perhaps the one of the most important provisions is the definition of those “Safety Features”. There are just two. One is, an “anti-tamper” device. The Delegated Regulation defines it as
“…the safety feature allowing the verification of whether the packaging of a medicinal product has been tampered with”.
And surprisingly, that’s about all it says about it. You are left to figure it out, but it is probably safe to say these are the kind of technologies that have been used on Over-The-Counter drug packaging ever since the Tylenol poisonings that occurred in the Chicago area in the mid--1980’s. Heat-shrink, seals, glue, tape. Anything that can’t be put back after opening the package.
The second safety feature is much more interesting. It’s the Unique Identifier. The Delegated Regulation defines it as
“…the safety feature enabling the verification of the authenticity and the identification of an individual pack of a medicinal product”.
In contrast with the anti-tamper device, there is a lot written in the Delegated Regulation about this safety feature, directly and indirectly.
The Unique Identifier must be composed of a Product Code, serial number, National reimbursement number (where required), batch number, and expiration date. It must be carried within a 2D Data Matrix barcode, and in human readable text on the package.
The serial number data element is defined as up to 20 alphanumeric characters “…generated by a deterministic or a non-deterministic randomisation algorithm…”, with the odds of guessing a valid one, being less than 1 in 10,000. This randomization requirement was originally unique to the FMD, although it is being emulated in other countries recently, like Russia and elsewhere. In the DSCSA, there is no such requirement. And that makes more sense in a point-of-dispense authentication system like the FMD than it does in a regulation like the DSCSA. But randomization is also one of the complications in this regulation.
Another important concept described in detail in the Delegate Regulation is the System of Repositories.
Figure 2. System view of the FMD "System of Repositories", source: EMVO
This is a logical view of that system, provided by the European Medicines Verification Organization (EMVO). The top center box is what is known as the “European Hub”, which has been built by the EMVO, and is the primary place drug manufacturers and parallel distributors will need to send data about the products they introduce into the supply chain. You can see those two entities represented in the upper left and upper right boxes.
The EU Hub will retain all the master data about each product, but it will pass all of the product data it receives—including the master data and serial numbers—to the National System repositories that are associated with the regions where the drugs can be marketed. Usually this will be a subset of the European Union. Each region will maintain their own National repository, whether it is a standalone system, or one based on the EMVO national blueprint. Most of them will follow the EMVO blueprints.
A National Repository is usually operated by a single Member State, but there are some that are shared between multiple States. As you can see in the lower row of boxes, wholesale distributors and pharmacies will need to connect to each of the National Repositories that serve the regions where they are located. When they need to verify a given product, they will make a request to one National Repository that serves the region where the drug is being dispensed or distributed from.
That’s how the System of Repositories will be built and used, but there are a few additional details. One is, if a given drug manufacturer or parallel distributor only markets drugs for a single region of the EU, they can send their data directly to that specific National Repository, bypassing the E.U. Hub. Another is, if the National Repository cannot find a record matching the Unique Identifier being verified by a wholesale distributor or pharmacy, the National Repository can send a request to the EU Hub to find out which National Repositories hold the verification data for it.
Under the FMD, drug manufacturers have certain obligations. First, they must begin applying the safety features to each drug package. As we’ve seen, this includes the anti-tamper device and the Unique Identifier.
And they must send the data to the EU Hub. That data includes:
- The Unique identifier data elements, including the Product code, the serial numbers, Lot Number, Expiration date, and the Reimbursement code (where required);
- The coding scheme of the product code, which can be GS1 Global Trade Identification Number, National Trade Item Number, or some National Code;
- The product master data, which are details describing the product, things like the product name, strength, dosage form, size, etc.;
- The EU Member State(s) where the product is intended to be placed on the market. Remember, this is the list of National Repositories that the EU Hub will send the data to;
- The Name and address of the manufacturer placing the safety features on the product;
- The Name and address of the Marketing Authorization Holder (MAH) for this product;
- The List of wholesalers authorized by the MAH to distribute the product;
- And where applicable, the code identifying the entry corresponding to the product in the database referred to in Article 57(1)(l) of EC Regulation No 726/2004.
Verification of the safety features is a fundamental process under the FMD. Here are some extracts from the Delegated Regulation which describe what is meant by “Verification”.
“When verifying the safety features, manufacturers, wholesalers and [dispensers] shall verify the following:
(a) the authenticity of the unique identifier; [and]
(b) the integrity of the anti-tampering device.”
This is important for patient safety. In the EU, “verification” means, you must check both things. To be able to check the integrity of the anti-tamper device, you must be able to see the individual unit. This likely means you can’t verify an entire case or pallet just by knowing the unique identifiers on the individual packages they contain, although, these two verification steps can be performed at different times, and the check of the integrity of the anti-tamper device is most important right before the drug is provided to a patient.
“When verifying the authenticity of a unique identifier, [companies] shall check the unique identifier against the unique identifiers stored in the repositories system…”
“A unique identifier shall be considered authentic when the repositories system contains an active unique identifier with the product code and serial number that are identical to those of the unique identifier being verified.”
Wholesalers and repackagers have their own set of obligations under the FMD. After the start date, they are obligated to verify drugs that have the safety features on them, under these conditions:
- Non-manufacturer purchases;
- And whenever they are required to decommission drugs.
Decommissioning is another very important concept under the FMD. It’s a way of indicating in the System of Repositories that a given Unique Identifier is no longer valid, or at least, should not be dispensed to a patient. The Delegated Regulation says that decommissioning should set the drug to an “inactive” status in the system of repositories.
Wholesale distributors and repackagers are required to decommission in these situations:
- On export outside the markets covered by the FMD;
- Whenever a package becomes “Non-saleable”;
- Whenever Products are to be destroyed;
- Whenever a government requests samples of Products;
And whenever Products are being distributed to certain smaller entities, like schools, individual practitioners, veterinarians, optometrists, police, military, prisons, ect. These are entities that are not expected to perform the verification for themselves, so to ensure that a verification is done before dispensing or administration to a patient, the law expects the wholesaler or repackager to do it.
Finally, ”Persons authorized or entitled to supply medicinal products to the public”, or dispensers, also have specific obligations under the FMD.
They are required to verify and decommission drugs under these situations:
- When dispensing to a patient, or they can do it anytime the drug is in their posession before dispensing. That allows larger pharmacies to do the verification and decommissioning in bulk, before they send the drugs to the actual pharmacy counters;
- Drugs in their possession that cannot be returned, or dispensed, for whatever reason;
- Products requested as samples by Competent Authorities in the government;
- Products to be distributed to those same smaller entities, just like the wholesale distributors;
- And finally, products which they supply for subsequent use as authorised investigational medicinal products or authorised auxiliary medicinal products as defined by Articles 2(2)(9) and (10) of Regulation (EU) No 536/2014.
GET EVEN MORE INFORMATION ON OUR EU FMD RESOURCE PAGE