Business and Finance

Cold Chain

Commercial Channels

Data and Technology

Legal and Regulatory

Manufacturing & Packaging

Market Access and Pricing

Opinion

Patient Support

Security

Supply Chain Logistics

Trade & Channel

News

Pharma Pulse

Publications

Brand Insights

Webcasts

Resources

Conferences

Conference Coverage

Conference Listing

Events

Videos

Podcasts

Editorial Podcasts

Subscribe

Business strategies and top news in the biotech / biopharma industry, including market access, supply chain distribution and more.

About Us

Advertise

Editorial

Contact Us

Do Not Sell My Personal Information

Privacy Policy

Terms and Conditions

Pharmaceutical Commerce

Instagram

Facebook

LinkedIn

Threads

Soundcloud

Spotlight

Digital Editions

Topics

1rem

Articles

Central nervous system (CNS) medication for society’s oldest and youngest present special challenges

Surveying the Mental Health Medication Landscape--Part 2

Antipsychotic and antidepressant drugs have risen to the top categories of prescribed medications in a challenging and risky medical and regulatory arena

Surveying the Mental Health Medication Landscape - Part 1

States continue to push for a ‘bio-economic’ foundation

Workforce and Supply Chain Top Location Must-Have Lists for Biopharma

Drugmakers recalibrate anti-counterfeiting and serialization efforts

Even While Regulatory Mandates Slip Into the Future, Brand Protection Needs Remain

Mature product franchises and mixed clinical outcomes have not dissuaded pharma companies from expending marketing resources for cardiovascular disease treatment

A Pitched Battle in Cardiovascular Drug Marketing

Biopharmaceutical manufacturers turn to a direct-distribution model to leverage opportunities for cost-effective drug delivery and personalized health management services

Building an Alternative Distribution Model for Ultra-Orphan Diseases

 interview, Dave DeJean, Systech’s VP of global strategic accounts, dives into:

The valuable lessons he’s learned along the way, given his three and half decades of experience at Systech

An overview of the Drug Supply Chain Security Act (DSCSA), including its three main pillars

How he would interpret this “Stabilization Period” that the FDA provided this past summer, and what he pharma industry do now during this period in order to avoid penalties later

Whether or not he anticipates the FDA implementing any other sort of delays in the near future in order to help remedy these issues/challenges surrounding the enactment of DSCSA

Podcast is available directly on SoundCloud.

Dave DeJean provides his expert insight on lessons he’s learned from his plethora of time in the industry, along with an outlook on where the pharma supply chain stands in adhering to the Drug Supply Chain Security Act (DSCSA). 

Complying With the DSCSA

The now-11-year odyssey to track drugs by item through the supply chain will be under a regulatory exemption for up to two years.

Facing Potential Drug Shortages, FDA Delays Enforcement of DSCSA Compliance Deadline, with Stipulations

With the implementation of unit-level traceability, the collaboration is expected to provide additional visibility not only within the aseptic manufacturing process, but the entire supply chain overall.  

BD, ten23 health to Roll Out Prefillable Syringes with RFID Capabilities

A panel offers its perspective on bolstering the temperature monitoring and data sharing process. 

LogiPharma USA 2024: Enhancing Cold Chain Insights

With the Nov. 27 deadline fast approaching, is the pharma supply chain ready for full data exchange?

LogiPharma USA 2024: Working Toward DSCSA Compliance

The collaboration is centered around meeting track-and-trace requirements. 

Arvato Systems, Advanco Form Serialization Partnership

The Dangers Surrounding Bits and Bytes

, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, outlined the top mistakes healthcare organizations make in software development and maintenance from a security standpoint, including a lack of incident response plan; inadequate data encryption; absence of multi-factor authentication; neglecting security development lifecycle (SDL) practices; infrequent security updates and patching; and ignoring regulatory compliance. Bernstein emphasized that proactive security measures and regulatory compliance are essential for healthcare software management. He also dove into some of the most common cyber threats companies are facing, and how he envisions those threats changing over the next decade.

A transcript of Bernstein’s conversation with

How do you envision these cyber threats evolving over the next decade?

Nico, one of the areas where we may see increased activities over the next 10 years is when it comes to geopolitical tensions. Some of these wars that we're observing on the news every night could spill over into cyber warfare situations where you have a smaller country with less of an arsenal—in order to compete with its adversary—going out and carrying out these asymmetric warfare attacks where they're targeting critical infrastructures. That would include healthcare, government services, transportation, the water and utility systems, and then also things like the power grid and the financial and banking system. This is very concerning because these types of attacks can very quickly lead to cascading consequences, which are very difficult to recover from. I think it's safe to say that we may see bullets and bombs replaced with bits and bytes in the coming years, and it's something you know, that's very scary but also realistic.

In the final part of his video interview with Pharma Commerce Editor Nicholas Saraceno, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, forecasts how cyber threats could potentially evolve over the next decade. 

Safeguarding Customer Data 

What are some of the most common cyber threats companies are facing, and how can they best protect their customers’ data?

No matter what authority you're talking to—whether it's a practitioner, somebody that's inside of an organization, performing security, even law enforcement and other authorities—everybody says that 90% of the successful data security compromises involve some type of human error. Somebody clicks on a link, they open an attachment that has a malicious payload, they go to a watering hole site, they're tricked into giving up their username and password, and they say that 90% of these attacks happen because of some type of human error. The first thing that's really important is providing education to your staff, and it should be everybody from the person at the front door, all the way up to the CEO. Everybody needs security education. Everybody has to understand that security is a matter of strategic importance for the organization, and that security will always enable the organization's success. People also need to understand the importance of not being promiscuous with their devices, and treating their communications especially like they would treat their home.

You wouldn't go away during the weekend and leave your front door open or your windows open. You want to have it secure. If your doorbell rang at four in the morning, you wouldn't just open it up without verifying who’s at the door, so these attacks typically come through communication channels, such as email, text messaging, and other communication channels. For that reason, everybody needs to be vigilant about it, and you're only as secure as your weakest link. Any one mistake can create chaos within an organization. That's the first thing. If you look at some of the attacks that we see over and over, they're the same type of attacks, especially on healthcare. If you look at healthcare, there's a lot of attack surface, a lot of different devices, disparate devices, people connecting from everywhere. Everything's running over IP. There's a lot of data. There's a lot of money involved and a lot of money changing hands. There are a lot of participants. There's a lot of communications in which these attackers insert themselves into.

The other thing in healthcare is that there are lives at stake. Attackers know this, and for that reason, they're delivering these ransomware attacks often, and it's really plaguing the whole industry right now. The reason is that the attackers know that the healthcare organizations will pay the ransom. That’s another very dominant attack that we see. The second one especially in healthcare, is that there are a lot of transactions. There's a lot of money involved and a lot of participants, which opens up opportunities for these attackers to insert themselves into these communications.

The second most dominant type of attack is business email compromises and wire fraud. The FBI says that about 50% of all monies that are stolen by cyber criminals are the result of wire fraud and business email compromises. It's very important to have good controls in place, to have good processes and procedures in place when money's changing hands, and to have great partners too. That's probably the next thing on the list: knowing who you're doing business with. You're only as secure as your weakest partner that has access to your data, so you can have all the security controls in the world, all of the greatest talent on your team, and the best budgets, but if you're sharing data with third parties and they're not doing the same in terms of securing that data, then you could end up in a lot of trouble.

In the second part of this video interview with Pharma Commerce Editor Nicholas Saraceno, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, outlines some of the common cyber threats faced by healthcare companies.

Safeguarding Customer Data

Expecting the Unexpected

, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, outlined the top mistakes healthcare organizations make in software development and maintenance from a security standpoint, including a lack of incident response plan; inadequate data encryption; absence of multi-factor authentication; neglecting security development lifecycle (SDL) practices; infrequent security updates and patching; and ignoring regulatory compliance.  Bernstein emphasized that proactive security measures and regulatory compliance are essential for healthcare software management. He also dove into some of the most common cyber threats companies are facing, and how he envisions those threats changing over the next decade.

What are the top mistakes healthcare organizations make when building and maintaining their software?

I think one of the most significant errors that healthcare organizations make is neglecting security by design and privacy by design principles, so when I look at those top five mistakes, I'm going to apply them to a security perspective. There may be other things, like user testing and other non-security related issues that are important too. These are security focused. First is lack of an incident response plan and having procedures there. Security incidents and events are always going to occur, so it's critical to have a plan and procedures that'll govern what activities should take place when a breach occurs. A good incident response plan will also identify key stakeholders inside and outside of the organization, including law enforcement. Inside would be people like the C-Suite, HR, corporate counsel, etc. Having an incident response plan is critical, because there are always going to be security incidents and events, and if you don't have one, you're in big trouble. The other part of that is having a partner to help you respond if you don't have internal capabilities.

The second one is inadequate data encryption. I think if you look at healthcare software, it often handles sensitive data, including PHI [protected health information]. Failing to implement strong encryption for data that's in transit and at rest is a big mistake. You want to make sure that your sessions, those communications and that this data is not going to be stolen, snooped, or leaked in any way. The third one is really the most impactful piece. When I look at the security investigations that we perform, over and over, we come into a situation where there's a breach, and we determined very quickly that multi-factor authentication was not implemented. Multi-factor authentication is a very simple solution. If these organizations are building applications without it and we’re not requiring it at the end user side, they're making a big mistake. Many of these breaches could be avoided. These compromises could absolutely be avoided if there was multi-factor authentication offered as a feature.

The fourth one is just SDL security practices. When bringing an application or software to the marketplace, it's very critical to have independent security penetration tests performed on those applications before you bring those applications into live production environments. What I mean by that is we do application security penetration tests to see what type of deficiencies, vulnerabilities, and flaws may exist within the software before they are put into production. The other thing is not performing just security tests, but also performing secure code reviews. There’s a saying that says the code never lies, and it's true. If you perform secure code reviews, static reviews, and dynamic reviews, it's a critical part of this, and you'll always identify the flaws, the vulnerabilities, and deficiencies that will allow attackers to access those applications in an unauthorized manner, leak data, and really create chaos on your application.

The other part of the application security process is that as these applications are updated, when new releases are made, it's critical to review those code modules of those updates. Whether they're security updates, functionality updates, if you're not reviewing those code modules as they're put into production, you're making a big mistake. That's four, I've got two more. The fifth one would be just lack of regular security updates and patching. Failure to apply regular updates and patches to software will leave it vulnerable to known exploits, so it has to be done often. Every day, there are new critical vulnerabilities being announced. If you're not patching the software, you're making a big mistake. That's five. I just want to throw in a sixth one, which is really also equally important to the others, and maybe more important in a lot of ways.

When we work with clients, they hire us for two reasons. One is to secure their infrastructure, their applications, and software, but two is to comply with the regulatory mandates that govern them. If you look at regulatory compliance, it has to be on your top list of priorities to be in compliance with the various legal and regulatory mandates that may affect you. In healthcare, it’s HIPAA here in the US. Over in the EU, you have GDPR, and having an expert, trusted advisor can help the organization avoid the pitfalls of being out of compliance with these regulations, but definitely don't ever neglect compliance.

In this video interview with Pharma Commerce Editor Nicholas Saraceno, Jeffrey Bernstein, director of cybersecurity and data privacy for Kaufman Rossin’s risk advisory services, explains the top mistakes healthcare organizations make when building and maintaining their software.

WEE request process

 Could you describe what the Waiver, Exception or Exemption (WEE) request process entails?

So essentially, under the statute, there are different conditions that a member of the supply chain can claim. For instance, if some requirement causes them undue economic hardship—that’s just on example—they can apply for a waiver, exception, or exemption. There are some parameters that are put out by FDA in their guidance on this, which is all available on their website. HDA is also going to have a compilation of all the guidance that the FDA has done, to put everything in one place and walk people through so that you can know what to do, such as if you need a WEE, here are the steps. Here's where to go on the FDA website.

The way that you do it on the FDA website, it's through their portal, NextGen. It looks a little daunting, but I think it's been pretty much simplified. When you're applying for a waiver, exception, or exemption, you need to really spell out why you need it, what you need it for; if there is a time period you think you're going to be ready for compliance in six months—be more narrow—and then also describing the problem, describing why you can't meet that particular requirement, essentially providing justification for why you need this exemption.

 What other sessions or topics at the Traceability Seminar are you looking forward to?

FDA speaking is always sort of the number one, and it's funny, sometimes they say new, exciting things, and sometimes they just provide reassurance or reiterate what they've put out, or clarifications. It's just a time for them to be in front of our members and the attendees of the conference, so that's always good. We also have a couple different panels this year.

For instance, we have a legal panel tomorrow afternoon with some lawyers who practice in this space, in which we’re trying to get their perspective on what they're hearing from clients. And that's always interesting, because sometimes, it uncovers different issues that—at the trade association level—we might not be aware of, and that every day trading partners might not have heard of. It's just interesting to see the perspective of different folks, along with what kinds of problems or issues companies are going to them to try and help them solve.

In the final part of her interview with Pharma Commerce Editor Nicholas Saraceno, Elizabeth A. Gallenagh, General Counsel and Senior Vice President, Supply Chain Integrity, Healthcare Distribution Alliance, discusses the WEE request process itself, while also providing her thoughts on other sessions that have garnered her attention.  
  


Latest Conference Coverage

HDA 2024 Traceability Seminar: The WEE Request Process

Waivers, Exceptions, and Exemptions session 

 You recently spoke on a panel regarding “Filing Waivers, Exemptions, Exceptions: Lessons Learned – and other HDA Perspectives on DSCSA Implementation and Readiness.” What was discussed during the session, and what questions did the audience raise?

I did the panel—it was myself and also two of my colleagues, Tish Paul from OFW Law and Brian Waldman from ArentFox Schiff. We work together a lot on these issues, and have worked together for years. We talked about the WEE process, or waivers, exceptions, and exemptions process, just in terms of this being a tool that is written into the statute for DSCSA. It's something that's available. It's something that FDA has encouraged. We talked about the need for timely decisions about WEEs, as well as some of the complexities—even if a WEE is granted, there are also additional complexities with managing those, so in addition to the WEE process, WEEs themselves, and where FDA is on all of that, we talked a little bit about HDA’s positioning right now, given our members’ focus on implementation and what we're seeing in the industry, just at least in the distribution sector, which really does provide us with an eagle's eye view, both upstream and downstream.

That’s kind of unique. We really just wanted to share with the audience what we're experiencing. Then, we conducted some Q&A, where we got some good questions about some very technical things that folks are grappling with, such as transition or grandfathered product, SOPs, or what a pharmacy do when they have a patient in front of them and no data with their product transactions. It was pretty diverse in terms of the topic or subject matter. We originally started out doing just what we had planned—the WEEs—and then, as we got closer and closer to the date for the presentation, realized there was just so much going on right now.

In an interview with Pharma Commerce Editor Nicholas Saraceno, Elizabeth A. Gallenagh, General Counsel and Senior Vice President, Supply Chain Integrity, Healthcare Distribution Alliance, highlights the hard-hitting points that she anticipated will be covered during her session at the 2024 HDA Traceability Seminar.

HDA 2024 Traceability Seminar: Filing Waivers, Exceptions, and Exemptions

pharma DSCSA compliance

 Following FDA’s implementation of the stabilization period last year, what is the pharma supply chain's overall preparedness in adhering to DSCSA’s Nov. 27, 2024 compliance deadline?

We're in a good place. It's not ready 100%, but FDA is implementing this one-year stabilization period, which allowed the supply chain to mature, and the connections really helped. We're at a much better place than we were last year, and we're closer to really being where we need to be, but there are still connections between trading partners where the data quality is poor, where there's discrepancies in information that's provided, and those need to be cleaned up. If there's a discrepancy or you don't have data, but you have product, that product can't move to the next trading partner, so a wholesaler can't sell it to a dispenser, and that means that product may not get to the patient who is waiting for it in the pharmacy.

All of these little end bits of data quality and making sure that your systems and processes are working and interoperable—that all has to be fixed and cleaned up. If you don't have that, if you're not ready, or your trading partner isn't ready, you got to go back and get that exemption, or WEE, that I talked about earlier.

 Although not required per the DSCSA, what have you heard in terms of companies tagging their products with RFID labels?

 Ten years ago—or even 15 years ago, we thought RFID was the next wave of making sure that you know where the product is, but we're not there. In fact, the DSCSA requires that two-dimensional barcode, and that takes enough real estate on the label and the package, that's where all of the focus is. Some companies are using RFID to help identify where a product is within their four walls, but it's not being used—as far as I know—for that tracking and tracing of a product through the supply chain. It's all focused on the two-dimensional barcode.

In the final part of her interview with Pharma Commerce Editor Nicholas Saraceno, Ilisa B.G. Bernstein, President of Bernstein Rx Solutions, LLC, comments on industry’s preparedness for DSCSA compliance and provides an update as to where pharma is in terms of RFID label adoption. 

HDA 2024 Traceability Seminar: How Prepared Is Pharma for DSCSA Compliance?

best practices stabilization period 

 As the end of the stabilization period approaches, what best practices should compliance teams consider?

It depends on whose shoes you're standing in. If you're a dispenser, you should know where your data is being held, because sometimes the wholesaler is holding the data. Sometimes you may have a solution provider, so that goes back to the SOPs and making sure that your employees know where they can get the data if they need to, and that they know how to verify the product identifier, because now, starting in November, for most cases, the product identifier will be on the package and available to be able to verify with the manufacturer if it's the accurate and the correct product identifier.

They should have been able to do that before, and they were able to do it before, but now, the product identifier will be on the transaction documentation that's traveling with the product. Having those relationships with your trading partners [is important] because it's all about who you're doing business with, in order to have that confidence in the transaction and knowing that you're getting legitimate product.

That actually goes back to another best practice, which is making sure that you have the systems and processes in place to identify suspect and illegitimate product, along with what to do if you find it. The supply chain should have been doing this since 2015, but now this is more important than ever, as now the whole supply chain has moved on, and DSCSA has matured.

In the second part of her interview with Pharma Commerce Editor Nicholas Saraceno, Ilisa B.G. Bernstein, President of Bernstein Rx Solutions, LLC, discusses the best practices that compliance teams should consider as the end of the stabilization period approaches this November. 

HDA 2024 Traceability Seminar: Best Practices Amid the Forthcoming Stabilization Period

DSCSA legal advice 

 You have an upcoming panel on “Legal Perspectives for DSCSA Compliance Teams.” What hard-hitting points will be discussed during the session?

It's a panel of four lawyers in a room full of supply chain experts. We've identified a couple of different issues and really want to get at it at a very high level for them [compliance teams]. The first and foremost issue is how important it is that if you or your supply chain trading partner are not ready, that you should be applying for a WEE. A WEE is a Waiver, Exception, or Exemption, and for the most part, trading partners should be applying for an exemption if they know that there may be some problems in moving the data, receiving data, or transferring the data to their trading partner. It may be that they're ready, but their trading partners aren't. This also includes how important it is to get a WE, which is something that you apply to FDA for, you explain why you need an exemption from certain requirements of DSCSA in order to be able to keep drug moving through the supply chain because it's all about making sure the drug gets continues through the supply chain to the patients when they need it.

Another area that we're going to be focusing on is how important it is to have SOPs, standard operating procedures. This is a no brainer because most of these companies should have SOPs in place, but the law requires you to have systems and processes, and that's all about having those processes in place, having them written down, training your employees on them, making sure that they follow those SOPs, and then training them again. That's a really important aspect of why that is important, because when FDA or a state investigator comes in, they're going to ask and look at what you are doing, and you can show them your SOPs, which are documented of how you are complying with the law.

Another aspect that we're going to be talking about is there was a Supreme Court case that came down earlier this year that impacts a lot of what FDA does, and it could impact parts of DSCSA. For example, what the case did is it changed the standard that courts will look at when they're evaluating whether or not FDA has interpreted a law correctly. If the law doesn't spell out how FDA has to implement it, previously, FDA would take a reasonable, rational approach. What this new court case says is it's up to the courts to determine if the law was interpreted correctly, and so how does that impact the DSCSA? It could impact wholesale distributor licensure rules that are in preparation right now. A proposed rule was published two years ago, and FDA will be finalizing it soon. What this means is FDA is going to look really carefully to make sure that they get it right, because they don't want a court to second guess them, and so that we're going to talk a little bit about that as well.

In an interview with Pharma Commerce Editor Nicholas Saraceno, Ilisa B.G. Bernstein, President of Bernstein Rx Solutions, LLC, highlights the hard-hitting points that she anticipated will be covered during her session at the 2024 HDA Traceability Seminar. 

HDA 2024 Traceability Seminar: Legal Advice for DSCSA Compliance Teams

Michael Rowe counterfeit product

What else should be done to limit “bad actors” from attempting to bypass the FDA by sneaking counterfeit drugs into the supply chain?

The DSCSA is not the one and only way to keep counterfeit product out from the supply chain. I think the FDA even hit on this. Having trusted trading partners that you're doing business with is critical, and no law is going to circumvent that type of due diligence that when you're purchasing pharmaceuticals, making sure that you're doing it from reputable sources. If a deal seems too good to be true, it probably is. I think trading partner trust is critical. I think we're also seeing a proliferation of bad actors almost circumventing the actual supply chain and going direct to consumers, and so that's also important to keep in mind—that there needs to be broad, actual awareness to patients that you need a valid prescription and you need to go to a valid pharmacy to get a prescription medicine; going to Facebook marketplace to purchase prescription drugs not a good place to go.

I think a lot of education still needs to happen. If we think about it, manufacturers and wholesalers play a huge role in keeping the supply chain safe, but really, the pharmacies are at the end of the line, and really need to be fully aware of their DSCSA obligations. They're there to help pharmacies screen bad product, and so making sure that when you're receiving product in that you're doing the right data checks, you are looking at the seals, looking at how the product is labeled, if anything is suspicious, raise that. I think our pharmacies—they're very busy and have a lot of competing priorities—but I think that's an area that could use some more bolstering. And I think that’s where the FDA and other stakeholders can come in and educate pharmacies.

The other area that is a challenge is duplicate serial numbers. The law requires that each product has its own unique serial number on there, so if a number has a duplicate on there, that obviously is a warning sign. I think what is difficult is that our supply chain isn't just linear; in terms of this serial number, it goes from A to B to C, sometimes it goes to A to B, then it goes back. There's these returns, or products are moving, so it doesn’t necessarily require that that serial number -be seen again. I think that's where we must determine, how as an industry, do we flag a duplicate serial number better in a way that also doesn't prohibit things like returns and products that are coming back and going back out that's still good.

I think the industry is still thinking about how to get through duplicate serial numbers as another area to help bad actors. I think the other is, what the industry is still sorting through, in my mind, trading partner credentialing. Under the DSCSA, everyone has to be properly licensed to sell or distribute pharmaceuticals. But we've seen instances where people fake these credentials. They fake that they have a license from whatever state to distribute this. I think more work using technology to credential these trading partners—in order to prove that they're authentic, that they have a valid license, and that these aren't made up—is another area of importance as well.

There's been a lot of great pilot work and groups that have done that. I feel like they've not gained a lot of momentum, just because we're still trying to do the basics of blocking and tackling, of sending good data on time, and it's hard to then build a use case on well, “I need to invest more technology or processes around credentialing licenses when I can't even send data and move the product.”

In the final part of his Pharma Commerce video interview, Michael Rowe, Two Labs’  Senior Director of DSCSA/Serialization Compliance Services, comments on other ways to limit ‘bad actors’ attempts to sneak counterfeit drugs into the supply chain, aside from the DSCSA.

Keeping Counterfeit Goods Out of the Supply Chain

Michael Rowe Stabilization Period

Do you believe there is any chance of the FDA extending the stabilization period beyond Nov. 27

If history repeats itself, there's been some sort of delay in enforcement pretty much for every major deadline up until now. Now, I will say that you are correct. The FDA has recognized that small dispensers or pharmacies need more time to get ready, and it was announced right before the public meeting—and then was reinforced at the public meeting—that any pharmacies with 25 or fewer pharmacy and pharmacists on staff, would have another extension of the stabilization period, another two years. So actually, Nov. 27, 2026 for those smaller pharmacies. I think primarily pointed at independently owned pharmacies, was really the goal there. So the FDA has extended it, but only for those entities that qualify.

What FDA has stated is that any other type of trading partner—manufacturer, wholesaler, a larger dispenser—regarding the stabilization period, they're very adamant that it is not going to be extended in a broad fashion. What the FDA was really posing at the meeting and in their updated guidance was that they're not going to offer broad enforcement discretion, but if you as a specific trading partner don't feel that you can comply with the requirements after Nov. 27, you could file an individual waiver exemption or exception—fondly called a WEE—so the FDA is saying, we're not going to give a broad delay, but you, as an individual trading partner, can get one, but it's up to FDA’s review.

A lot of the public meeting was spent on how feasible is that, how many companies will apply. There are many companies now that maybe weren't thinking about filing for a waiver and exemption that are now. I think that's the stance from the FDA. I'll put on my Michael Rowe hat here—one of the recommendations that I made at the public meeting was that there still needs to be another relief valve beyond a trading partner-specific relief valve. And what I mean by that is, we have a customer that sends data, and then their customer goes, “Hey, you sent me the wrong data. Can you fix it?” It's those types of errors where the product is still good, and if a risk-based analysis is done to prove that it's not a suspect drug, can we at least let that product move so a patient doesn’t get impacted at the end of the day? I think that's the big worry. It’s not that there are companies simply not passing data, but it's when there's a problem with the data. we can't quickly fix it right now. So one of the recommendations that I hope FDA takes into consideration is almost a threshold risk-based approach that says, “as long as there's these other measures that are done to verify that the product is authentic, can we let the product go through, even though maybe the data isn't with that product.”

We obviously have to limit that. We can't make it super broad, because that could impact patient safety. If there's a blanket bypass allowed, that could potentially, like counterfeiters, go in and say, “Oh well, I'm operating under this bypass threshold allowance,” so it's got to be balanced, but I fear that if we even move the needle another 10%, that could make roughly a quarter of all medicines in the US quarantined at any given day.

There's not that much safety stock in the supply chain, and you now have a pharmacy that has a patient there trying to get the medicine, and they're saying, “I can't order the product because it's stuck at a wholesaler in quarantine because there's bad data on it.” It's going to be a hard—maybe pun, not intended—pill to swallow, to say, well, this is actually authentic product, but I can't give it to you because I can't validate the serial number.

So I think it's going to be a difficult position for a lot of companies to be in. I don't think FDA will give another broad enforcement delay like they have in years past, where they say everybody gets another year. It's going to be very controlled, very measured.

It was actually quite funny at the FDA public meeting, they did one of those word doodles, where people type in their response and they said, “what do you think FDA should do, or what do you what do you think about the stabilization period, and what should happen next?” As more people type in the same word, the bigger it gets on the screen. So all of a sudden, everyone starts saying, “enforce DSCSA, do not delay.” That becomes the biggest thing on the board, and then this other word stops coming up, “delay, delay, delay, delay.” So now up on the screen, you have two words that are in complete polar opposite of one another. I'm in the camp of another broad delay is not going to be beneficial to the industry.

In this part of his Pharma Commerce video interview, Michael Rowe, Two Labs’  Senior Director of DSCSA/Serialization Compliance Services, predicts the likelihood of stabilization period postponement. 

Security

Latest News

More News