2012 Product Security Report

Fig. 1. By GS1’s accounting, there are serialization programs going live all over the world as of early 2012. Programs in Turkey and France are essentially up and running. Credit: GS1

Securing the distribution of pharmaceuticals remains a constant worry for pharma brand managers, industry regulators, and healthcare providers looking more closely at the quality and integrity of the products they acquire. The threats range from cargo theft to diversion, to actual counterfeits, and now include verifying the temperature and physical conditions during shipment and storage. Solutions—and there are many—range from real-time tracking of products during shipping, to anticounterfeiting measures like holograms and microcodes in or on product packages. Nearly all of them would function more effectively if they were undergirded by a universal, item-level tracking system—the “track-and-trace” or “e-pedigree” systems that have been debated for nearly a decade now.

As the old saying goes, “Time and tide wait for no man,” and when it comes to establishing national drug-tracking standards, the tide is already going out for the US. What was merely rumored or conjectured a year or two ago—that China, the predominant source of counterfeit pharmaceuticals worldwide would have a national track-and-trace system in place before the US—is now becoming accepted as fact. True, a Chinese national program is one thing, and making it an effective security measure both domestically and internationally, is entirely another. And China is by no means the only country moving forward; Turkey’s program is more or less in place; India and Brazil have programs that are going forward, if spottily; and the EU, as part of its “Pharmaceutical Package” passed by the European Parliament, has made a transnational tracking system, based on 2D barcode, a centerpiece of a modernized drug-distribution system.

In the recent past, business-value drivers of tracking systems, such as better management of recalls, and faster and more accurate reconciliation of chargebacks and rebates, were looked on as economic benefits of tracking systems. Now, the number of one-to-one (one manufacturer to one provider) or closed tracking systems are increasing all over the pharma supply chain, even as, internationally, more tracking systems are being adopted—and the business owners of these efforts are accruing those benefits. But the Holy Grail objective of tracking systems—a uniform national program in the US (and one that is compatible with international programs)—remains out of reach.

Establishing a national standard was the main driver of the so-called RxTEC Act, the effort promoted by a cross-industry Pharmaceutical Distribution Security Alliance (PDSA). That draft legislation was included nearly wholesale in this year’s reauthorization of the Pharmaceutical Drug User Fee Act (PDUFA-V), but was dropped from the final, reconciled legislation signed by Pres. Obama at the beginning of July as the FDA Safety and Innovation Act of 2012.

According to Allan Coukell, director of medical programs at Pew Health Group (a Washington, D.C.-based public advocacy group, part of the Pew Charitable Trusts), there have been nearly nonstop daily briefings within the key Congressional committees—the House Energy and Commerce Committee, and the Senate Health, Education, Labor and Pensions Committee—“given that there was intensive discussions and negotiations on this subject in the run-up to passing the PDUFA legislation,” and that a new bill, incorporating parts of the RxTEC Act, and parts of prior Congressional bills, could reach the floor of both houses before the end of the year.

“Everyone agrees that there is a need for a uniform national law,” he says. “Our view, and that of others involved in the negotiations, is that the federal law should not create a system that is not a significant improvement over the current situation.” That’s a knock against RxTEC, which would not require item-level tracking through the supply chain; and because the California law set to go into force starting in 2015 does require item-level tracking, but also allows for federal preemption of its law, the RxTEC Act would be, in effect, a step backward.

Many in industry are not waiting. “Pfizer is not slowing down our serialization or supply-chain integrity efforts in any way” despite the lack of a federal law, says Peggy Staver, lead director, US Trade and Serialization Strategy at the company. “In fact, we are ramping up our serialization efforts to ensure compliance with the various emerging regulations.”

“We assembled a project team several years ago, when the original California e-pedigree date of 2009 was looming, but then disbanded when that was postponed to 2015,” says Ian Rosenblum, associate director, IT supply-chain, at Biogen Idec (Weston, MA). “With the goal of increasing supply chain security, ensuring that our products are safe when they reach our patients, and due to the emerging global regulations, we re-engaged a cross functional global team last year. We quickly confirmed our strategy, chose our vendors, and now have a global centralized solution in production.” Rosenblum says that the company has already addressed serialization requirements in Turkey and Argentina with local partners, and is going through the process of determining their global rollout strategy.

In fact, most multinational pharma companies have some level of activity going on; Greg Cathcart, president of Excellis Healthcare, estimates that 10% of the 7,000—8,000 pharma packaging lines around the world have serialization capability. “The big players are ramping up their line-by-line implementation projects already,” he says, “so now some of the focus is shifting to mid-tier companies, and contract packagers.”

Somewhat unexpectedly, the generic manufacturers are moving ahead as well. Both Teva Pharmaceuticals and Mylan Labs have serialization projects underway; others are expected to follow.

Packaging equipment dogfight

With serialization projects slowly moving forward, packaging equipment and software vendors are gearing up for a lively marketplace battle. “Our marketing activities have escalated in the past six months,” says Bill Bonaccorsi, director of marketing at Domino North America, a leading labeling and marking company. “We’re selling directly to pharma manufacturers, as well as acting as OEM for packaging machinery vendors who incorporate machine vision and coding into their production lines.”

Bonaccorsi says that while the process of putting a serial number somewhere on a package (either by coding on the packaging line, or by applying precoded labels) is relatively straightforward, the real challenge is integrating the item-level serialization with case and pallet packaging, and serving up the serialization data so that products can be tracked through the supply chain. The company is also banking on its network of 25 subsidiary offices around the world and 200 distributors.

Even so, smaller companies who have focused nearly exclusively on pharma packaging have stolen a march on many of the big players. Two that get frequently mentioned are Systech International, and Optel Vision. Both combine machine vision and inspection hardware expertise with software development of data capture systems. This year, Systech boosted its software capabilities by acquiring Apostrophe Systems, a developer of cloud-based manufacturing software services. Bob De Jean, CEO of Systech, says that the action is geared to mid-tier pharma packagers who might lack the IT resources to manage the high volume of data generated during serialization runs.

At Optel, marketing manager Ken Fallu says that the company has doubled in size in the past 18 months, and now has more than 150 project engineers and software developers to manage serialization implementations in pharma. “Our strength is that we can essentially connect any hardware to any software, giving customers the flexibility to choose both packaging equipment vendors and the enterprise-level software needed for supply-chain management.”

The package-to-case-to-pallet alignment, generally known as “aggregation” in the packaging industry, continues to be a worry for making serialization effective as a supply-chain practice. The California Board of Pharmacy, which restarted quarterly meetings on preparedness for its 2015 deadline, has scheduled meetings on this topic during the latter half of this year, and one of the approaches to aggregation is to allow for “inference” of what’s in a case or pallet when it is delivered from a manufacturer to a trading partner. But at least one packaging equipment vendor, Omega Design Corp., is addressing this issue in a novel way: By putting an intermediary barcode on the bottoms of pharma packages, its machinery can then assemble and verify each item in a bundle, and each bundle in a case or pallet. Aggregation/deggregation occurs at other points in a supply chain (such as when totes of product leave a wholesaler’s distribution center), but the solution could go a long way to upgrading the precision of manufacturers’ packaging processes. Omega offers its own serialization software, “OmegaTrack,” but also integrates others’ software into its packaging machinery.

Glen Siegele, Omega president, says that the company’s latest product offering is a manual case-packaging station, which arose because the company’s international business is increasing, and many non-US packaging lines don’t deal in the high production speeds that occur in the US. “This gives the customer flexibility to automate or keep manual some of its processes, lowering capital costs and decreasing the footprint of a serialization process on an existing packaging line,” he says.

European packaging vendors, building on their experience in serialization projects there, are also gearing up their efforts. Laetus, which announced the completion of a serialization project for Astellas Pharma production in Meppel, the Netherlands, earlier this year, is expanding its PrintSpect line of coding stations. Bosch Packaging Technology has added a Tamper Evident module to its labeling machines, in order to meet both serialization and package-integrity features to its packaging machinery lines. (The coming EU directive on serialization has specifications for both serialization and tamper evidence.) About 18 months ago, Körber Medipak, which supplies both packaging technology and contract packaging services, acquired Seidenader, a German inspection and coding company, and is about to launch an updated track-and-trace solution for pharma serialization, according to Len Valeo, a marketing consultant with the company’s US division in Clearwater, FL. Seidenader will also work with Cognex to deploy the latter’s machine vision technology in serialization applications.

Another company tapping into German packaging expertise is Mettler-Toledo, which acquired Pharmacontrol Electronic GmbH) this spring. M-T will combine PCE’s inspection and tracking technology with its own product inspection solutions; M-T can also offer global support of its products.

Middleware

While one battle is going on with packaging and serialization hardware, another is shaping up in the middleware arena—where either serial numbers from a central source are handed down to the packaging lines, or aggregated serial data is handed up from the packaging lines to an enterprise-level repository. The ability to link those data with, for example, warehouse management systems or order-processing systems is a key opportunity, and challenge, for manufacturers.

Technically, line-management programs from Systech, Optel Vision and others can communicate with enterprise-level ERP systems, specifically those of SAP AG, the enterprise-software vendor that is dominant in life sciences globally. But at the same time, many, if not most, serialization implementations involve additional software vendors. Axway, with its Track & Trace solution, has been deployed in a number of implementations, and the company is currently engaged in a global deployment with Sanofi-Aventis. IBM and Oracle have track-and-trace modules that attach to their enterprise-level software suites. SAP itself has modules, called AII and the Object Event Repository (OER), that also connect to packaging-line systems.

“Biogen Idec saw fit to make use of both Axway for serial number management and a global event repository, and TAKE Solutions for managing serialized product in its warehouses,” according to Biogen’s Rosenblum.

All of these, in one fashion or another, address the event-management requirements of the GS1 standard. GS1 is the de facto standard for managing and sharing serialized data; alignment with its EPCIS (EPC Information Service) standard is the hallmark of a globally compliant software solution.

“It depends on how much you want to automate the process of matching serial numbers to events, to non-manufacturing data like warehouse locations or production orders,” says Seidenader’s Valeo. “Many of the existing solutions require a manual intervention, but over the next five years, that’s where all the action is going to be.”

Fig. 2. FDA’s annual count of counterfeiting cases opened in the preceding fiscal year. The number of cases remains elevated well above the levels seen in the early 2000s.

TAKE Solutions, for example, touts an “edge” software solution that aligns warehouse operations with the serial data generated in production lines, according to Matt Walker, EVP, supply chain. Its technology is especially suited to handling materials management processes in warehouses, the “geneology” of products being shipped, and coordinating operations with trading partners. Similar capability is offered by Acsis, through a suite of tools called Productrak SPDM (SPDM stands for “serialized product data management”).

Verify Brand is another IT vendor that put its life-sciences serialization applications on the shelf, but is now back, touting VB Enterprise 4.0 for Life Sciences. The company does not take production data directly from packaging lines, but can receive those data from other software systems, and then integrate its serial data management with events. Of special note is its capability to provide supply-chain monitoring, as an anticounterfeiting and diversion-control application, according to Scott Pugh, life sciences industry manager at Verify. The company’s software is offered as a cloud-based service.

Covectra, a software company aligned with a contract packaging partner in Ireland, MSO Group, has a software application called Authentitrak that it is marketing both as an anticounterfeiting solution, and to provide brand owner feedback from the marketplace, such as connecting with patients via a cell phone-based communication of the package’s serial number. Applications include medication adherence programs, and better control of diversion of controlled substances. “We’re bidding on a project to enable prescribing physicians to match a serial number with a prescription, so that the prescribing of controlled substances would be subject to less abuse,” says Steve Wood, company president.

Another cloud-based provider is TraceLink, which is focused primarily on collaboration tools between brand owners and contract manufacturers. But because of its heritage as the founders of SupplyScape, one of the early pedigree solution providers, TraceLink retains significant activity in managing existing, state-based pedigree requirements. Its Business Cloud service provides GS1-compliant sharing of track-and-trace data.

rfXcel was another of the companies that developed software tools for handling pedigree documentation (and, now, the e-pedigree structure of the California mandate). Now, it has a suite of products, branded as the rfXcel Traceability System (RTS). The suite coordinates aggregation of packaging line data and reporting to/from SAP enterprise systems; it is also GS1-compliant. A novel expansion of this capability is a Prior Authorization Module, which is said to connect prescribing physicians with insurance company formularies (so that the physician knows he is prescribing a drug for which the patient will be reimbursed). That’s an expansion of track-and-trace capabilities that has only been hinted at in past years, but it remains to be seen whether health provider IT systems, as well as insurers, will be able to link up their databases with a track-and-trace system. The company says that the module can also be used for physician (or, where required, wholesaler) compliance with FDA Risk Evaluation and Mitigation Systems (REMS), a post-approval requirement that many drugs with complex prescribing requirements have (Pharmaceutical Commerce, March/April, 2011, p. 1).

One other IT vendor hanging in from the early pedigree days is ROC IT Solutions, whose owners had worked at an IT company called Blue Vector in the mid-2000s; they are supporting a handful of existing implementations of that software, and are marketing a track-and-trace solution based on their proprietary technology, called aspect-oriented programming.

There could be a general re-sorting of all these industry offerings as SAP brings forth a new addition to its enterprise computing environment: Global Batch Traceability (GBT). GBT is not built specifically for the pharma industry, but that industry’s needs were clearly part of the development process, according to Steve Cloughley, a product manager there. “Pharma companies are currently using either AII, which is usually included in any SAP installation, even if the client doesn’t activate it, or Object Event Repository, which was built in the early days of the Auto-ID movement,” he says. (GS1’s EPCIS and related standards are, roughly speaking, the inheritors of the Auto-ID effort.) “Some clients use both—AII for communicating serial data, and OER for EPCIS-compliant event tracking.” With GBT, an effort is being made to be able to connect front-end supply-chain activity—raw materials or intermediates being brought into a batch production run—with the lots or batches that come out of manufacturing, and then enter commercial distribution.

Cloughley notes that SAP was one of the vendors involved in a pilot program for serialization and point-of-dispense authentication, which was run by the European Federation of Pharmaceutical Industries and Associations (EFPIA) in 2010, (Pharmaceutical Commerce, January 2010, p. 8), and the company’s Life Sciences unit has a schedule of bringing pharma clients together periodically to discuss supply-chain issues. Potentially, GBT could address both the needs of the supply-chain security managers concerned with serialization and pedigree, and the product-sourcing managers who are concerned with protecting the integrity of the raw materials and intermediates they purchase. “This could be a game-changer,” he says. “Industries that do batch processing, including pharma, have been wanting this since forever.”

Although the bulk of industry attention is on serialization right now, that application is only a partial solution to actually authenticating an

Fig. 3. A full-featured product label includes human- and machine-readable elements; options could include authentication features on the label itself, as well as RFID electronics. Credit: Verify Brand

individual package at point of dispensing. A number of companies, such as Sproxil, PharmaSecure and a few others, have been marketing systems that sidestep nearly all of the track-and-trace requirements, with a simple, cell phone-based system that allows customers to dial in a serial number and get confirmation that the product is authentic. Both of these systems are being used in the developing world, and are having some success in corralling the rampant counterfeiting that goes on there. But the authentication is not 100% reliable, and the systems are not, generally speaking, GS1-compliant.

Pharma companies, selectively, continue to invest in physical security measures, especially for high-value branded products that are commonly counterfeited. A vast cornucopia of holograms, microprinting, microscopic taggants and other techniques are available, many coming out of the same vendors that serve the document- and currency-anticounterfeiting industry.

One such company that has had takeup with some pharma clients is AlpVision, which offers a technology based on the random patterns inherent in any printing or papermaking process. Most recently, it announced “Fingerprint” technology, and a collaboration with a medical-products packager to provide authentication based on the surface patterns in molded-plastic containers.

Bilcare Research, a contract packager and provider of blister-card packaging materials, offers an embossed film for counterfeit prevention of blister cards, and also a technology called NonClonableIDT, which involves a surface treatment of packaging, combined with a handheld scanner. “This technology is being used in our home country, India,” says Dr. Ajith Nair, head of global R&D, “and for that reason pharma companies were reluctant to look into it. But now we’re finding that multinationals looking to expand their operations in the developing world see that as an advantage, because it’s been proven in those markets.”

Another approach, from Schreiner ProSecure, involves combining various types of taggants with packaging (including labels, which another division, Schreiner MediPharm, markets). The company also provides sophisticated tamper-evidence solutions with its labels. Schreiner’s US HQ is in Blauvelt, NY.

NanoGuardian has developed an “on product” authentication method that allows for encoding symbols (even serial numbers) on the surfaces of pills and capsules themselves; these marked pills could then be verified with either a lab-based analyzer, or an optical analyzer for field use. The company announced at the beginning of this year that a pharma client was going to deploy it, but no further details have been announced.

A seemingly close competitor to NanoGuardian is TruTag Technologies, which is developing a silica-based, chemically inert microscopic taggant that can be added to drug tablets, food products or consumer packaging. The taggant contains a spectral signal, which can be encoded to specific batch lots, and then read with lab- or field-based spectroscopes. The company is still gearing up operations, but has sample lots in the thousands for pilot-testing purposes, according to Peter Wong, COO.

Two companies that operate internationally and across a wide swath of security and anticounterfeiting applications—SICPA, and OpSec Security, agree that physical countermeasures are a necessary complement to serialization. “As a security organization with extensive experience using serialization to address counterfeiting and diversion, SICPA strongly encourages the combination of visible codes with some form of material-based security,” says Jack Henderson, business manager. “Many companies are using serialization as a platform to integrate covert or overt security technology to proactively address potential counterfeiting or diversion issues.”

At OpSec, Lisa Hill, director, says that the company’s range of physical countermeasures, including proprietary optical-variable devices (e.g., holograms) provide essential security in supply chains, but US-based pharma companies are only halfhearted users of them. Outside the US (both for products being manufactured or shipped there), usage approaches 30% for branded products.

Cargo security

A couple years ago (especially after the break-in of the Eli Lilly warehouse in Enfield, CT, resulting in a $75-million loss of product), pharma logistics managers were energized to address what had been a nagging, but not severe, problem: theft of drugs in transit. Suppliers of controlled substances have been dealing with this for years, but only recently have criminals connected the high value of many branded drug products with the relatively unsecure means by which they have been transported. As a result of efforts by the Pharmaceutical Cargo Security Coalition (www.pcscpharma.com), cargo thefts have dropped dramatically; at the same time, FDA investigators, and international cargo security managers, have stepped up their monitoring and reaction capabilities.

Many pharma companies have subscribed to international monitoring services such as FreightWatch International (Austin, TX), LoJack Supply Chain Integrity, Kirsen Security and others that employ GPS or cellular technology to monitor shipment in transit. A sign of the times: earlier this year, FreightWatch was acquired by Carrier Corp., the parent of Sensitech. Sensitech is the market leader in onboard temperature- and condition-monitoring devices for temperature-sensitive pharma products; its technology had evolved from data recorders whose records could be downloaded manually at the conclusion of a shipment, to real-time monitoring of shipping conditions. Now, the temperature- and condition monitoring becomes part of overall supply-chain integrity monitoring.

Sensitech and FreightWatch aren’t the only game in town; several airlines that specialize in healthcare products transportation are using the GPS/cellular technology of OnAsset Intelligence to provide real-time tracking; Southwest Airlines Cargo has just announced a Cargo Companion service to this end. And, like comparable services provided by FedEx, UPS and others, the tracking can be continued outside the air lane—essentially end-to-end tracking.

Security + integrity

Fig. 4. The direction that standards like USP <1083> are going in align both sources of products (“good import practices”) with the security and integrity of finished products. Serialization and anticounterfeiting systems are part of the “distribution control systems.” Credit: Adapted from Abbott Labs, 2012 USP presentation

It doesn’t take a bright light to realize that if products are being tracked through supply chains for one reason, that same tracking could occur for security or pedigree purposes. That’s part of the logic that is bringing the pedigree/track-and-trace world together with that of logistics and antiterrorism security in transportation, and includes the efforts made by manufacturers with temperature-sensitive (“cold chain”) products.

In Europe, there is a broad-based movement toward implementing “good distribution practices” (GDPs) as part of the overall regulatory framework for product movement. GDP doesn’t resonate very much with FDA—which defers some aspects of pharmaceutical logistics to state pharmacy authorities&mdash;but it is resonating with the US Pharmacopeia organization (USP; Bethesda, MD), which began an effort last year to write a “general chapter” of recommended (not required; USP is not a regulatory body) GDP practices. Those practices would also extend to the importation of raw materials and intermediates, or “good import practices” (GIPs). “Even the largest and best-resourced manufacturers may rely on smaller players to supply ingredients or distribute their products. In such an intricate and intertwined system, this new general chapter can help stakeholders maintain supply-chain integrity,” says Desmond Hunt, PhD, senior scientific liaison at USP.

Data pools

Still to be defined and implemented is the next level up from enterprise data collection of serial numbers—sharing them with trading partners. Many of the existing track-and-trace systems operating today are essentially closed systems between one manufacturer and selected trading partners. A good example of this is EMD Serono, which has operated a track-and-trace system successfully for years now, requiring prescribers and dispensers of certain of its drugs to be registered and to document the serial number of the drug they are dispensing. But the eventual goal of regulators, such as California’s Board of Pharmacy, is to be able to walk into any drugstore or hospital pharmacy, record a serial number, and have a pedigree of that package regardless of where it was manufactured or how it was conveyed.

All of the Big Three wholesaler/distributors, and many of the regional or specialty distributors, are working with barcode-based tracking systems, but the volume of drugs being tracked (at least from one manufacturer to one wholesaler) is still slight. (Furthermore, the legalities of requiring trading partners to share pedigree information is still up in the air in the US.) There are at least two efforts of significance to provide the universal “data pool” that would allow many suppliers to interact with many trading partners—the 1Sync initiative of the GS1 organization, and GHX. 1Sync is the operational subsidiary of GS1; GS1 organization also certifies compliance with its own GDSN standards for data sharing. 1Sync is being used in a variety of industries, but has not as yet made significant headway in life sciences. GHX, which is owned by consortium of life sciences and healthcare-provider organizations, initiated a pilot project last year to bring pharma companies into its trading and contract-administration platform, while handling e-pedigrees. A company spokesperson says that “the pilot is ongoing” but there is no information to release to the public as yet.