Spinning up the pharma traceability wheel

There are centrifugal and centripetal forces carrying along the drive toward pharma traceability today: forces that bring the pharma supply chain into a more united and cohesive effort (centripetal); forces that are sending supply chain participants in different directions (centrifugal). And while much of the US industry is continuing a drive toward compliance with the Drug Supply Chain Security Act (DSCSA), passed in 2013 with a highly unusual 10-year implementation schedule, technology—and the vendors advancing technology—have continued to evolve, creating new opportunities for tracking the movement of pharmaceuticals throughout healthcare, or for preventing counterfeiting of drugs (one of the original objectives of creating DSCSA).

Industry progress had been advancing, if by fits and starts, when the global pandemic hit. Now, many industry experts expect that deadlines for various compliance milestones will be delayed by a year or more; the 2023 deadline for full DSCSA compliance is already expected to move to 2024.

Here are a few of the unifying (“centripetal”) forces:

●The successful establishment of the Partnership for DSCSA Governance (PDG), a voluntary collaboration to bring manufacturers, distributors, pharmacies and health systems together to solve end-to-end supply chain issues with DSCSA compliance. PDG originated with some of the same people who founded the Pharmaceutical Distribution Security Alliance (PDSA) as DSCSA itself was being written. PDG is up and running, and various members are engaged in workgroups for interoperability and credentialing, among other goals.

●The heavy lifting to meet DSCSA requirements for verifying returned product. DSCSA rules mandated that US wholesalers be able to verify the authenticity of returned product before it is put back into distribution; the technical means to do this has come to be called a Verification Router Service (VRS). As it turns out, creating a VRS that enables (in a perfect world) any possessor of returned product to verify its source is an exercise in full DSCSA compliance, at a micro level. In effect, VRS has become a pilot study for DSCSA functionality.

Here are some diversifying (“centrifugal”) forces:

●Hospital dispensing and the return of RFID. The pharmacies at health systems are finding increased value in their own identification and tracking processes inside their systems, and in some cases are using radio-frequency identification (RFID) technology to do so. This creates the prospect of one system for DSCSA compliance and another for internal tracking—a potentially duplicative and divisive element of overall traceability.

●The advancement of traceability in other industries. Both before and during the 2013-2023 rollout of DSCSA, other industries, notably food and consumer goods, have been advancing their own traceability initiatives. In some cases, advances in those industries will help move pharma traceability forward; in other cases, it creates potential conflict. The role of the GS1 global organization (which sets standards for, among other things, barcoding of commercial goods) will be key in keeping various players more or less on the same page. Another aspect of this is that some key pharma-traceability vendors are now eying these other industries (good for their business plans, bad for pharma if the focus shifts away).

Pharma traceability is a global undertaking—not only for manufacturers outside the US sending products into the US, but also for traceability and authentication efforts in 40 or more countries for their own internal markets. In the past year, much attention was paid to Russia, whose traceability systems are now coming online, and attracted the efforts of traceability vendors in the US and Europe. Brazil is also in this about-to-start-up mode. The European Union’s Falsified Medicines Directive (FMD) is now operational, to varying degrees of success, throughout the EU.

VRS becomes real

With fingers crossed, wholesalers in the US are readying their systems for verifying the authenticity of product returns, which represent several billion dollars’ worth of inventory for them. This regulatory milestone was to have been enforced in November 2019, but FDA delayed it for a year. According to industry sources, efforts were proceeding smoothly for industry readiness at the beginning of this year—then the pandemic struck. Getting a VRS system operational cannot be performed remotely; distribution center workers need training and equipment, but travel restrictions have slowed down the ability to do that gearing up. The hope is for a further delay at FDA (who, it is expected, will have its own difficulties in sending out inspectors come November).

The technical issues, to a large degree, appear to have been solved. Based on developmental work by the Healthcare Distribution Alliance (HDA), wholesalers and manufacturers have settled on a system where traceability vendors create a lookup directory (LD) of their clients’ product information, and the vendors ensure that their various repositories can communicate with each other. Then, when a request for validating a product return comes into one vendor, that LD routes the request to whichever vendor has the relevant manufacturer information. Ultimately, the request shows up at the appropriate manufacturer, who verifies the product identity. All of this needs to occur within milliseconds.

Wholesalers have had two tasks over the past couple years: setting up a VRS for the products they handle; and getting manufacturers onboard to be able to respond to a request. The VRS interoperability project was also an element of the FDA DSCSA Pilot Program (see below); technology vendor Rfxcel worked with an engineering-consulting firm Vantage Solutions, to run the interoperability tests, demonstrating the feasibility of the routing network. Work is proceeding on both tasks during the course of this year.

The process of verifying saleable returns involves a part of the pharma supply chain: wholesalers, manufacturers, and solution providers who offer a VRS system. Broader DSCSA compliance will bring in retail pharmacies and health systems—and they have a nominal November deadline for being able to verify the authenticity of incoming pharma products. According to industry sources, progress has been made at many health systems, but is lagging at chain pharmacies, and is nearly hopelessly lagging at independent pharmacies (some of whom lack basic internet access). A possible workaround is that the wholesalers supplying independent pharmacies will be able to provide both verification and reporting capabilities to their pharmacy clients—but the success of that remains to be seen.

FDA pilots

The DSCSA law mandated that FDA perform pilot studies of technology and business processes, and that effort kicked off in the spring of 2019 with applications being submitted, and a final list of projects issued by FDA last summer (see Fig. 1).

Fig. 1 FDA's list of accepted pilot projects for DSCSA testing.

The list was quite diverse in goals and capabilities. FDA intentionally sought out broad representation, including large and small pharma manufacturers, a variety of solution providers, and various pharmacies. (The involvement of chain pharmacies, except for participants in group discussions, was notably missing.) The creation of PDG was itself a “pilot;” and there were some projects in the works already, such as the HDA VRS effort, which got merged into the Rfxcel-sponsored FDA pilot.

All of these projects were to have been completed in early 2020 and reports filed with FDA. Some of the companies involved provided a report for public viewing; some issued a press release. Pharmaceutical Commerce obtained several of these reports and news releases; at presstime, some of these projects were to be part of an online presentation by PDG (who might then archive them for public viewing). At some point, FDA is supposed to issue a comprehensive report on lessons learned.

Some highlights:

●Cardinal Health ran a study of DSCSA information it had received from manufacturers, contract manufacturers, repackagers (including its own business unit), other wholesalers. The goal was to evaluate how closely all participants are adhering to EPCIS standards (which have been developed by the GS1 organization). Results were troubling: only 28% of records could be accepted as is.

For the most part, the exceptions were resolvable, involving such details as events out of sequence (i.e., a shipment notification being dated before a commissioning notification); inappropriate GLNs (Global Location Number—another GS1 standard); or missing data.

“Given the volume of products involved and in order to avoid interruptions in patient care, it is important that there be ways to distinguish these commercially routine exceptions (transmission and aggregation errors) between established trading partners from true suspect or illegitimate product situations,” concluded the report.

●KitCheck demonstrated its compatibility with DSCSA goals in the hospital-tracking systems it has already commercialized. The company provides RFID tags which are applied to incoming pharmaceutical products at hospital pharmacies, as well as a cloud-based data repository for the data. Hospitals can then track the drugs as they move through the facility, including those that are included in med-surg “trays” (kits). According to the company, being able to track those kitted drugs enables hospitals to retain them longer (as opposed to throwing away all the contents of the kit, once it was opened), as well as to track its inventories more closely.

The company has also had notable success in helping hospital pharmacies control the dispensation of controlled substances. Some 500 hospitals are already using a KitCheck system.

●The IBM/KPMG/Merck/Walmart group, which has called itself the “Pharmaceutical Utility Network (PhUN)," demonstrated that blockchain technology can be used to record product movements, and to initiate an alert for an investigation or recall. The testing did not, however, involve actual product movements. IBM is heavily involved in developing Ethereum-based blockchain projects, and has run what is called the IBM Food Trust for providing traceability in food production.

Fig. 2. MediLedger's vision of a network that provides both DSCSA compliance and communicates business transactions. credit: MediLedger

●The MediLedger project, which involved that blockchain company, plus 25 organizations in the pharma supply chain (members of a consortium that has been coordinating blockchain development since 2017). Among other things, the pilot demonstrated the feasibility of MediLedger’s Ethereum-based technology to exchange messages; the company calculates that a full-blown, national system will require at least 856 transactions/s to be communicated.

●The BruinChain project, spearheaded by another blockchain company, LedgerDomain, demonstrated the ability of its HyperLedger-based blockchain technology to track deliveries into the pharmacies of the UCLA Health System. This was one of the few actual pilot projects, in the sense of performing real-world testing (the project involved tracking deliveries of Spinraza, a Biogen product). Among other findings, the project revealed that “white-bagging” (the shipment of a drug from a manufacturer directly to a healthcare provider, rather than distribution from a wholesaler to a pharmacy) complicates product tracking: since a wholesaler wasn’t involved, someone else (the manufacturer or the manufacturer’s agent) needs to document transaction history.

What FDA will make of all this is unclear, which is not to say that the pilot projects were a wasted exercise. Many of the conversations that occurred among project participants are a preparation for how the industry will deal with the march to full DSCSA compliance. It is notable that several of them involved blockchain technology, which holds the promise of providing “immutable” records of transactions—a goal of DSCSA; the general drift of blockchain discussions is that private blockchain networks will eventually be set up, and then the challenge becomes how these networks will interoperate.

Whether the future of pharma traceability is blockchain-based or not, the ability to identify who is requesting or providing transaction information will need to be established. That, in turn, points to the “governance” of the networks—and that is where PDG comes in. The eventual goal is to be able to verify “authorized trading partners” among whom information can be exchanged.

Fig. 3. Excellis Health's Alert Management Service, which tracks incoming tracking messages for manufacturers or distributors. credit: Excellis

These pilots are by no means the totality of what has transpired in the past year in DSCSA compliance. LSpedia, a solution provider, has just announced the newest generation of its technology. TraceLink has announced the introduction of the Opus Network, an architecture that is intended to allow third-party developers to offer software to make use of the extensive data it holds for its hundreds of pharma clients. Multiple vendors, including Rfxcel, Movilitas, Covectra, Adents, Antares and others have VRS offerings. Axway and VAI have partnered with LSpedia on a VRS offering. Sovereign Pharmaceuticals, a Fort Worth, TX, contract manufacturer, has installed an open-source traceability system, Qua4rtet, working with Vantage Solutions to implement.

Meanwhile, business is growing for ancillary software to manage the installed base of traceability systems. Excellis Health is offering an alert management system, to enable DSCSA messages (such as saleable return queries) to be tracked to resolution. Gateway Checker Corp. is offering a same-named product to perform conformance checking on EPCIS messages. LedgerDomain has expanded its data repository, and provided a smartphone-based interface, to check product details based on FDA records.

Overall, the outlook for industry to meet DSCSA deadlines (whether by 2023 or 2024) looks positive—but much more work remains to be done.