White Paper

The data debate: management, retention and authentication of

product data in the context of the EU falsified medicines directive

Introduction
In the third of a series of features designed to help pharmaceutical manufacturers prepare for
the impending implementation of the EU Falsified Medicines Directive (FMD), Craig Stobie,
head - global Life Sciences team at Domino Printing Sciences, examines the thinking behind
how the vast amounts of data acquired under the auspices of the FMD will be collected, stored
and interrogated and why.
In previous features relating to the Falsified Medicines Directive
and how it affects pharmaceutical manufacturing and packing,
we looked firstly at the Hidden Challenges of Serialisation
from a hardware and Overall Equipment Effectiveness (OEE)
perspective and subsequently Beyond Serialisation at the
potential benefits of data aggregation creating hierarchical
relationships at each stage of the packaging process to the
supply chain. Effectively we have considered how best to
achieve item-level serialisation and how going beyond the brief
[aggregation is not a specified requirement of the FMD] to
create linkages between bundles, cartons, cases and pallets can
offer significant return on investment.
While for most producers the past couple of years will rightly
have been about building the correct hardware eco-system and
setting the correct operating landscape to achieve a consistently
high standard of robust marking, thoughts must now turn to the
framework within which the data generated will be managed.
In this paper, we will take a look at the role of those bodies
supervising the generation of data and those responsible for its
management and how manufacturers can prepare the ground
for positive data management.
 The data debate: management, retention and authentication of product data in the context of the EU falsified medicines directive

To help the entire community meet this deadline, GS1 continues

to scrutinise the requirements of the FMD, particularly in terms
of data standards and structures, to ensure that mandates
emanating from Brussels are clear and unambiguous. Through
its Healthcare Users Group, GS1 is establishing and qualifying a
network of suppliers that can provide the level of advice needed
for the implementation of the standards.
In the UK, GS1 is looking at FMD on two levels. The first is
dealing with the Department of Health and the NHS and
addressing the education of 300,000 employees who will
become responsible for scanning medicine packs. The aim is to
have a full plan for training and accreditation in place by April
however it is an ongoing process due to the staff turnover within
the NHS, which is around 15% annually.
The second level which is the area that concerns Domino
and its partners most is dealing with the suppliers to the
NHS. That means educating suppliers who service and maintain
NHS facilities as well as pharmaceutical and medical equipment
providers.
GS1 the supply chain supremo
As the global standards body for product identification, GS1s
mission is to make companies more efficient by establishing
a common language when it comes to identifying, locating,
transporting and trading goods. The organisation is both
independent and not-for-profit. GS1s healthcare teams have
been carefully structuring their response to the impending FMD
legislation. With its focus on the whole of the supply chain, GS1
has a rare, holistic perspective on the product journey from its
source, the manufacturer through a complex distribution chain
to its final destination, the patient.
In common with Domino and many other industry voices, GS1
acknowledges the move from batch to item-level serialisation as
a sea change for the pharmaceutical industry.
The EU FMD is a very complicated set of regulations, but what
is more problematic is that some manufacturers are reluctant to
start investing in equipment until the finite detail is confirmed in
late 2015.
Although there may be little change from what has been
mooted thus far, the caution stems from the fact that significant
capital investment is at stake and that investment must be
fit for purpose. With an average life cycle of 18-months to
for investment approvals, thousands of manufacturers will be
scrambling to be FMD compliant before the end of 2018. While
the timeline for enactment of the Directive has slipped marginally
since 2011, it is an inevitability and therefore imperative that
pharmaceutical suppliers are legislation compliant, in order to
continue to produce and sell their products.
A big problem for small suppliers
The changes mandated by the EU FMD legislation present some
very significant logistical challenges for manufacturers, a diverse
group which includes research based pharmaceutical providers,
contract packagers or generics manufacturers. The research
based pharmaceutical companies are largely perceived to be in
a better position, as they are often larger and usually have the
specialists and the budgets to cope with the demands of the
FMD. For smaller and medium sized companies who operate on
smaller budgets, the ability to develop the broad solution needed
can be a challenge. On the positive side however they are more
agile, potentially making it easier to embrace change. Either way
it will be a challenge for companies of all sizes, albeit for different
reasons.
Manufacturers may know a little about data but for most
companies, printing serialised barcodes onto packs on moving
production lines in a dynamic environment will be a new
challenge. Many manufacturers have no experience of putting
structured data into a global data pool, for instance, which is a
central requirement of the FMD. The requirements are also more
stringent because of the nature of the regulated environment in
which the pharmaceutical industry operates.
GS1 UK is conducting trials with some of the major NHS Trusts
(the regional bodies charged with running the NHS) to see how
many current suppliers are working with GS1 standards. The
top 15 to 20 per cent, accounting for around half of products
supplied to the NHS, are compliant but the bulk of the suppliers
in the market up to 70,000 according to the Department of
Health have yet to be accredited to put information into a
data pool.
The Electronic Product Code Information System (EPCIS) will
be run by the Department of Health with input from GS1
and every code issued and used will go through its verification
process. It is a way of structuring data globally and, although
more complex in the pharmaceutical industry, is already proven
in the food and beverage markets, enabling a supermarket in
Hong Kong to access the same data as a store in Hartlepool, UK.
The system works well in the food and beverage markets but
will need to be far more complex and multi-layered to reflect
the array of mandatory information on a typical pharmaceutical
pack.
 The data debate: management, retention and authentication of product data in the context of the EU falsified medicines directive

Code alert
According to most current requirements, manufacturers need
only apply a simple alphanumeric expiry date and a lot number
to each item. Generally speaking, they have never had to apply a
barcode on a production line in a dynamic environment.
Under the auspices of the FMD, each item will have four vital
pieces of information the GTIN, expiry date, lot or batch
number and a unique identifier, and where the market requires
it a fifth line of text for a national identification number.
Each prescription piece, single ampoule or vial, and every
pharmaceutical pack must be uniquely identifiable, using both
human- and machine-readable information.
This involves a complicated process of taking data from the
manufacturers own internal software architecture, applying
individual codes to each pack, reading them, verifying them,
rejecting them if necessary and then putting the information back
in the data pool for publication and reuse.
The machine-readable element of each pack mark will be
encoded using the ECC200 2D Data Matrix (DM) standard, With the exception of China, the majority of countries are
which can incorporate up to 144 x 144 cells and is therefore proposing to use the ECC200 2D Data Matrix as the machine-
eminently capable of handling the necessary volumes of readable code of choice, albeit with some differences. In Europe,
information. The DM has the ability to encode 50 characters in a transitional period will support countries such as France,
a symbol that is readable at 2mm2 or 3mm2 and can still be read which had already embarked on a national serialisation scheme
with a 20% contrast ratio a huge benefit when data must be CIP13 before the EU Directive was first publicised in 2011.
acquired in a single pass or tracked along a supply chain. With A degree of flexibility within the FMD coding standards will also
an error rate of less than 1 in 10 million characters scanned, the be required to accommodate countries that will incorporate
ECC200 2D Data Matrix is the newest version of the code and a national reimbursement number within the code, such as
can still be read even after sustaining 30% damage along the Germany. Even though most countries use a DM for their anti-
logistics process. This gives it a huge advantage when reading and counterfeit measures, the encoded data requirements vary from
authentication is such an important part of the FMD process. country to country.
The verification process uses specialist vision systems to
ensure the code conforms to the relevant standards - currently
ISO15415. The reader camera uses the information for
movement tracking or inventory stock checks or patient and
medicine verification in the case of the FMD.
As an Open Source code, DM codes can also be read by mobile
phones by downloading code specific mobile applications. This
extends the usability of DM codes by providing an outlet for
consumer verification of goods and medicines. If necessary, users
can read and interpret DM codes to establish their provenance
and determine if they are legitimate goods before sale. It
provides the verification checks at the user level to establish an
items credentials well before final usage.
GS1 will make available a whole raft of training and support
material to help manufactures implement the ECC200 standard.
The recommendation in the UK is for a GS1-approved Global
Trade Identification Number (GTIN) while Germany and other
countries will use both a GTIN and a national trade identification
number (NTIN). It may take many years to switch over to
a standardised system due to the lifespan of many existing
products.
This all adds to the complexity of the system as every country
mandates different legislations. To some extent, there is no way
around this problem, but the Falsified Medicines Directive will
address this lack of standardisation. From 2018, every country
must have the ability to accept and record GS1 data subjects
they will have to accept information from the data pool, be able
to verify it and track its journey from the first to last step.
So far, so good. However, routes to market are notoriously long
and complex in the pharmaceutical sector, such that national
databases are also essential to enable the random/risk-based
verification which is deemed an essential safeguard of the EMVS.
Risk assessment has been a key principle underpinning the
design of the system, with Stakeholders pooling their respective
expertise to identify and contain points of vulnerability within
the system. Key to this is the ability to authenticate product via a
code scan at any point in the supply chain.
The Hub went live last year, when it was also announced that
Germanys SecurPharm database would join forces with the
European Stakeholder Model, enabling proof-of-principle of
interoperability between national and European repositories to
be demonstrated.

The European Medicines Verification System

A core tenet of the FMD is a supranational database that will
ensure safe access to medicines for patients by providing real-
time verification of products with a single scan. To achieve this
aim, a number of industry stakeholders, including EFPIA, came
together under the European Stakeholder Model umbrella to
establish the European Medicines Verification System (EMVS).
To be run by the stakeholders on a not-for-profit basis, the
EMVS is an interoperable, pan-European database which
enables medicines to be verified instantaneously at the point
of dispensing. As a central repository, the EU Hub also reduces
complexity by creating a single interface for manufacturers
across all Member States. Product data will be uploaded directly
to this European Hub from the pharmaceutical manufacturer,
contract packer or parallel distributor, such that it will contain
a unique record for each item entering the supply chain. That
record remains available for interrogation through to the point
at which the product is dispensed, when the pharmacist or other
dispenser scans the product. This action updates and effectively
closes the record, such that the product is no longer live and
available within the supply chain.
Until very recently, a major focus of this paper would have
been the storage and management of the vast volumes of data
generated by serialisation. Even ahead of the 2011 publication
of the Directive, pilot serialisation projects were under way and
without exception, data handling emerged as a significant issue.
However, the past few years have seen cloud-based business
models emerge and swiftly mature, such that cost-effective and
highly secure data storage is widely available. Indeed, the fact
that the EMVS itself is built on a cloud platform is the strongest
possible signal that the technologys credentials are beyond
question. Strategies around what data to keep locally and for
how long will vary from one manufacturer to the next, however
one of the major obstacles in this regard how and where to
store local data has been removed.
Our ten cent tour of the EMVS brings us back to one of the key
challenges of serialisation, which is that each item now consists of
two indivisible parts a physical asset and its data counterpart.
Removing any item from the supply chain for reasons other than
dispensing it creates significant challenges in managing the data
asset, particularly where the serialisation scheme is randomised.
The entire verification system depends on the ability to produce
and read good quality item-level codes which is why the right
first time principle is so critical.
www.domino-printing.com
Good Serialisation Practice
Irrespective of whether codes are produced by laser, ink
jet or thermal transfer overprinting and whether they are
aggregated through the supply chain using serialisation-
capable print and apply labelling or outer case coding,
there are a number of basic principles that can be applied
to achieve the requisite standard of coding and a smooth
passage through the supply chain.
Collectively, Domino defines these as Good Serialisation
Practice and believes that if Standard Operating Procedures
are established and maintained under each heading, a clear
and successful serialisation strategy will become self-evident.
1. Understand the data structure you need an expert
who understands the standards and how to apply them
2. Place somebody in an ownership position to drive the
process through the production environment
3. Understand your customers processes for managing data
4. Choose your partners early serialisation is too
complicated for a one-fit solution. A partnered approach
will cover all the bases
5. Make sure your company has integrated departments
so you all understand what serialisation means. It means
executive buy-in to ensure IT, marketing, manufacturing
and logistics teams work collaboratively on the
development of the system
6. Select your technology solution whether printing,
validation, IT systems and design, you need to be clear on
your preferred solution at the outset
7. Pay heed to Overall Equipment Effectiveness (OEE). All
these extra processes are bound to slow things down, so
make sure manufacturing does not suffer
8. Start early! Make sure the plans are in place now, even if
the legislation has not been ratified. By the time they are,
there will be intense pressure to meet the compliance
deadline in 2018.