FDA Home Page | Search FDA Site | FDA A-Z Index | Contact FDA | FDA Centennial

Thank you for submitting to me the Counterfeit Drug Task Force Report - 2006 Update. I strongly concur that increasing the safety and security of the nation's drug supply and protecting it from the increasing sophisticated threat of counterfeit drugs is critically important. I commend you and the rest of the Counterfeit Drug Task Force on your efforts in developing this report and its recommendations to further this goal. I appreciate the fact-finding efforts that the Task Force undertook, such as holding the February 2006 public workshop and soliciting public comment, to understand the issues and provide me with informed recommendations.

I endorse the report and its recommendations. This includes the recommendation not to further extend the stay and to issue a compliance policy guide (CPG) that discusses FDA's enforcement focus regarding pedigree requirements. Please move forward with these recommendations, pursuant to FDA's good guidance practice (GGP) process (21 CFR § 10.1 15), as appropriate.

FDA COUNTERFEIT DRUG TASK FORCE REPORT:
2006 UPDATE

I. INTRODUCTION

This report is based on the work of the Food and Drug Administration's (FDA or Agency) Counterfeit Drug Task Force.¹ It is the third report issued by the Agency since 2004 to address FDA's and the private sector's response to the emerging threat of counterfeit drugs entering the U.S. drug supply. This report contains recommendations to FDA's Acting Commissioner regarding actions that the public and private sector can take to further speed the adoption of electronic track and trace technology and for the use of pedigrees in general, to increase the safety and security of the U.S. drug supply.

After discussing the background and public comment on the issues addressed in this report, we discuss our recommendations or conclusions regarding:

• The expiration of the stay of 21 CFR §§ 203.3(u) and 203.50;
• The extent to which electronic track and trace technology is being used across the supply chain for electronic pedigrees and the use of radio-frequency identification (RFID) for drug products in the drug supply chain; and
• Technical issues related to the implementation of electronic track and trace technology, such as mass serialization, universal and uniform pedigrees, data management, and privacy issues.

II. BACKGROUND

A. The Counterfeit Problem

Counterfeit prescription drugs are illegal, generally unsafe, and pose a serious threat to the public health.  Many are visually indistinguishable from authentic drugs. As we stated in our first Counterfeit Drug Task Force report in 2004 (2004 Report),² we believe that counterfeiting is quite rare within the U.S. drug distribution system because of the extensive scheme of federal and state regulatory oversight and the steps taken by drug manufacturers, distributors, and pharmacies, to prevent counterfeit drugs from entering the system. However, we are concerned that the U.S. drug supply is increasingly vulnerable to a variety of increasingly sophisticated threats. We have witnessed an increase in counterfeiting activities and a more sophisticated ability to introduce finished dosage form counterfeits into legitimate drug distribution channels over the years.

B. The 2004 Counterfeit Drug Task Force Report & 2005 Update

In 2004, the Task Force issued a report outlining a framework for public and private sector actions that could further protect Americans from counterfeit drugs, including implementation of new track and trace technologies to meet and surpass goals of the Prescription Drug Marketing Act (PDMA).³ This framework called for a multi-layer approach to address the problem and included the following measures:

• Secure the product and packaging
• Secure the movement of drugs through the supply chain
• Secure business transactions
• Ensure appropriate regulatory oversight and enforcement
• Increase penalties
• Heighten vigilance and awareness
• International cooperation

In order to implement these measures, the Task Force Report stated, among other things, that:

• Widespread use of electronic track and trace technology would help secure the integrity of the drug supply chain by providing an accurate drug "pedigree," which is a record of the chain of custody of the product as it moves through the supply chain from manufacturer to pharmacy;
• RFID is a promising technology as a means to achieve electronic pedigree (e-pedigree);
• Widespread adoption and use of electronic track and trace technology would be feasible by 2007; and
• The effective date of certain regulations related to the implementation of the PDMA should be delayed until December 1, 2006 in order to give stakeholders in the drug supply chain time to focus on implementing widespread use of e-pedigree.

In 2005, the Task Force issued an annual update report (2005 Report)⁴. The 2005 Report assessed FDA's and industry's progress toward implementing the 2004 recommendations. In the 2005 Report, the Task Force found, among other things, that:

• Stakeholders had made significant progress in developing and implementing RFID during the previous year;
• FDA was encouraged by the progress stakeholders, standard-setting bodies, and software and hardware companies had made toward implementing an e-pedigree for drug products and that we were optimistic that progress would continue in an expeditious manner toward meeting FDA's 2007 goal of widespread use of e-pedigree across the drug supply chain;
• If it appeared that the 2007 goal would not be met, we planned to consider options for implementing the provisions of the PDMA rulemaking that are the subject of the stay; and
• FDA would identify what we could do to address obstacles to the widespread adoption of RFID.

 C. 2006 Fact-finding Efforts: Public Workshop, Vendor Display, and Docket

As the Task Force continued to monitor the adoption and implementation of e-pedigree and electronic track and trace technology, we recognized that adoption across the U.S. drug supply chain was slower than originally anticipated. To determine whether widespread use of e-pedigree by 2007 was still feasible, and to solicit comment on the implementation of certain PDMA-related regulations, we held a public meeting on February 8 and 9, 2006.⁵ Our objectives for the meeting were to:

• Identify incentives for, as well as any obstacles to, the widespread adoption of RFID across the U.S. drug supply chain and possible solutions to those obstacles;
• Solicit comment on the implementation of the pedigree requirements of the PDMA and the use of an e-pedigree; and
• Learn the state of development of electronic track and trace and e-pedigree technology solutions.

Over 400 people attended the public meeting. Forty-six presentations were made and 27 vendors participated in the vendor display.

Members of the drug supply chain, the technology sector, special interest groups, academia, health professionals, and consumers also filed sixty comments to the public docket that we opened as part of the public workshop.

In addition, we have been attending conferences, meeting with stakeholders, tracking the status of pilot programs, monitoring changes in and use of technologies, participating in standards development, and closely following other influences to remain up-to-date on the relevant issues.

This report is based primarily on information gathered from these fact-finding efforts. It contains our views on outstanding issues related to e-pedigree and RFID implementation, as well as recommendations for additional public and private measures to support our continuing efforts to further secure our nation's drug supply.

III. WHAT IS NEXT FOR PDMA IMPLEMENTATION?

What should FDA do regarding the stay of 21 CFR §§ 203.3(u) and 203.50?

Issue/Background

The PDMA as modified by the Prescription Drug Amendments of 1992 (PDA) amended the Food, Drug, and Cosmetic Act (the Act) to, among other things, establish requirements related to the wholesale distribution of prescription drugs. Section 503(e)(1)(A) of the Act requires that

"…each person who is engaged in the wholesale distribution of a drug***who is not the manufacturer or authorized distributor of record of such drug *** provide to the person who receives the drug a statement (in such form and containing such information as the Secretary may require) identifying each prior sale, purchase, or trade of such drug (including the date of the transaction and the names and addresses of all parties to the transaction.)"

PDMA defines an authorized distributor of record as a wholesaler that has an "ongoing relationship" with the manufacturer to distribute the drug. However it does not define "ongoing relationship."

In December 1999, the Agency published final regulations (1999 final rule) (21 CFR part 203) related to the PDMA⁶ that were to take effect on December 4, 2000. After publication of the final rule, the Agency received communications from industry, industry trade associations, and members of Congress objecting to the requirements in 21 CFR §§ 203.3(u) and 203.50. These provisions define the phrase "ongoing relationship" as used in the definition of "authorized distributor of record" (ADR), set forth requirements regarding an identifying statement (commonly referred to as a "pedigree"), and define the fields of information that must be included in the pedigree. Those objecting to the regulations explained that some secondary wholesalers may not receive pedigree information from their suppliers who meet the PDMA's definition of "authorized distributor" because the PDMA does not require authorized distributors to provide pedigree information. Without this information, they explained, secondary wholesalers would not be able to sell the drugs because they would be unable to pass a pedigree that met all the requirements of 203.50. Many secondary wholesalers are small businesses and expressed concern that their inability to meet the regulations' requirements would frustrate sales and drive them out of business.

Based on the concerns raised, the Agency delayed the effective date for those provisions until October 1, 2001⁷ in order to reopen the comment period for the regulations and receive additional comments. In addition, the House Committee on Appropriations (the Committee) requested that the Agency review the potential impact on the secondary wholesale pharmaceutical industry and prepare a report to the Committee summarizing the comments and issues raised and the Agency's plans to address these concerns. The Agency's report, which was submitted to Congress in June 2001 (2001 PDMA Report to Congress), concluded that we could address some of the concerns raised by the secondary wholesale industry through regulatory changes, but that some of the changes requested by the secondary wholesale industry would require statutory change.⁸ Since submitting the report to Congress, FDA has continued to delay the effective date of these provisions.

In February 2004,⁹ FDA again delayed the effective date of the particular provisions until December 1, 2006, because we were informed by stakeholders in the U.S. drug supply chain that industry would adopt electronic track and trace technology by 2007. When widely adopted, this technology could create a de facto e-pedigree that would document the movement of the drug from the place of manufacture through the U.S. drug supply chain to the final dispenser. If properly implemented, e-pedigree could meet the statutory requirements in section 503(e) of the Act.

In our 2006 fact-finding effort, we sought comment on whether to continue the delayed effective date, let the regulations go into effect, amend the 1999 final rule, or take other steps.

What We Heard

Most of the comments¹⁰ to our February 2006 notice advised FDA to implement the regulations and let the stay expire. Some said the regulations should be implemented as currently written, without amendment. Others suggested amending the final rule to either 1) exempt the passing of pedigree along primary supply chain routes or the "normal chain of distribution," or 2) phase-in implementation, starting with requiring pedigrees for those drugs that are susceptible to counterfeiting and diversion, or 3) require a pedigree for "one forward-one back" in the distribution chain (as opposed to a pedigree that documents all prior sales transactions back to the manufacturer). A couple of comments suggested that we extend the stay in order to give industry more time to continue moving toward adoption of electronic track and trace technology and e-pedigree. A few wanted the stay to be extended in order to give time to amend the regulations. The amount of time requested for extending the stay varied from 5 years to indefinitely. We also received one citizen petition from a secondary wholesalers' trade association requesting that the stay be extended.

Some comments suggested that FDA work with Congress to eliminate the provision exempting the authorized distributor of record from having to pass a pedigree. They claimed that it was too confusing to recognize when a pedigree should or should not be passed.

Several comments asserted that implementation of the PDMA regulations would speed the development of new, less expensive ways to provide pedigree.

Discussion

We carefully considered several options and recommend that FDA no longer delay the effective date of §§203.3(u) and 203.50 past December 1, 2006. Regulations defining "ongoing relationship" and "authorized distributor of record" are scheduled to go into effect thereafter. In our 2006 fact-finding efforts, we gave stakeholders and the public ample opportunity to provide their input, but we did not hear the same arguments that we heard on previous occasions regarding why we should further extend the stay. Rather, this time, an overwhelming majority of the comments favored allowing the stay to expire.

The PDMA was signed into law in 1988. We believe that FDA can no longer justify delaying implementation of these regulations. In its 2001 PDMA Report to Congress, FDA shared the concerns that were raised regarding implementation of the regulations. By recommending implementation of the stayed provisions, we are supporting the law that Congress passed and has since retained. Furthermore, our extensive experience with counterfeit and diversion drug cases reveals that the secondary wholesale market is where much of the illegal activity occurs. Allowing the stay to expire will provide clarity in the drug supply chain regarding who is and is not an ADR, requiring those secondary wholesalers who may be involved in illegal activity to provide pedigrees. Continuing the stay would perpetuate the current confusion and further allow opportunities for counterfeit and diversionary practices to flourish.

We do not intend to put secondary wholesalers out of business. We continue to be sensitive to the concerns that they raised several years ago, even though we did not hear these concerns during our current fact-finding effort. Therefore, as explained below, we recommend that FDA take an enforcement approach that focuses on products most susceptible to counterfeiting and diversion, which should relieve some of the burden that secondary wholesalers might confront when these regulations go into effect.

Most of the comments we received in this fact-finding effort recommended that the regulations be implemented as is, while others advocated a phased-in approach, whereby the regulations would apply to a limited number of drugs at first. We agree that the regulations should be implemented as is. Many of the recommended changes to the pedigree requirements would require a change in the law. We believe that the regulations as currently written appropriately interpret and implement the PDMA, as Congress intended.

Although the regulations do not provide for a phased-in approach, we propose that FDA publish a Compliance Policy Guidance (CPG) before the stay expires that will contain a list of factors for FDA field personnel to consider in focusing their efforts when carrying out their duties in enforcing the law. We propose that these factors reflect a risk-based approach in which FDA uses its limited resources to focus on drug products that are most vulnerable to counterfeiting and diversion. We do not propose the creation of a list of drugs that meet the criteria, but instead suggest that the CPG provide examples. However, we recommend that FDA not limit its enforcement to just those drugs that meet the factors. Rather, the factors would merely provide guidance for where our field personnel should target their enforcement efforts. The factors to consider for the enforcement focus may include drugs with a high value in the U.S. market, drugs with prior indicators (such as drugs that were involved in diversion cases or counterfeiting), and drugs that are easily counterfeited.

We believe that this CPG would be considered a Level 1 guidance under FDA's good guidance practice (GGP) regulations. (21 CFR §10.115.) Therefore, we recommend that FDA publish a draft version for public comment, evaluate the comments, and then publish a final guidance by December 2006.

We recognize that complying with the stayed regulations may require changes in business practices. Compliance may also require implementation of additional information technology systems to generate a pedigree. Each of these processes may take time to achieve. However, we note that, although the regulations at issue have been stayed since 1999, the fundamental statutory requirement to pass a pedigree has been in effect since PDMA was enacted. The regulations primarily serve to clarify who is an authorized distributor of record and what information a pedigree must contain. In addition, we believe that this report and the CPG we advocate herein will focus public attention on this issue such that any wholesalers who thought that they were not subject to the pedigree requirement will have adequate time to take appropriate steps to comply with the regulations.

Furthermore, many States have moved forward with their own pedigree requirements, which often contain requirements in addition to those in the PDMA. We are aware that stakeholders are preparing to meet these State requirements, both electronic (to meet California law) or otherwise. Consequently, they should be that much closer to meeting the federal PDMA requirements as well.

IV. WHAT IS THE STATUS OF ELECTRONIC TRACK AND TRACE ACROSS THE DRUG SUPPLY CHAIN?  

A. What is the progress of the use of e-pedigree in the drug supply chain?

Issue/Background

In the 2004 Task Force Report, we said that adoption and widespread use of reliable track and trace technology is feasible by 2007. We stated that this would help secure the integrity of the supply chain by providing an accurate drug "e-pedigree," an electronic record documenting that the drug was manufactured and distributed under secure conditions. We particularly advocated for the implementation of electronic track and trace mechanisms and noted that RFID is the most promising technology to meet this need.

In our 2006 fact-finding effort, we sought comment on the progress of e-pedigree implementation in the drug supply chain to determine if the goals outlined in the 2004 Task Force Report would be met.

What We Heard

Several comments described completed and ongoing pilot programs for e-pedigree and their successful deployment of e-pedigree in a real-time production environment. Most pilot programs involved distribution with one manufacturer, one wholesaler, and, in some cases, one pharmacy. Many comments stated that e-pedigree can be achieved using either RFID or barcodes. A number of comments stated that standards for e-pedigree are complete and that interoperable software is available. A few comments from manufacturers of already-serialized products said that they have developed track and trace systems capable of providing an e-pedigree through existing internet technologies.

Most comments agreed that it was necessary to adopt mass serialization with unique identifiers on each package as an important step to facilitate e-pedigree, while some comments stated that it is not needed. A majority of the comments stated that although widespread use of e-pedigree is not far off, it is hard to predict when that might happen or set a new timetable or a new target date. However, many comments suggested that FDA set a specific date by which all products must have an e-pedigree, arguing that without a specific date progress toward adoption will continue to be slow. Some comments recommended that FDA establish realistic phased-in compliance dates for adoption of e-pedigree.

Discussion

In 2004, we were optimistic that widespread implementation of e-pedigree was feasible by 2007 because we were told by many stakeholders in the drug supply chain that this was a realistic goal. Although significant progress has been made to set the stage for widespread use of e-pedigree, unfortunately, this goal most likely will not be met. We will not issue a new forecast or target date for adoption of e-pedigree because we do not have enough information to do so at this time. Most comments said that it is difficult to predict or designate a target date. We do believe that a timetable with achievable, realistic milestones is crucial to keep e-pedigree implementation on track. Therefore, we recommend that FDA continue to work with members of the drug supply chain to develop such a timetable.

We believe that members of the drug supply chain should be able to implement e-pedigrees in the very near future. We applaud those members who already are taking steps to implement an e-pedigree and States that have championed this cause, such as California. However, it is clear from our recent fact-finding efforts that the voluntary approach that we advocated in the 2004 Task Force Report did not provide industry with enough incentives to meet FDA's deadline. The mere "risk" of the PDMA regulations being implemented was not enough of an incentive. When PDMA was enacted, the state of technology was not as advanced as it is today, and, as a practical matter the industry could pass only paper pedigrees.

We understand the complexity in moving toward an e-pedigree and recognize that a hybrid approach using both paper and electronic pedigrees will be needed during a transition period. We continue to believe that RFID is the most promising technology for electronic track and trace across the drug supply chain. However, we recognize that the goals can also be achieved by using other technologies, such as 2D-barcodes. Based on what we have recently heard, we are optimistic that this hybrid environment of electronic/paper and the use of RFID/bar code is achievable in the very near future. We believe that efforts to ensure that hybrid pedigrees are secure and verifiable should be a priority consideration.

If legislation is considered in Congress related to e-pedigrees, we stand ready to provide technical assistance.

B. What is the progress of the use of RFID on drug product packages?

Issue/Background

We sought comment on the implementation status of RFID, including a description of the obstacles to widespread adoption, an estimate of the timetable, the suggested role of FDA, and the incentives needed to promote adoption.

What We Heard

A majority of the comments agreed that RFID is the most promising technology for track and trace in the drug supply chain. We received many comments describing current obstacles to wider adoption of RFID, including:

• A lack of standards (for e-pedigree fields and format, data systems, international transmission standards, and hardware specifications);
• Privacy concerns;
• Concerns about the ownership of confidential business transaction data;
• Challenges in serializing all products;
• Concerns over the accuracy and speed of electronic devices and systems; and
• A lack of definitive data to determine how RFID will affect sensitive products (e.g., liquids, biologics).

Many comments stated that it is not possible to predict or estimate a timetable for widespread adoption of RFID, or stated that widespread RFID adoption is at least many years away. Some comments estimated that it will take up to 10 years. Many comments suggested that technical issues (e.g., adoption of standards, product/software development) would need to be settled before a more accurate timetable could be estimated. A number of comments suggested a phased-in approach for RFID adoption to provide industry sufficient time to explore all options. One comment from a stakeholder closely involved in the development of RFID technology stated that the FDA timeline for RFID adoption is technically feasible, that is, widespread adoption of RFID is feasible by 2007.

Comments noted that progress toward the full adoption of RFID technology is occurring, but that adoption is moving more slowly than previously anticipated. Several pilot projects have been conducted or are underway to test the feasibility of RFID deployment along the prescription drug supply chain, but data is limited.

Most comments said that FDA should not mandate or require the use of RFID in the drug supply chain. Instead, some comments said that FDA should continue to encourage the use of RFID. Many comments said that FDA should actively participate in, support, and facilitate RFID activities, especially those activities of groups working to establish RFID standards and implementation. In addition, many comments said that FDA should take a lead role in developing a public education program about the use of RFID technology on drug products.

Most comments said that incentives would help in the adoption of RFID across the supply chain. Only one comment said that no incentives are needed. Comments suggested the following incentives:

• Financial/tax incentives;
• Mandating mass serialization on drug products, but allowing industry to determine the most appropriate technology to ensure compliance;
• Statutory changes.

Discussion

We continue to believe that RFID is the most promising technology for implementing electronic track and trace in the drug supply chain and that stakeholders should move quickly to implement this technology. We appreciate the candid views and concerns that were shared with us during this fact-finding effort in identifying obstacles to implementation. Within this report, we have tried to address the issues related to those obstacles that are within FDA's purview.

Although we are encouraged by the efforts of GlaxoSmithKline, Pfizer, and PurduePharma in tagging their products, and the efforts of many other companies and wholesalers in exploring and piloting RFID, we are disappointed with the lack of overall progress across the drug supply chain. In the 2004 Task Force Report, we laid out milestones and goals for RFID implementation based on credible information that stakeholders gave us. Many of these milestones have not been met. The technology vendors uniformly told us that their RFID and e-pedigree solutions and technologies are ready to go, but manufacturers, wholesalers, and retailers are slow to implement them.

We recognize that progress may have been delayed because standards have not yet been established. However, we are encouraged by the progress that industry has made to develop and adopt universal standards. Based on what we heard, those standards are close to completion. Once completed, we would expect to see a rapid growth in the implementation of RFID in the drug supply chain. We look forward to continuing to participate and support this standards development process.

In November 2004, FDA issued a CPG for conducting pilot studies for RFID tagging. In that CPG, FDA excluded biological products as eligible for these pilot studies because we had insufficient information about the impact of radio-frequency (RF) on biologics. To date, we have not received sufficient information to change this policy. Therefore, the CPG continues to remain in effect as written until December 31, 2007. In order to further our understanding of the impact of RF, we have begun our own study to evaluate the potential impact of RFID on drug and biological products. We expect to share the results of this study later this year.

We recognize that implementing an RFID-enabled drug supply chain is challenging. We appreciate the comments advocating a phased-in approach and urge manufacturers to take a risk-based approach to implementation by first tagging the products that are most vulnerable to counterfeiting and diversion, based on factors such as the sales price, volume sold, demand, ease of counterfeiting, and prior history of counterfeiting or diversion, among other things. If a company's products are not "at risk", then we would suggest the company choose its highest volume/highest sale drug(s) and start piloting. Although RFID deployment does have significant start up costs, based on our discussions and what we heard, most stakeholders agree that there are also significant benefits. Not only does the track and trace capability of RFID provide anti-counterfeiting and supply chain security benefits, but it also offers significant savings in the form of better inventory management, reduction in theft and product loss, improved recall efficiency, and reduced paperwork burdens.

RFID also has tremendous potential benefits for drug products used in public health emergencies, such as a pandemic influenza or a bioterrorist attack. RFID tracking could help in expeditious deployment and redeployment of medical countermeasures in times of crisis. FDA should, therefore, encourage manufacturers of these types of products to explore the use of RFID.

We agree with the comments that FDA should not mandate RFID. Although in 2004, we sought voluntary adoption and more widespread use by 2007, we believe that the private sector momentum is moving and that our input on some of the perceived obstacles may jumpstart further adoption interest and momentum. In the 2004 Task Force Report, we laid out a timetable for mass serialization and RFID implementation, as well as steps for businesses and standard-setting issues. Although the timetable goals were not met, we continue to stand by this approach and are prepared to work with stakeholders who wish to take the lead in developing a new, feasible, yet ambitious, timetable.

V. WHAT TECHNICAL ISSUES RELATED TO ELECTRONIC TRACK AND TRACE NEED RESOLUTION?

1. Mass Serialization

Issue/Background

Mass serialization involves the incorporation of a unique identifier number on each drug package in order to track the individual drug package as it moves through the drug supply chain. We sought comment on mass serialization numbering schemes, including the preferred numbering convention, the merits of incorporating the National Drug Code (NDC) number and its impact on patient privacy, and the timetable for mass serialization across the drug supply chain.

What We Heard

Almost all the comments recommended that industry use a single numbering convention to reduce costs and complexity. One comment noted that multiple numbering schemes could lead to conflicts (e.g., duplicate numbers for the same item) and incompatibility between points in the distribution chain. Several comments suggested that using random numbers for the product identification component of the electronic product code (EPC) could increase security, while concealing proprietary information about the product or manufacturer. However, other comments suggested that the EPC should include the manufacturer ID as part of the code.

Many comments addressed whether or not the NDC should be included in the unique identifier. Many comments were concerned that RFID tags could be surreptitiously read, and if the NDC was included, it could jeopardize the privacy of patients and potentially endanger the drug supply chain. However, pharmacies and their trade groups supported the inclusion of the NDC, arguing that their information systems currently identify products by using the NDC and that they might incur significant costs to change these systems if they used an EPC that did not include the NDC. Some of these comments also noted that the NDC plays an important role in the dispensing process and it would be disruptive to workflow to have to consult another database to link the EPC number to the NDC number. However, a couple of the comments noted that it is not necessary to include the NDC as a component of the unique identifier because, pursuant to FDA regulations (21 CFR §§ 201.2 or 201.25), the NDC is printed on most drug packaging.

Finally, several comments from stakeholders that are closely involved in developing the EPC standards suggested that the numbering convention be sufficiently flexible to accommodate standards-based numbering systems already in use (e.g. NDC for pharmaceuticals, UID for U.S. Department of Defense, EAN.UCC for consumer goods.)

Discussion

We continue to believe that using mass serialization to uniquely identify all drug product packages in the U.S. is a powerful tool in securing the nation's drug supply. The issues surrounding which numbers should be included in this unique identifier are complex. The NDC number is ubiquitous as an identifier of drug products for inventory, dispensing, and claims adjudication, among other things. However, because it is such a recognized number, an NDC number could compromise patient privacy and supply chain security if it could be read surreptitiously.

We believe that the NDC number is an important product identifier and it should be closely associated with the product. We note that, currently, for most prescription drug product packages, the NDC number is either printed on the packaging or included in a bar code on the package. We do not anticipate this practice to change.

We also recognize that inappropriate access to the NDC number on individual products raises patient privacy and security issues. These competing concerns, however, can be addressed through IT solutions. Therefore, we believe that for drug product packages using RFID or other non-line-of-sight technologies, the unique identifier should either include an encrypted NDC number or provide an accessible link to the NDC number that is readily available to pharmacies to facilitate their needs.

Ideally, there should be one numbering scheme used in the drug supply chain. We recognize that the technology continues to advance and it is difficult to predict what its capabilities will be in the near future.

2. Universal Pedigree and Uniform Pedigree Fields

Issue/Background

The PDMA limits who is required to pass a pedigree and authorizes FDA to determine what information should be included in the drug pedigree. This information is codified at 21 CFR 203.50. Some States have laws imposing pedigree requirements on members of the drug supply chain not covered under the PDMA. Some States have enacted laws requiring additional information to be included in pedigrees passed with drugs sold in their State. In addition, State requirements differ with respect to the information that must be included in the pedigree. We sought comment on what information pedigrees should contain and how such a uniform standard could be achieved.

What We Heard

Nearly all comments encouraged FDA to implement federal uniform pedigree requirements and standards binding on the drug supply chain and States. Several comments noted the work of stakeholder initiatives, including the Uniform Pedigree Task Force and the EPCglobal e-pedigree standards working group. These stakeholder initiatives suggested data fields that could be captured in a uniform pedigree, including:

• Product Information: drug name, manufacturer, product NDC, dosage form, strength, container size;
• Item Information: lot number and expiration date, quantity of units by lot, product serial number (if serialized);
• Transaction Information: transaction identifier (e.g., PO, invoice) and date, transaction type (e.g., sale, transfer, return), date received;
• Trading Partner Information: business name, address and license of seller, alternate ship-from location of seller, seller contact information for authentication, business name, address and license of recipient, alternate ship-to location of recipient;
• Signatures/Certifications: digital signature of seller, digital signature of recipient.

There was near complete agreement that all wholesalers, not just non-authorized distributors, should be responsible for passing pedigree information. Many of these comments urged FDA to take appropriate steps to require a universal and nationally uniform e-pedigree so that stakeholders do not have to comply with 50 different State pedigree requirements.

Discussion

The PDMA requires a statement/pedigree ("in such form and containing such information as the Secretary may require") to be passed with certain wholesale distributions. The PDMA and FDA's pedigree-related implementing regulations define the information that must be included in a pedigree.

We continue to believe that a universal e-pedigree (i.e., a pedigree passed by all wholesalers, not just those who are not authorized distributors of record) that documents the movement of every prescription drug product from the manufacturer to the dispenser would be an important step in preventing counterfeit drugs from entering the drug supply chain.

We also agree with the comments that a single, national, uniform pedigree would be ideal to help ensure efficient distribution of safe and effective medicines. To be most effective and efficiently communicate chain of custody and other information about the drug product, it would be ideal if all members of the drug supply chain passed a pedigree that was uniform across all States. Fifty different State pedigrees will no doubt create confusion in the marketplace and could stifle interstate drug trade. For example, the pedigree laws that were enacted in Florida, California, Indiana, and other States contain different requirements.

Under existing law, FDA lacks statutory authority to implement a universal and nationally uniform pedigree. If legislation is considered in this area, we stand ready to provide technical assistance.

3. Data Management/Data Security

Issue/Background

For e-pedigree transmission to be successful throughout the drug supply chain, business partners at each point in the supply chain should be able to share information effectively and efficiently. The choice of data management practices and standards becomes an important one for all stakeholders. One issue that has been raised is whether the data/information should be stored in one central database or if a distributed approach (where each stakeholder's system exchanges information with other systems) should be used.

What We Heard

A majority of the comments advocated the use of a distributed database approach to data management. Many noted that a centralized database would be more costly, slower to implement, a threat to patient privacy, and could disrupt drug distribution if the database was unavailable or compromised for some reason. Comments suggested that secure peer-to-peer transactions would be possible under the distributed model. One comment suggested that data management be controlled centrally via a third party, contractually-managed by FDA.

A few comments suggested specific data security measures, such as pedigree documents having digital signatures to maximize document integrity, authentication, and non-repudiation. Some comments referred to existing data transmission standards used elsewhere, specifically Public Key Infrastructure, Federal Information Processing Standards, and the ISO/ICE standards 17799 or 12207. One comment noted that e-pedigrees could be authenticated electronically, using electronic verification of the digital signature and the signed transaction content for each transaction. One comment promoted the use of biometric log-on methods to improve security.

Discussion

It is vital that specific event information contained in the electronic pedigree be secure. We have no preference as to whether the data is housed in a central database or in a distributed scheme. Based on what we heard, it is our understanding that e-pedigree is technologically feasible with either model and even in a hybrid environment, where some data is stored in a central database while other data is distributed across company servers. We believe it would be most efficient to let the market and technology dictate how to best capture and access the data in e-pedigrees.

We do believe that it is essential that every entity in a drug product's chain of custody has access to the product's pedigree data all the way back to the manufacturer, in order to verify and authenticate the pedigree. It is also important for FDA to have access to the information in matters of suspect illegal activity.

4. Privacy Issues

A. Labeling/Disclosure/Education

Issue/Background

There is general concern that an unauthorized person might be able to read the information from an RFID tag on a drug without the possessor of the drug knowing it, possibly disclosing personally identifiable information or the name of the drug. We sought comment on whether privacy concerns are warranted and whether it is possible for an unauthorized person to read the information from an RFID tag on a drug once that drug is in the consumer's possession. If so, what type of information could be accessed? We also sought comment on how to make consumers aware that an RFID tag is on the drug package and the type of consumer education that would be needed as the use of RFID in the drug supply chain becomes more prevalent.

What We Heard

The majority of the comments indicated that privacy safeguards are needed. However, some pharmaceutical organizations said that patient privacy issues are not a major concern because many of the prescriptions filled at pharmacies are not dispensed in the original bottles from the manufacturer; the prescriptions are instead placed in a consumer-size container, which would not have an RFID tag. Some comments cited concern about persons gaining unauthorized access to information about the type of drug being taken as well as personal identifying information. Several comments said that the RFID tag should not contain information that identifies the drug (e.g., NDC number). Instead, these comments suggested that the tag should contain a random serialized number so that anyone reading the tag would see only a meaningless number.

Many comments referred to the importance of consumer notice and choice and the use of fair information practices. Comments noted that notice of the presence of an RFID tag on a drug package should be clear, conspicuous, and accurate. Several comments indicated that one way to address the issue of consumer notice is to use a symbol on the package. There was uncertainty, however, as to where the symbol should be placed.

Some comments pointed out that many concerns about privacy are due to concerns about database security (i.e., once the data is collected from an RFID tag, how secure is the database where it is stored?).

The majority of comments said that consumer education is needed for the successful adoption of RFID across the drug supply chain. Many comments indicated that consumers should be informed of the benefits of RFID (e.g., how RFID can help secure the drug supply chain), as well as the risks associated with the technology (e.g., potential threat to privacy). According to some comments, consumers should also be educated about the options that are available for deactivating or removing the RFID tag. Most comments said that FDA, as well as experts in academia, industry, and patient and consumer groups, should be involved in developing education programs.

Discussion

Privacy issues are a real concern for consumers and FDA. These concerns will continue unless there is appropriate disclosure of the presence of an RFID tag on containers given to patients and sufficient education about the application, true risks, benefits, and vulnerabilities associated with RFID tags on drug products. This is no easy task.

Although we support the use of a statement or symbol to disclose the presence of an RFID tag on a drug product package, it is important that manufacturers work with FDA to develop an appropriate message or symbol. Most statements made on the labeling of prescription drug products are regulated by FDA and subject to agency pre-approval. We, therefore, recommend that manufacturers should work with FDA before choosing a statement or symbol to add to their product labeling.

We also are willing to work with stakeholders to develop a uniform statement or symbol that can be used to signal the presence of an RFID tag on a drug product package to use in educational campaigns. Such campaigns would help consumers to readily identify and understand the meaning of the statement or symbol.

We do not propose to issue guidance at this time regarding statements or symbols on drug product labeling to indicate the presence of an RFID tag.

Consumer education is necessary. Potential messages could include educating consumers about RFID, the benefits of its use for patient safety, the privacy risks, possible risks from RF emission, and deactivation and removal of the tag. We do not currently have the resources to lead educational efforts. However, we will work with manufacturers and other stakeholders in their efforts.

B. "Turning Off" the RFID Tag

Issue/Background

Some people have suggested that the RFID tag should be "turned off" or deactivated before it leaves the pharmacy, or that patients should be given the choice of whether it is "turned off". We sought comment on the advantages, disadvantages, and feasibility of deactivating the tag.

What We Heard

Many comments indicated that deactivating or removing the RFID tag at the point of purchase (i.e., the pharmacy) would effectively address privacy concerns. However, some comments pointed out that while deactivating or removing the tag would address privacy concerns, it may also prevent post-sale benefits (e.g., recalls) which would have been possible had the tag remained active/in place.

Some pharmacy groups said that the tag should be deactivated prior to arrival at the pharmacy retailer to ensure that no patient is inadvertently sent home with an active tag. One comment said that in practice, deactivating the tag at the point of sale is not feasible because it would place too much responsibility on pharmacists and may re-expose the drug to unknown radio-frequency effects. Some comments indicated that FDA should provide guidelines to ensure privacy protections through RFID tag deactivation or removal.

Many comments suggested various deactivation methods. Some of the suggested options were: kill function (total or partial), blocker chips, encryption, read protection, decommissioning with individual tag password, tag destruction, placing RFID tagged objects in a foil lined bag (which would prevent unwanted reads), and database controls. There was no consensus on the best deactivation method. However, a standards organization commented that it is evaluating tag deactivation, taking into consideration the consumer and industry benefits of post-sale uses of RFID tags. The point in the supply chain where RFID tags should/could be deactivated is also being evaluated.

Discussion

There are benefits to both keeping the RFID tag active after sale and deactivating it before dispensing the product. We believe that an active tag can provide valuable information if the drug product finds its way back into the drug supply chain. FDA has found counterfeit and diverted drugs in the drug distribution system when drug wholesalers, third-party return entities, or manufacturers return drugs for credit and/or destruction. Those products with active tags would be easier to identify and track through the supply chain. That said, we respect the privacy concerns, however, and do not believe that it is necessary for an active tag to go to the patient.

It is unclear whether technological methods to deactivate the tag in the normal course of business are mature enough for use in the marketplace at this time. We believe that this issue warrants further discussion among stakeholders, technology experts, and consumers, about the viable options and we are not prepared to make a recommendation at this time.

CONCLUSION

FDA's vision of a safe and secure drug supply chain is premised on transparency and accountability by all persons who handle the prescription drug, starting with the manufacturer and ending with the pharmacist who hands the drug over to the patient. Drug supply chain efforts that capitalize on advances in electronic track and trace technology to create a secure electronic pedigree further this vision.

With the implementation of the PDMA regulations in December 2006, we expect that supply chain stakeholders will move quickly to adopt electronic track and trace technology, implementing RFID in a phased-in approach. We recognize that there are important issues that still need resolution, such as privacy concerns and uniform and universal pedigrees that might benefit from further discussion by stakeholders or Congress. However, these issues should not hinder the forward progress and momentum toward widespread adoption that we have witnessed and expect to continue. Companies should continue to tag drug products, build infrastructure across the supply chain for using an e-pedigree, and remain vigilant in their responsibility to provide a safe and effective drug product to the patient.

Footnotes

¹ The Task Force consists of senior staff from the Office of the Commissioner (Office of Policy and Planning, Office of the Chief Counsel), Office of Regulatory Affairs, the Center for Drug Evaluation and Research, and the Center for Biologics Evaluation and Research.
²The FDA Counterfeit Drug Task Force recommendations are detailed in its report, entitled, "Combating Counterfeit Drugs – A Report of the Food and Drug Administration ," February 18, 2004 (2004 Counterfeit Drug Report) (http://www.fda.gov/oc/initiatives/counterfeit/report02_04.html).
³ PDMA (Public Law 100-293) was enacted on April 22, 1988, and was modified by the Prescription Drug Amendments (PDA) (Public Law 102-353, 106 Stat. 941) on August 26, 1992. The PDMA, as modified by the PDA, amended sections 301, 303, 503, and 801 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 331, 333, 353, and 381) to, among other things, establish requirements related to the wholesale distribution of prescription drug products.
⁴Combating Counterfeit Drugs: A Report of the Food and Drug Administration Annual Update , May 18, 2005 (http://www.fda.gov/oc/initiatives/counterfeit/update2005.html).
⁵The workshop agenda, speakers' presentations, and meeting transcript are available at www.fda.gov/rfidmeeting.html .
⁶64 FR 67720.
⁷65 FR 25639.
⁸See http://www.fda.gov/oc/pdma/report2001/
⁹69 FR 8105.
¹⁰In this report, the term "comments" includes comments that we heard at the public meeting and written comments submitted to the docket.

Counterfeit Drugs Home Page

FDA Home Page | Search FDA Site | FDA A-Z Index | Contact FDA | Privacy | Accessibility

FDA Website Management Staff