In recent essays I have covered the “Anatomy of an NDC”, the “Anatomy of a GTIN” and the “Updated HDMA Bar Code Guidance: A Must Read“.  Now let’s put them all together.  Why would we need to do that?  Because the U.S. FDA requires many Over-The-Counter (OTC) and all prescription drugs marketed in the United States to have their National Drug Code (NDC) presented in the form of a linear barcode on the package.  Pure and simple.  To do that in a way that your trading partners can understand—that is, to do it interoperably—you need to follow a standard.  You have two realistic choices for standard approaches to this problem:  HIBCC or GS1.

The use of HIBCC standards is fairly common in the U.S. medical surgical devices supply chain but in the pharmaceutical supply chain it is very rare.  Most companies choose GS1’s barcode standards so that’s all I’m going to focus on in this essay.  If you want more information about how to do this with a HIBCC barcode find it here.

OVER-THE-COUNTER DRUGS:  GTIN-12

If your drug is sold over the counter (OTC), like aspirin and cold medications, the barcode on your packages will need to be scanned at point of sale (POS) terminals in the same way that any other consumer good is.  For that reason you need to put your National Drug Code (NDC) into a Universal Product Code (UPC) barcode in the United States.  A UPC-A barcode symbol contains a GS1 GTIN-12 data structure.  Here is what you need to do to convert your NDC into a GS1 GTIN-12:

1. Register your FDA Labeler Code with GS1 US who will convert it into a GS1 Company Prefix (GCP) and grant you the right to use it
   Recall from my previous essays that your FDA Labeler Code is either 4 or 5 digits long and a GCP can be anywhere from 6 to 10 digits depending on the fee you pay GS1 US when you register it.  In the case of FDA-regulated pharmaceuticals GS1 US will register a 4-digit FDA Labeler Code as a 6-digit GCP and a 5-digit FDA Labeler Code as a 7-digit GCP.  The reason is that they need to synchronize the length of the Item Reference portion of the resulting GTINs with the combined length of the Product Code and Package Size fields of your NDC.  This is to ensure that you are able to generate valid GTIN-based barcodes for every possible NDC that your Labeler Code enables you to generate.  You only need to register your FDA Labeler Code with GS1 US once as long as you keep up with the annual subscription fees so for subsequent drugs that use a Labeler Code that is already registered you can skip this step.  If you have multiple FDA Labeler Codes you need to register each one with GS1 US once.
   
   GS1 US has reserved GCPs that start with “03″ for owners of FDA Labeler Codes as shown in the following table.
   

   Click images to enlarge

2. From your new GS1 Company Prefix construct your U.P.C. Company Prefix
   Ah ha!  This is an esoteric step.  It is necessary because of the way GS1 merged the formerly North American-only Uniform Code Council’s (UCC) Universal Product Code (UPC) company prefixes with the European Article Numbering Association’s (EAN) European Article Number (EAN) company prefixes and made the whole combined scheme suitable for global company prefixes and yet retained backward compatibility with the UPC and EAN.  But you don’t have to follow any of that.  Here’s what you do.
   
   You take the GCP that GS1 US assigned you and you strip off the leftmost digit.  That digit is always going to end up being a zero because we are dealing with an FDA regulated pharmaceutical and GS1 US will make sure that it is a zero on your behalf.  The remaining digits make up your new U.P.C. Company Prefix, usable only for generating UPC-A barcodes  and a few other less common things (see the GS1 General Specification for what else you can do with a U.P.C. Company Prefix).  For an NDC that has a 4-digit Labeler Code your U.P.C. Company Prefix will now start with a “3” and it will be 5 total digits long.  For an NDC that has a 5-digit Labeler Code your U.P.C. Company Prefix will now start with a “3” and it will be 6 total digits long as shown below.
   

   Click images to enlarge

3. Combine your U.P.C. Company Prefix with the Product Code and Package Size fields from your NDC
   For an NDC that has a 4-digit Labeler Code your Product Code and Package Size fields will be a total of 6 digits long.  Combine them with the GS1 U.P.C Company Prefix by placing them to the right of the prefix.  For an NDC that has a 5-digit Labeler Code your Product Code and Package Size fields will be a total of 5 digits long.  Combine them with the GS1 U.P.C. Company Prefix by placing them to the right of the prefix.  You should now have a total of 11 digits regardless of the length of your Labeler Code as shown in the table below.
   

   Click images to enlarge

4. Calculate the Check Digit and add it to complete your GTIN-12
   GS1 provides an algorithm to calculate the Check Digit in section 7.2.7 of the GS1 General Specification.  They also provide a handy calculator at this webpage(although where they say to enter the “Item Reference”, they really mean for you to enter the full prefix and item reference together).  Add check digit to the right of the code constructed in step 3.  You should now have a 12-digit code as shown below.  This is the GTIN-12 that can be encoded into a UPC-A barcode and printed on your product.
   

   Click images to enlarge

If you look closely at the table above you may see a short-cut that would get you directly to your GTIN-12.  All you need to do is take your 10-digit NDC and put a “3” in front of it and put a calculated check digit at the end as shown in the following table.

Click on images to enlarge

It is true that you can get there this way but then you might be tempted to skip step #1 and not obtain your official GCP.  As I understand it, since GS1 owns a copyright on the UPC family of barcode symbologies they could make a claim against your company if you encode your NDC into the copyrighted UPC-A symbology without first registering your FDA Labeler Code with them and paying whatever fee they place on that.  Talk to GS1 US to get the full story for your particular situation.  On the other hand, if you have already registered your Labeler Code with GS1 US then this short-cut should always produce your GTIN-12 for subsequent products that share the same FDA Labeler Code.

PRESCRIPTION DRUGS:  GTIN-14

Any drug distributed in the U.S. that is regulated by the FDA as a prescription drug must be dispensed by a registered pharmacist.  In that case it will not be scanned at a retail POS station.  For that reason you do not need to encode your NDC within a GTIN-12 but should encode it into a full GTIN-14.  GTIN-14s should also be used on all case labels whether OTC or prescription (see the HDMA Bar Code Guidance for details).  You can render a GS1 GTIN-14 identifier into a GS1-128, GS1 DataMatrix, or GS1 DataBar symbology depending on the application.

Here is what you need to do to properly convert your NDC into a GS1 GTIN-14 data structure:

1. Register your FDA Labeler Code with GS1 US who will convert it into a GS1 Company Prefix (GCP) and grant you the right to use it
   This is the same as step #1 for GTIN-12 above.
   
   
2. Combine your GS1 Company Prefix with the Product Code and Package Size fields from your NDC
   For an NDC that has a 4-digit Labeler Code your Product Code and Package Size fields will be a total of 6 digits long.  Combine them with the GS1 Company Prefix by placing them to the right of the prefix.  For an NDC that has a 5-digit Labeler Code your Product Code and Package Size fields will be a total of 5 digits long.  Combine them with the GS1 Company Prefix by placing them to the right of the prefix.
   
   
3. Add your Indicator Digit
   Next you need to add the single digit “Indicator digit” to the left of the GS1 Company Prefix.  Refer to my previous essay, “Anatomy of a GTIN” to learn what this digit is for.  For a unit of use package, use the value “0″.  You should now have a total of 13 digits regardless of the length of your Labeler Code.
   
   
4. Calculate the Check Digit and add it to complete your GTIN-14
   GS1 provides an algorithm to calculate the Check Digit in section 7.2.7 of the GS1 General Specification.  They also provide a handy calculator at this webpage.  Add check digit to the right of the code constructed in step 2.  You should now have a 14-digit code.  This is the GTIN-14 that can be encoded into a GS1 Code-128, GS1 DataMatrix, or DataBar barcode and printed on your product or case.  (NOTE:  DataBar should only be used on packages that are too small to accept one of the other symbologies.  See the HDMA Bar Code Guidelines for details.)

Finally, if you have already registered your Labeler Code with GS1 US you can use the following short-cut to construct your subsequent GTIN-14s.

Click image to enlarge

The following figure summarizes the contents of all forms of the NDC for both GTIN-12 and GTIN-14 data structures.

Click images to enlarge

IMPLICATIONS

There is an important implication stemming from the use of GS1 identifiers and barcodes to encode and render your NDC that I think needs to be explained.  This applies to any company that already possesses a GCP that does not match their FDA Labeler Code.  I can think of two ways that this might happen:

1. Any company in the U.S. that distributes non-drug products and already obtained a GCP from GS1 US for those products,
2. Any drug manufacturer that is based outside of the United States and that already possesses a GCP that was issued by their local, non-U.S. GS1 Member Organization.

Neither of these types of GCP’s can be used to encode an NDC for distribution within the U.S.  That’s because these GCPs do not match your FDA issued Labeler Code.  Only GS1 US, the U.S.-based GS1 Member Organization, can issue you a GCP that is properly based on your Labeler Code.  So these companies should contact GS1 US to register their Labeler Code, whether the company is based in the U.S. or not.

Systems and their associated databases should always be designed to accommodate the full GTIN-14 even when the application may seem to only need to deal with GTIN-12′s.  See GS1′s position paper on this topic for more explanation.

There are a few more “Anatomy of…” essays I want to write including the FDA’s Standardized Numeric Identifier (SNI), and GS-128 in the U.S. Pharma supply chain.  Watch for those essays in the near future.

Dirk.

In a long awaited and much anticipated move the Healthcare Distribution Management Association (HDMA) published updated guidance for the formatting, encoding and placement of barcodes in the U.S. pharmaceutical supply chain.  The document is called “HDMA Guidelines for Bar Coding in the Pharmaceutical Supply Chain 2011”.  The guidance is aimed mostly at pharma manufacturers and repackagers who place barcodes on their drug packages, cases and pallets.  The last time the guide was published was in 2005 and this new edition includes some significant changes that everyone in the supply chain who deals with product and shipping container labeling should be aware of.

The updated document can be downloaded from the HDMA Marketplace web page.  It is free to HDMA members.  Non-members will need to pay a fee but don’t let that stop you from downloading a copy if you have any responsibility for applying or reading barcodes in this supply chain because you will need to make changes to keep up with the direction of the technology and the industry.

Full disclosure:  I work for a company that is a member of HDMA and I contributed to the development of this updated guideline, but this essay is not a marketing pitch for the benefit of HDMA or my pride.  Rather it is to help generate alignment around a common approach within the supply chain.

HDMA GUIDELINES FOR BAR CODING IN THE PHARMACEUTICAL SUPPLY CHAIN

The guidelines provide the reader with the industry-specific information necessary to know how to apply GS1 and HIBCC standards in the U.S. pharmaceutical supply chain.  It provides an excellent discussion of barcode standards, including some history which I made use of in my recent RxTrace essay “Anatomy Of The National Drug Code”.  It explains how those standards should be applied to identify drugs at all levels of packaging as they move through the supply chain so that companies can maximize the benefits of barcode technology.  This edition provides expanded guidance on the implementation of 2D barcodes and RFID on packages and shipping containers.

For the first time the HDMA now “…recommends investing in imaging scanners capable of reading Data Matrix and linear codes whenever auto-id procurement needs are under consideration.”  This HDMA recommendation aligns well with GS1 Healthcare’s position as published in 2009.

Both of those recommendations make sense because we are now standing on the threshold between two barcode eras in the U.S. pharma supply chain:  linear in our rear-view and 2D in our forward-view.  Any investment in linear-only barcode reading and writing equipment now probably won’t reach the end of its full depreciation still in use.

Imaging equipment manufacturers have made great strides in the last decade in nearly matching the read performance of linear barcode readers and the prices have come down.  Linear readers will probably always be cheaper than imagers but you should consider this lower cost a reflection of the fact that they are now in the “discount bin” of obsolete technologies.

Linear codes are not dead yet, but I think we are going to see a fairly rapid transition to 2D barcodes in this industry with the approach of serialization regulatory mandates here and abroad.  See my RxTrace essay “SNI’s Are Not Enough In a Plateau-Based Supply Chain Security Approach“ for more on this.

The development of the HDMA guideline documents over the years have benefited by the contribution of George Wright IV, Vice-president of PIPS / Product Identification & Processing Systems, Inc.  George is an automatic identification and data capture (AIDC) industry veteran and I have found him to be a bottom-less well of technical and historical knowledge in this area.  Many sections in the HDMA guidelines have a depth and quality that come directly from George’s contribution.

CHANGES

If you think you already know how to properly format and print barcodes on drugs marketed and shipped in the U.S., you need this edition of the guidelines.  There are some significant differences from the way things have been done up to now.  The first section of the updated document is a Summary of Revisions.  Here is a partial list:

• Addition of a unique serial number in the GS1-128 product identification bar code to product case labels;
• Addition of an optional but recommended 2D GS1 DataMatrix bar code symbol to drug packages and product case labels;
• Removal of ITF-14 as a Primary Data Carrier (bar code) option for product case labels;
• Removal of AI(22) as a Secondary Data structure option on product case labels.  This is a major departure from the way things are done today because AI(22) currently appears on about 75% of all product cases in the U.S. pharma supply chain.  The document provides details on what AIs to use in place of AI(22) and how to arrange them;
• Reduction in the minimum X-dimension for GS1-128 symbols.  This move enables a slightly tighter linear barcode on case labels so that serial numbers can be added to them without blowing out the available space;
• Reduction in the minimum height for GS1-128 symbols on case labels.  Another move to free up precious real estate on case labels so that serial numbers will fit in the barcodes;
• A new HDMA recommendation for adding GS1 serial numbers to units and shipping containers;
• New information on standardized numerical identifiers (SNIs).

ENFORCEMENT?

The HDMA does not enforce compliance with their guidelines.  That is, if you don’t follow their guidelines no one from the HDMA will knock on your door or send you a cease and desist letter.  The same goes for GS1.  The U.S. FDA tightly regulates everything that appears on drug primary packaging—including the linear barcode that encodes the NDC—but they don’t regulate the contents of case-level product identification or shipping labels.  While the U.S. Drug Enforcement Administration (DEA) does place certain restrictions on the information that appears on shipping labels (and they will come knocking on your door if you fail to follow them) those are limited to controlled substances.

So who enforces compliance with the HDMA guidelines?  In reality no one does and that has led to a major missed opportunity for improved efficiency, accuracy and even profitability in the supply chain.  Unfortunately very few companies follow all of the HDMA guidelines closely and that causes downstream trading partners to miss out on the opportunity to maximize the use of product case barcodes in operations like receiving, inventory management, picking and shipping.  Barcodes are certainly used extensively in all of those processes today but case-level product identification labels cannot always be trusted because there is so much variance in compliance to both GS1 standards and HDMA guidelines.  If you can’t trust the data in the barcode you can’t achieve its promise to maximize efficiency and data capture accuracy.

Some pharma manufacturers take their product case labels very seriously and have a program to ensure that they comply with the standards and with HDMA’s guidance, even without any heavy-handed enforcement.  I applaud them.  But the truth is, the majority of companies seem to take a quick stab at producing the barcodes on their case labels and then ship them out.  If no one complains, they probably think they got lucky and got it right the first time.  In other supply chains that face intense price competition these kind of inaccuracies and waste are not tolerated.

I keep thinking that something will trigger closer attention to detail in the construction of case labels in the pharma supply chain.  Maybe this newly updated guideline from HDMA is just what we need.  Do you think it will have a positive impact?  Leave a comment below.

Dirk.

The U.S. Food and Drug Administration (FDA) created the concept of the National Drug Code (NDC) in 1969 to “…provide an identification system in computer language to permit automated processing of drug data by Government agencies, drug manufacturers and distributors, hospitals, and insurance companies” (from 34 FR 11157, July 2, 1969).  (I can’t find a copy online of the original Federal Register article from 1969 so I’m relying on a more recent article that references it.)   Those of us in the U.S. pharma supply chain make use of NDC’s every day, but very few of us know the history of their development, exactly how the numbers are composed and what they mean.  I’ll try to explain all of that and provide sources for further reading.

HISTORY OF THE NDC

The NDC was initially a voluntary identifier (see references at the end of this essay).  We all know how that would have turned out (for more on that thought, see my recent essay “Should Regulations Dictate Technology?“) so in 1972 the FDA made the NDC mandatory for all prescription and over-the-counter (OTC) drugs.  Manufacturers were required to obtain a “Labeler Code” from the FDA, construct their NDC’s using that code as the base and print the NDC number on drug packages.  Barcodes were not required by the FDA back then.

From the quote in the first paragraph above you can see that the FDA intended the NDC to be used among the full spectrum of users who needed to unambiguously refer to specific drugs.  I can’t imagine how inefficient it must have been to refer to a specific form, size and concentration of a particular drug in every step between manufacturer, patient and insurer before the advent of the NDC.  Even from the very start the FDA intended the NDC to help with automation using computers.  Computer automation leads to greater efficiencies and much greater data accuracy–just what was needed for the drug industry and supply chain to grow in the coming decades.

The FDA recognized in the early 1970′s the automation value of encoding the NDC into barcodes, but as I said, they didn’t require them.   However, barcodes were making a big splash in the grocery industry and soon after in the consumer products goods industry around that time because of the great gains experienced in checkout efficiency and inventory control.  The Uniform Grocery Code Council (UGCC) introduced the 12-digit Universal Product Code (UPC) identifier and barcode symbology in 1974 and it quickly became the standard for all products sold at checkout counters.  Chain stores of all kinds started putting maximum pressure on manufacturers to put a UPC barcode on every product they sold.

This led to an interesting collision of mandates.  The FDA had already mandated that OTC drugs be identified by their NDC.  The UGCC mandated that the “Company Prefix” portion of the Universal Product Code that was encoded in UPC barcodes be assigned by the UGCC.  Since OTC drugs were one of the products that were being sold by chain stores, pressure was put on the UGCC to find a way to accommodate the 10-digit NDC within the 12-digit UPC.

UGCC technical experts quickly came up with a way to do it.  They came up with the scheme of pre-pending the NDC with the digit ’3′ and then adding the standard UPC checksum at the end.  The UGCC had to commit to reserving all UPC’s with a ’3′ as the first digit for drug companies and they agreed to reserve the Company Prefixes for drug companies so that they matched the FDA’s Labeler Code.  OTC drug manufacturers now had a way to satisfy both mandates and many years later that approach continued to be used as manufacturers started to apply barcodes to non-OTC drug packages.

Around that time the UGCC became the Uniform Product Code Council (UPCC), then the Uniform Code Council (UCC) in 1984, and finally became GS1 U.S. in 2005.  All along the organization has been a privately held, non-profit, tax-exempt corporation.

While the printing of the human readable NDC on drug packages was mandatory the printing of a barcode on drugs was voluntary until only relatively recently.  The FDA published a final rule  in 2004 that mandated all drug packages have a linear barcode printed on them starting in 2006.  By 2004 roughly 90% of drug packages in the supply chain already had linear barcodes on them voluntarily.  It seems odd that it took the FDA so long to mandate such a valuable automation element when it seems like it could have mandated it much earlier with little justifiable complaint from the industry.  The final rule document contains a significant amount of discussion, explanation and documentation about the benefits of barcodes on drug packages, particularly around the benefits to patient safety.

THE ANATOMY OF THE NDC

The NDC is composed of three semi-fixed-length data fields:

• FDA Labeler Code
  This is a code that is assigned by the FDA to the manufacturer, packager (“labeler”) or repackager of the drug as part of an application process.
• Product Code
  This is a code that is selected by the owner of the FDA Labeler Code.  It represents the unique combination of the drug, the dosage form and strength that will be packaged by that owner.  While the code is assigned by the owner of the Labeler Code it must be registered with the FDA.
• Package Size
  This is a code that represents the package size or package grouping of the drug.

For a short time the NDC started out in 1969 as a 9-digit code.  Initially the Labeler Code was defined as 3 alphanumeric characters long–a fixed length–but was soon changed to 4 numeric digits bringing the full code to the full 10-digits we know today.  The product code was defined as a fixed 4 digits long and the package size took up the remaining 2 digits.  But Labeler Code assignment requests came it at an alarming rate and it apparently wasn’t slowing down as they started to approach 999 sequential code assignments.

A decision had to be made.  If they crossed the border and assigned Labeler Code 1000, the NDC would forever be limited to 4 digits with a maximum of 9,999 codes and they might run out someday.  They were already approaching 10% of that number.  But if they made the fields of the NDC semi-fixed length at either 4 or 5 digits, they could continue assigning codes until a theoretical maximum of 99,999 codes.

The FDA didn’t want to expand the NDC to 11 digits so they decided to remove one digit from either the Product Code or the Package Size fields.  Rather than picking one or the other they decided to leave that choice up to each owner of the new 5 digit Labeler Codes.  Those companies could choose to have only 3 digits for the Product Code and 2 for the Package Size (written as 5-3-2), or they could choose to have 4 digits for the Product Code and only one digit for the Package Size (written 5-4-1).  The decision is made by the owner and they must register their choice and stick with it for the life of the Labeler Code.

But there is a problem with this approach.  Given a 10-digit NDC that might have a 4-digit or a 5-digit Labeler Code there could be conflicts between the NDC’s of two different companies.  Two companies might end up generating the identical NDC for two different products.  To eliminate this potential problem they decided to never assign labeler codes 1000 through 9999 (actually there is no explicit rule published that the FDA is following this technical requirement but it appears that this is what they are doing for most new Labeler Codes).  This makes the actual maximum number of Labeler Codes available equal to 90,999…not a bad compromise.

This solution provides a well-defined rule that allows systems to easily figure out the length of the Labeler Code within a given 10-digit NDC number.  All NDCs assigned by companies who own a 4-digit Labeler Code will always have a zero in their leftmost position and all NDC’s assigned by companies who own a 5-digit Labeler Code always have a non-zero digit in their leftmost position.  But there is no easy way to figure out if the owner of a 5-digit Labeler Code is using the 5-3-2 form or the 5-4-1 form without looking it up in a database.

The Package Size field is an important field used to differentiate not only the various dosage form sizes of the packages that the manufacturer or repackager produces (i.e. 30-count, 60-count, 90-count), but also the casepack quantities of each of that same set of packages.  There are no standard values for the Package Size field so the values used for one manufacturer cannot be compared with those of another.  They are simply used to differentiate package sizes and groupings within a single product type causing considerable confusion to those who wish to make use of this field.

For example, Company A might choose to use the values ’30′, ’60′ and ’90′ to represent the Package Size codes for their 30, 60 and 90 count bottles of a given drug, and the values ’31′, 61′ and ’91′ to represent a single casepack quantity of 48 bottles for the 30 pill bottle, and 24 bottles for the 60 and 90 pill bottles.  Company B might have chosen the 5-4-1 form of the NDC so they are left with only a single digit to represent their Package Sizes and groupings.  They might choose values ’1′, ’2′, and ’3′ for their 30, 60 and 90 count bottles of a given drug, and the values ’6′, ’7′ and ’8′ to represent the single casepack quantity of 96 bottles of their 30-count bottle, 48 bottles of their 60-count bottle and 24 of their 90-count bottle.  Confused yet?

So what use is this Package Size field if there isn’t any standard?  It simply allows manufacturers and repackagers to create unique NDCs for each dosage form size and casepacks so that interested parties can use it to look up the other information in a database.  You can’t just look at an NDC and know exactly what it stands for unless you have some prior knowledge about the choices the manufacturer or repackager has made for that product.  A database lookup doesn’t care what values are chosen for each packaging level or grouping as long as they are each unique.

NCPDP STEPS IN TO REDUCE AMBIGUITY

The current design of the NDC results in a number of ambiguities that stem from the fact that the length of each of the three fields can be one of two values.  The National Council for Prescription Drug Programs (NCPDP) decided to fix the ambiguity to increase the accuracy of claims submission.  They saw that all you have to do to return to a fixed length set of fields is to add an eleventh digit.  The goal was to always end up with a 5-4-2 format for all NDC’s.  To all 4-digit labeler codes (4-4-2) they added a ’0′ on the left.  To any 3-digit Product Code fields (5-3-2) they added a ’0′ on the left.  To any 1 digit Package Size (5-4-1) they added a ’0′ on the left.  All of these resulted in a 5-4-2 format (11 total digits).

For their purposes I’m sure this works great.  But it introduces its own ambiguity when an 11-digit “pseudo-ndc” is offered where a 10-digit true NDC is needed.  Which zero is the extra zero?  You can’t always tell unless you know for a given NDC.  Incidentally, the FDA apparently doesn’t recognize the NCPDP 11-digit format so it is not a real NDC.  That’s why I’ve called it a “pseudo-ndc”.

UNIT DOSE/UNIT-OF-USE NDCs

There is one more thing I want to say about NDCs.  I think the FDA made a significant error in not defining the NDC in a way that requires all pharma manufacturers and repackagers to clearly identify which NDC is a unit dose or unit-of-use for each drug.  The NDC appears to have been conceived as a way for a manufacturer to assign a unique code for each type of package they make for a given drug.  Since most manufacturers currently do not produce packages that contain a single unit dose or unit-of-use there is theoretically no need for them to define an NDC for that level.  I am told that some manufacturers do define and register an NDC for this level even if they don’t package at that level, and the rest do not.

I imagine that this has caused serious heartburn for insurers and Pharmacy Benefit Managers (PBMs) who are probably given the NDC for the original manufacturer’s bottle that a prescription was filled from.  What does it mean for a pharmacist to claim that they filled a prescription with ’1′ of NDC 9999988882 (psuedo-ndc 99999888802 for claims submission) where that NDC describes a 30-count bottle?  Did the patient receive one 30-count bottle or did they receive a single pill that the pharmacist pulled from a 30-count bottle?  There must be some convention for limiting the ambiguity that this introduces.  Perhaps someone can leave a comment to explain what happens in this instance.

In my view all manufacturers and repackagers should always generate and register an NDC for a unit dose or unit-of-use.  Ideally you’d like to think that the Package Size values of either ’00′ or ’0′ would be reserved to indicate the unit dose or unit-of-use, but since it wasn’t defined that way you will probably have lots of drugs that assign those values to some multi-dose/-use package or even a casepack.  It would be too disruptive to force that kind of change on the industry now.

REFERENCES

Normally I provide links to all my references, but there are a couple of sources that I drew from for lots of this content and so I’d like to list them here:

• George Wright IV, Vice-president, PIPS / Product Identification & Processing Systems, Inc.
• “HDMA Guidelines for Bar Coding in the Pharmaceutical Products Supply Chain”, Healthcare Distribution Management Association (HDMA), 2005
• “History of the UPC Bar Code and The Uniform Code Council, Inc.“, by Rob Cummings, Cummings Design
• George Laurer, Inventor of the UPC

Please submit a comment if you have additional information, clarifications or corrections.

Dirk.

If you are a regular reader of RxTrace but you still haven’t read Fortune Magazine’s recent article, “Drug Theft Goes Big” by Katherine Eban, then I suggest that you stop reading this essay right now and spend the next 15 minutes absorbing her article carefully.  And then return here for my analysis.  It’s that good and that important.

Many of you will remember Katherine Eban as the author of the excellent book “Dangerous Doses, A True Story of Cops, Counterfeiters and the Contamination of America’s Drug Supply”.  See my comments on the book here where I point out that a lot has changed since the events that are documented so well in the book.

The new Fortune article is a great update on what drug supply chain criminals have been up to since “Dangerous Doses” was published back in 2005.  The greatest thing about the article is that it contains one answer to the question that is on the minds of so many people in the industry:

HOW COULD ILLEGITIMATE DRUGS END UP IN THE LEGITIMATE SUPPLY CHAIN?

I wondered about this myself in my recent essay “Do We Even Need To Mandate Drug Pedigrees Anymore?”.  But this new article shines a light on one explanation—based on the work of a seasoned investigative reporter—of how this allegedly happened in the instance of some of the Levemir that was stolen back on February 5, 2009.  We can use this explanation to figure out how a modern pedigree model might have worked to detect the stolen drugs in the supply chain before they could cause harm to patients.

Let’s construct a hypothetical sequence of events that matches the sequence that Eban’s article describes in her section titled “From Heist to Pharmacists”.  That way we can dispense with company names and we won’t have to worry about discussing something that is probably still under investigation and will likely result in future criminal charges.

We know that the drug was manufactured and it was stolen in North Carolina while it was en-route from the manufacturer (M) to some destination.  Eban describes how some smaller quantity of drugs that matched the NDC and lot of the drugs that had been stolen were delivered to a licensed wholesaler (W1) in South Carolina five days later.

(As an interesting aside, here is a Google Map that shows a driving route between the town where the real drugs were stolen and the town where the first wholesaler received drugs of the same description as documented by Eban, only 150 miles away.  It’s very interesting, but it’s not really important to our analysis of the hypothetical sequence of events.)

W1 quickly resold these drugs to another licensed wholesaler (W2).  W2 then sold part of its stock to a third licensed wholesaler (W3) in Maryland.  W2 supplied W3 with a “phony pedigree” that inaccurately indicated the drugs had been supplied by a well known national wholesaler.

I use quotes around the phrase “phony pedigree” because that’s what Eban calls it, but that phrase gives the concept of “pedigree” a bad connotation.  One might ask, “What good are drug pedigrees if they can be faked so easily?”.

WHAT GOOD ARE DRUG PEDIGREES IF THEY CAN BE FAKED SO EASILY?

A quick check of the state pedigree regulation map posted by the Healthcare Distribution Management Association (HDMA) shows that neither North Carolina nor South Carolina have any kind of pedigree regulation.  Coincidence?  Maybe, but because neither W1, W2 nor W3 appear to have been Authorized Distributors of Record (ADR’s) for the drug in question, these drug sales should have fallen under the pedigree requirements of the federal Prescription Drug Marketing Act (PDMA).  Even with the court ordered stay in 2006 of part of those requirements, it seems that some kind of pedigree should have been required in each of these sales transactions.

But as Eban discovered in her investigation, only the W2 to W3 transaction apparently included some kind of pedigree.  That transaction occurred between South Carolina (W2) and Maryland (W3).  According to the HDMA’s map, Maryland has a pedigree regulation.  Hmmm.  Interesting.  But it didn’t help because the pedigree was allegedly forged to look legitimate.

Almost certainly, the pedigree that was supplied by W2 would have been a paper pedigree.  A paper pedigree is about as easy to forge as a note from your mother excusing you from gym class, but it is legal in every state that currently requires a pedigree for drug sales of this kind.  The regulatory acceptability of a paper pedigree is little more than an invitation to criminals to make them up.  Most tragic of all, they lend an undeserved impression of legitimacy to this kind of transaction.  W3 apparently complied with Maryland’s pedigree law.  That is, they apparently received a pedigree along with the drugs.  But even so, patients were harmed later.  The pedigree didn’t do its job of protecting patients.

Continuing with the story, W3 sold part of their stock to a chain drug store (CDS) based in Ohio.  Eban doesn’t mention if a pedigree was provided with the sale, but Ohio is another state that has no pedigree regulation.  CDS apparently distributed these drugs to their pharmacies (Ph) in at least four states where they were later found on pharmacy shelves, but not before at least two of their customers had life-threatening adverse reactions.

WHAT DOES THIS HYPOTHETICAL SEQUENCE OF EVENTS TELL US ABOUT PEDIGREE MODELS?

We have to remember that the drugs in the real story were not serialized.  So unless every unit in the entire lot that the manufacturer produced was stolen, it is not possible to say that the drugs that were allegedly found to have caused adverse events were definitely the units that were stolen.  That’s why unit-level serialization is a given in any future pedigree model.  There’s really no question about it.

I’ve already pointed out that paper pedigrees are worthless for protecting patients.  Because they can be forged so easily and the forgeries are so hard to detect, legitimate buyers of illegitimate drugs may accept them and feel confident that the drugs are real.  At least these forged paper pedigrees can be used later to help discover who the bad guys are.  That’s why investigators would rather have a forged pedigree than none at all.  At least they can use the forgery to prosecute the bad guys.  The forgery becomes obvious only after a time-consuming investigation.

But shouldn’t pedigrees help protect patients?  Shouldn’t they help legitimate supply chain members detect when they are being sold illegitimate products at the time of the sale so they can confidently refuse to buy them and notify the authorities right away?  The paper pedigree in our hypothetical story didn’t do that because it couldn’t.  A pedigree model is only as protective as the buyer’s ability to validate pedigrees quickly, efficiently and reliably.  Paper pedigrees with hand written signatures fail all of those tests.

Now let’s assume that every sale from W1 through CDS included the passing of an electronic pedigree that would be capable of being validated quickly, efficiently and reliably.  But that’s still not enough.  Even electronic pedigrees can be forged.  The difference is that forgeries of electronic pedigrees should be very easy to detect—if the pedigree model includes that feature (not all do).

But that capability alone won’t automatically translate into every legitimate company in the supply chain validating every pedigree.  Electronic pedigree validation will still take some amount of CPU time, even if that process is quick, efficient and reliable.  If companies don’t have to check the validity of pedigrees, many probably won’t bother.  In that case, even with a pedigree model that would be capable of easily detecting a forgery, patients could still be harmed if the pedigrees aren’t checked.

Should companies be required to check every electronic pedigree for validity on receipt?  If every recipient had checked an electronic pedigree in our hypothetical sequence, the sequence would have stopped at W1 because they would have easily found that the pedigree they were given was forged.  The thief could not have constructed a pedigree without forging the necessary record that only M could have produced.  All W1 would have needed to do is check the pedigree and the forgery would have failed validation.

Even if W1 had skipped pedigree validation, the next sale to W2 would have provided another opportunity to detect the forged M record.  The sale to W3 provided another opportunity and the sale to CDS another.  With the combination of serialization, an electronic pedigree model with the right features and each recipient validating each pedigree they receive, this hypothetical sequence of sales would have provided at least four opportunities to detect that the product was illegitimate before it was ever given to patients.  The first recipient to actually validate the pedigree would have detected the forgery and the stolen drug would have been stopped right there.

I am fascinated by the results of Eban’s investigation.  Can you see any other lessons from either the real or the hypothetical sequence?

Earlier this month the Healthcare Distribution Management Association (HDMA) published newly updated guidance documents for the use of Accredited Standards Committee (ASC) X12 Electronic Document Interchange (EDI) messages in the U.S. healthcare supply chain.  This is a very important update that supply chain participants should take notice of because it includes new information about how to properly communicate GS1 identifiers, including GLN’s, GTIN’s, and Electronic Product Codes (EPC’s) like SGTIN’s and SSCC’s, within the four document types that are in common use for Order-to-Cash transactions.

The EDI document types included in the updated guidance includes:

• 810, Invoice
• 850, Purchase Order
• 855, Purchase Order Acknowledgement, and
• 856, Advance Shipment Notice (ASN)

Technically, these guidance documents are in four separate documents, but the HDMA has chosen to package all four into a single PDF file.  That seems like an odd choice, but at least you only need to download one (large) file.  You can submit an order for the document at the HDMA Online Store.  There are many useful documents on this site for sale or free download (to members).  The newly updated document I’m referring to is called

“EDI Guidelines For Order-to-Cash (810, 850, 855, 856) in the Healthcare Product Supply Chain (Electronic Download)”

The file download is free for HDMA members.

You can use the file as it is, although the page numbers start over at page 1 at the beginning of each of the sub-documents and that can be confusing.  I found it very slow to work with the single file so I downloaded a free utility from the SourceForge.net called PDF Split and Merge which allowed me to split the one large PDF file into the four separate PDF files.  This is the way they originally intended them to be and this way the page numbering in each document is accurate.

WHY THIS UPDATE IS SO IMPORTANT

As I said above, this update contains important new information about how to properly represent GS1 identifiers in the four standard EDI document types.  Each participant in the U.S. healthcare supply chains who plans to make use of EDI document to carry GS1 GLN’s, GTIN’s and EPC’s should follow this guidance so their EDI documents will be compatible and understandable by their trading partners.  The HDMA has determined the proper EDI segment type and representation for each type of GS1 identifier.  They include two detailed examples for each of the four document types.  In the EDI 856 ASN document, examples are included that show how to represent a detailed serialized packaging hierarchy.

Someday companies will probably make use of ePedigrees to pass unit, inner-pack, case and pallet serialized packaging hierarchy to their customers rather than ASN’s, but until the California pedigree regulations go into effect, this new HDMA guidance update shows how that data can be passed within existing EDI exchanges.  ASN’s are not ePedigrees, and companies should not expect to use them to comply with pedigree regulations, but for now, adding serial numbers to these common B2B messages can be a low cost way to pass this valuable data to your downstream trading partners.

If you are interested in sending or receiving GS1 identifiers and/or serial numbers within standard EDI messages, check with your trading partners to see if they are willing to adopt the changes in this important update.

I don’t get paid for endorsements.  I don’t sell my opinion.  No one has my thoughts under their control.  So when I tell you that the Healthcare Distribution Management Association’s HDMA Track and Trace Seminar is my favorite pharmaceutical industry serialization and pedigree seminar every year, you should know that’s my honest opinion.  This year, the event will be held on November 8-10 in National Harbor, MD (just south of Washington DC). 

BTW, This opinion wasn’t solicited and I am paying full (member) price to attend the event.  This isn’t an advertisement.  It’s what I believe.

It’s an event that is intensely focused on any and all of the issues faced by pharma manufacturers, distributers and pharmacies related to serialization and pedigree technology and laws.  No fluff, no wasted time. 

HDMA books the right speakers, speaking on the right topics, and that attracts the right solution providers in their trade show room.  But most importantly, all of that attracts the right attendees from across the industry.  That’s important, because if the speakers don’t cover some burning topic during the regular program that you need to know about right now, just ask around in the halls during the breaks and you will learn a lot about what the industry thinks and what they are doing about it.

I can’t recommend it enough for those needing to know the current state of the laws, standards and technology.  I’ve been to other, larger serialization conferences (notably those run by RFIDJournal) that have had a couple of sessions aimed at the pharmaceutical supply chain, but they usually try to cover a bunch of other industries at the same time.  I’ve always been disappointed in them.  The HDMA event is the only one that is pharma from start to finish so you can be much more efficient in picking up the information you need.

Historically, the seminar was originally co-sponsored with the National Association of Chain Drug Stores (NACDS) but around the time that the California pedigree deadlines were pushed out (to 2017 for the pharmacy segment), NACDS pulled their co-sponsorship.  I was very pleased when that blow didn’t end the annual event as I had feared it would.  HDMA continued it (although the event did get a little smaller after that happened).

This year, GS1 Healthcare US is co-locating one of their 2015 Readiness Worshops at the same location so it’s a great opportunity to cover both events and get a really full picture of the current state of regulations, standards and technology.  If you’re thinking about attending the GS1 US workshop, make sure you read my previous post about it first.

“TRACK AND TRACE” OR “SERIALIZATION AND PEDIGREE”?

By now you must be wondering why HDMA calls it a “Track and Trace” Seminar, and I keep referring to it as a “Serialization and Pedigree” Seminar.  Why do I do that?  Let’s talk semantics.

It’s kind of a little game we play.  It all started when California included the pharase “track and trace” in their pedigree law.  When you ask those who work for the California Board of Pharmacy, or those who work for the U.S. Food and Drug Administration (FDA) what the difference is, they will tell you that they are one in the same. 

But they aren’t.  “Pedigree” is really only “Trace”.  “Pedigree” and “Trace” are both a complete supply chain history of a given drug package from a historical perspective, and from the perspective of the current owner.  It’s a view back “up” the supply chain that the current owner can use to know exactly where that drug package has been and when.

“Track”, on the other hand, is to simply know where the drug is right now…at all times.  Usually this is from the perspective of the manufacturer.  So if the manufacturer has a means to know exactly where a given drug package is in the supply chain at all times, they can be said to be “tracking” that package.

So “Pedigree” is half of “Track and Trace”.  When the pharse “track and trace” appears in a pedigree law, the authors don’t mean that they want to require the manufacturers to track their drug packages until they reach a pharmacy or a consumer, they mean that they want the “trace” part.  The pedigree part.

“Track” is a non-regulatory application of serialization.

TRACK, TRACE, PEDIGREE AND PEDIGREE MODELS

How does all this apply to pedigree models and the available standards?  To put it simply, the GS1 Drug Pedigree Messaging Standard (DPMS) represents a purely “trace” pedigree model, and pedigree models built around GS1′s Electronic Product Code Information Services (EPCIS) standard are usually ”track” and an attempt at “trace”.  Consequently, people who favor a purely EPCIS pedigree model usually prefer the term “track and trace” over “pedigree”.  The term includes the pedigree use case as well as non-regulatory use cases. 

I use “pedigree” because that’s the problem I’m currently most interested in solving and, in my view, you need DPMS to ensure that you fully solve it.  EPCIS, in my view, adds value, but can’t solve the pedigree problem by itself.

In my endorsement of the HDMA Track an Trace Seminar above, I refer to it as my favorite “serialization and pedigree” seminar because that’s the main focus of the seminar right now due to the looming pedigree regulations.  In future years, I hope that HDMA will expand their coverage to include more of the non-regulatory applications of serialization, but not at the expense of pedigree coverage until that problem is behind us. 

I wouldn’t miss the HDMA Track and Trace Seminar.  If you’re reading this, then you shouldn’t either.  See you there.

Does the supply chain itself make any contribution to patient safety?  The legitimate pharmaceutical supply chain is that complex web of companies that move drugs from the manufacturers to the pharmacies that dispense them to patients.  The supply chain always includes both of those end points (manufacturer and pharmacy) and, in the U.S., normally also includes at least one wholesaler.  The supply chain is typically viewed as “Manufacturer to Wholesaler to Pharmacy”, whether the pharmacy is within a hospital, clinic, retail independent, chain store, grocery store, or mail order.  The great majority of prescription drugs arriving in the hands of U.S. patients have passed through this supply chain.

So what contribution does this chain make toward the safety of those patients?  In my view, it comes in three ways:

1. Supply Chain Integrity
   This includes the responsibility of each supply chain company—and by extension to each of their employees—to be ever vigilant for attempts by criminals to introduce illegitimate drug products into the legitimate supply chain.  Trading partners should know their suppliers very well (to prevent the introduction of counterfeit, tampered or stolen drugs) and they should also know their customers (to detect and stop diversion).  The protection of patients here is fairly obvious.  They can trust that the prescriptions they receive at any legitimate pharmacy in the U.S. will contain exactly the legitimate drug their Doctor or Pharmacist prescribed.  When supply chain integrity breaks down, very sad things happen.
2. Recall Execution
   This includes extremely fast (near instant?) blockage of any shipment of units covered by a recall, communication of the recall notice to supply chain customers who have been shipped the recalled units any time in the past, and a tight quarantine of the recalled units to ensure that they cannot make their way back into regular stock.  Once a recall is issued—especially a safety recall—there should be no way for these units to move forward in the supply chain again.  Patients are protected by the immediate removal of a large pool of the recalled items from their availability, thereby reducing the problem to those remaining units that have already been dispensed to patients by pharmacies (and those drugs are outside the supply chain).  When this breaks down, patients may end up being dispensed prescriptions that contain the recalled medicine even after the recall has been issued.
3. Data Quality
   This includes the use of accurate data about each drug by every company in the supply chain.  The drug manufacturer creates this data and each successive owner in the supply chain must ensure that they are using that exact data as part of their buying, selling and dispensing.  Patients are protected mostly by their pharmacy’s use of accurate data, but because the supply chain arm of a pharmacy company may rely—at least in part—on data received from their supplier, in those instances, the quality of the data supplied will have a direct impact on patient safety.  When this breaks down there is a slight, but unnecessarily elevated risk that a patient somewhere could receive the incorrect dosage, the incorrect drug entirely, or a drug that is covered by a known recall.

Interestingly, all of these contributions to patient safety become much easier to implement and are much more reliable in execution when the drug packages are serialized and all companies in the supply chain make use of those serial numbers to maintain pedigrees.  For downstream trading partners to be able to make use of these serial numbers it is essential that manufacturers also supply two types of data for each product they serialize:  Supply Chain Master Data (SCMD) for each Stock Keeping Unit (SKU), and Instance Data (IData) for each serial number.

SUPPLY CHAIN MASTER DATA SYNCHRONIZATION

SCMD is the data that describes each product that is traded in the supply chain.  The synchronization of that data requires the creator (with a lower case “c”…I’m referring to the drug manufacturer here, not God) to pass it to every potential supply chain owner of their products, and keep it up-to-date, so that they always have the correct information.  The product code is the identifier that is used by supply chain members to link to, and reference, the SCMD.  In the case of drugs in the U.S., that product code is the NDC.

As you might expect, GS1 has a series of standards that can be used to implement SCMD.  They include the Global Trade Item Number (GTIN) and Global Data Synchronization Network (GDSN) standards.  In the pharmaceutical supply chain a GTIN can be composed from the combination of an FDA-issued Labeler Code and FDA-registered Product Code (the two components of the NDC) as a base, although manufacturers are expected to register with GS1 and pay a fee before doing so.

GS1’s GDSN is a standard that can be used by supply chains to communicate SCMD to all of the companies who participate in it.  Generally, its use requires all trading partners in a given supply chain to subscribe to a GDSN-conformant Data Pool service provider.  Unilateral adoption of GDSN by a single company doesn’t make any sense.  It’s a high bar for a large and complex supply chain to achieve through voluntary means.  Right now the pharma supply chain in the U.S. has not achieved it and so the quality of SCMD in the supply chain is currently dependent on ad hoc relationships and data passing.  Some of this includes manual data entry into the local master data systems at many points in the supply chain. 

INSTANCE DATA COMMUNICATION

Instance data is data that describes the unique and specific identity of individual units, or a relatively small collection of units of a given SKU.  For the pharmaceutical supply chain this always includes the lot and expiration date of each unit, but in the future it could also include covert security elements that could vary and therefore could be unique by the individual unit.  Like SCMD, only the creator (again, the manufacturer, but also repackagers) can create the instance data.  The unique identifier—typically composed of the product code plus a serial number—is the identifier that is used by supply chain members to link to, and reference, the instance data.  Some instance data, like information about individualized covert security elements, are not shared with downstream trading partners but are kept by the creator for use in their product or package authentication system, but data like lot and expiration date must be shared with downstream trading partners.

Again, as you might expect, GS1 has a standard to help supply chains exchange instance data.  The Electronic Product Code Information Services (EPCIS) standard can be adopted by supply chains for this purpose.  Unlike GDSN, there may be reasons a company can find value in applying EPCIS unilaterally, but the adoption of EPCIS for communicating instance data with trading partners only makes sense if all of your trading partners agree to adopt it as well.  So far the pharma supply chain in the U.S. has not yet adopted EPCIS widely for the purpose of exchanging instance data, but the standard has caught the attention of a number of the larger corporations within the supply chain.  Some of those companies are working with GS1 U.S. to figure out how this instance data can be exchanged in an interoperable way.  Currently there is no widely adopted alternative approach for communicating instance data because serialization, the enabling prerequisite technology, is only just now starting to be deployed on a handful of products in the supply chain.

MOTIVATION FOR ADOPTION

Deploying applications that serialize units, synchronize SCMD and communicate instance data through the supply chain is expensive.  Generally, companies look for hard financial returns on any investments they consider.  It’s nearly impossible to find a positive ROI from serialization and the associated data synchronization and communication.  That is, depending on how you measure “return”, and that depends on your motivation. 

Richard Feldman, Vice President of Trade and Product Safety at EMD Serono, a manufacturer of biopharmaceuticals, and Ron Bone, Sr. Vice President, Distribution Support at McKesson, a U.S. pharmaceutical wholesaler, both spoke about motivation as it relates to adoption of this type of technology at the Track and Trace Technology Seminar held by the Healthcare Distribution Management Association (HDMA) this past December.  Feldman spoke about his company’s high-level commitment to patient safety and how that commitment motivated the corporation to view funds spent on technologies designed to protect the supply chain as sound investments.  They measured the return on their investments differently than those who looked only for the hard financial returns that are so hard to come by.  Bone spoke of a similar commitment at McKesson.  Both referred to understanding and support from the highest levels of the company leadership. 

These are true supply chain organizations who realize that their very existence as participants in the pharma supply chain comes with a responsibility to contribute to its integrity.  The “return” on those investments may be immeasurable because it is most directly collected by their ultimate customers—the patients.  The result is a more secure supply chain, and a more secure supply chain is a healthier one.  One that will continue to operate well, and that ensures their ongoing participation in it.  Now that’s a “return” that every company should recognize and embrace.