Most of us who work on developing and deploying technologies designed to protect the supply chain usually focus on anti-counterfeiting. But that’s only one of the elements in the list of illegitimate activities that can cause damage to the health of patients and the profitability of legitimate businesses who participate in the U.S. pharma supply chain. I include the following activities in that list:
These activities have all been detected from time to time in the U.S. supply chain for quite a few years, but the frequency of some of them has been on the increase over that same period of time. The question is, how much of each activity should we, as a society, tolerate before we step up counter-measures that are targeted directly on one or more of them?
THE RISE OF PHARMACEUTICAL CARGO THEFT
Over the last 18 months the U.S. has experienced an unprecedented rise in the value of drugs stolen in thefts of entire truckloads as they are being transported from point to point (also see this). I’ve heard lots of theories about who is behind it (organized criminals/gangs, of course) and where the product ends up (outside the U.S., most people think). Continue reading How to Stop Pharmaceutical Cargo Theft
I am fortunate to have so many friends and colleagues who work in end-user and solution provider companies and who are impacted by the issues I cover in my blog. After each post I often exchange emails and phone calls with some of them and we discuss/debate what I’ve written about. These are great conversations because they sometimes confirm my opinions and sometimes challenge them, but I almost always come away with a more refined understanding of the technology or regulation we discussed. That is, I learn something.
This is exactly what has been happening with my recent series on Supply Chain Master Data (SCMD). As I’ve defined it, SCMD is just like regular old Master Data (MD) except that the identifier and the full data set behind each instance of SCMD has a single owner, and all parties in the supply chain who may encounter the identifier must have a way of obtaining the full set of data from the owner so they know what the identifier means. But this assumes that only the identifier will be used in supply chain data communications in place of the full data set that the ID refers to.
GLN’s On Electronic Invoices
Let’s take GS1’s GLN (Global Location Number), for example. You can use GLN’s in two ways: as true SCMD, or in a non-SCMD way.
An example of using GLN’s as SCMD in an invoice application would result in an electronic invoice that did not have any explicit addresses in it–no customer billing address, no customer shipping address and no “remit payment to” address. Instead, it would simply include the customer’s billing GLN, the customer’s shipping GLN and the “remit payment to” GLN. Each party in this example would have already obtained the full addresses from their respective owners in some way, either through a registry (like GS1 U.S.’s GLN Registry for Healthcare), or directly from the owner, so there is no need to include that data on each invoice between these parties.
The non-SCMD use of GLN’s occurs when a company uses a GLN identifier as a way of obtaining their trading partner’s full address, and then they would put the full address on each of their invoices for that partner. This approach makes use of GLN’s to “synchronize” the address master data that each trading partner keeps locally. Continue reading Use of GLN and GTIN for Pedigree Regulatory Compliance
I recently read in Pharmaceutical Commerce online magazine about the apparent resolution of the RxUSA lawsuit that had delayed implementaton of a couple of the pedigree provisions of the Federal PDMA (Prescription Drug Marketing Act). While Pharmaceutical Commerce did its usual great job of providing historical context, I thought it might be an appropriate topic for the RxTrace blog. But before I had time to document the history of the PDMA in my own words, Brian Daleiden beat me to it in the Supply Network Blog. So rather than writing my own version, I gladly refer you to his post. Between the Pharmaceutical Commerce article and Brian’s post, I have nothing more to say right now.
The Supply Network Blog is a fairly new publication of TraceLink, the successor to SupplyScape, my former employer. I look forward to hearing more from their blog in the future so I recently subscribed. Check it out and see what you think.
Conversations about the merits of various pedigree and authentication models usually start from dissatisfaction with some characteristic of the current GS1 DPMS pedigree model. I maintain that the design of DPMS—including its perceived flaws—is merely a reflection of the current state and federal pedigree laws and regulations. Characteristics that people don’t like—like digital signatures, a growing document as drugs move down the supply chain, and the fact that Supply Chain Master Data is not used by DPMS—are actually all characteristics of the laws and/or regulations, so any alternate pedigree model that would truly be usable for compliance would need those characteristics too.
But that’s not exactly what I want to discuss in this essay. Instead, I wanted to explain my theory of what U.S. pedigree laws are trying to accomplish in the first place. Forget about how they do it for now. What were the goals of those who wrote these laws and regulations? I’ll agree that this is impossible to know for sure but I think I can construct a pretty convincing theory. I don’t know any of the legislators or congresspeople who wrote these laws, but I have studied their work for over four years now. I have made the following observations.
- The highest priority goal of the Florida and California laws appears to be to detect the introduction of illegitimate drugs (counterfeit, stolen, up-labeled, diverted, etc.) into the legitimate supply chain as early as possible, preferably at the very first transaction. These laws accomplish this by requiring companies buying drugs within the supply chain to receive the full supply chain history of those drugs at the time of the purchase (contained in a “pedigree”), and, most importantly, by requiring them to verify the legitimacy of those prior transactions. In Florida that verification can be performed by direct contact, such as a phone call, email, fax, etc., or, optionally, through the use if digital signatures. In California, this verification can only be performed through the use of digital signatures. The federal PDMA, on the other hand, does not appear to obligate the buyer to do any verification of the information provided on pedigrees they receive.Finally, Florida and California both require the recipient of the shipment to confirm that the physical drugs they received match those described by the pedigrees they received. That seems obvious, doesn’t it? Why would any legislative body require all or some supply chain participants to go through all the expense to generate and pass pedigree information but stop short of requiring anyone to actually look at it? Well, oddly, the federal PDMA appears to do just that.
- There is a clear attempt in the laws to help identify who participated in the introduction of the illegitimate product. This is important if your goal is to efficiently and quickly investigate the suspected crime. This would aid in shutting down the criminals as quickly as possible before they are able to spread bad medical products very deeply into the supply chain. Continue reading What are Pedigree Laws Trying to Accomplish Anyway?