SNI

SNI’s Are Not Enough In a Plateau-Based Supply Chain Security Approach

I recently published an essay on RxTrace called “Plateaus of Pharma Supply Chain Security” in which I proposed that a better timeline for the introduction of technology to secure the U.S. pharmaceutical supply chain was one based on plateaus.  Each succeeding plateau would add the adoption of new technology and/or data communications among the participants in the supply chain with the intent of elevating the security over the previous plateau.

In that essay I included illustrative dates for each of the four plateaus that I offered as an example of the concept, but you could easily imagine the overall program having open-ended dates that would allow the supply chain to adopt one plateau at a time and move to the next plateau only if/when a security problem is discovered at the current plateau.  That is, jump to the next plateau only when necessary.  Taking this approach, you may never actually need to get to the later plateaus.

For example, imagine that the first plateau were for manufacturers to serialize all drugs at the pharmacy-saleable package level (what I normally call “unit-level”) with an FDA Standardized Numeric Identifier (SNI) and all supply chain owners of drugs were to read the SNI’s and simply keep records of who they bought them from and who they sold them to.

With no data communications between trading partners that includes the SNI’s it might seem that little
security has been gained over what is done today.  But this small step (“small” compared to a full pedigree or track & trace system) would allow criminal investigators to make quicker progress in finding the path of suspicious drugs than they can today.  Limited recalls and drug cargo theft notices could be issued based on the exact SNI’s that are involved and supply chain organizations could almost instantly search their current inventory and their shipping history to determine if they have ever seen those units.

This would be a powerful achievement because it would prevent thieves from easily dumping stolen drugs back into the supply chain through an unsuspecting legitimate member.  But criminals may progress to the point where they would create new labels or cartons with different SNI’s for the drugs that they steal.  In that case, it will be time for the next plateau, and so on.

The time between plateaus would provide supply chain companies time to spread their costs and adjust to the technologies and processes added in the latest or next plateau.

SNI’s ARE NOT ENOUGH

If you were to do a big bang going from zero to full supply chain ePedigree system in a short period of time (like in 2 ½ years as the current California Pedigree Law does), all you would really need are GS1 SGTIN’s (Serialized Global Trade Item Numbers) to fulfill the SNI requirement (see my essay “FDA Aligns with GS1 SGTIN For SNDC“).  That’s because, in this instance, everyone is going to have some kind of repository that would be able to tell them everything they need to know about a given unit of drugs, all keyed off of that SNI.

ACRONYM REFRESHER

Here is a brief interlude to explain some of the acronyms I’m using in this essay.  The U.S. FDA (Food and Drug Administration) intended their SNI (Standardized Numeric Identifier) to be a new identifier that combined the existing NDC (National Drug Code) with a unique serial number.  The result is a unique identifier that refers to a specific single bottle or package of a given drug of the kind referred to by the NDC portion of the identifier.  Prior to the publication of their SNI guidance they were calling it the “Serialized NDC”, or “sNDC”.

They allow and, in fact, they expect the SNI to be encoded using existing industry standards, like HIBCC’s serialized HIBC (Health Industry Bar Code) or GS1’s “GTIN plus serial number”, or SGTIN (Serialized Global Trade Item Number).  These are industry standard ways of combining a general product code—which is what the NDC is—with a unique serial number.  So, in effect, an SGTIN (or a serialized HIBC) is a industry standards-based way of depicting an SNI, which is a way of combining your existing product NDC with a unique serial number (chosen by you), as defined by the FDA.  I try not to use the terms sNDC, SNI and SGTIN interchangeably, I try to use the term that is appropriate, but in some contexts they can all mean the same thing.

But if you imagine that my plateaus idea were to be implemented, it would take a number of years between the time that all drugs contain SNI’s and the time when a full pedigree or track & trace system is fully operational.  During the time of the interim plateaus, especially the first few, all any company would have is the SNI’s that they read off of each package of the drugs they handle.  There would be no data repository containing information about the drugs and no data exchanged.

As I pointed out above, these SNI’s would be helpful for any process that could benefit from specific serial numbers, like reacting to cargo thefts and execution of limited recalls, but what about normal, full-lot recalls and stock rotation?  It is unlikely that manufacturers will switch from just identifying the lot number(s) involved in a large drug recall to identifying every single unit-level SNI in the lot(s) being recalled.  That seems impractical.

But because downstream trading partners would have no way of translating a specified “lot number” into a set of “unit-level SNI’s”, execution of these most common type of recalls would not be helped in these early plateaus.  And SNI’s alone provide no help with stock rotation.  For these reasons, in a plateau’ed approach, SNI’s are not enough.

What would be very helpful on each package of drugs is the lot number and expiration date in addition to the SGTIN—not as optional data elements, but everyone would need to supply them.  With these three data elements—readable by electronic reading equipment—on every drug package, big benefits would start right away in the first plateau without any data repository or communication needed.  These includes:

  • Efficient SGTIN-based recall execution;
  • Efficient full-lot-based recall execution;
  • Efficient stock rotation based on expiration dates;
  • Efficient SGTIN-based stolen product monitoring.

ENCODING SNI, LOT NUMBER AND EXPIRATION DATE

These three data elements can be combined in a single RFID tag using the GS1 SGTIN EPC (Electronic Product Code) as the base, then adding the lot and expiration date in “user memory” as specified in the latest GS1 Tag Data Standard.  To encode them in a barcode GS1 handles it a little differently but the result is the same.  In this instance, there would be four data elements in a single barcode encoded using GS1’s GS1-128 Application Identifier standard as specified in the GS1 General Specification:

  • The NDC-based GTIN (AI=01, exactly 14 digits)
  • The Serial Number (AI=21, 1 to 20 alphanumeric characters)
  • The Expiration Date (AI=17, exactly 6 digits)
  • The Lot Number (AI=10, 1 to 20 alphanumeric characters)

THE LEAP FROM LINEAR TO 2D BARCODES

Back in 2004 the FDA mandated the use of linear barcodes—that’s right, very explicitly and specifically, linear barcodes—for encoding the NDC on all unit-level drug package labels.  So if you have recently replaced the linear barcode that contained your NDC on your drug package labels with a 2D barcode (you know who you are), you are in violation of the current FDA barcode regulation 21 CFR 201.25.

The problem is, if you tried to encode all four of the data elements I listed above in a linear barcode it would be way too big to fit onto most drug package labels.  The proper barcode would have at least 30 characters (which would be totally impractical because to make it that small the lot and serial numbers would both have only one character in them) to a maximum of 68 characters (which would be very unusual because drugs usually don’t necessitate 20 character lot numbers and 20 character serial numbers).  The typical length would probably be somewhere around 50 characters.  That’s pretty long considering that NDC barcodes today are only 12 digits long.

So this is when people start talking about adopting 2D barcodes like GS1 DataMatrix.  2D barcodes can store a lot more information in a smaller space than linear barcodes, but you need a more modern (read: more expensive) readers to read them.  A 2D-specific barcode reader can read linear barcodes, but a linear-specific barcode reader cannot read 2D barcodes (purists might find rare examples where one or both of these statements might not be totally accurate, but I consider these inconsequential).

The problem is that every participant in the U.S. pharmaceutical supply chain has maintained a large investment in linear barcode readers for many years.  These readers are spread all over the place.  Any abrupt switch from linear barcodes for NDC’s on drug packages to a 2D code to encode the NDC, serial number, lot and expiration is going to require all of these organizations to abruptly toss out their existing equipment nationwide and replace them with more modern (again, read: more expensive) readers.  Omni-directional readers used in some applications for reading the linear NDC barcodes have not yet been perfected as 2D readers so those business processes may slow down.

So far the industry is sticking with linear barcodes because of that one little word in the FDA barcode regulation (“linear”!), but I’ve recently heard an FDA official say in a presentation that they were considering changing it to allow 2D barcodes on drugs.  In fact, last summer the FDA asked for comments on an idea to allow 2D barcodes to include lot and serial number on some vaccines and that generated support from GS1 and AIM but a mix of support and opposition from around the industry.  Daphne from PMPNews breaks it down in her interesting essay “Can FDA’s Bar Coding Efforts Help Standardize Healthcare?“.

WHERE IS IT ALL LEADING?

Most manufacturers are currently planning to add SNI’s to their drug packages, but because the California Pedigree Law doesn’t require lot and expiration it is unlikely that many will voluntarily choose to add them.  Without a change to the FDA’s barcode regulation those SNI’s will either have to be encoded in a linear barcodes (or RFID tags), or the SNI 2D barcode will have to be placed on the packages in addition to the existing linear NDC barcode.

At some point I think we will see the addition of more information on drug packages than just the NDC and serial number in electronic-readable form, no matter if my “plateaus of security” concept is ever picked up or not, but the timing is hard to tell.  Without those additional data elements the industry will be forced to implement a full ePedigree or Track & Trace system to get any value out of the SNI’s, something that more and more people are opposed to as they see what it will cost.

Where do you think it is leading?

Dirk.