Should Regulations Dictate Technology?

Important Notice To Readers of This Essay On November 27, 2013, President Barack Obama signed the Drug Quality and Security Act of 2013 into law. That act has many provisions, but one is to pre-empt all existing and future state serialization and pedigree laws like those that previously existed in California and Florida. Some or all of the information contained in this essay is about some aspect of one or more of those state laws and so that information is now obsolete. It is left here only for historical purposes for those wishing to understand those old laws and the industry’s response to them.In the U.S. pharmaceutical supply chain this question becomes, should regulators—state legislatures, state Boards of Pharmacies, Congress or the FDA—mandate specific technology for serialization, ePedigree and other regulations?  This question arises whenever a new regulation is considered by any of these bodies or agencies.  It’s an important question now that the FDA is considering standards for ePedigree, Track & Trace and related things and I think there are some natural conclusions that can be drawn from past examples that lead to a potential answer.  Let’s review the history first.


The language of the U.S. Prescription Drug Marketing Act (PDMA) specified the kind of data that must be in a compliant pedigree but it did not identify any particular technology to carry that information.  Of course, compared with today, what kind of technology was available back in 1987 when the PDMA was first introduced in the U.S. House of Representatives?  Is it a paper pedigree?  Can it be electronic?  What is the format?  Can GS1’s Drug Pedigree Messaging Standard (DPMS) be used to comply?  None of these questions are definitively answered in the Food and Drug Administration (FDA) documents I have seen.  Also missing is any recognition of the concept of “interoperability” and its importance to companies across the supply chain.

The Florida Pedigree Law was originally passed in 2003.  In the text of the law the word “pedigree” was always followed by the word “papers” as in:

“The information required to be included on a legend drug’s pedigree paper must at least detail the amount of the legend drug, its dosage form and strength, its lot numbers, the name and address of each owner of the legend drug and his or her signature, its shipping information, including the name and address of each person certifying delivery or receipt of the legend drug, and a certification that the recipient has authenticated the pedigree papers.”

It is a document-based pedigree law.  The Florida law allows the records to be stored and transmitted electronically but when the “pedigree papers” are presented to an inspector, they apparently expect them to be in paper form so electronic documents would need to be printed.  The Florida Law assigns the responsibility of creating a form for use as a valid paper pedigree to the Florida Department of Health (DoH)—the only “technology” identified in the law.  The DoH created a form for wholesalers and one for repackagers that companies have used successfully since 2006 when the law went into effect.

SIDEBAR:  Ever since the Florida DoH did a major redesign of their website in the last year or so they seem to have made the paper pedigree forms inaccessible.  If you know where to find them, please leave a comment with the URL below because people frequently search for them on RxTrace.  I haven’t been able to find them.

However, the law required the DoH to produce “rules” for the industry to follow and in these rules (see also these rules) the DoH specifies that an electronic pedigree must make use of a number of Federal Information Processing Standards (FIPS) regarding digital signatures and related technology.  This is a significant technology mandate that is highly specific, but it is optional since it is only required if the company wishes to produce electronic pedigrees rather than paper.

Can you use GS1’s DPMS to comply with the Florida law?  Neither the law nor the regulations say explicitly that you can but I happen to know that many companies have been doing just that since 2006.  The DPMS standard was created after the original laws were passed and it was specifically created to help companies comply with the document-based pedigree laws known at the time.  That included PDMA, Florida, California and the “normal distribution” pedigree laws in a number of other states.

The California Pedigree Law was first enacted in 2004.  It requires the application of “…a unique identification number…” on “…the smallest package or immediate container distributed by the manufacturer…” (see the full text for additional details).  Once again, no specific technology is identified but is left up to the industry to come up with.

The California law was the first pedigree law in the U.S. to specify that “…[a] pedigree shall be created and maintained in an interoperable electronic system, ensuring compatibility throughout all stages of distribution.”  This seemingly simple statement does two things.  First, a pedigree must be electronic.  Second, the system a pedigree is created and maintained in must be interoperable throughout the supply chain.  That is, all parties in the supply chain must be able to read, understand and update the pedigree, but it avoids identifying a particular technology for doing so.  The hope was apparently that the industry would get together and select the optimum technical approach.

How’s that going?  It doesn’t look good right now.  Rather than coalescing around a single, interoperable technical approach to ePedigree it seems like companies in the supply chain are fragmenting into several camps.  Carried to its logical conclusion we may yet find that a few large companies will eventually dictate what technology everyone else will be forced to adopt regardless of the investments those other companies might have already made, but that assumes that those “few large companies” can agree on a single technology.  We’ll see.


Many in the industry actually prefer that regulatory entities avoid identifying specific technologies in their laws and regulations.  For example, during the comment collection phase of what eventually became the FDA Standardized Numeric Identifier (SNI) Guidance, the SecuringPharma article, “Stakeholders respond to FDA’s track-and-trace proposals”, paraphrased that sentiment in the part of the article that described the response from UPS Supply Chain Solutions:

“UPS Supply Chain Solutions contends that the FDA should not mandate any specific technology for track-and-trace, rather define the requirements, and that industry stakeholders should develop interoperable technology themselves”.

On the surface this seem very logical.  Ultimately the FDA did just that when they published their final guidance for the SNI and did not specify a particular carrier technology or mandate a specific standard, although they did identify the GS1 Serialized Global Trade Item Number (SGTIN) as an example of something that does conform to their guidance.


But there is an example of a time when the FDA did mandate a specific data carrier on prescription drugs and I think it warrants a closer look.  Back in 2004 the FDA published their final bar code rule that required all prescription drugs distributed in the U.S. to have a linear barcode at the unit level.  The final rule took effect in 2006.  That rule did not specify a particular linear symbology, only that the barcode had to be linear.  The final rule itself includes a lengthy section of comments submitted as part of the proposed rule and the FDA’s responses.  In that section they pointed out that,

“[m]ost comments [received] argued against the use of linear bar codes or asked us to encompass other technologies or to eliminate any reference to linear bar codes in the final rule. Many comments claimed that the rule would discourage or inhibit technological innovation, although they differed as to their preferred alternatives to a linear bar code.”

The discussion included in the final rule is lengthy and contains an excellent analysis of the trade-offs between specifying a linear barcode, specifying a different data carrier or not specifying any technology at all.  Very well thought out, interesting reading and very pertinent to this topic.  I highly recommend reading it.

The document continues:

“After reviewing the comments, we have decided to retain the linear bar code requirement, but will consider revising the rule to accommodate newer technologies as they become more mature and established.”

Apparently, that time has come.  Last month the FDA published a new request for comments (RFC) to determine if they should revise the 2004 Bar Code Final Rule by specifically reconsidering the “linear bar code” requirement.  Initial comments must be received by January 9, 2012 and reply comments by February 23, 2012.  According to the RFC…

“FDA is requesting comments and supporting information on (1) bar code labeling standards for drugs and biological products and (2) the identification of current alternative technologies for use by industry and others.”

The remainder of the RFC includes a list of specific questions that are designed to help facilitate more unified responses.


In my view the original FDA Bar Code Final Rule of 2004 did the right thing in specifying linear barcode technology, but my reasoning is slightly different from those that the FDA listed in that document.  The real value to the industry in the FDA’s mandate was that the technology was fixed on a well-know, well-established and sufficient technology for the time which led to significant efficiencies in the handling of this product in the supply chain.

In this instance I think it is laughable to think that the FDA’s mandate would stifle technical innovation as some did back then.  What that “technical innovation” would have led to if that argument had been embraced by the FDA back then is significantly reduced efficiency in handling drugs by distributors, pharmacies and hospitals who would have been forced to deploy multiple technologies and multiple business processes to deal with every “innovation”—or whim—that drug manufacturers would have chosen to invest in.  As we have seen recently in California that would have included multiple flavors of RFID, linear barcodes and 2D barcodes.  Thankfully they didn’t do that and those drugs that were serialized for California pedigree pilots also retained the linear barcode so that existing systems could still read the NDC.

Now that some time has passed and regulatory needs have evolved, with this new review the FDA can let the industry help them determine if some alternate technology has some important benefits that linear barcodes do not have.  Considering that we are now looking at the need for serialization within the U.S. supply chain because of the California pedigree law and potentially a new Federal law, a new carrier technology to replace the linear barcode seems quite timely.

Just like it did with linear barcodes in 2004, the FDA should now select a logical new carrier technology and mandate it, giving manufacturers at least two years to deploy the necessary system changes.  But once the new carrier technology mandate goes into effect, every manufacturer must use the same, single carrier technology on all saleable units.  That way the downstream supply chain organizations can invest in a single technology to read the NDC and perhaps the serial number, lot and expiration date (if so mandated now or in the future).

It is the movement by the industry in unison that is the real benefit of carefully mandating a single technology for identifying drugs in the supply chain.  It is the key to maintaining and even improving supply chain efficiencies.  This is nothing more than “interoperability”, where everyone uses the same approach to something so that the systems of all companies can understand and work with that something to its fullest extent.  Does it stifle innovation?  Yes, but it does it in a way that allows the most efficient changeover to each new innovation, which actually leads to more benefits than allowing any company to make use of any innovation at any time.

So the point is, pick the right innovation to switch to at the right time.  I think now is the right time, but what is the right innovation?  Make sure you submit your favorite one to the FDA through their docket and don’t forget to clearly explain why it is best.


When it comes to regulating a supply chain I think it is clear that interoperability is essential to ensure lower costs for all parties.  Interoperability comes from standards, which is just another way of saying “one way of doing something”.

Consider what is happening right now in the GS1 Network Centric ePedigree (NCeP) group.  That group has published descriptions of seven different ways to create a new drug ePedigree system through a network approach.  I have been part of that effort.  Once we had a list of five NCeP models we felt like we needed to reduce the number by selecting one or two to go forward with, or by eliminating two or three.  We found that to be so hard to do that instead of the number of models being reduced it actually grew to the current seven models!

For the most part, the models are mutually exclusive.  To attempt to allow two or more models simultaneously within a given country or region would result in the same problem that multiple carrier technologies on packages of drugs would.  It might be technically possible, but it would lead to reduced interoperability, be very confusing and highly inefficient for all supply chain members.  Maximizing interoperability would come from the use of a single NCeP model at any given time within a given region and that would have the effect of maximizing efficiency for all.

I finally concluded that we shouldn’t reduce the number of NCeP models at all.  In fact, the GS1 NCeP list of models and their descriptions should be considered a “catalog” of models for use by any regulatory bodies who feel the need for a new ePedigree system, and the industry to compare and select the best model for their region and their supply chain.  Ultimately the regulatory body for that region should be expected to identify exactly one of the NCeP models that must be followed after a given date in the future as part of a new regulation.  A specific technology mandate.  The regulatory body could identify another date farther out in the future when the choice of models will be reconsidered—with industry input—so that innovation is accommodated, just like the FDA is doing with their barcode rule.

GS1 can facilitate that only so far.  They can help explain the standards behind each model, as we have already done in the NCeP group.  Once again, the final decision must be made by the regulator using the input of all stakeholders.

Do you disagree?  Should regulators allow/encourage the use of multiple carrier technologies on drugs within the U.S. supply chain?  Should they allow/encourage the use of more than one ePedigree model within a given region?  Is there some other way to get total alignment around a single technology within a supply chain of a given region without resorting to a regulatory mandate?  Explain your logic in a comment below.


4 thoughts on “Should Regulations Dictate Technology?”

  1. Agree. Interoperability is key. As you point out, technology has changed and enabled many approaches since the 80’s. Who can predict the future of technology? DoD supports interoperability. Aerospace can be a model for FDA regulation including AIDC. Some stakeholders, pursuing their individual interests, have severely impeded progress toward adoption of technology in healthcare.
    Another medical device UDI conference in Boston next week. Hope for some new news.

  2. Agree with most of your thought provoking article, but just like the old saying about retail (location, location, location), in this case it is interoperability,times 3! As technology evolves it only makes to see if it will improve current processes, solutions, etc., but change just to embrace a new technology does not make sense if it doesn’t provide addtional benefits. And one final thought on interoperability and change, I feel that it would be good to give some thoughts to those companies that did try to get ready for the CA laws back in 2007 and now have a working solution that may have to be changed or modified.

  3. Prescriptive FDA regulation rather than regulation bundled up in specific technologies. Then let the Technology providers solve and continually improve Track and Trace interoperability.
    Increasing important for Food to clear customs across national and export boarders. Also why states should coalesce around FDA (rather than go it alone on Pedigree Law).

Comments are closed.