The wide-scale use of “inference” in the pharmaceutical supply chain is essential to the successful operation of a track & track or ePedigree system. Companies cannot be expected to open every case they plan to ship, or that they receive, so that they can figure out exactly which package-level serial numbers are involved. The use of the serial number packaging hierarchy, or, “Aggregation information”, to “infer” which packages are being shipped or received is the only way to maintain a level of supply chain efficiency that is close to pre-serialization levels. On the other hand, regulator acceptance of the use of inference in the supply chain has the potential to complicate their investigation of criminals.
In recognition of its importance in maintaining efficiencies, the California legislature instructed the Board of Pharmacy to draw up rules that would allow companies to optionally make use of it (see my essay “Inference in the Pharmaceutical Supply Chain” for the exact text of the inference provisions of the California Business and Professions Code). It leaves the important question about who is liable for the accuracy of product information and pedigrees when using inference up to the Board.
At the December meeting of the Enforcement Committee of the California Board of Pharmacy, the Committee instructed Joshua Room, Deputy Attorney General, California Department of Justice, and Board Counsel, to draw up a proposal for inference rules. These rules could determine just how much effort companies will have to expend to implement the pedigree law, and potentially determine the most likely criminal defense against them. The first draft of the proposed rules are due by their March meeting.
Companies will need to create and document their Standard Operating Procedures (SOPs) for making use of the container serial number hierarchy when they infer the contents in each business process. According to the law, this will need to include some kind of statistical sampling process for determining the accuracy of the aggregation information provided to them. The SOPs will need to be available for the Board to review them.
I am personally a little skeptical of the value of statistical sampling. I’ll leave the math to someone more familiar with statistics, but it seems to me that the number of unintentional errors will vary somewhere between small and very small. Statistical sampling isn’t going to detect them because the number of cases being opened as part of the sampling program will be too small to find those few that are in error. Alternatively, performing a confirmation scan of the package serial number prior to sale or dispense would find all errors. The only trouble is, the statistical sampling requirement is baked into the law itself.
Just who will end up being liable for inaccuracies in the aggregation data is what keeps some manufacturers up at night. Because manufacturers are expected by downstream trading partners to provide aggregation information for all cases of drugs, who do you think would be liable if that information isn’t accurate 100% of the time? For more on manufacturers, aggregation and accuracy, see my essay, “Pharma Aggregation: How Companies Are Achieving Perfection Today”.
INFERENCE AND CRIMINAL DEFENSE
I’m not a lawyer, but it seems to me that the very first thing a criminal would claim after being questioned by a California State inspector about drugs found in their possession without valid ePedigrees, is that it must be an inference error. What originally might have been clear evidence of a criminal act—possession of drugs without a valid ePedigree—will now become a potentially lengthy and complex investigation into whether or not the aggregation information provided by the upstream trading partner was accurate, and if not, who is liable for that.
I’m imagining counterfeit, diverted or stolen drugs that had been sold through 4 or 5 different wholesalers before the cases were finally opened with the inspector to discover that, whoops, the aggregation information received from the last owner wasn’t right and therefore these drugs don’t have pedigrees.
“Well officer, I’m not liable for that. The law allows me to use inference and here is my SOP and here is my sampling history. See? Every case I ever opened was 100% accurate until these that you just opened.”
Now the investigator is back to chasing down the previous owner, and then the previous owner, and then the previous owner until the previous owner is the manufacturer. At that point it might be easy to establish what happened, but definitely not as easy as the authors of the pedigree law might have intended. Of course, in my scenario, there is a criminal who copied the valid data obtained through a legitimate purchase and used it to sell both the legitimate product and (to someone else) the illegitimate product.
(Note that this would be quite easy to do using a DPMS-based or a distributed EPCIS-based model, but would be very difficult to do within the context of an ePedigree model that makes use of a semi-central pedigree checking service. In that case the semi-central checking service would have an unimpeded view of all changes of ownership of any given serial number, which makes it much harder to simply copy serial numbers, or to make them up and sell the illegitimate products labeled with them.)
INFERENCE IN PRACTICE
Use of inference is optional. That is, the law does not require its use. However, since manufacturers will find it necessary for their own use, it is likely that all parties (except independent pharmacies) will make use of inference. (See my essay, “Will The Pharma Supply Chain Be Able To Use Inference? Maybe Not!”.)
Allowing the use of inference eliminates the ability to immediately charge anyone found in possession of drugs without a valid ePedigree, as long as those drugs are found within a sealed case. Everyone is free to infer that the drugs hidden inside of a case must match the information printed on the case label and identified in the ePedigrees and aggregation information they were given. It appears to me that until the case is opened to reveal the discrepancy, no one is acting criminally (assuming they are following their statistical sampling SOPs).
The opening of a case that had previously been the object of inference should lead the owner to read the serial numbers on each package contained inside (perhaps not immediately but before the next sale or dispense). Any packages that do not match those that were inferred probably didn’t arrive with the matching ePedigrees (although they may have: an inference error doesn’t always mean a pedigree error). Of course, once opened and the discrepancies are known, the next action will separate the innocent from the guilty. Packages that do not have a valid e-pedigree should be quarantined and the supplier must be contacted for resolution, because at this point, the drug cannot be sold or dispensed until that resolution has occurred.
Should the Board of Pharmacy be informed of all discrepancies as a matter of course? That might result in a lot of notifications, especially at first. Certainly the Board of Pharmacy should not expect to investigate every case of inference-gone-bad, but perhaps, in an ideal world, an automated electronic notification would allow them to maintain records of how often a company has discovered and resolved inference discrepancies. However, it’s not likely California would fund an electronic service like that. On the other hand, a semi-centralized service could include this kind of tracking quite easily, right along with the ePedigrees themselves.
Last fall the Board of Pharmacy asked companies to provide their ideas on exactly how inference should work. Very few provided the level of detail that they were looking for. This might be your last chance to provide your thoughts on how it should work before the Board develops their own rules. Leave a comment below to express your ideas now.