Meeting U.S. and E.U. Drug Serialization Requirements With A Single Solution

As serialization mandates sweep the world you would think that drug manufacturers and repackagers would just deploy one generic “serialization application” and simply turn it on for any drugs that requires it, and turn it off for any that do not.  That’s probably what the legislatures and regulators who create the requirements think.  RxTrace readers know it’s not nearly that easy.

The problem is that every regulation requires something different.  The only common thread is that there is always a “serial number” requirement in there somewhere (thus the name).  But the serial number itself is usually defined differently and everything else that surrounds the serial number is often not the same.  It’s not a matter of just turning it on and off, it’s a matter of changing a bunch of parameters, which result in significantly more complexity in the setup, testing and validation of the system for each market.

I can’t eliminate these problems entirely, but I can help you sort out exactly what needs to be placed onto drug packages targeted for distribution in the E.U. and the U.S.  There are important differences between the requirements of these two markets, but there are also some common elements that your single solution can take advantage of.  Here are the data, machine-readable and human-readable characteristics of the unit-level unique identifiers that are required in these two important markets, based on my interpretations of the Drug Supply Chain Security Act (DSCSA), administered by the U.S. Food and Drug Administration, and the Delegated Regulation (EUDR), administered by the European Medicines Agency (EMA):

Data

Characteristic U.S. DSCSA E.U. Delegated Regulation

Serial Number length

Up to 20 characters

Up to 20 characters

Serial Number Randomization

Not specified

Mandatory

Serial Number reuse

Not specified

1 year after expiration date or 5 years after sale or distribution

Unique Identifier Composition

NDC + serial number

Product Code + serial number + National drug registration number (where required) + lot # + expiration date

Oh good.  The serial number length is the same between these two laws.  And that’s the same length as the GS1 serial number field definition.  We’re off to a good start.

But the next three characteristics are different.  Randomization adds an extra level of complexity to the generation of serial numbers (see the five-part series that starts with “Randomization—An Interview with Ken Traub—Part 1: GS1 Serial Number Considerations“).  To eliminate the differences in the generation of serial numbers between the U.S. and E.U. you could just randomize them all.  Because the U.S. Congress did not mention randomization in the DSCSA it does not go against the law if you choose to randomize your U.S. serial numbers.  In fact, I recommend it, if you need to deploy a randomization capability to meet the E.U. or other regulation and (see “DSCSA: Congress Should Have Mandated Randomization“).  That way one less thing will be different in the setup for these two markets.

Only the EUDR mentions serial number reuse.  In my opinion, the ideal way to treat reuse is to just never reuse a serial number.  However, that will require you lengthen your serial numbers by one or two digits to accommodate the “forever-ness” of your serial numbers compared with the reuse that the E.U. allows.  If that is unacceptable to you, then follow the EUDR’s requirement in both the E.U. and the U.S.

The Unique Identifier Composition is different between the DSCSA and the EUDR.  The difference is a logical result of the difference in how the two governments expect serialization to protect their supply chain.  The E.U. Falsified Medicines Act (FMD) and EUDR are designed to authenticate all drugs at the point of dispense.  To fully accomplish that, you would want all of that data every time.  The U.S. DSCSA is designed to capture and retain transaction documentation at each point in the supply chain where the drug changes ownership so it can be studied and traced later if something suspicious is discovered.  For that you just need the minimum data to identify exactly which drug unit you are referring to.  In that case, the lot number and expiration date would only get in the way in the Unique Identifier.  They belong in the machine- and human-readable components for sure, but not in the official identifier that uniquely identifies a given instance of a product.  So both regulations got it right for what they are designed for.

The National Drug Registration Number–often referred to as the National Drug Reimbursement Number, or National Healthcare Reimbursement Number (NHRN)–is only required in certain E.U. member states, as determined by the local government.  Germany is one of them and their national number is known as the Pharma Central Number, or Pharmazentralnummer (PZN).  The E.U. Unique Identifier includes these numbers, but the problem is, the data element is optional in the EUDA and because not every member state currently plans to have one, it will result in the official Unique Identifier being significantly different across different sub-markets within the E.U.  This will add complexity to your solution.

Machine-readable image

Characteristic

U.S. DSCSA

E.U. Delegated Regulation

Barcode

Data Matrix

Data Matrix ECC200

Mandatory identifier

NDC (may be encoded in a GTIN-14)

Product code (GTIN-14 appears to comply)

Regional identifier

None

National Drug Registration Number, where required (NTIN appears to comply)

Serial number

Mandatory

Mandatory

Lot #

Mandatory

Mandatory

Expiration date

Mandatory

Mandatory

Other data allowed in barcode?

Yes

Yes

Requires the use of GS1 standards

No

No

GS1 standards may be used for compliance

Yes

Yes

The machine-readable component required by both laws is a 2-dimensional barcode–specifically a Data Matrix code.  In the E.U., the barcode image or graphic must conform to the ECC 200 specification for Data Matrix.  This is a smart choice for the U.S. as well.  Because GS1 standards are likely to dominate in both markets, GS1 DataMatrix is really the only right choice, and it is an ECC 200 code.

Once GS1 standards are selected, encoding the product code as a 14-digit GS1 Global Trade Item Number (GTIN-14) is the obvious choice (see “Depicting An NDC Within A GTIN“, and “DSCSA ‘Serial Numbers’”), and it appears to comply with both laws–in the barcode anyway (see below for human-readable).

The DSCSA does not include anything like the EUDR National Drug Registration Number so this will be a difference in your implementation.  Unfortunately it will only appear in the barcode of some of your E.U.-targeted drug packages.

The Serial number, Lot number and Expiration date are all mandatory in the barcodes for both markets.  Using GS1 standards for both markets makes this easy because those data elements have just one format.  This is particularly important for the expiration date.  The only format GS1 allows in their barcodes is “YYMMDD”.

Both markets allow you to encode additional, non-regulatory data in your Data Matrix barcodes if you prefer.  Fortunately this is easy to do without interfering with the mandated data elements through the simplicity of GS1’s barcode data encoding specification, which is found in their General Specifications (see “GS1 Publishes Version 16 Of Their General Specifications …And Why You Should Care“).

Interestingly, neither regulation requires the use of GS1 standards, even though the pharma industry has decided to use GS1 standards on their own to meet both of them.  That’s because both laws were clearly and carefully designed in a way that allows the use of GS1 standards, but without actually mandating their use.

That’s not a bad way to do it.  Please take note, those of you who are writing new pharma serialization regulations in countries like Brazil, Russia, Egypt, Pakistan, India and elsewhere.  You don’t have to mandate GS1 standards, but you need someone to help you understand how to write your regulation so that the industry is able to choose them to meet it.  There is no doubt they will.

Human-readable

Characteristic

U.S. DSCSA E.U. Delegated Regulation

Mandatory identifier

NDC

Product code (GTIN appears to comply)

Regionally mandatory identifier

None

National Drug Registration Number, where required (NTIN appears to comply)

Serial number

Mandatory

Mandatory

Lot #

Mandatory

Not required by the EUDR but is likely required by existing regulations

Expiration date

Mandatory

Not required by the EUDR but is likely required by existing regulations

Reduced requirements for small packages?

FDA is required to provide guidance for label size exemptions but is now nearly 3 months overdue

Yes

You would think the human-readable requirements would be the easiest to implement.  Not necessarily.  There are a few minefields here.  Fist, the product code.  The EUDR is very flexible when it comes to the product code, but it leaves the choice up to each E.U. Member State, not to you.  Each Member State could choose a different way to do it (see “The FMD Product Code“).

In the U.S., the product code is the National Drug Code (NDC) (see “Anatomy Of The National Drug Code“).  The DSCSA combined with the Food and Drug Administration (FDA) Standardized Numerical Identifier (SNI) guidance (see “FDA Aligns with GS1 SGTIN For SNDC“) makes it clear that the FDA is fine with companies encoding a barcode (or RFID tag) on a drug with an NDC that is contained within a GTIN-14 structure.  But it is not at all clear that they will accept the human-readable showing a GTIN, even if the GTIN contains the drug’s NDC somewhere within it.  The SNI guidance only talks about it within a barcode or RFID tag.

The DSCSA requires the human readable to include the drug’s SNI (see Section 581[14]), which is defined within the SNI guidance as a serialized NDC (sNDC), which is composed of the drug’s NDC and a serial number.  GS1 will tell you that the human readable next to a GS1 barcode should contain the data that is encoded within the barcode, but that’s in the absence of a legal requirement.  Since the NDC is encoded within a GS1 GTIN in the barcode, GS1 would normally expect you to put a numeric GTIN next to the barcode, and GS1 Healthcare US’s guidance (version 1.1) for the DSCSA shows it that way.  But that’s going to confuse the medical professionals and patients who the human readable is intended for.  In my view, you should either list the NDC, or both the NDC and the GTIN next to the barcode.  Both of these approaches would be very minor deviations from GS1 standards but in this case patient safety and compliance with the law take precedence.

A similar problem happens with the expiration date.  We’ve already seen that the expiration date must be encoded within the barcode as “YYMMDD”, as required by the GS1 General Specifications, but this is inconsistent with nearly all human-readable formatting norms.  Even the DSCSA guidance from GS1 Healthcare US shows the expiration date being formatted in multiple ways that differs from the exact format in the barcode.

For all human-readable data elements, GS1 has historically required companies to display the GS1 Application Identifier (AI) in parentheses next to the data as it is encoded in the barcode, but in 2015 they updated their General Specifications “Human-Readable Interpretation” (HRI) spec to allow healthcare  companies (only) to use descriptive words in addition or in place of the AIs (see “I’ve Changed My Mind, Follow GS1’s HRI Specification“).  In my view, this should also cover the NDC field in place of, or in addition to, the GTIN.

Interestingly, the EUDR does not include an explicit requirement to include the drug’s lot number and expiration date in the human-readable data.  My assumption is that these were already required by other statutes and so, to avoid duplication, they were not included here.  Obviously these are vital patient and healthcare professional data.

The EUDR includes fairly clear language around when you are allowed to reduce the human-readable requirements (see Article 7), but the DSCSA requires the FDA to publish guidance for the purpose.  That FDA guidance is one of those that are overdue (see “Who Is Being Harmed By Four Overdue FDA DSCSA Guidances?“).

I hope you can see that it is possible to take advantage of characteristics that are common between these two laws.  You can do the same exercise with other laws.  But there will probably always be differences between each law that will require changes to your setup when you switch a given line from packaging drugs for one market to another.

I also want to point out that, to construct these tables and write this essay, I have made quite a few interpretations of each regulation.  I am not a lawyer and these are each just one way to interpret those sections of the laws.  You need to use your own judgement and follow it when implementing your solution.  In the end, the only interpretations that matter are those of the FDA and the EMA.  Until we get their interpretations, are yours different from mine?  Leave a message below and tell us why.

Dirk.