Over the last 18 months or so, the Ministry of Health in the Russian Federation has been conducting a pilot to learn what works and what doesn’t work for pharma serialization and tracing (see “Russia Begins Its Pharma Supply Chain Pilot” and “The Russia Serialization Pilot Guideline”). They were due to publish a report on their findings in February of this year, but we are still watching for that. As we’ve learned over the years, it’s not uncommon for governments to miss their deadlines, at the same time, making tough statements about the industry needing to meet theirs, followed by caving on those deadlines too (See US, China, Brazil, US, India, Pakistan…). That pattern is repeating in Russia.
Even as the pilot was still winding down, the first deadline for full implementation was supposed to be at the end of the first quarter this year, then successive deadlines at the end of each quarter until everything was to be serialized and traced by the end of 2018. Of course, the official specifications—beyond the pilot specifications, which were clearly not intended to be final and polished—have still not been published. Yet, I’ve heard of some multi-national drug companies scrambling to serialize their products using the pilot specifications to meet those deadlines. I’ve also heard rumors that cynical local Russian drug companies are used to “paper tiger” deadlines and are just ignoring these.
I guess that was the right reaction, since the serialization pilot barcode specifications have apparently been replaced by a different specification in a government decree on April 28, 2018. That’s when Order #791-r was signed by Demetry Dedvedev, Chairman of the Russian Federation. I’ve seen a proprietary English translation of the order, which I cannot share, but trust me, it’s not very clear. It raises lots of unanswered questions.
- Is it for drugs? The order doesn’t mention drugs, medicines or any healthcare items. It appears to be a serialization approach for any kind of product.
- Is the product code still a GS1 Global Trade Item Number (GTIN)? Some people fear that the Order implies that product codes would be supplied by the Russian government instead.
- Does the manufacturer define the serial number? Hard to tell for sure.
- Are the batch number and expiration date still required? Can they be included in the barcode voluntarily?
I’ve seen several other unofficial documents related to Order 791-r that seem to provide the following answers. I’ve also seen notes from GS1 Healthcare that seem to corroborate these answers. By the way, GS1 Healthcare is an incredibly valuable source of up-to-the-minute information about serialization and tracing regulations around the world. If you aren’t a member, I strongly recommend you consider joining. Their Public Policy work group is incredibly valuable for monitoring regulations around the world.
Keep in mind, these are not official sources, and they’ve gone through language translation, the author’s interpretation and then my interpretation of those results, so take them with a grain of salt. They could easily be wrong…or there could be additional caveats or complications.
- Order 791-r appears to apply to any product that would be serialized and sold on the Russian Federation market. Drugs appear to be the initial product category that will use it.
- In my reading of the Order, I don’t get the feeling that the GTIN has been replaced by a government issued product code, but I have not been present in meetings with government officials who may have provided that indication verbally. There is enough concern about it that five Russia-based pharma industry associations have sent a letter to the government expressing concern over this and several other issues raised by the Order.
- My best guess is that the manufacturer will still define the serial number, but there are two new data elements that must be obtained from a government subcontractor’s cloud-based service, or, for local manufacturers, from a government supplied piece of hardware.
- Another guess, based on my read of all the documents I have seen is that the batch number and expiration date in the barcode are purely voluntary.
Order 791-r does not contain the name “Crypto-tail”, but the Functional Model, paragraph g) says:
“g) labelling code shall be centrally generated and consist of 2 parts – identification code and validation code. Identification code shall contain the commodity heading code according to the Unified Commodity Catalogue of the Russian Federation, labelled with the identification means and the unique code of the goods item. Validation code shall be generated using the Russian cryptographic technologies;”
In one of the separate documents I have seen, but cannot share, the government subcontractor, CRPT, indicates that the mandatory fields in the 2D barcode include:
- (01) GTIN-14
- (21) Serial number (exactly 13 characters)
- (91) Key (4 characters)
- (92) Signature (88 characters)
The “Crypto-tail” consists of the last two fields. That’s a total of 119 characters encoded in the full barcode, not including the FNC1 character that should terminate the serial number field, even though they fix the length at 13 characters. In fact, there should also be an FNC1 character after each of the Key and Signature fields as well, since in the GS1 System, Application Identifiers (AI) 91 and 92 are both variable length fields. So technically, that’s a total of 122 characters.
WHAT’S THE POINT?
The Crypto-tail appears to me to be a way of enabling a limited form of verification when internet service is not available. Russia is a massive country, spanning 11 time zones. More than three quarters of the population lives west of the Ural Mountains, leaving less than one quarter to live in two-thirds of the land mass. There are several reasons for this unbalanced distribution of people. One is that Siberia is notoriously cold. But another important reason is that, unlike anywhere else in the northern hemisphere, the major rivers flow north rather than south, east or west, and they empty into the Arctic Ocean (see the map above). That results in epic ice jams and flooding every spring.
The population of Russia is not big to begin with, but when you spread one quarter of that population across such a huge area, many people are very remote. Internet access is probably rare across a wide swath of central and eastern Russia. For this reason, it makes some sense to come up with a scheme to enable an algorithmic form of verification that does not rely on internet access.
It appears that the Crypto-tail can be used locally to confirm that the combination of the GTIN, serial number are valid or not. This isn’t the same as verifying these values through an internet-based online verification service, where the verification processes can also check real time statuses, like recall, stolen, withdrawn, already decommissioned, etc. But when you don’t have internet access, you don’t have a choice, an algorithmic verification is probably better than nothing.
Unfortunately, it may be easy for criminals to circumvent. All they have to do is copy the barcode from a single valid unit and print it on their counterfeit units, and then distribute them in the remote areas where online validation isn’t possible. The algorithm will show all these units are valid. Of course, to fight against this criminal technique, isolated pharmacies can keep their own records of which Crypto-tails they have already scanned/dispensed. Any duplicates would raise the alarm locally and could then be reported through non-internet means to other regions.
Despite this limitation, the Crypto-tail is a clever way to offer more protection than without it, in remote, disconnected areas. It seems like the kind of thing that could also work in China, India and parts of Africa and Southeast Asia. I don’t see the value of the Crypto-tail in regions where online verification is readily available.
WHAT’S NEXT IN RUSSIA?
The latest word is that the detailed regulations and specifications—multiple documents—will be published in August so we won’t have long to wait. That is, assuming they don’t just cave. I assume those documents will provided all the detail we need to definitively answer the questions listed above. Either way, RxTrace will analyze them.