While the IC’s research organization looks into adding security to cloud environments, in the here and now, intelligence agencies are sharing more data.
The Fagan family of Long Island, N.Y., thought they were out of the woods when their 16-year-old son, Tim, came through a lifesaving liver transplant in 2002. Yes, he would need to take immune-suppressing drugs for the rest of his life, but his prognosis was good.
Among the drugs in Tim’s regimen was Epogen, an anti-anemia medication prescribed to help boost his production of red blood cells. Tim’s mother administered a weekly injection of the drug, bought from the local branch of a national pharmacy. But hours after the shot, Tim would wake up screaming in excruciating pain. His doctors had no explanation, and no one would have guessed the cause was fake pharmaceuticals.
“The first night I thought someone had broken into his room and was attacking him,” says Tim’s father, Kevin Fagan. “It was a very emotional and very painful thing to watch our son suffer. To find out two months later that he was taking counterfeit drugs just blew us out of the water. We couldn’t believe counterfeit drugs even existed.”
Indeed, counterfeit drugs pose an “increasingly sophisticated threat” in the United States, according to Dr. Andrew von Eschenbach, acting commissioner of the Food and Drug Administration, citing the 2006 update of the FDA’s Counterfeit Drug Task Force Report.
“We have witnessed an increase in counterfeiting activities and a more sophisticated ability to introduce finished dosage-form counterfeits into legitimate drug distribution channels over the years,” the report concludes.
To squash that threat, or at least suppress it, the FDA has championed the use of new technologies that would meet and surpass the goals of the Prescription Drug Marketing Act enacted in 1988 and updated in 1992. Among other things, the law established a pedigree requirement for the wholesale distribution of drugs to document the ownership history of a product.
Since 2004, the FDA’s Counterfeit Task Force has supported widespread use of electronic track-and-trace technology to help secure drugs’ integrity with accurate pedigrees in the supply chain. An e-pedigree is a legally binding document in electronic form that includes certain data elements required to populate the pedigree.
“We’d love to see companies continue to move toward an electronic pedigree,” says Dr. Ilisa Bernstein, director of pharmacy affairs at the FDA. “The difficulty is that under the law there is no distinction between whether a pedigree is paper or electronic. In our view, if everyone moves toward some electronic pedigree and every product has its own serial number, we could track that product from manufacturer to pharmacy — that’s a way we can further secure our supply chain.”
Radio frequency identification is considered the most promising technology to achieve e-pedigrees, Bernstein says, with the primary advantage that it does not require direct line of sight to read — each item does not have to be scanned, as is the case with a bar code.
An RFID tag, a small chip with a tiny antenna, can carry and transmit data. The tag goes under the label of each drug package. With RFID readers, supply-chain partners would gather information on the chip, so as the product moves out of the manufacturer’s door, it is read, read again in the wholesaler’s receiving dock and throughout the warehouse, and so on down the chain.
“Companies can gain other benefits in addition to the supply-chain security that we’re all looking for,” Bernstein says. “Better inventory control, staff management and help in reducing some of the paperwork sometimes involved with the distribution of drugs, such as controlled substances.”
Peggy Staver, director of trade product integrity for Pfizer, one of the few drug manufacturers pioneering the use of RFID technology, adds that the pharmaceutical industry is interested in potential operational benefits such as enhanced shipping and receiving efficiencies, accuracy, increased inventory management and availability, potential shelf-life applications, and recall possibilities.
“You can read an entire case of bottles in a fraction of a second ideally, when everything is working well, by passing a case through a portal or in the presence of a reader, as opposed to having to scan every individual item,” Staver says.
But to date, only three drug makers have introduced serialized branded pharmaceutical products with RFID tags in the U.S marketplace — Pfizer (see sidebar below), GlaxoSmithKline and Purdue Pharma. Each trading partner has to have the appropriate equipment, so an infrastructure is needed for RFID to work. But adoption across the industry has been slower than expected, and that infrastructure is not yet in place.
The industry could not move forward without standards, and the first pedigree standard was just published this January by EPCglobal North America, a nonprofit organization aimed at achieving mass adoption of electronic product code (EPC) and RFID technology.
“With one standard, vendors can be certified by us to be compliant and know that they are interoperable,” says Bob Celeste, director of health care at EPCglobal North America.
This first standard builds on a document model and is essentially a one-way pedigree. Celeste describes it like a Russian doll or a snowball, in which more and more information is added to the previous information. Initially the manufacturer provides its data as well as information about the distributor, the drug itself and the transaction. That information moves in a parallel path with the drug.
With RFID, it is not necessarily on the chip, but a message that is sent to the distributor. The distributor receives that message, authenticates the shipment, and then wraps around it another message with information about the receiving part of the transaction. When the drug goes to the hospital or pharmacist, another layer is created about shipping, and it keeps going down the line, so everyone has knowledge of where that product has been and who has had it.
But the manufacturer or others at the beginning of a pedigree can’t see into the future. So, according to Celeste, work is under way on a track-and-trace modelwhere one could see up and down the supply chain. Today, if someone found a questionable drug or a drug in a place where it didn’t belong, she would have to go to the manufacturer and walk her way up the supply chain to find the last place that bottle legally existed. With track-and-trace, she could go to anyone at any place on that supply chain and know the drug’s entire history.
This offers additional business process benefits, such as more automated replenishment and vendor-managed inventory. For example, a distributor could have visibility of when a product is used by a customer and know when to replenish the drug and when to bill.
“The pedigree [standard] itself has taken a big step in that direction in at least identifying the information that needs to be passed, giving one standard that can comply with many regulations,” Celeste says. “It’s really giving the industry something to work with. So if you had paper and wanted to move to electronic, there are guidelines in the standard to do that.”
The pedigree is a messaging standard and does not require RFID, Celeste points out. He also notes one reason why widespread adoption has been slow: Each trading partner needs to understand the regulation in the jurisdiction with which it is trying to comply. If a company is shipping product in the United States, it has to understand the FDA’s PDMA; in Florida, it needs to know PDMA, plus Florida’s drug law; in California in 2009, it would have to understand the California law also.
The Florida law does not require an item to be serialized. The California law currently requires products to be serialized and numbers to be authenticated prior to receiving the drug. That’s the niche where companies are starting to look at RFID from the compliance standpoint, Celeste says, offering a real-life example.
“If you’re a distributor and receiving cases of drugs on a pallet, in 2009 in California you would have to verify each bottle in each case,” Celeste says. “The manufacturer could mark the bottles with a 2-D bar code, meaning the distributor would have to open each case. Or, with RFID, the distributor can read right through the case. That is the link between pedigree and RFID.”
Stakeholders are interested for a number of reasons, including brand protection. The proposition of having an RFID chip on a bottle and unique serialized numbers in a network could create a more secure environment in which a product is less likely to be diverted or counterfeited. At the end of the supply chain, in pharmacies and hospitals, the interest lies in the internal processes once those organizations receive drugs, Celeste says. As an example, he uses the ability to pull bottles off the shelf by their expiration dates.
EPCglobal North America has a group looking further into the future, connecting sensors with RFID. One would be able to get information on whether a drug has stayed in the appropriate temperature range, for example.
“Future work will be to get a sensor that does not require new hardware or software,” Celeste says. “That’s where RFID takes off. It’s not just seen as a replacement for bar codes; it’s seen as a highly mobile computer that can do many things during your processes.”
At some point, e-pedigrees will be commonplace, Bernstein predicts. “We were told in 2004 it would take three years. Here we are in 2007, and we’re not there,” she says.
Among the reasons is concern about privacy. “People fear if someone is driving down the street with a reader, he could read what’s in the medicine chest of a house he drives by. That’s not the case,” Bernstein says.
Both ultra-high-frequency near-field tags and high-frequency tags would require a reader to be within 4 to 5 inches of the tag to be able to read it, Celeste says. “And what you would read off there wouldn’t necessarily tell you what drug it is,” he explains. “Companies today are masking the drug code on that tag and also working on decommissioning technology to make the tag active only if the consumer wanted it.”
Another reason for pursuing the track-and-trace model is to split the security so it lies with both the tag and the bottle’s unique number.
“The physical tag, yes, that may be counterfeited,” Celeste says. “But the fact that the number on it is known to the network, if that number ever shows up again, it could alert the supply chain that there’s an issue and both bottles could be quarantined until things are figured out.”
Bernstein also acknowledges that cost can be a major barrier to early adoption of a new technology. The FDA is doing its part to try and make sure the costs of RFID or other technologies that will help achieve industrywide e-pedigrees don’t add to the ever-increasing cost of drugs.
There are capital costs to retrofit packaging lines and enable unique serialization, Staver says. Depending on how many manufacturing lines a company has, there could be many lines that require hardware and software to tag items, cases and pallets. An ongoing cost is that of the tags, which are much more expensive than a printed bar code.
Pfizer spent nearly $5 million implementing RFID on bottles, cases and pallets of Viagra, she says. “But we were early adopters, so our costs were higher back in 2005 than they would be today. Costs are coming down as the technology continues to mature.”
One thing drug manufacturers, regulators and consumers agree on is that technology alone will not prevent counterfeiting. Improved business practices, enhanced legislation, strengthened enforcement and the deployment of technology are all required, Staver says. “We need to do this in a way that doesn’t undo the efficiencies built into current processes,” she says.
Kevin Fagan and the lawyer representing his family, Eric Turkewitz, want to see the supply chain shortened, so that there are fewer opportunities for fake drugs to slip in. Manufacturers would be “foolish if they do not combine [RFID] with a very tight distribution system,” Turkewitz says. “If they let their wholesalers buy drugs from secondary wholesalers, then they are inviting trouble.”
Fagan says he supports a bill named for his son, “Tim Fagan’s Law” (HR 2345), introduced by Rep. Steve Israel (D-N.Y.). The bill would increase criminal penalties for the sale or trade of counterfeit prescription drugs, modify requirements for maintaining drug pedigrees, establish recall authority for the FDA, and implement the safety measures recommended by the FDA’s counterfeit drug task force, including the deployment of anti-counterfeiting technology.
“There has got to be a way to track where a drug has been. A pedigree system, whether paper or electronic, is a great step, but more important is to shut down the ways that [counterfeit] drugs can get into the supply chain,” Fagan says. “Certainly track-and-trace is great, RFID is great, but we also need legislation that has a multipronged approach, and more people who become aware and get involved. If this could happen to us, it could happen to anyone.