Pharmaceutical Supply Chain Security
Released: 2013-10-31T00:00:00

Pharmaceutical Supply Chain: Why People Care

The prescription drug that you picked up on the way to work this morning may have changed hands many times before the pharmacy clerk handed you the amber vial with its sticker label and perhaps one or two multi-page information inserts about the drug. That means that there were many potential opportunities for your drug to be mishandled or even substituted with a counterfeit. The counterfeit could be a watered down version of the actual drug, a sugar-filled non-medicinal fake, or a substitute chemical that looks, weighs, and reacts like the real drug but is actually toxic. While, overall, the U.S. drug supply is typically safe, Congress, the Food and Drug Administration (FDA), industry groups, and consumers are working to devise a system to limit opportunities for counterfeiting and mishandling.

Health experts call the drug's journey a supply chain . It begins with the ingredients a manufacturer uses, carries through the manufacturing process, and continues through the distribution system of wholesalers, warehouses, and transportation to the dispensing retail and institutional pharmacies—all the way to you, the consumer, the patient. FDA, a federal scientific regulatory agency within the Department of Health and Human Services (HHS), regulates not only which drugs manufacturers may sell in the United States but also the integrity of the drugs through the supply chain, which is now global.

In April 2013 testimony before the House Committee on Energy and Commerce, Janet Woodcock, the Director of FDA's Center for Drug Evaluation and Research, described the chain as follows.

[T]he increasingly complex drug supply chain, from raw source materials to finished products for consumers, presents multiple opportunities for the product to be contaminated, diverted, or otherwise adulterated. Our efforts to secure the supply chain include minimizing risks that arise anywhere along the supply chain continuum, from sourcing a product's ingredients through the overseeing of a product's manufacture, storage, transit, sale, and distribution. A breach at any point in this continuum could lead to dangerous and even deadly outcomes for patients.

Dr. Woodcock referred to problems "including contamination, diversion, counterfeiting, and other adulteration." She gave several examples of counterfeit and stolen or diverted products: counterfeit Adderall and Vicodin sold on the Internet; stolen insulin vials needing refrigeration that were later purchased by patients without accountability for appropriate handling; and a stolen and expired seizure drug that "made it back into the legitimate supply chain and was being returned for credit."

Additional examples of specific breaks in the supply chain include human growth hormone bought from Medicaid patients and sold by a Florida wholesaler in 2008; insulin cargo stolen in 2009 that appeared among drugs sold by three wholesalers; and, in 2010, a licensed Texas wholesaler offering prescription drugs obtained from patients. Other publicized breaches of the supply chain have involved "fraudulent versions" of Botox "sold by unlicensed suppliers who are not part of the legitimate U.S. supply chain"; counterfeit Lipitor that U.S. consumers purchased from United Kingdom sources; and counterfeit Avastin (with no active ingredient) that some U.S. medical practices bought from foreign distributors.

This report serves as a primer on pharmaceutical supply chain issues. It (1) describes the chain from manufacturer to patient, including where it is vulnerable; (2) summarizes current federal law, regulation, and FDA policies that Congress and the agency designed to protect the integrity of the final drug product, and indicates where those protections may falter; (3) notes state-level and professional association activities; and (4) discusses areas that Congress, FDA, and industry, health care, and patient stakeholders have suggested might be changed to increase the security of the pharmaceutical supply chain.

Pharmaceutical Supply Chain: How It Works

To understand how the supply chain functions, it helps to know the extent of FDA's involvement with prescription drug safety and effectiveness. FDA regulates the approval, production, distribution, and advertising of prescription drugs. It works to prevent unsafe, ineffective, subpotent, superpotent, or adulterated drugs from reaching pharmacies and patients in the United States—whether introduced on purpose or inadvertently.

Before FDA approves a manufacturer's application to sell a prescription drug, it requires, among other things, that a manufacturer demonstrate that its product is safe and effective for its intended use, that directions on the label are clear and appropriate, and that the drug will be manufactured in specific production lines that have been registered and approved by FDA. After FDA approv es the application, the manufacturer must continue production according to FDA-approved "good manufacturing practices" (GMPs). The manufacturer must register each establishment involved in drug production with FDA and provide a list of current products, and periodically open its production facilities to FDA inspection.

After production, the manufacturer typically sends, perhaps via a repackager, the drug to FDA-registered U.S. drug wholesale distributors (authorized distributors of record, secondary wholesale distributors, and others) for further distribution. Industry observers estimate that "consumers receive 11 million prescriptions per day from more than 150,000 locations throughout the US. Our drug distribution network involves tens of thousands of independent companies." States license or authorize the pharmacists and wholesalers who sell and distribute pharmaceuticals within their borders and also license the physicians and dentists who prescribe the drugs.

As illustrated in Figure 1 , many entities are part of the downstream pharmaceutical supply chain. Definitions of the players vary somewhat across federal and state laws and regulations and across proposed federal systems. The following textbox provides general descriptions.

Figure 1 presents the steps a finished drug product may take on its way from the manufacturer (labeled A) to the dispenser (labeled D) who will give the drug to the individual patient. This segment of the supply path is called downstream . The upstream segment ends with the manufacturer and involves the sources of materials that the manufacturer uses to produce the finished drug product, such as active pharmaceutical ingredients and inactive ingredients (e.g., fillers, binders, and colors).

A manufacturer may sell directly to a dispenser, but usually sells to a primary wholesale distributor (labeled B). The primary wholesale distributor may sell directly to a dispenser or may sell to a secondary wholesale distributor (labeled C) who sells it to the dispenser. A dispenser may return unopened and unexpired medication to the wholesaler who may then sell it to another dispenser or to another wholesaler or return it to the manufacturer. The combinations are numerous. Interspersed throughout the chain may be third-party logistics providers who transport or warehouse the drug under contract to the manufacturer, distributor, or dispenser.

At each change of hands, the drug could be vulnerable to theft, mishandling, adulteration, and tampering; for example, part of a legitimate shipment may be stolen for resale elsewhere and substituted with a fake. Problems may arise at other times; for example, an otherwise legitimate shipment may be inadequately refrigerated in a truck or warehouse. The colored lines in Figure 1 illustrate alternate paths from manufacturer to patient.

How Congress Has Moved to Regulate theSupply Chain

FDA's earliest authorities, in 1906, concerned product integrity. Subsequent changes in the law related to product integrity and safety reflected the mid-century pharmaceutical industry with mostly domestic factories. Since its passage in 1938, the Federal Food, Drug, and Cosmetic Act (FFDCA), as amended, both directly addresses and indirectly influences the pharmaceutical supply chain. Relevant FFDCA sections cover topics including prohibitions and penalties regarding adulterated or misbranded drugs (e.g., Sections 301, 303, 501, and 502), pharmaceutical security (e.g., Section 505D), registration and inspection of producers and facilities (e.g., Sections 510 and 704), and imports and exports (e.g., Section 801), among others.

In the last quarter century, Congress has made three focused attempts at improving supply chain security by amending the FFDCA. Each one added tools—standards, penalties, required planning—to strengthen federal oversight of the supply chain, as described below. Gaps, however, remain.

Prescription Drug Marketing Act of 1987

In the 1980s, Congress determined that the drug distribution system was not sufficiently "closed" to prevent abuse of drug samples. The Prescription Drug Marketing Act of 1987 (PDMA, P.L. 100-293 ) amended FFDCA Section 503. It banned the sale, trade, and purchase of drug samples, and mandated storage, handling, and accounting standards for drug samples. By adding a new Subsection 503(e), PDMA also addressed other segments of the supply chain with the following changes to the FFDCA:

required that wholesalers, except for authorized distributors of record, provide to the recipient "a statement ... identifying each prior sale, purchase, or trade of such drug.... ," often referred to as a pedigree; required each manufacturer to maintain a current list of its authorized distributors of record; stated that no one may engage in wholesale distribution unless licensed by a state in accordance with the Secretary's guidelines; required the Secretary to issue guidelines, by regulation, establishing minimum standards for wholesaler licensing to include storage and handling and records; and defined authorized distributor of record (ADR) and wholesale distribution (see earlier textbox).

PDMA also established civil and criminal penalties for violations of its provisions.

Implementation of FFDCA Section 503(e)—in particular the first bullet, above—has not gone smoothly. To enforce the law, the FDA drafted regulations that would require drug companies to maintain a detailed "chain of custody" (also known as a pedigree) for every pharmaceutical product sold in this country. The recorded pedigree would allow manufacturers to trace back suspected counterfeit shipments. FFDCA Section 503(e)(1)(A) [21 U.S.C. 353(e)(1)(A)] states:

Each person who is engaged in the wholesale distribution of a drug subject to subsection (b) of this section [a prescription drug] and who is not the manufacturer or an authorized distributor of record of such drug shall, before each wholesale distribution of such drug (including each distribution to an authorized distributor of record or to a retail pharmacy), provide to the person who receives the drug a statement (in such form and containing such information as the Secretary may require) identifying each prior sale, purchase, or trade of such drug (including the date of the transaction and the names and addresses of all parties to the transaction).

However, the law specifically excluded manufacturers' authorized distributors of record (ADRs) from this pedigree requirement. Because ADRs sell most drugs into secondary drug wholesale distribution markets, the PDMA recordkeeping requirement created a dilemma. Because the law does not require that a manufacture or an ADR give the records or pedigree with the drugs, the secondary distributors do not necessarily have the chain-of-custody information that the law requires them to provide to their customers.

For that reason, when FDA published final regulations to implement this section of the PDMA in December 1999, the Small Business Administration petitioned the agency, arguing that enforcement of the provision would drive 4,000 or more secondary distributors out of business. Subsequently, FDA delayed the effective date of this provision's enforcement repeatedly, most recently because it believed that industry voluntary conversion to an electronic pedigree was imminent, in which case the rule would be superfluous. In November 2006, FDA announced the availability of a compliance policy guide (CPG 160.900) regarding the December 1, 2006, implementation of its PDMA pedigree regulations (21 CFR 203.3(u) and 203.50)), along with a guidance for industry to answer questions about PDMA requirements. One week later, a court issued a preliminary injunction to prohibit FDA's implementing key pieces of the rule and FDA published an addendum to its guidance for industry, describing the injunction's effect on various elements of the regulatory requirements. In March 2010, FDA stated that, "As a result of this litigation, FDA has been exercising its enforcement discretion concerning the drug pedigree requirements and only requiring that drug pedigrees go back to the last 'authorized distributor of record.'" In July 2011, FDA issued a proposed rule to remove its rule on pedigree requirements for wholesale distribution (21 CFR 203.50(a)).

Food and Drug Administration Amendments Act of 2007

The PDMA chain-of-custody requirements are not the only provisions in the FFDCA that address the security of the pharmaceutical supply chain.

With the FDA Amendments Act of 2007 (FDAAA, P.L. 110-85 ), Congress added FFDCA Section 505D [21 U.S.C. 355d] "Pharmaceutical Security." The law directed the Secretary to "develop standards and identify and validate effective technologies for the purpose of securing the drug supply chain against counterfeit, diverted, subpotent, substandard, adulterated, misbranded, or expired drugs." In particular, the law required the Secretary to

develop a standardized numerical identifier (which, to the extent practicable, shall be harmonized with international consensus standards for such an identifier) to be applied to a prescription drug at the point of manufacturing and repackaging (in which case the numerical identifier shall be linked to the numerical identifier applied at the point of manufacturing) at the package or pallet level, sufficient to facilitate the identification, validation, authentication, and tracking and tracing of the prescription drug.

Complying with that requirement, FDA issued "Draft Guidance for Industry on Standards for Securing the Drug Supply Chain—Standardized Numerical Identification for Prescription Drug Packages" in January 2009. The agency issued the final guidance in March 2010. Note that FDAAA did not authorize the Secretary to require the use of SNIs. Action on use of an SNI will likely depend on future legislation.

FDAAA also directed the Secretary to undertake other activities. They fall into three general areas: addressing promising technologies, such as radiofrequency identification technology, nanotechnology, encryption technologies, and other track-and-trace technologies; undertaking enhanced and joint enforcement activities with other federal and state agencies; and establishing regional capabilities for validation and inspection.

Food and Drug Administration Safety and Innovation Act of 2012

Five years after FDAAA, attempts by Congress, FDA, and other stakeholders to craft a comprehensive supply chain plan culminated in the Food and Drug Administration Safety and Innovation Act (FDASIA, P.L. 112-144 ). Members, committees, bipartisan and bicameral staff groups, and stakeholder groups had released several bills and discussion drafts in the 112 th Congress in advance of FDASIA. Although all parties expressed willingness to compromise because of the urgent need to find solutions to security threats and the complications that would arise if each state went its own way with laws and regulations, they were unable to agree on a complete approach.

FDASIA, as enacted, expanded FDA authority regarding manufacturer registration, facility inspection, and importation. It included provisions to allow FDA to refuse entry of an imported drug if the manufacturing facility inspection was denied or limited; enhance penalties for suppliers of counterfeit or substandard products; and require a unique manufacturing facility identifier for both domestic and foreign facilities. (The following textbox provides a longer summary of the FDAAA drug supply chain provisions.)

Although FDASIA included several elements of a broader plan, key items, such as chain-of-custody documentation and track-and-trace technologies, remained unresolved. Following FDASIA passage, Members and staff continued discussions, attempting to find an effective and feasible mix would cover domestic and foreign facilities.

State Activity

In the absence of a federal plan, about half of all states have passed their own laws to address drug pedigrees and supply chain security. Legislation is pending in some other states. The approaches and extent of law and regulation vary by state, but they generally address similar issues such as definitions, licensing, permits, registration, pedigrees, and recordkeeping, among other topics.

In discussing federal proposals for a uniform national system, Members of Congress as well as stakeholders testifying at congressional hearings often refer to the law that California first passed in 2004 and then amended (regarding implementation dates) in 2006 and 2008. The California law now calls for its pedigree requirements to go into effect in 2015.

Central to the California law is a required electronic pedigree to include every transaction from the manufacturer to the dispenser of the prescription drug. The pedigree is to include information about the seller (e.g., identifying information and registration number), the drug (e.g., name, quantity, dose, expiration date, lot numbers, and a unique identification number), and the shipment (e.g., size and number of containers, and invoice number). The pedigree data must be handled in a system that is interoperable, "ensuring compatibility throughout all states of distribution." The law provides definitions and exemptions (e.g., medical gases and drugs for veterinary use).

One provision of the California law is particularly relevant for federal policymakers:

Upon the effective date of federal legislation or adoption of a federal regulation addressing pedigree or serialization measures for dangerous drugs, Sections ... shall become inoperative.

Members of Congress who want a comprehensive supply chain law (such as what California has enacted) may not want to pass a less extensive federal law because it could prevent California from implementing its pedigree requirements. Some manufacturers and distributors have cautioned that not only are the California requirements expensive but they rely on technologies that are not fully formed. Others report that the technologies are sufficiently advanced and they have already begun gearing up to comply with the California law.

Professional and Industry Association Activity

Several associations and ad hoc alliances of industry participants recommended supply chain security systems or proposed legislation that they could support.

The National Association of Boards of Pharmacy (NABP) has worked with states to create a Model State Pharmacy Act and Model Rules. The 2010 Model Act defines wholesale distributor and recommends the adoption of electronic pedigrees subject to the availability of adequate technology.

NABP has also developed criteria and a process to accredit distributors. NABP's website describes its Verified-Accredited Wholesale Distributors (VAWD) program, established in 2004 and updated in May 2013, and notes that 21 states recognize VAWD, including 3 that require it. NABP describes the VAWD program as follows:

Wholesale distributers that display the VAWD Seal as part of their accreditation have undergone a criteria compliance review, including a rigorous review of their operating policies and procedures, licensure verification, survey of facility and operations, background checks, and screening through the NABP Clearinghouse. Accredited facilities are reviewed annually and undergo a site survey every three years.

The Pharmaceutical Distribution Security Alliance (PDSA) issued draft legislative language in February 2012: the Pharmaceutical Traceability Enhancement Code (RxTEC) Act. The draft would create a comprehensive system involving a machine-readable graphic on individual packages to support lot-level tracing of a product to its immediate previous and subsequent owners. The system would be implemented incrementally, with manufacturer, repackager, wholesale distributor, and dispenser requirements beginning three, four, five, and six years, respectively, after enactment.

Policy Decision Points

Versions of pharmaceutical supply chain legislation have been considered in both the House and Senate in the 113 th Congress. This report is designed as a backgrounder for those new to the issue, thus it does not track current legislation.

All parties to the discussion agree to one big-picture goal: pharmaceutical supply chain security. Several sub-goals, some of them overlapping, are evident in current and prior legislative proposals that would

protect the patient from ineffective or dangerous drugs that may be in the supply chain as a result of counterfeiting, theft and resale, or manufacturing, transportation, or storage mishaps; protect the manufacturer , who can lose both money and reputation if its product harms a patient, regardless of whether the fault laid with the manufacturer's actions; and allow the assignment of accountability for identified problems.

In working toward those subgoals, policymakers are also trying to

avoid having to comply with diverse state requirements by enacting a national plan; and establish a system that is logistically feasible at manageable cost .

Although Congress, FDA, and affected industry and health care stakeholders agree on an overall goal (increasing supply chain security), they have disagreed about approaches and details. The drafters and negotiators of legislative language face many policy decision points. Some policy decision points involve whether to do something at all (e.g., Is the current system of state regulation better than proposed federal changes?). Others would involve the implementation timing of a requirement (e.g., implement six months or 10 years after enactment, study and consider recommendations six months or 10 years after enactment, or implement in clearly defined action and timing stages); or the scope of a requirement (e.g., types of drugs, types of facilities, time period covered, timing of activity).

The following section lays out many of the terms and policy decision points under discussion by Members, committees, and staff of Congress. Each paragraph presents a term (e.g., track and trace) under discussion and a very brief suggestion of how it fits into the overall attempt to regulate the pharmaceutical supply chain.

Definitions . Different industries, professions, and statutes use similar terms differently. In creating legislation for pharmaceutical supply chain security, policymakers must decide how to define the meaning of terms they use. For example, wholesaler, distributor, third-party logistics provider, manufacturer, pharmacy, package, and pedigree.

P edigree . A description of the drug (possibly information such as name, amount, dosage, manufacturer, lot number) and a statement of the transaction history of the drug, including each transfer of ownership (and/or physical possession) of the product. This could include seller, purchaser, amount transferred, lot numbers, among other information. Current movement is away from paper toward an electronic pedigree.

Track and trace . A system that involves electronically tagging each package with a unique identifier (serialization), noting each transfer of a drug package, and maintaining a database of all such transactions. For example, a manufacturer might want to track a package to facilitate a recall if a problem were noted. A public health authority (or the manufacturer) might want to trace back to where a package has been to determine the source of a local problem.

Serialization ( SNI—standardized numerical identifier ) . A mark placed on a package at the manufacturing facility (and again at the time of repackaging) that is unique to that package. As FDAAA required, the Secretary has developed a standardized numerical identifier (SNI). FFDCA, including FDAAA amendments, does not give the Secretary authority to require the use of SNIs.

Lot- or unit-level activity . Whether a labeling or tracking requirement applies at the level of the lot or the unit. A lot is the full output of a manufacturer's production run; it can include thousands of units. A unit is the smallest package that is delivered to the dispenser (retail or hospital pharmacy or clinical setting) who will dispense it to a patient. The use of unit-level tracking and tracing could allow quicker and more focused recalls and real-time investigation of adverse events. This more extensive approach would also be more expensive. Some proposals would separate the labeling task from the reporting task in setting implementation goals or requirements.

Supply chain . Analysts speak of the upstream supply chain (sources and path of ingredients that go to the manufacturer) and the downstream supply chain (path of the finished product after it leaves the manufacturer). Current legislative discussions are focused on the downstream chain. For each requirement regarding pedigrees/transaction records, authentication/verification, and other supply chain security activities, legislation could specify start and end points; however, opinions differ on which points to use. The most inclusive (and with higher up-front costs for supply-chain participants) would cover all transactions beginning with the manufacturer and ending with retail sale to the patient.

Authentication . When accepting a shipment, the recipient (e.g., distributor, warehouse, or dispenser) could be required to verify the SNI and the distribution history.

Technology choice . Under a track-and-trace system, an SNI would be applied at the manufacturer or repackager level to each package. Information about contents and its distribution path could be included or linked. Analysts debate the benefits and limitations of various technologies such as two-dimensional bar codes or radio-frequency identification (RFID) for track and trace purposes. Further, the technologies are evolving as packaging and data management engineers are designing other systems for supply chain use.

Interoperability . For a track and trace system to work as envisioned, the data maintained by the manufacturer and each subsequent link in the chain must have compatible formats and definitions. Interoperability would also apply to the way data are communicated (e.g., a standardized language) and interpreted by those contributing to or using the data.

Data management . In a track-and-trace system, some entity would maintain standards on how participants collect, store, protect, and use data. Such management could be centralized or decentralized (distributed), each approach having benefits and limitations.

Data access . Policymakers could specify in legislation several choices regarding data access—such as who would have access to which data elements—or leave it to the responsible agency (most likely FDA) to establish by regulation and guidance. Considerations might include for what purposes someone might use the data; and whether the user would need real-time data to track an unknown contaminant or could use semi-annual records for reports.

Confidentiality . Decisions about data management and access could involve consideration of the confidentiality of information about patients, dispensers, clinicians, and business entities across the supply chain.

Notification . Distributors or dispensers may find that a shipment includes suspected or confirmed counterfeit or substandard drug products. A new law might require that they notify other supply chain participants. The law or subsequent regulations could direct how the data management group or the overseeing federal agency could manage that information.

Penalties . Legislation could specify whether penalties (civil and/or criminal) would apply to various violations of compliance with provisions relating to, for example, labeling or completing transaction records. FFDCA already allows penalties for, among other violations, acts of counterfeiting, misbranding, and marketing of unapproved drugs.

Implementation timing . Various legislative proposals set different time frames for each step—for example, use of SNI, lot-level transaction reporting, unit-level transaction reporting, and issuance of proposed and final regulations.

Licensure , registration, and accreditation . In general, states choose whether and how to license members of professions and specific activities. At the federal level, FDA requires entities to register with FDA if they participate in specified activities; for example, a manufacturer of a drug in commercial distribution. Some legislative proposals address the federal role in licensing standards for wholesale distributors and other members of the supply chain.

Accountability . Registration of supply chain participants would support assigning or accepting accountability for errors, accidents, and weaknesses along the chain. How a supply chain security system is structured could affect how foreign participants engage with the recordkeeping and how FDA could manage oversight and enforcement of compliance.

Cost . Consideration of cost is often a part of decisions regarding scope, implementation dates, reporting requirements, and other elements of a supply chain security system. Issues raised include who bears the cost (e.g., manufacturer, patient, government, distributors, dispensers); what the cost would be given current technology and systems; and what it might be if new products are developed in response to new requirements.

Federal and state jurisdiction . There seems to be general agreement that a uniform set of national standards has advantages over a patchwork of varying state requirements. However, the requirements in federal legislation might preempt state law and regulation. Those who favor the more extensive requirements that some states (such as California) have enacted would prefer that federal requirements be a floor upon which states could choose to build.

Concluding Comments

As drug production has shifted to a global supply chain of manufacturers, processers, packagers, importers, and distributors, FDA leadership, among others, has suggested that the agency's current statutory authority does not match its responsibilities to ensure that the nation's drug supply is secure. In April 2013, FDA's Dr. Woodcock testified,

A robust track-and-trace system, in which each drug produced would be tracked as it passes through the distribution system and allows purchasers to verify its distribution history, would improve the ability to identify and detect potentially harmful products if they enter the supply chain. Another potential benefit would be to improve the efficiency of product recalls. Imagine a system that enables the distributor or pharmacist to readily determine if they have sold or now have in stock a drug that had been identified as a counterfeit or subject to a recall. They could quickly remove that product from the supply chain, keeping the patient out of harm's way. The only way this can be done effectively is if all supply chain stakeholders participate in the system and if all legitimate products have a way to be identified and tracked as they are distributed from the point of manufacture.

Many Members of the current Congress have been trying, as had their predecessors, to craft legislation that could help (1) keep counterfeit, mishandled, and substandard drugs away from patients; (2) maintain clear lines of accountability; (3) use appropriate levels of technology and data management; and (4) avoid unintentional adverse effects on patients, industry, communication systems, and relationships of all with each other and the states and FDA. Current congressional attention is on H.R. 3204 , the Drug Quality and Security Act, the text of which was released as an agreement by majority and majority leadership of the Senate Committee on Health, Education, Labor, and Pensions and the House Committee on Energy and Commerce on September 25, 2013. Title II is the proposed Drug Supply Chain Security Act. The House passed H.R. 3204 on September 28, 2013. The bill now awaits Senate action.