The EU Falsified Medicines Directive and What It Means
Europe’s Falsified Medicines Directive (FMD) comes into full force in little over a year, on 9th February 2019. Far-reaching, mandatory requirements for product coding, traceability and tamper-evidence will be enforced in over thirty countries.
What is the Requirement?
The FMD requires that all unit-of-sale packs of prescription medicines (with potential exceptions for perceived low-risk products) must carry a “safety feature” comprising a Data Matrix code and human readable data, and must be tamper-evident.
The code must contain a minimum of four pieces of information: batch number, expiry date, global trade item number (GTIN) and a randomized serial number. Some countries require a fifth data string for national use. The data must also be printed in human readable form, ideally adjacent to the code. Manufacturers (and licensed parallel traders) will code their products and report data to a central EU Hub run by the European Medicines Verification Organisation (EMVO). This will push data down to appropriate national data repositories run by corresponding National Medicines Verification Organisations (NMVOs). Pharmacists (or other authorized persons) will scan the codes during the dispensing process and these codes will be checked against those local databases.
Who Must Report FMD Data?
The task of reporting accurate data to EMVO is the responsibility of the Marketing Authorisation Holder (MAH) and cannot be delegated to a contract manufacturer (CMO). This means that every MAH company, however small or virtual, needs a software solution to generate, manage and report serial numbers in a highly accurate, controlled and validated way. This comes as a surprise to some companies, who are used to outsourcing everything, but it needn’t be a major burden given the right solution choices.
How Should Companies Report Their Data?
However the serialisation data is generated, whether by in-house software or by an outsourcing partner, the data will need to be collated and uploaded by each MAH. All serialisation data from such license holders will go through EMVO and their hub system. This means that early engagement with EMVO is important. The administration procedure to register with EMVO as a MAH involves a number of documentation steps and verification checks. It is not a quick process and can take months. Over two thousand MAH entities will need to be on-boarded to EMVO in 2018, which is likely to lead to a bottleneck. We recommend that MAHs start the process now rather than wait until later in the year.
What Tools Are Needed for Reporting?
This challenge cannot be addressed with an Excel spreadsheet and the IT equivalent of duct tape. Too much is at stake. The FMD should be seen as a significant business continuity risk, albeit with upside potential. The law is very clear: no data or wrong data means no sale. This means that license holders can’t afford to delay or to choose the wrong solution.
Production lines need to be modified with code printers, vision systems to check printing, ejection mechanisms to remove miscoded packs, perhaps more-stable conveyors, tamper-evidence stations etc. These are controlled with software, classified as Levels 1-3 on the ISA-95 scale. They pass data to Level 4 (enterprise-level) and Level 5 (external reporting interface) software. These last two are sometimes combined into the same solution, as with rfxcel, and provide the gateway to the outside world.
Only a small number of gateway solution providers, including rfxcel, are currently Technically Certified to provide access to EMVO. This certification is a critical minimum requirement, which indicates that the software solution has been rigorously tested and shown to do what EMVO requires. But that doesn’t mean it has been optimized for data quality. Don’t assume that all certified vendors take a proactive approach to data integrity. In most cases, the system is validated but not the data flow within it. The old adage of “garbage in, garbage out” still applies. Look for a vendor that actively checks the data fields for accuracy. Not just one-time validation of data connections but checking every piece of incoming data for errors. Also beware of systems that require frequent re-validation due to external changes beyond your control.
What About Distributors and Dispensers?
When manufacturers upload their data via the EMVO hub, it is then pushed down to national repositories run by national medicines verification organizations (NMVOs). This is done based on the master data attributes and specifically the global trade item number (GTIN). For example, data for products destined to be sold in France will be pushed to the French NMVO. Any downstream checks by distributors and dispensers are made against the national repository in their jurisdiction.
Unlike the equivalent US law (the Drug Supply Chain Security Act) the FMD doesn’t require codes to be checked between manufacturer and pharmacist except on a risk basis (e.g. for returned product). However, pharma logistics in the real world is complicated and bi-directional. The FMD is likely to increase the flow of returned product, at least until the system stabilises. In the same way that implementing serialization causes an overall equipment effectiveness (OEE) impact on production lines, the FMD will cause a macro-scale “OEE” dip in the European supply chain.
Is Aggregation Mandatory?
Aggregation is a production process that builds a hierarchy of traceability data from pack to case to pallet. One master code on the outside of a container is linked via a database with the identities of all the unit packs inside. This means that one scan can verify multiple codes in a sealed container – very useful for distributors and for managing internal hub and spoke logistics. Aggregation is not mandatory under the FMD, but avoiding unpacking, checking and re-packing coded product during verification is one of the key reasons that many MAHs are implementing aggregation.
Summary
If you have internal production lines and have not yet started converting them for serialization, my advice is to transfer production to a CMO or arrange post-production coding. You probably don’t have time to complete a production line conversion before February 2019.
Every MAH (even a virtual one) needs at least the Level 4/5 software discussed above, since they have the responsibility to report their own data in a reliable and validated way. They must show the regulators that they are in control of their serialization system at all times, so choice of vendor is critical.
If your company already outsources finished goods production, you still have time to procure, install and validate a L4/5 software solution but you need to start now. Call us today for a more detailed discussion and let us help you to get ready for February 2019.
Conclusion:
Understandably, this presents a challenge to your company to implement. It is crucial that your company acquires a working knowledge of the law in order to understand your risk. Most companies outsource this work to a solution provider such as rfxcel. rfxcel is a EU FMD compliance software provider that addresses all compliance management and requirements, serialization processes and connectivity to a global network. With hundreds of customers and over 14 years of experience, rfxcel has been the leader in the track and trace industry for pharma. A company focusing on the success of its customer, it ensures a designated team for your implementation, support and quality control.
