With so much at stake, we all hope that DSCSA will work. Unfortunately, the current standards and guidelines appear to “build in” potentially “fatal” design flaws. Providentially, the current initiative could clear the path for a system that could work.
Formerly referred to as ePedigree, Title II of the Drug Supply Chain Security Act—DSCSA—is a US federal law whose objectives include the prevention of counterfeit and diverted prescription drugs to improve quality and patient safety. In essence it is a legally mandated effort to create an industry-wide internet-of-things (IoT) platform. Its conception and implementation are well into their second decade. Industry participants are collaborating with government officials to set the standards and guidelines for how the system will work.
November 2018 marked the DSCSA’s first major deadline[1]and milestone: marking each product “at the lowest salable unit” with a scannable unique serial number. It appears that major industry participants have already implemented their solutions, and that others are meeting the deadline, if necessary, by applying labels at the end of their production lines.
The direction is provided through the collective expertise of government regulators, an international numbering standards body, and the pharmaceutical industry. The first major decisions demonstrate that creating a multi-organizational track-and-trace system is extremely challenging. (It’s extremely difficult to do it for a single organization.) There are many ways to get it wrong, and far fewer ways to get it right.
Making each drug a node on the Internet of Things (IoT) has the potential to enable the industry and governments to achieve their DSCSA objectives. However, success requires that hundreds of decisions (technical, economic, and social) be made correctly. The first major design decisions illustrate the challenges of getting it all right.
For example, the system establishes an extremely long data structure. The GS1 data structure encodes at least 4 important data elements into a 2D datamatrix barcode. The GTIN number (a unique number identifying this product formulation from this manufacturer in this quantity—kind of like a company SKU, but for the entire industry), a serial number for this item, an expiration date, and a lot number (or sometimes a control number). In addition to these numbers, each number is preceded by a 2-digit code which indicates what type of number follows (with some idea of the expected number of digits). These numbers are strung together to form a +40 numeric (and sometimes with letters) string. This long string is encoded into a 2D datamatrix barcode.
The length of this data string is unwieldy, unusual in industry, and impractical. Keeping track of very long data strings is a challenge for humans, who on average can’t remember more than 7 digits. Transcribing more than 40 digits from one person to another is fraught with potential errors. Other industries have solved complex serialization challenges using more practical approaches: tracking all of the cars in the USA since 1971 using a VIN of 17 characters, every unique credit card with 15 or 16 digits, every credit card transaction with 8 alpha numeric characters or 18 digits, every air travel itinerary with 6 alpha numeric characters, and the list goes on. Theoretically, the pharmaceutical industry could track a trillion unique drugs with 15 digits[2], or with 8 alpha numeric characters (leaving nearly 2 trillion extra unique serial numbers).
This long string of digits and characters results in a large data matrix. These are accommodated on packaging or bottles by covering lots of package “real estate” or by using very small cell sizes within the data matrix. Some packages may be too small to accommodate the new required labelling. A datamatrix with small cell sizes is more difficult to scan.
Most importantly, the inclusion in the data matrix of security related data (product ID, Serial #, expiration date, and lot #) could make it easier for bad actors to gather this data and use it for illicit purposes. This decision has the potential to completely undermine the original program objectives to abate counterfeiting and diversion.
We’ve highlighted two challenges with the DSCSA data structure. Does this mean the entire system won’t work? That’s impossible to answer at this time.
While there are issues with the basic data structure, there are still dozens of additional design decisions that need to be made. If enough correct design decisions are made by governments and pharmaceutical players, the system may be able to realize its original objectives. But this requires astute insight, analyses, and thinking.
If the early decisions prove “fatal” to the system, can a workable system be salvaged from the current design? The answer to this question is much more positive. Careful adjustments to the design could improve the performance of the system to where it achieves its objectives to reduce counterfeiting and diversion of prescription drugs.
Making these design changes will require the experience and expertise of those who have spent decades implementing many successful track and trace systems in multi-organization environments.
—Tom Swem contributed to this post.
Please let us know what you think in the comments below or contact us.
[1]This current deadline was previously a year earlier. It was pushed back to this due to lack of industry readiness.
[2]Technically, a trillion less 1.