Serialization Strategy 101

By David A. Loy, Senior Director of Quality and Regulatory Affairs, Aphena Pharma Solutions

A step-by-step guide to implement track and trace.

With every recurrence of confirmed counterfeit drug product in the pharmaceutical supply chain, the pressure increases to establish a national standard for pharmaceutical track-and-trace solutions. Although a universal standard has yet to emerge, there is one set of requirements that is currently driving action: the California Board of Pharmacy’s ePedigree.

Moreover, with considerable attention from legislators, regulators, and standards organizations to track and trace a pharmaceutical product throughout its lifecycle, drug manufacturers and packagers are under increased pressure to implement serialization to provide supply-chain integrity to the public.

However, with the deadlines for the California Board of Pharmacy’s ePedigree law quickly approaching, it will be vital for the industry to accelerate its efforts to start putting compliance measures in place in 2013.

With the accelerated pace of regulatory involvement worldwide in serialization and track and trace, a strong working foundation of imminent requirements is necessary.

Several of the U.S. states are in the process of creating legislation for ePedigree; however, California is, by far, drawing the most attention for two reasons:

1. Although it has pushed the initial enforcement date out, there seems to be a common understanding that the current initial enforcement date of January 1, 2015, will stand.
2. Of those states actively pursuing similar legislation, California’s requirements are the most demanding. For example, Florida’s law requires the tracking of product to the lot level, whereas California’s goes to the smallest saleable unit level.

California’s legislation is written such that it will effectively be usurped by federal legislation, but it is not known when the feds may introduce similar or overriding legislation. The bottom line? The deadline is fast approaching, and action needs to be taken now in order to comply with the impending law. As you contemplate your track-and-trace efforts or are putting systems in place, you should first keep the following considerations in mind.

Compliance Matters
Any and all systems added or maintained to resolve the ePedigree initiative must be compliant with the regulations. Although the need to attack the problem of counterfeit medicines in the supply chain is obvious, many of the system design considerations may be derived from an analysis of the regulations the system(s) will address. The following are regulations to keep in mind to help guide your process:

1. ISO Requirements: Depending on the extent to which a company implements serialization for a packaging operation, there will be significant regulatory impact to a serialization project. At a minimum, there are ISO requirements for a formalized computer-system life-cycle management process. In any case, the use of best practices in today’s world for well-tested and documented business-critical systems is a safe assumption.
2. CFR Part 11: Other regulations may also be impactful. In the case of pharmaceuticals, 21 CFR Part 11, Electronic Records; Electronic Signatures, there are many requirements that must be met. These include specific actions to ensure authenticity, integrity, and confidentiality of e-records where appropriate.
3. GAMP 5: The pharmaceutical industry adheres to industry standards that can be found in a document published by the International Society of Pharmaceutical Engineers (ISPE) in its most recent guide, GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems. Immediately upon the formalization of a systematic serialization approach within an organization, the resulting project then becomes subject to standard Good Manufacturing Practices (GMP) Quality Management System requirements. GAMP 5 will drive the project planning and implementation of a structured track-and-trace program in the typical pharmaceutical company.

Within GAMP 5, topics include how:

• the system will be designed, built, and tested
• the system will be documented
• the system will be handed over to the users
• incidents will be documented, and corrective and preventive measures will be captured and coordinated
• system changes will be managed
• system audits will be conducted
• electronic records will be maintained, retrieved, and archived
• ... and more

Ask The Right Questions To Form Your Strategy
Apply a structured analysis of the integrated automation system to assure adequate understanding of the processes and scope of the effort (i.e. determine what business processes, system interfaces, and human control activities need to be assessed) prior to formal project Scope Statement.

Questions to be addressed for this phase should include the following:

• Is this a global project? If so, what communication and collaboration tools will be used to support the project?
• What is planned for a proof-of-concept?
• Which lines will be upgraded?
• Are multiple facilities involved?
• Is there a serialization system already in place? If so, has a gap analysis been performed to identify the differences between the “as-is” and the “to-be” processes?
• Have all important stakeholders been included?
• How will we be able to insure a good level of communication with stakeholders?
• Is there an opportunity to leverage standardization in order to reduce or eliminate the need for redundancy and duplication?
• Is there potential for leveraging corporate standards or guidelines and supplier standardization?

The project plan should consider task ownership so that there are clear expectations of who will deliver what and when. Although this consideration is universally applicable to all elements of the project, the bottom line is that the delivery of the system, including all software, hardware, documentation, and on-going support and maintenance, must be well understood and agreed upon in writing.

Click to view larger image

Test, And Test Again
As with any complex project, there will be a lot of trial and error, potentially resulting in rejects and rework. This is primarily because now we are aggregating serial numbers into containers holding smaller serialized units. When the serial-number “chain” is disrupted for whatever reason, the human business processes’ and automated systems’ capabilities to cope with the management of such an issue is key.

Although there are a number of potential scenarios that will inevitably occur, the following is an example based on a standard high-speed packaging operation of between 100 to 200 bottles per minute:

Assumptions:

• All labeling within the batch must be uniquely serialized, verified, authenticated, and aggregated during the packaging operation.
• At a minimum, the following automated systems, including mechanized ejection capability, are parts of the packaging train: (1) controlled creation and issuance of a pool of uniquely serialized values for the specific packaging operation; (2) confirmation and verification following application that the bar code is machine readable and is an issued value from the approved pool; (3) aggregation of the serialized product during the final boxout into shipping containers to create the parent–child relationship between the uniquely serialized bar code applied to the shipper case and each uniquely serialized container within the shipper; (4) reconciliation of used, destroyed, and remaining values against the issuance for the original pool.

1. Product, labeling, and packaging materials (e.g. container, closures, corrugated shippers) are issued to a packaging suite.
2. Inevitably, equipment fails, whether using inkjet, laser, thermal transfer, or some other labeling technology.
3. Upon failure, defective units result, causing rejects that are automatically detected and separated from the rest of the batch.
4. Depending on product value, rejects are placed in a secured location and destroyed at the conclusion of the batch, or rejects are fully reworked using an approved rework process that specifically addresses the final disposition of the serialized labeled primary container.
5. As the rejects contain controlled serialized values created for the specific batching operation, these units must be closely controlled and reconciled during the batch-approval process. Discrepancies will result in delayed batch release, potential quarantines, and investigations.

It is evident that any fault in the data linkage will result in significant lost production time. Moreover, considering throughput on today’s high-speed packaging lines, a failure scenario such as the one described above could have significant cost and/or compliance impact.

Internal Corporate Requirements
Of course, not all of the system requirements will be gleaned from a review of the regulations. So, in addition to the user requirements focused specifically on meeting the regulations, additional requirements will need to be gathered and documented clearly describing our internal users’ expectations for the delivered system. Examples of requirements for this group may read similar to these:

• “The system shall be able to monitor availability of serial numbers and notify an operator when a ‘low level’ limit is reached.”
• “The system must be able to ‘read’ all serial numbers applied by scanning with appropriate equipment and immediately reject defective units and notify operator(s) when illegible serial number(s) is/are encountered.”

Although the expectations from legislators, regulators, and standards regarding track and trace of pharmaceutical product are being communicated to the industry, it is quickly becoming evident that there are resource limitations throughout the industry to address these new expectations. Attention must now be focused on the extended project piloting and implementation time requirements to get these systems up and running in an accelerated fashion.

At this point, you must implement an aggressive time line to meet the minimum compliance requirements of the California ePedigree Law. I have included one project plan approach, focused on fulfilling the basic requirements. Adherence to the plan does not guarantee a successful implementation, as there are a myriad of variables; however, failure to establish a plan at this late stage certainly guarantees the inability to effectively comply.

David A. Loy currently serves as Senior Director of Quality and Regulatory Affairs for Aphena Pharma Solutions in Cookeville, TN. Loy has been involved in track-and-trace, pedigree, and unit-level serialization since 2006. Loy developed, approved, and implemented a fully traceable, unit-level serialization program that has produced over 25 million uniquely identified units. Loy maintains current Designated Representative status in both California and Florida and is well versed in the regulatory requirements and implications of existing and pending state and national legislation associated with track and trace, including serialization. Loy holds a MA and BA in English from Tennessee Technological University located in Cookeville, TN.