Indian Serialization Mandate & The US Supply Chain

Given the strength and importance of the country’s pharmaceutical sector, it is essential that Indian exporters adapt to comply with stringent new global regulatory requirements for serialization and traceability. These have been enacted by countries around the world to support the manufacture and distribution of safe, high-quality drugs.

This challenge will be felt keenly in the United States, since India supplies roughly 30% of its generics market. While there are approximately 546 manufacturing units in India that supply product only to the United States,1 many are only at the early stages of implementing serialization. Some were not ready to meet the US Drug Supply Chain Security Act (DSCSA) mandate for item-level serialization, which became effective last November.5 This is one reason that the ISPE Serialization Workshop in May 2017 highlighted the Indian generic medication supply shortage in a discussion with participants from the US Food and Drug Administration’s (FDA) Office of Drug Security, Integrity, and Recalls. On 30 June 2017 the agency modified its draft guidance and issued a one-year nonenforcement period until November 2018 to give manufacturers additional time and avoid supply disruptions.8

In addition to serialization, harmonized standards between the United States and India will also help ensure an uninterrupted flow of safe medicinal products. For these reasons, CONVAL Group, consultants to worldwide pharmaceutical companies on compliance and quality issues, and RxGPS, the alliance for global pharmaceutical serialization, provide information and recommendations to bodies such as GS1 India,^∗ Pharmexcil, National Informatics Center (NIC), Directorate General of Foreign Trade (DGFT), Ministry of Commerce, Drug Controller General of India, and several Indian

pharmaceutical associations that implement, regulate, and enforce India’s mandate for serialization for all exports of medicinal products. These efforts are directed toward aligning India’s serialization regulation with the GS1 global standard3 and with DSCSA mandates in the United States (Figure 1).

There are four key areas of risk that threaten Indian pharmaceutical exports and the US supply chain: scope, collaboration, automation, and reporting.

∗ GS1 is a nonprofit organization that develops and maintains global standards for barcodes and other unique identifiers. According to its website, GS1 India works with industry and government agencies “to enable compliance with regulatory requirements and global best practices.” For more information, see http://gs1india.org

• 1
• 5US Food and Drug Administration. Guidance for Industry. “Product Identifier Requirements Under the Drug Supply Chain Security Act—Compliance Policy.” Draft guidance. June 2017. https://www.fda.gov/downloads/drugs/guidancecomplianceregulatoryinformation/guidances/ucm565272.pdf
• 8US Food and Drug Administration. “FDA Issues Draft Guidance: Product Identifi er Requirements Under the Drug Supply Chain Security Act—Compliance Policy.” https://www.fda.gov/Drugs/DrugSafety/DrugIntegrityandSupplyChainSecurity/DrugSupplyChainSecurityAct/ucm565358.htm
• 3GS1. “Standards.” https://www.gs1.org/standards

Scope

Every pharmaceutical exporter of medicinal products that we’ve talked to has indicated that its serialization program has overshot the scope, its budget, and timeline. This affects departments that include artwork, supply chain, new product launch, target-market-specific regulations, shop-floor production, quality assurance, information technology, and engineering. At the same time, new international regulations continue to evolve, with recent additions from China, Egypt, Jordan, Russia, Saudi Arabia, South Africa, and South Korea. This is important because organizations that have developed an internal serialization program are now extending them beyond the walls of the company, since they partner with dozens or hundreds of contract manufacturers around the world.

The risks of inadequate scoping include limited time to develop a complete, properly funded serialization program that complies with evolving regulations, and managing with limited resources to meet these challenges.

Limited time

Approaching deadlines for new serialization regulations leave limited time for compliance. This could lead to loss of market share and supply chain interruptions, with patients paying the price if drug shortages accrue. Because the few global vendors that provide compliant solutions are already overbooked, the average time of a line delivery can be as long as 8–9 months. Average time for qualification of each serialization line is approximately 8–9 weeks. IT integration for reporting requires additional time. The key to compliance, therefore, is linked to an early start of a serialization program.

Ever-changing scope

The extent of a company’s serialization program depends on different and changing country regulations that require software upgrades, new installations, or new equipment. These additional efforts increase serialization program costs and alter schedules. This happened when both China and Brazil put their regulations on hold while they updated them. Meanwhile, companies had already invested to meet the compliance mandates. These moving targets make it difficult for management to set up a fixed schedule and budget. As a consequence, budget and timelines must be tracked and updated regularly. This effort should be company-wide, ongoing, and consider new directives issued from regulators.

Lack of skilled resources

Resources that can handle complex serialization programs and understand the end-to-end life cycle of data and its integrity are in short supply. Detailed technical knowledge and experience in serialization hardware and software configurations, artwork, a comprehensive tracking list of finished product stock keeping units (SKUs) and their delivery schedules, packaging orientation, IT infrastructure, site-server and data-exchange-reporting cloud solutions are some key competency areas. Generally, multiple vendors are involved at various levels of the solution.

Less-skilled resources can cause damage or add risks. The major risk of insufficient or inadequately trained resources is that track-and-trace solutions will continue to be commercialized without key understandings of configuration management, Electronic Product Code Information Services (EPCIS)† reports, and reconciliation due to inadequate testing.

^† A global GS1 standard that allows different applications to create and share electronic product code data, creating a framework that permits all trading partners to know the status of any given item.

Collaboration

The serialization world has become a fragmented network with diverse country-specific mandates, some of which are not even aligned with GS1 global standards. Some countries have issued serialization mandates without performing a regulatory risk assessment to check the effect of new regulations on a globally integrated supply chain.

Similarly, many serialization solution vendors failed to perform standard feasibility studies, which led to vendor blocking and dedicated data exchange. Consider, for example, a facility that hosts multiple vendor-specific site servers. If vendor A installs eight lines and their proprietary site server to manage those lines, vendor B then installs six more lines and their site server. The Open Serialization Communication Standard (Open-SCS) Working Group6 created the interoperability standard for industrial automation in which users, vendors, and consortia collaborate to create secure and reliable data transfer standards for multivendor, multiplatform programs like this.

Inadequate collaboration has resulted in a higher cost and variable implementation schedules across supply chains. Downstream supply chain partners, including wholesalers, dispensers, and patients, are currently not even aware of or trained to understand what needs to be done.

Automation

Track-and-trace systems follow a five-level model: line-level equipment performing serialization coding-inspection-confirmation (levels 1 and 2); site-level server for serial number issuance and reconciliation (level 3); enterprise resource planning (ERP) systems, and manufacturing execution systems (MES) for product data exchange, e.g., process order, product ID, batch number, and expiration date (level 4); and applications—generally cloud-based—for reporting and data exchange with health authorities, wholesalers, and others (level 5).

Developing these systems involves a multivendor system landscape that is fairly new to the pharmaceutical industry, especially in developing countries. The setup of these systems is complex, posing risks if something goes wrong. Accountability and responsibility issues arise when there are technical problems.

In developing countries, new serialization vendors are mushrooming, despite their lack of experience with good automated manufacturing practices (GAMP^®) standards. Many do not follow the software development life cycle approach, and testing is rudimentary. They are unable to manage configuration changes and modular developments, and frequently change the base version of the software to incorporate new functionalities. They also do not understand the critical requirements of 21CFR211.68^‡ and other regulatory requirements that are essential for assuring data integrity and a robust serialization solution.

^‡ US Code of Federal Regulations Title 21, Part 211, Section 211.68, “Automatic, mechanical, and electronic equipment.”

Data exchange and reporting carry their own risks and, in case of supply interruptions, can disrupt availability across wide geographic areas.

“India Is A Worldwide Leader In Drug Manufacturing, Producing 10% Of Global Pharmaceuticals” 

Reporting

Every country has its own reporting mandate and ways of exchanging data. In India, all serialization data is reported to the Drugs Authentication and Verification Application (DAVA), a national portal that is maintained by the NIC.

Data repositories such as this, which host sensitive business information, need robust security to thwart unauthorized access and breaches to protect sensitive business information. Security holes can render the portal vulnerable to hackers, who tend to target the most vulnerable data repository.

In addition to security concerns, the dynamic reporting requirements of level 5, which enable diverse, multi-country reporting with the use of standard software tools, carry the risk of error and scope creep. The location that has had, or currently has, physical possession of the product must have accurate master data, transactional data, and event data related to the product to assure real-time point-of-dispense verification. Any software error in this database can directly affect patient safety. Scope creep occurs when a new regulation leads to a technical upgrade of already commercialized serialization lines, which in turn can require configuration changes to hardware and software, which introduce other new risks. This adds additional effort, time, and cost to the program.

Until now, few countries have successfully achieved live productive environments with established country reporting and downstream supply chain integration. The effect of the real-life portal load and stress is unknown to most implementation programs currently underway.

Indian Serialization

Export requirements

In 2011, India’s Directorate General for Foreign Trade (DGFT) began to issue public notices informing manufacturers that as of 1 April 2016 all drug formulations for export must be serialized at the primary, secondary, and tertiary packaging levels.1 While primary level serialization is currently optional, dummy serial numbers need to be recorded in the portal for export to countries that have no mandatory serialization requirement.

Drug formulations must be identified with a 2D barcode encoding a 14-digit global trade item number (GTIN), batch number, expiration date, and unique serial number. Drugs can be exported only if both the tertiary and secondary packaging carry bar coding as applicable and the relevant data is uploaded to DAVA. Verification occurs at each packaging level as defined by DAVA reporting guidelines.4

• 6OPC Foundation. Open-SCS Working Group. https://opcfoundation.org/markets-collaboration/open-scs-working-group
• 4DAVA. Drug Authentication and Verifi cation Application. http://dava.gov.in

Primary level (optional)

Packaging in direct contact with the product and meant for sale to consumers (e.g., medicine strips, vials, single-therapy kits, or items packed in mono cartons). It carries a 2D barcode as per GS1 standards. Authentication uses the 14-digit GTIN and serial number on the label.

Secondary level

Secondary packs such as folding boxes and mono cartons. It carries a 2D bar code, with the GTIN, batch number, expiration date, and serial number indicated on the pack.

Tertiary level

The highest level of packaging, this can be a shipper case (intermediate pack) or a palletized unit containing several shipper cases destined for transport as individual units. The label carries a 1D barcode with embedded GTIN, batch number, expiration date, and serial shipping container code (SSCC).

Within this level are homogenous cases that contain inner packs at the lowest unit of sale (tertiary or secondary), and heterogeneous cases that contain different products.

Dava Portal

The root cause of many of the problems with Indian serialization regulations is that they apply to exports, but not to products for domestic consumption. In theory, Indian exports must adhere to the importing country serialization mandate. Indian regulations,⁹ however, state that:

• In case, the Government of the importing country has mandated a specific requirement, the exporter has the option of adhering to the same and in such a case, it would not be necessary to comply with the stipulation under sub para (i) to (iv) of Para 2 of this Public Notice and if an exporter is seeking to avail such exemption from bar coding prescribed by the Government of India as above, the exporter is given the option to move an application to the Pharmaceuticals Export Promotion Council of India (Pharmexcil) for this purpose, clearly specifying the nature of such an exemption in the interest of the exports from the country. Pharmexcil shall dispose of such applications on case to case basis with prior approval of Government. However, the tertiary level of packaging will have additional printing of barcode as per Para 2 (i) (c) of this Public Notice in addition to importing country’s requirement, if any. [emphases added]9

Many pharmaceutical and merchant exporters don’t understand how to interpret this mandate, especially if they’re exporting to the United States. The confusion about requirements for the Indian mandate and the US HAD and DSCSA shipper case label requirements have caused major logistical disruptions for wholesalers and distributors.

Another concern is that Indian exporters are required to create dummy serial numbers for primary packs in the Indian DAVA portal. RxGPS and the US FDA have serious concerns about the generation and use of such dummy serial numbers, as they are tantamount to fake serial numbers, which defeats the core principle of fighting counterfeits.

The Indian regulation for reporting aggregation—a requirement for countries that do not have their own serialization regulations and do not apply directly to the US market—mandates the use of GTIN-independent serial numbers. These must be unique to the company, but are not required to follow the GS1 standard of SGTIN (GTIN + serial number), which is the serialized numeric identifier (SNI) per FDA guidance for prescription drug packages.

Currently, all global vendors are aligned with the GS1 EPCIS standard that considers SGTIN as the SNI, which is globally accepted. Changing a standard feature of any serialization unit poses a risk to data integrity. This can lead to incorrect generation of EPCIS reports, present an unmanageable technical requirement, and creates the potential for supply disruption.

Implementation Black Holes

The lack of harmonized regulations between the DGFT and importing countries has led to confusion about export product labeling. We have seen multiple GTINs on homogenous cases, SSCC and GTINs on the same case, a combination of GS1 India-issued GTINs and US-issued GTINs on a homogenous case, and the same GTIN on multiple levels of packaging.

US market challenges

These problems will affect the US supply chain. Having duplicate GTINs on packaging levels can lead to errors, since it is unclear which barcode should be scanned. GTIN discrepancies can cause a product to be returned. Combining the SSCC and GTIN—which puts two serial numbers on the same unit of packaging on the same homogenous case—can lead to aggregation errors. Nonconformance with Healthcare Distribution Alliance bar code guidelines can decrease supply chain efficiency, resulting in increased costs, product delays, and potential drug shortages (Figure 2 and Figure 3).

Recommendations

Given the limited time for compliance, the variable scope due to differing regulations from country to country, and the lack of qualified resources to help develop a serialization program, we suggest the following:

Start your serialization program early. Keep in mind that new regulations will continue to challenge implementation of your schedule and will affect your budget. Your priorities will change over time. Standardize your process and how you collect, store, and share data. Harmonize your implementation plan, taking into account all possible scenarios, and leverage specialized consulting help if in-house expertise is not sufficient.

Collaborate with regulators and industry groups. GS1 and RxGPS should engage early with regulators. Consulting companies and solution providers should unite under ISPE to develop a serialization working group. The DGFT should harmonize its implementation with that of the US DSCSA and the European Union’s Falsified Medicines Directive (FMD). Create custom unified deliverables to reduce maintenance of master data and validation efforts. The solution should be designed from the bottom up, from line level to the cloud, without retrofitting of regulations to a commercialized solution, which carries the risk of undetected errors.

Collaborate on automation. Indian serialization vendors should enroll with Open-SCS to make sure that they are aligned with global standards. Indian pharmaceutical companies and exporters should watch for vendor blocking. Custom solutions require enhanced validation efforts. Serial number management and exchange should be part of the overall program. Do not consider line level as a hardware problem alone; instead, qualify it as a hybrid computerized system.

Collaborate on reporting. Pharmaceutical companies supporting the US supply chain should consolidate their site and production-line reporting, obtain exemption from Pharmexcil for correct DAVA portal reporting, and set up correct master data sets, including GTINs. Full aggregation reporting requirements should be based on clear regulations. Consider nondeterministic random serial numbers for the FMD and implement this concurrently.

If these recommendations are considered, we are hopeful that Indian pharmaceutical manufacturers will meet the compliance deadlines that are fast approaching. We would like to see US importers of pharmaceutical supplies closely monitor contract manufacturers that use locally developed serialization solutions, since the manufacturers are at high risk of not meeting DSCSA requirements and compliance deadlines. The selection of globally reputable serialization vendors will fast-track the implementation schedule and harmonize its standards to meet the requirements of the DSCSA.

We have less than a year to succeed.

• 9Government of India. Directorate of Foreign Trade. “Implementation of the Track and Trace System for Export of Pharmaceutical and Drug Consignments.” Public Notice No. 3/2015–2020. 21 April 2016. http://dava.gov.in/fi les/PublicNotice_21042016.pdf