FDA Publishes Guidance on the Enhanced System Under the DSCSA Going into Effect on November 27, 2023

In June 2021, the Food and Drug Administration (FDA or the Agency) issued draft guidance (Guidance) to assist supply chain stakeholders, particularly trading partners, with requirements for enhanced drug distribution security at the package level under section 582 of the Federal Food, Drug, and Cosmetic Act (FD&C Act or the Act), as added by the Drug Supply Chain Security Act (the DSCSA). Requirements for enhanced drug distribution security, commonly referred to as the “enhanced system,” go into effect on November 27, 2023. Manufacturers, in particular, may benefit from planning to engage in internal assessments of current supply chain readiness.

The Guidance clarifies the enhanced system requirements listed in section 582(g)(1) of the Act and provides recommendations on the system attributes necessary for enabling the secure tracing of product at the package level, including allowing for the use of verification, inference, and aggregation, as necessary.

See FDA’s Guidance on Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act (June 2021), available here. 

The DSCSA outlines critical steps for building an electronic, interoperable system by November 27, 2023, that will identify and trace certain prescription drug products as they are distributed within the United States. Section 202 of the DSCSA added section 582 to the FD&C Act, which established product tracing, product identifier, authorized trading partner, and verification requirements for manufacturers, repackagers, wholesale distributors, and dispensers to facilitate the tracing of products through the pharmaceutical supply chain. The requirements aim to improve the oversight of trading partners in the supply chain and are designed to usher in the gradual development of an enhanced system.

Enhanced Drug Distribution Security

System attributes that the Agency views as important to promoting drug distribution security are addressed in section 582(g)(1) of the Act, including:

1. the exchange of transaction information and transaction statements in a secure, interoperable, electronic manner;
2. transaction information that includes the data elements of the product identifier at the package level for each package included in the transaction;
3. systems and processes for verification of product at the package level;
4. systems and processes necessary to promptly respond with the relevant transaction information and transaction statement for a product upon request by FDA or other appropriate Federal or State official in the event of a recall or for the purposes of investigating a suspect product or an illegitimate product;
5. systems and processes necessary to promptly facilitate the gathering of the information necessary to produce the transaction information for each transaction going back to the manufacturer upon request by FDA or other appropriate Federal or State official in the event of a recall or for the purposes of investigating a suspect product or an illegitimate product, or upon request of an authorized trading partner for the purposes of investigating a suspect product or an illegitimate product or assisting FDA or other appropriate Federal or State official with a request; and
6. systems and processes to associate a saleable return product with its applicable transaction information and transaction statement to allow a trading partner to accept the returned product.

FDA believes that the effective use of aggregation and inference in the enhanced system will depend on the quality of aggregated data, documentation and shipping/packing integrity, and the ability of the system to effectively use aggregated data to meet FD&C Act requirements. The terms “aggregation” and “inference” are not defined in the DSCA but the Agency considers these terms to mean the following:

• Aggregation: the process of building a relationship between unique identifiers assigned to packaging containers.
  • Example: a parent-child relationship would exist between the product identifiers for a package or group of packages (the child or children) that are contained in a homogeneous case (the parent).
• Inference: the practice of examining or using information for a higher level of packaging to infer information about the lower level(s) of packaging and its contents—for example, inferring information about individual packages from information about a sealed homogeneous case.

To facilitate the effective use of data aggregation, the Guidance recommends that a selling trading partner and its purchasing trading partner(s) decide how they will share data files in a secure, efficient manner that allows the purchasing trading partner(s) to use the data file for determining the information that is associated with each package of product.

While FDA notes that automated solutions may make the practice of inference unnecessary in the future, the Agency does acknowledge that inference is currently a common business practice that enables members of the supply chain to handle data, processes, and products during shipping and receiving steps. FDA recommends that a trading partner only use inference when it receives pallets or homogeneous cases with aggregated data if the integrity of the unit is intact—meaning the tamper-evident tape or wrap, or other security seal, has not been broken. If the receiving trading partner determines that a product with broken tape or wrap is suspect, the trading partner should not use inference for the aggregated data. FDA also clarifies that if a federal agency breaks a security feature to allow for examination or testing, the product should not be treated as suspect or illegitimate solely because of that reason.

System Structure

Although each trading partner should have its own individual validated system and processes for managing its product and data, FDA recommends that the enhanced system enable the interoperable integration of such individual systems to the degree necessary to allow appropriate access, efficient information sharing, and data security. The Guidance notes that the enhanced system should allow FDA and other Federal and State officials to communicate with trading partners’ individual systems and receive relevant information upon request.

FDA supports a distributed or semi-distributed data architecture model because either model can allow each trading partner to maintain control over its own data. In addition, trading partners can use the model that best facilitates promptly providing Federal and State officials, upon their request, with complete product tracing data as required under the DSCSA.

FDA recommends the enhanced system use appropriate data security standards, security protocols, and security applications to protect data, trading partners’ individual systems, and the enhanced system from falsification, malicious attacks, and breaches. To ensure data security, trading partners should adopt standards and/or protocols developed by a widely recognized international standards development organization. FDA plans to address standards for secure, interoperable data exchange in a separate guidance.

The Guidance highlights that trading partners should use individual systems and procedures that protect confidential commercial information and trade secrets. FDA expects trading partners to ensure that they will maintain the confidentiality of product tracing information through usual business practices. The Agency affirms that it will protect information it receives in compliance with all regulations that prohibit public disclosure of confidential commercial information and trade secrets.

The Guidance also recommends that the enhanced system permit only an authorized trading partner to request relevant data related to a product the authorized trading partner sold or purchased. Additionally, the system should enable trading partners to share relevant data in a secure manner upon request by an authorized trading partner, FDA, or other appropriate Federal or State official in the event of a recall or for the purpose of investigation of a suspect or illegitimate product.

Enhanced Product Tracing Requirements

To meet the requirements of section 582 of the Act and facilitate the secure, interoperable exchange of product tracing information, FDA expects trading partners to go beyond current requirements of only exchanging limited information and use steps and technical functions to enhance security that accommodates the inclusion of the standardized numerical identifier, expiration date, and lot number in the transaction information of product by November 27, 2023.

Furthermore, to ensure that selling trading partners accurately reflect the product they sell, FDA recommends that selling trading partners develop and use processes that automate recording the electronic data in the transaction information and transaction statement associated with the product physically shipped to the purchasing trading partner.

Under section 582 of the Act, the trading partner purchasing the product must not accept ownership of the product unless the previous owner provides the product tracing information before, or at the time of, the transaction. Once the purchasing trading partner receives product and product tracing information, FDA expects the purchasing trading partner to incorporate this information into its individual system in such a manner that the data can be used for product tracing purposes.

FDA recognizes that clerical errors or discrepancies may occur in product tracing information that is not necessarily indicative that the product is suspect. Therefore, the Agency is recommending that trading partners immediately notify trading partners they purchased the product from to resolve aggregation errors or other types of discrepancies. After working together to resolve the error, the trading partners should document that they resolved the error through current business practices.

Requirement for Gathering of Relevant Product Tracing Information

In the event of a recall or for purposes of investigating a suspect product or illegitimate product, section 582 of the Act requires trading partners to have the systems and processes necessary to promptly respond with the transaction information and transaction statement for a product, and to promptly facilitate the gathering of information necessary to produce the transaction information for each transaction going back to the manufacturer, as applicable, upon request by a Federal or State official or authorized trading partner. The expectation of the Agency is that the enhanced system will enable visibility by appropriate requestors into product tracing information from all trading partners to better facilitate investigation of suspect or illegitimate product or to conduct a recall.

Requirement for Enhanced Verification Using Product Identifier

Beginning November 27, 2023, trading partners will be required to exchange product tracing information electronically. As part of the enhanced system, enhanced verification includes the incorporation and use of the product identifier—specifically, verifying the product at the package level, including the National Drug Code and serial number. To support enhanced verification, section 582 of the Act requires trading partners to have systems and processes for verification of product at the package level, including systems and processes that can associate saleable returned product with the appropriate transaction information and transaction statement.

If a product has been identified as illegitimate or is the subject of a recall, FDA expects that the enhanced system will be able to provide a message or alert to the supply chain. FDA envisions that there will be two types of alerts, one for illegitimate product and one for recalled product. Trading partners should include these alerts of illegitimate and recalled products in their individual systems. This will allow trading partners to identify illegitimate or recalled products when engaging in enhanced product tracing or verification.

RELATED INDUSTRY UPDATES: This is the third of three briefings from Winston & Strawn summarizing newly issued FDA guidance on the DSCSA. The first briefing on Identification of Suspect Product and Notification (June 2021) can be found here. The second briefing on Definitions of Suspect Product and Illegitimate Product for Verification Obligations Under the Drug Supply Chain Security Act (June 2021) can be found here.

******************************************************************************

For further information or questions on previous DSCSA Guidance and this Guidance on Enhanced Drug Distribution Security at the Package Level Under the Drug Supply Chain Security Act and the obligations they may create, please contact T. Reed Stephens, Amandeep S. Sidhu, Stephanie Turner, or your Winston relationship attorney.