Drug Diversion and Counterfeiting: Emerging Role of RFID
 
September 28, 2004
 
George Wheeler - Washington

“The realities of the wholesale marketplace have combined to create a system in which a large amount of attractively priced pharmaceuticals are constantly available, some of which are not safe or effective. The physical movement, conditions of storage, and, in some cases, even the origins of much of this merchandise is unknown to the first, second, or third level buyer, who in effect plays a form of Russian roulette. This situation cannot be allowed to continue.”

So wrote House Energy and Commerce Committee Chairman, John Dingell, in a 1986 subcommittee report[1] that led to passage of the Prescription Drug Marketing Act. Remarkably, mechanisms established by Congress to address the problem are now being undermined – in some instances they were never fully implemented – and the situation recently has grown worse. In October 2003, the Washington Post ran a week-long series (“Pharmaceutical Roulette – A Vast, Unregulated Shadow Market”), with headlines alleging that the U.S. prescription drug system is “Under Attack.”[2]

The gravity of the situation is particularly striking in that grassroots law enforcement authorities are increasingly concerned. Last year, for example, a statewide Florida Grand Jury examined the safety of prescription drugs in that state and reported “shocking and disturbing” evidence of counterfeiting and diversion, concluding that the “potential profits available to corrupt wholesalers rival those found in narcotics trafficking.”[3] That Grand Jury also found:

• Drug diversion: An alarming percentage of drugs in the wholesale market have been illegally acquired, “stolen from shipments, pharmacies, clinics, and hospitals; purchased on the black market from recipients and healthcare professionals who are defrauding insurance companies or Medicaid with bogus prescriptions; or illegally imported from overseas.”[4]
   
• Relabeling scams: Counterfeiters relabel drugs “to hide the fact that they have expired, been previously dispensed, or illegally imported; to falsely overstate their strength (sometimes by as much as 2,000%); or to pass off some other substance as a genuine pharmaceutical.”[5]
   
• Fake-drug horror stories: “One case concerned a father in Michigan who repeatedly injected his son with what he thought was a growth hormone [but was later learned to be insulin]. He did not buy that medication out of a car trunk or a back alley. Those drugs were traced to a legitimate pharmacy in Orlando, Florida, but it is obvious that this mislabeled, adulterated product was brought into the stream of commerce by some counterfeiter. Had the wholesaler bothered to check the pedigree by verifying the transactions, it would have discovered that the drugs could not be traced to the manufacturer.”[6]

As if these domestic counterfeit and diversion concerns were not enough, the stakes have been raised even higher by a back-door erosion of the Food and Drug Administration’s (FDA) “gold standard” that was not anticipated in the 1980s – virtually uncontrolled Internet sales that are being exploited by common crooks, organized crime and even terrorists[7] in search of ready sources of cash.

What brought us to this pass, and what are FDA and Congress intending to do to protect American patients and consumers? The answers are not entirely reassuring, but one certainty is that electronic “track and trace” technology will begin to play a central role.

Holes in the PDMA Safety Net

In response to Congressman Dingell’s oversight hearings, Congress passed the Prescription Drug Marketing Act (PDMA),[8] which was enacted in 1988, with final implementing regulations issued in 1999.[9] Two PDMA provisions in particular were intended to address the problem of drug diversion and counterfeit.

(1) Pedigree requirements: Unauthorized distributors (those other than the manufacturer and authorized distributors of record) are required to provide purchasers with a “statement … identifying each prior sale, purchase, or trade of such drug … .”[10]

(2) Limits on reimportation: Congress restricted the reimportation of prescription drugs to the only party believed capable of confirming the safety and authenticity of particular shipments – the original manufacturer.[11]

The limits on importation are under continuing scrutiny. Title XI of the Medicare Modernization Act[12] established a new FDCA § 804, which provides for the importation of drugs from Canada by pharmacists and wholesalers under certain conditions, but only if the Secretary of the Department of Health and Human Services (DHHS) first certifies to Congress that this can be done without posing any additional risk to the public’s health and safety, and moreover will result in significant cost savings. Congress currently is considering even broader proposals to open up the borders to drug importation. It remains to be seen whether Congress and the Administration will sanction any of this, given the apparent and unresolved consumer risks. The legislative history of the PDMA documented the need for such limits, citing the threat of foreign counterfeits and the inability of U.S. law to control the proper storage and handling of legitimate pharmaceuticals outside this country[13] – all problems that have not diminished in the intervening years.

Unlike importation limitations, the pedigree requirements have never become fully effective. Despite the fact that a verifiable accounting trail back to the manufacturer provides the only practical means of ensuring authenticity, FDA has declined to specify the form and content of the pedigree requirements. On successive occasions, the agency has delayed the effectiveness of this part of the 1999 final PDMA regulations, most recently in February 2004 (re-setting the effective date to December 1, 2006).[14] Recently, however, FDA announced criminal misdemeanor guilty pleas for wholesalers who had failed to satisfy the statutory pedigree requirements, regardless of the absence of implementing regulations.[15] This successful strict-liability prosecution appears to signal FDA’s intent to police the drug distribution system even as the public policy debates continue over wholesaler practices and importation.

FDA appears to have hesitated in issuing final regulations over the record-keeping burdens that would be occasioned by a meaningful pedigree requirement, particularly with regard to the secondary wholesaler community. Nevertheless, the drug distribution system is increasingly relying on paper pedigrees – both out of recognition of the pedigree’s role as a secure business practice and in response to the requirements of a growing number of state Boards of Pharmacy. Reflecting what was learned in the course of a statewide Grand Jury investigation, for example, new regulations under Florida’s Prescription Drug Protection Act now require pedigree papers for all products on a list of 31 specified drugs, and ultimately all wholesale distributions, by July 1, 2006.[16] Nevada is in the process of strengthening its already considerable pedigree paper regulations. It has recently implemented legislation establishing requirements for wholesaler transactions that are aimed at allowing at most one “lateral” sale among wholesalers before final sale to a pharmacy or practitioner.[17]

While FDA continues to equivocate about paper pedigrees, the counterfeit challenge remains. The FDA Commissioner in July 2003, Mark McClellan, cited the insidious and growing problem of counterfeits and formed a task force charged with finding ways to respond to this emerging threat. In announcing the task force report issued in February 2004, DHHS Secretary Tommy Thompson stated, “The dangers of counterfeit drugs are real and we must protect consumers from this fraud.”[18] While declaring that there is no single “magic bullet” to resolve counterfeit concerns, the task force report emphasized the importance of new technologies and secure practices to better protect the drug supply. In particular, the report singled out the promises of electronic pedigree. Indeed, the key to FDA’s recommended path forward is the anticipated introduction of electronic “track and trace” tagging by means of Radio Frequency Identification (RFID) by 2007.

It is the advent of RFID technology that formed the basis for FDA’s decision – announced just days after release of the Task Force report – to again delay implementing the PDMA’s pedigree requirement. FDA’s stated rationale is that an electronic pedigree “should accomplish and surpass the goals of PDMA and is potentially a more effective solution to tracing the movement of pharmaceuticals than a paper pedigree.”[19] In the meantime, until RFID is in widespread use, FDA “encourages wholesalers to provide pedigree information that documents the prior history of the product, particularly for those drugs most likely to be counterfeited, even when such a pedigree is not required by the act.”[20] What is behind FDA’s bet on RFID technology, and what will it mean for consumers?

Envisioned Role for RFID in Securing the Nation’s Drug Supply

In the task force report, FDA underscored the interest among security experts, federal and state law enforcement officials, technology developers, manufacturers and other stakeholders in implementing a combination of rapidly improving “tracking and tracing” and other authentication technologies to enhance security for drug products. FDA also cited recent developments in electronic technology, concluding it is “rapidly approaching the state at which it can reliably and affordably provide” much needed assurances about the product safety and continued potency. The agency concluded that RFID tagging appeared to be “the most promising approach to reliable product tracking and tracing.”[21]

RFID tagging is accomplished by attaching RFID tags, which are small electronic identification chips, to all (or selected) drug products and packaging levels. Such chips, which can be passive or independently powered with a battery, would transmit data to “readers” via wireless data communications. This tag-reader capability enables all of these items to identify themselves wherever readers are located in the supply chain. This identification information is then gathered, analyzed and stored in a database (centralized or otherwise), so that the “pedigree” can be confirmed from point-of-origin to destination. A virtually limitless variety of information can be stored and transmitted – and encrypted if desired – depending on the application need and the complexity and cost of the chip.

FDA’s findings come on the heels of the widespread use of RFID tags in other industries (e.g., the twelve-state EZPass electronic toll collection system; tagging of shipping containers and railroad box cars; and retail uses for inventory management and antitheft control).

New stakeholder needs also are driving RFID technology development. For example, the U.S. Department of Defense and major retailers (e.g., Target, Wal-Mart, Albertson’s) have initiated the use of RFID tag-reader systems to streamline receiving, put-away, pickup, inventory, shipping, manifesting, transportation, ordering and returns, and to prevent theft and manage recalls, among many other uses. These recent initiatives have boosted research and development to expand the capabilities of current RFID devices and to lower their cost.

An industry-wide pharmaceutical Product Safety Task Force (PSTF) currently is considering how RFID technologies, in combination with other technology-based approaches, could be used to reduce counterfeiting and realize the potential envisioned by FDA. The PSTF anticipates that RFID technologies ultimately can be adapted on a cost-effective basis to provide “mass serialization” of all products and all packaging levels. This means that all products and all packaging levels can be uniquely identified, and then tracked, traced and linked throughout their lifecycle to confirm the integrity of the supply chain. For a variety of reasons, however, it may be most practical to apply RFID technology first to the so-called “pallet and case” level before moving on to individual bottles or even prescription - or pill-level serialization. Pilot projects currently under way are putting RFID technology to the test, amid suggestions that electronic tagging might first be used on medicines most prone to counterfeiting (which again brings to mind the “specified list” approach initiated by Florida and endorsed by the National Association of Boards of Pharmacy). In the meantime, the use of other technologies (e.g., barcoding[22]) is not inconsistent with the introduction, and even parallel use, of RFID.

Before any real-world utilization of RFID capabilities can occur, however, there is an array of unresolved issues involving technology choice, RFID system capabilities, data sharing and privacy concerns that the PSTF and other industry stakeholders must consider and resolve.

• Technology choice: What will be the wireless spectrum, bandwidth capacity, range of operations, and interference protection thresholds that best meet the anticipated scope of uses, data capacity, reliability and error rates for RFID systems?
   
• RFID system capabilities: Will companies have individual RFID systems or will they rely solely on a shared interoperable user network? Will companies use multiple versions of RFID tags (or multimode tags) for product and/or store packaging levels? In addition, beyond simple product identification and authentication, can the technology be used to identify and protect against product diversion and smuggling?
   
• Data sharing: What restrictions will be imposed on the sharing of data among the various supply chain participants? How will intellectual property interests in product data recorded on RFID tags be protected? Will such data be available to, and used by, Customs and Border Protection, and the Department of Homeland Security?
   
• Privacy concerns: How will the industry address consumer privacy and HIPAA privacy issues, which quickly become more problematic depending on whether RFID tags are used on containers provided to consumers?

The foregoing list is not intended to be comprehensive. Much will need to be accomplished before widespread uses of RFID tags are implemented to meet FDA’s anticounterfeiting goals. Some analysts have estimated that initial “pallet and case” level deployment could occur within FDA’s 2007 timeframe and that broader utilization might occur within five years. There are also complex issues that would have to be addressed if RFID ever were to be relied upon to provide authentication for medicines which are foreign-sourced or travel outside of the relatively closed domestic drug distribution system.

Conclusion

The pharmaceutical industry faces unique challenges involving the protection of patient safety and growing risks from counterfeit and diversion. RFID technology happens to be maturing at a time when FDA, the states and industry stakeholders are searching for a way to establish a robust track and trace capability. For this reason, the industry is expected to be among the early adopters of advanced RFID systems. Industry leaders will need to become increasingly involved in planning how the technology will be deployed, not only to take advantage of the efficiencies and productivity gains in supply chain management, but also to help ensure that the industry’s anticounterfeiting and pedigree needs – as well as FDA expectations – are met.

A version of this article was previously published in the July/August 2004 Issue 4 of Update (Food and Drug Law Institute, www.fdli.org)]

For more information, e-mail Matthew B. Van Hook or George Y. Wheeler, III at matthew.vanhook@hklaw.com or george.wheeler@hklaw.com, respectively, or call toll free, 1-888-688-8500.

___________________

1. House Subcomm. On Oversight And Investigations, Comm. On Energy And Commerce, 99th Cong., Dangerous Medicine: The Risk To American Consumers From Prescription Drug Diversion And Counterfeiting 20 (Comm. Print 99-Z 1986) (Hon. John D. Dingell, Chairman).

2. Gilbert M. Gaul and Mary Pat Flaherty, Pharmaceutical Roulette – A Vast, Unregulated Shadow Market: U.S. Prescription Drug System Under Attack, Wash. Post, Oct. 19, 2003, at A1 (first of a five-article series).

3. First Interim Report of the Seventeenth Statewide Grand Jury, Supreme Court of the State of Florida, Case No: SC 02-2645, at 4 (Feb. 2003), available at http://myfloridalegal.com/swp (Florida Att’y Gen.’s Office of Statewide Prosecution) (last visited May 21, 2004).

4. Id. at 2.

5. Id. at 3.

6. Id. at 22.

7. GlobalOptions Inc., An Analysis of Terrorist Threats to America’s Medicine Supply (2003) (a report in which three main terrorist threats to the medicine supply are identified: producing and selling drugs; raising funds from drug sales for attacks; and launching an attack using drugs).

8. Prescription Drug Marketing Act (PDMA), Pub. L. No. 100-293, __102__ Stat. __95__ was enacted Apr. 22, 1988, and subsequently modified by the Prescription Drug Amendments of 1992, Pub. L. No. 102-353, __106__ Stat. __941__ (Aug. 26, 1992). The PDMA modified several provisions of the Federal Food, Drug, and Cosmetic Act (FDCA), including 21 U.S.C. §§ 331, 333, 353, and 381 (FDCA §§ 301, 303, 503, and 801, respectively)).

9. The final rule implementing the policies, requirements and administrative procedures of the PDMA was published at 64 Fed. Reg. 67,720 (Dec. 3, 1999).

10. PDMA § 6 (21 U.S.C. § 353(e)(1)(A) (FDCA § 503(e)(1)(A)).

11. PDMA § 3 (21 U.S.C. § 381(d)(1) (FDCA § 801(d)(1)).

12. Medicare Prescription Drug, Improvement, and Modernization Act, Pub. L. No. 108-173, 117 Stat. 2066 (2003).

13. ^{H.R. Rep. No.} 100-76, accompanying H.R. 1207, the Prescription Drug Marketing Act of 1987, 100th Cong., 1st Sess. 11 (section-by-section analysis and committee views; Sec. 3 – Reimportation).

14. FDA announced a further delay – to Dec. 1, 2006 – of the effective date of the pedigree regulations contained in the final PDMA rules. 21 C.F.R. §§ 203.3(u), 203.50; 69 Fed. Reg. 8105 (Feb. 23, 2004) (correction 69 Fed. Reg. 12,792 (Mar. 18, 2004)).

15. See FDA News Release of August 27, 2004, “FDA Gets Significant Guilty Please, re U.S. v. RxBazaar Inc., U.S. District Court, Southern District of Ohio, Criminal No. 1:04CR00107, Judgment and Plea Agreement of August 27, 2004.

16. The Prescription Drug Protection Act, SB 2912, was signed into law June 19, 2003. The Web site of the Florida Bureau of Statewide Pharmaceutical Services includes links to the state’s new Pedigree Paper Requirements (including the list of 31 specified drugs for which pedigree papers are required), and pertinent Florida statutes (Fla. Stat. tit. XXXIII, ch. 499, § 499.0121 – Storage and Handling of Prescription Drugs; Recordkeeping), available at http://www.doh.state.fl.us/pharmacy/drugs/ (last visited May 21, 2004).

17. Nevada Revised Statutes, §639.2615 (2003), “Transactions Involving Wholesalers,” establishing requirements and definitions for “bona fide” sales and purchases by wholesalers.

18. Combating Counterfeit Drugs: A Report of the Food and Drug Administration (Feb. 18, 2004), available at http://www.fda.gov/oc/initiatives/counterfeit/report02_04.html (last visited May 21, 2004).

19. 69 Fed. Reg. at 8107 (correction 69 Fed. Reg. at 12,794).

20. Id.

21. Combating Counterfeit Drugs, supra note 10, at 3 (Exec. Summary (1)(a)).

22. On Feb. 25, 2004, FDA announced its final rule requiring bar codes on drugs and biological products, aimed at reducing medication errors. See 69 Fed. Reg. 9120 (Feb. 26, 2004). See generally FDA barcode Web site at http://www.fda.gov/oc/initiatives/barcode-sadr/ (last visited May 21, 2004).