News
October 15, 2018

FDA Issues Guidance Documents and Begins Drug Supply Chain Security Act Enforcement

Advisory

In late September, the US Food and Drug Administration (FDA) released one draft and two final guidance documents regarding the implementation of the product identifier requirements under the Drug Supply Chain Security Act (DSCSA), Title II of the Drug Quality Security Act (DQSA) of 2013. Specifically, FDA finalized its guidance documents titled, "Grandfathering Policy for Packages and Homogenous Cases of Product Without a Product Identifier" (Grandfathering Policy) and "Product Identifier Requirements Under the Drug Supply Chain Security Act—Compliance Policy Guidance for Industry" (Product Identifier Policy). In addition, FDA published draft guidance titled, "Product Identifiers Under the Drug Supply Chain Security Act—Questions and Answers" (Product Identifier Q&A Guidance), which is intended to clarify FDA's interpretation of product identifier requirements, including as they relate to the linear barcode requirements under 21 CR 201.25. Comments on the draft guidance can be submitted to FDA (Docket No. FDA-2018-D-3175) until November 19, 2018.1

Collectively, the two final guidance documents had minimal changes from their respective draft versions, but did clarify guidance for repackagers:

  1. FDA finalized in the Grandfathering Policy that a package or homogenous case of product that is not labeled with a product identifier is grandfathered "only if the product's manufacturer packaged the product before November 27, 2018, or a repackager repackaged the product before November 27, 2018." Such grandfathered products are not considered misbranded under the Federal, Food, Drug and Cosmetic Act (FDCA).
  2. The final Product Identifier Policy confirmed FDA's one-year delay of the serialization deadline (the "one-year delay in enforcement" or "grace period"), and that FDA does not intend to take action against manufacturers who do not affix or imprint a product identifier "if the package and homogeneous case of product was packaged by the manufacturer on or after November 27, 2017, but before November 27, 2018."
  3. FDA clarified that a package or homogenous case of product is considered "in the pharmaceutical supply chain" if it "was packaged by the product's manufacturer or repackaged by a repackager before November 27, 2018, is grandfathered."

In announcing the two final policies and draft guidance, FDA Commissioner Scott Gottlieb, MD emphasized the agency's "commit[ment] to using increasing tracing of drugs to protect patients at every point in the supply chain."2 While the FDA's timing to release the product identifier guidance documents aligns with the upcoming implementation deadlines, it also appears to signal that FDA is preparing for additional oversight, inspections and potential enforcement.

For example, FDA recently posted an FDA Form 483 to McKesson Corporation, a wholesale drug distributor, for an inspection of a facility in San Francisco. FDA included three observations, all related to DSCSA requirements. Specifically, FDA cited deficiencies with respect to: (1) systems to identify illegitimate product subject to a notification from a trading partner and quarantine of suspect or illegitimate product; (2) failure to make a determination regarding product subject to an illegitimate product notification from a trading partner; and (3) deficient procedures to make notifications to immediate trading partners of an illegitimate product. This inspection report comes several months after FDA issued draft guidance titled, "Standardization of Data and Documentation Practices for Product Tracing." Collectively these developments may suggest that FDA is beginning to focus more on enforcement and oversight of the DSCSA as additional provisions and requirements become effective.

Final Grandfathering, Product Identifier Policies

One of the core requirements of the DSCSA is that each package3 and homogenous case4 of product must contain a product identifier5 (Section 582 of the DSCSA) that is encoded with the product's standardized numerical identifier, lot number and expiration date by specific dates outlined in the DSCSA. The DSCSA required manufacturers to affix product identifiers by November 27, 2017, however, in response to manufacturer and trading partner concerns, FDA issued a compliance policy in July 2017 delaying these requirements for manufacturers (and related requirements for other trading partners) until November 27, 2018.

The DSCSA also directs FDA to issue final guidance specifying whether and under what circumstances product that is not labeled with a product identifier that is in the US pharmaceutical supply chain at the time of the effective date of the requirements for section 582 shall be exempt from such requirements (grandfathering). Only packages and homogenous cases of product, including saleable returned packages and sealed homogenous cases of product, which are "in the pharmaceutical supply chain at the time of the effective date" are eligible for grandfathering. FDA issued a draft grandfathering policy in November 2017.

The Final Grandfathering Policy reiterates that:

A package or homogenous case of product that is not labeled with a product identifier shall be grandfathered where there is documentation that it was packaged by a manufacturer or repackaged by a repackager before November 27, 2018. For example, if a package or homogenous case of product not labeled with a product identifier is accompanied by transaction information or a transaction history that includes a sale before November 27, 2018, that trading partner can reasonably conclude the product was packaged by a manufacturer or repackaged by a repackager before that date (emphasis added).

If the transaction information or transaction history does not include a sale before November 27, 2018, and absent other indicia that a product may be suspect or illegitimate, the transaction statement is one indication that the product was in the pharmaceutical distribution supply chain before that date. Furthermore, since manufacturers and repackagers retain packaging date information in the ordinary course of business,6 they should provide the packaging date to any trading partner who owns the product if they request it (emphasis added).

For grandfathered product, manufacturers are exempt from the package level product verification and product verification request requirements (from trading partners) of the DSCSA. However, manufacturers must still validate any applicable transaction history and transaction information in their possession and otherwise investigate the product to determine if it is illegitimate (as applicable). Wholesalers and dispensers handling such grandfathered product are also exempt from their respective product verification requirements, and are permitted to purchase or receive grandfathered product. With respect to repackagers, the Final Grandfathering Policy clarified that:

[R]epackagers may accept ownership of products without a product identifier from a manufacturer or other repackager on and after November 27, 2018, if such products are grandfathered. Repackagers may also transfer ownership of product without a product identifier to another trading partner on and after November 27, 2018, if the product was repackaged by the repackager before November 27, 2018 (emphasis added).

However, if a repackager accepts ownership of grandfathered product without a product identifier from a manufacturer or other repackager and repackages such product on or after November 27, 2018, the product must be encoded with a product identifier before the repackager transfers ownership (emphasis added).

The Final Grandfathering Policy also clarified that manufacturers are exempt from the DSCSA requirements to add product identifiers before redistributing grandfathered saleable returned packages or sealed homogenous cases of product "if the product remains in the original package or sealed homogenous case" (emphasis added). Repackagers are also not required to add the product identifier to such products if the "product remains in the original repackaged package or sealed homogenous case" (emphasis added).

FDA explained that trading partners may engage in transactions involving grandfathered product per the conditions of the final Grandfathering Policy until product expiry, regardless of when the transaction occurs. FDA otherwise reiterated that trading partners must comply with all other applicable requirements of the DSCSA (e.g., authorized trading partners, track/trace information, suspect/illegitimate provisions, etc.). Due to the statutory language of the DSCSA directing FDA to issue this guidance, the final Grandfathering Policy has legally "binding effect" (Section IV of the document), rather than by regulation.

Product Identifier Q&A Guidance

The draft Product Identifier Q&A Guidance clarifies that the DSCSA product identifier requirements "do not change the linear barcode requirements under § 201.25," and FDA explained that such requirements "were established for different purposes than the DSCSA requirements and apply to additional FDA-regulated products and packaging in some instances and are still in effect." The draft guidance provides additional detail on § 201.25 requirements, including, but not limited to:7

  • Identifier Format: FDA recommended that the human-readable product identifier appear on the drug package label in the following format, and provides additional technical guidance for each element

    NDC: [insert product's NDC]
    SERIAL: [insert product's serial number]
    LOT: [insert product's lot number]
    EXP: [insert product's expiration date]

  • GTIN: FDA clarified that manufacturers and repackagers cannot use the GSI Global Trade Identification Number in place of the NDC to comply with the requirements for a human-readable NDC as part of the product identifier. FDA did clarify that if "the NDC is on the label in its FDA-assigned three-segment format, a company may also voluntarily affix or imprint the associated GTIN on the label."
  • QR Code: FDA clarified that "a QR code cannot replace the 2D data matrix barcode on packages or the linear or 2D data matrix barcode on homogenous cases," as required under the DSCSA for product identifiers.
  • 2D Data Matrix: FDA clarified that "if space permits, the 2D data matrix barcode should be affixed or imprinted near or next to the human-readable portion of the product identifier on a package" to help downstream trading partners "associate the information encoded in the 2D data matrix barcode with the human-readable information."
  • Level/Size of Package: FDA noted that product identifiers must be affixed or imprinted "on the smallest individual saleable unit of product for distribution by a manufacturer or repackager that is intended by the manufacturer for ultimate sale to a dispenser," citing the DSCSA definition of "package."

    • To determine what constitutes a package, FDA recommended that "manufacturers and repackagers should consider how their packages of product may be opened and separated by wholesale distributors, who may sell smaller individual units of product that were inside the larger package to a dispenser for ultimate dispensing or administration to a patient. For example, although a carton of 10 individual product units may be sold to a dispenser, manufacturers and repackagers may want to apply a product identifier to each of the 10 product units that could conceivably be sold individually by a wholesale distributor to a dispenser."
  • cGMPs: FDA clarified that cGMP requirements under 21 CFR Parts 210 and 211 (e.g., packaging and labeling operations) apply to the product identifier requirements.
  • Waiver: FDA clarified that the DSCSA authorizes the agency to grant a waiver, exception or exemption for products and transactions from the product identifier requirements in section 582. FDA issued draft guidance on the process for submitting a waiver, exception or exemption request.
  • Product Identifiers and Rx Drugs Without FDA Approval: FDA clarified that the DSCSA product identifier requirements apply to prescription drugs marketed without FDA approval, and manufacturers of such products are required to submit the product identifier as part of the product's labeling during FDA registration and listing (under 21 CFR Part 207).
  • FDA Labeling Considerations Under the DSCSA: FDA clarified that under section 582(a)(8) of the FDCA, a change made to the drug package label solely to incorporate the product identifier may be submitted in an applicant's annual report in accordance with 21 CFR § 314.70(d).

Manufacturers and others involved in the drug supply chain should carefully review these guidance documents and ensure that their organizations are prepared to address the new era of FDA inspectional scrutiny of compliance with DSCSA requirements.

© Arnold & Porter Kaye Scholer LLP 2018 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.

  1. 83 Fed. Reg. 47626 (Sep. 20, 2018).

  2. FDA In Brief: FDA advances policies related to bolstering security of drug products in the U.S. supply chain.

  3. Defined as the "smallest individual saleable unit of product for distribution by a manufacturer or repackager that is intended by the manufacturer for ultimate sale to the dispenser of such product. For purposes of this paragraph, an 'individual saleable unit' is the smallest container of product introduced into commerce by the manufacturer or repackager that is intended by the manufacturer or repackager for individual sale to a dispenser." See 21 USC § 360eee(11).

  4. The DSCSA defines "homogeneous case" to mean "a sealed case containing only product that has a single National Drug Code number belonging to a single lot." See 21 USC § 360eee(7).

  5. Defined as a "standardized graphic that includes, in both human-readable form and on a machine-readable data carrier that conforms to the standards developed by a widely recognized international standards development organization, the standardized numerical identifier, lot number, and expiration date of the product." See 21 USC § 360eee(14).

  6. For example, FDA clarified that "batch production and control records are required under regulations for current good manufacturing practices for finished pharmaceuticals (21 CFR 211.188(b)(1))."

  7. See Questions 16-19 and Section E.

Email Disclaimer