The California Board of Pharmacy today announced its decision to extend the deadline for implementation of e-pedigree laws to 2011.The probability that California will actually implement item level pedigree January 2011 is very low.
Archive for March, 2008
Pharmacy Board to Weigh Delays on Drug Tracking
Pharmacy Board to Weigh Delays on Drug Tracking
HEATHER CHAMBERS
The California State Board of Pharmacy will meet in San Diego for a second time this year to weigh arguments for delaying implementation of a statewide drug tracking system scheduled to take effect Jan. 1.
Drug companies big and small have lobbied for additional time on the requirement, which would put in place an electronic system, known as an “e-pedigree,” to track prescription drugs along the supply chain.
The pharmacy board has the authority to delay requirements for two years, as it did once before, though board members have made clear their desires to keep the deadline intact.
Virginia Herold, executive officer of the board, said members are weighing possible impacts on the industry.
“We’ve received a lot of inquiries, a lot of statements from the industry that the industry may not be ready by 2009 but may be ready by 2011,” she said.
Fake drugs, including those that have been diluted or altered, have become a growing concern in the industry. According to the state pharmacy board, 3.4 billion prescriptions were dispensed in the United States in 2006. If only 1 percent of those drugs were counterfeit, 34 million prescriptions would be affected.
From 2000 to 2004, the FDA reported a tenfold increase in the number of cases investigated involving counterfeit drugs.
Congress passed a law in 2007 that required the FDA to develop standards for a national tracking system by 2010. But federal standards have been put on hold, which means California could lead the way for electronic drug tracking as early as Jan. 1.
Supporters Admit
Even supporters admit that wholesalers and pharmacies might not be able to put electronic tracking in place by 2009. Two bills introduced in late February aim to modify current legislation. SB 1270, introduced by Sen. Gilbert Cedillo, D-Los Angeles, pushed to impose tracking requirements by an unspecified date. A proposal by Sen. Mark Ridley-Thomas, D-Los Angeles, SB 1307, would require a “unique identification number” on bottles of drugs.
Bill Hubbard, a former FDA associate commissioner said he thinks the pharmacy board should require pedigrees beginning Jan. 1 but allow more time for electronic track-and-trace systems.
“We think that, over time, this is going to be a widespread technology because it’s really the next generation of the grocery store scanner that we’re used to,” he said. “But that may be another 10 or 15 years away.”
Doug Farry, managing director in the San Diego office of McKenna Long & Aldridge LLP, pointed to challenges involved in the regulation of an e-pedigree system. If federal regulations were to take effect before California’s system went into effect, he said the FDA could face difficulties in enforcing the rules.
“The FDA was really built to regulate the safety and efficacy of drugs — that they’re not killing you and they’re working as advertised,” Farry said. “Enforcement mechanisms for retailers and others who manufacture these drugs are more unique challenges to their scope of authority.”
Protection against counterfeit drugs too important to rush
Protection against counterfeit drugs too important to rush
While a tracking system is a good idea, the devil is in the details. Those participating in the supply chain — from pharmaceutical companies to community clinics to mom-and-pop drugstores — are greatly concerned about implementing a law that won’t work because of the unanswered questions of what an e-pedigree would entail — including what standard is right for the entire chain, what technology to use, what frequencies are mandated, how pill containers versus injectables would be treated, how to weather the costs of pedigree readers and writers, and, critically, who would be the owner, guardian and steward of the information. The law says the e-pedigree needs to be interoperable, but no federal or state standards exist. Additionally, there is no technology in place that is interoperable and compatible throughout all stages of distribution.
This raises another concern: California is the only state to require e-pedigree down to the unit level. Yet as more and more states start passing their own, different statutes, the potential for chaos in trying to fulfill all these different rules may become increasingly costly. These costs, as well as the direct costs associated with pharmacy implementation of just the California law, estimated by Rite-Aid to be $80,000 per pharmacy, will fall upon consumers.
Because of these issues, the Board of Pharmacy should extend the deadline for two years.
But in addition, during this time, the legislature should see the e-pedigree law as the beginning of drug safety efforts in the state, not the end. The key problem unaddressed by this law is the Internet. To protect against harmful drugs from this growing source, we need to ban Internet sales of drugs unless these facilities are licensed to practice in California and are subject to rigorous oversight standards. This can be done through the Verified Internet Pharmacy Practice Sites accreditation program of the National Association of Boards of Pharmacy. This safety effort can also be effectively promoted by prohibiting credit card companies from executing any transactions associated with online sales of drugs unless the site is approved by the VIPPS program.
The bottom line is that we all want our drugs to be safe. We need an e-pedigree law implemented that works, and we need legislation to address problems with the Internet. By extending the deadline for the e-pedigree law so the practical concerns can be addressed while simultaneously dealing with the problem of online drug sales, we in California can lead in the effort to ensure safety in the drug supply chain — a leadership role we should aspire to.
After 19 deaths, California pharmacy board urged to delay e-pedigree
Pharmacists debate the efficacy and impact of California’s forthcoming e-pedigree rule.
The California Board of Pharmacy continues to press forward with the January 2009 deadline for implementing its e-pedigree requirements even as it listens to a growing chorus of calls to the board for a delay. The National Community Pharmacists Association, Pharmaceutical Research and Manufacturers of America, Generic Pharmaceutical Association, McKesson, Pfizer, Teva, and many other drug companies submitted letters formally requesting a two-year delay in implementation. The California law is designed to combat counterfeiting by creating an easily traceable electronic record of the entire life cycle of a product from manufacture to dispensing or destruction. Under the law, after January 1, 2009, no wholesaler or pharmacy may sell, trade, or transfer a prescription drug at wholesale without providing an electronic pedigree. Furthermore, no wholesaler or pharmacy may acquire a prescription drug without a pedigree. The law also allows the board discretion to delay implementation an additional two years until 2011.
Other states, like Utah and Florida, have instituted more limited pedigree requirements, but the California law is the most far reaching. The Food & Drug Administration has advocated for a national approach, but the federal pedigree regulation in the Prescription Drug Marketing Act (PDMA) has been challenged in an ongoing court battle between the secondary wholesaler RxUSA and the FDA. The judge in the case has granted a preliminary injunction while the case proceeds.
National pharmacy chains are hoping that the California rules will serve as the template for other state pharmacy boards. “There has to be a uniform standard established,” stressed Philip Burgess, R.Ph., national director of pharmacy affairs at Walgreen Co. “If California is able to come up with a standard that can be adopted by the manufacturers, the wholesalers, and the retailers, then it does have a unique opportunity to set the standard for the rest of the country.”
Despite the long lead time for the rule, many companies are telling the board that they will not be ready in time. Technological hurdles with RFID (radio frequency identification) technology have slowed implementation, although new generations of RFID tags and supply-chain software have made great strides. Just as significantly, e-pedigree requires both changes in workflow and significant investment throughout the supply chain. “I don’t believe that a thorough financial analysis has been done on the implementation of electronic pedigree,” maintains David Fong, Pharm.D., senior VP of pharmacy & family care at California-based Safeway. “Who’s picking up that cost?”
“It shouldn’t be a question of whether Safeway is ready as much as whether the supply chain is ready, because we can do our part,” added Fong. “We don’t believe that on January 1, 2009, the supply chain will be ready to comply with the rule.”
In testimony before the board last month Steve Perlowski, National Association of Chain Drug Stores’ VP of industry relations, requested that the board allow pharmacies to continue two practices that would otherwise be banned by the new regulations. Perlowski urged the board to extend the deadline for inferencing until 2013 and to allow existing inventory up to two years beyond the compliance date to sell through the supply chain. With the practice of inferencing, when a shipment is received from a reputable manufacturer with no history of problems, pharmacies check the number of packages against the receiving documents and infer that if there is no sign of tampering that the shipment is safe and accurate. According to Lynn Rolston, CEO of the California Pharmacists Association, the board doesn’t have statutory authority to give pharmacies extra leeway, but the organization is hoping to sponsor legislation to handle the problem.
Others pharmacists worry about the broader impact e-pedigrees will have on the industry. “The deeper issue is the cost on pricing policy in general,” explained Stephen Schondelmeyer, Pharm.D., Ph.D. director, PRIME Institute, College of Pharmacy, University of Minnesota. “E-pedigree puts the manufacturers in control of their product from the time it leaves their plant till it gets to the patient. So they can enforce price maintenance all the way through the system, but that’s never talked about when we talk about e-pedigree. We need to honestly evaluate economic policy for pharmaceuticals. We have many policies on the books that were there for other reasons that dramatically affect our cost structure, and that’s why we pay 50% to 60% more than most other countries for the same drug.”
19 dead – We need more time to stop it ?
LA Times -
Delays thwart drug tracking system
The pharmaceutical industry says its needs more time to gear up for a novel state plan to fight counterfeiting.
March 25, 2008
News of as many as 19 deaths in the United States linked to contaminated blood thinner heparin from China has generated new concerns about how to keep bad drugs from finding their way into the marketplace.
But if California’s 5-year-old effort to fight counterfeit drugs is a guide, the task may be tougher than it looks.
The pharmaceutical industry has repeatedly balked at implementation of the state’s first-in-the-nation law approved in 2004 that would require manufacturers and retail pharmacies to create an electronic system to record a drug’s journey from factory to patient.
The system was to be in place by Jan. 1, 2007, but the California Legislature in 2006 extended the deadline until next January. Today, the state Board of Pharmacy will consider another extension — this time until 2011.
Big pharmaceutical companies, drug wholesalers and retail pharmacy chains say they can’t meet California’s Jan. 1 deadline and are asking for more time. Various industry associations have begun a quiet, coordinated campaign to promote the extension, hiring lobbyists and both Republican and Democratic-oriented firms that specialize in political strategy and media.
But state regulators say they’re worried that further delays could endanger public health. “In 2011, they’ll want 2013. In 2013, they’ll want 2015,” said state board member Stan Goldenberg, a Los Angeles pharmacist. “They’ll keep the ball in the air until something bad happens.” He said, “They’re playing Russian roulette with the consumers of California.”
The board, Goldenberg said, wants to be proactive.
“We are desperately seeking cooperation from the pharmaceutical industry,” he said. “But we are not getting their cooperation” except for certain smaller manufacturers.
Stronger regulation is overdue, said Virginia Herold, executive officer of the pharmacy board. “We’ve learned that we cannot trust the supply train, and there are bad players.”
The U.S. Food and Drug Administration has also had no luck implementing a national system to fight counterfeit drugs.
FDA spokesman Christopher Kelly acknowledged that the agency has run into a number of legal and administrative delays in instituting its own rules over the last 20 years. The FDA, he said, “supports California’s efforts to further secure the drug supply chain.”
The World Health Organization estimates that counterfeit drugs account for less than 1% of the nation’s drug supply, but even that small number could mean that Californians are picking up 3 million prescriptions a year filled with phony pills and liquids, state regulators warn.
At the heart of the 2004 California law is the “electronic pedigree” system that would trace drugs back to production. When the Legislature postponed the start of the program in 2006, it also toughened it by mandating that the industry install electronic readers to track serial numbers on each salable unit of a drug at key points along the distribution system.
The Legislature first acted after an estimated 200,000 bottles of fake Lipitor, one of the nation’s most widely used medications for controlling cholesterol, were recalled in 2003, causing a national outcry.
Drug companies say that they’ve been working diligently to meet California’s tracking deadline but contend that they need more time to overcome technical and financial challenges.
“If the law were implemented next year, McKesson would not be able to deliver vital medications throughout the state,” said a letter to the board from McKesson Corp., the San Francisco drug company that is one of three main national drug wholesalers and distributors.
“The health and safety of Californians would be best served if the e-pedigree implementation date is delayed until 2011,” the company said in a letter to the board.
The industry wants the pharmacy board to approve the two-year delay today. As a backup, pharmaceutical companies are sponsoring a bill that, if passed, would indefinitely put off the date for starting to electronically track medicines.
Some drug makers say they aren’t sure they can meet a deadline, even if it’s extended to 2011.
“It’s going to be hard to know right now. We need time to do research and development,” said Kathleen Jaeger, president and chief executive of the Generic Pharmaceutical Assn. “The industry may need additional time.”
Even if they approve the two-year delay, state regulators say they hope to persuade all participants in the drug supply system, including manufacturers, distributors and retailers, to begin voluntarily complying with as much of the electronic tracking law as feasible: by putting bar codes or radio frequency identity chips on products and installing scanners throughout the manufacturing, distribution and sales system.
Under current law, the pharmacy board would be empowered to make such actions mandatory after Jan. 1, 2011.
Acting quickly is essential, said Rick Roberts, who discovered in 2000 that he’d been taking a counterfeit human growth hormone to counteract AIDS-related atrophy.
“It was a nightmare. Not knowing whether I did damage to myself really consumed me,” said the University of San Francisco professor, who has since recovered. Drug counterfeiting, he said, is a “heinous crime.”
RFID Fails the counterfeit test
When the California Board of Pharmacy decided to endorse RFID as a mechanism for ePedigree of drugs, they were willingly led down the path of false sense of performance. While serialization is an excellent approach for anti-counterfeit measure, below is an example of how RFID does not perform as a security mechanism.
Hackers Find a Way to Crack Popular Smartcard in Minutes
Security on RFID-enabled smartcards is easily broken by young hackers.
People are starting to wake up to the fact that RFID-enabled smartcards now can be far more easily, and cheaply, cracked than ever before, as a trio of young computer experts recently showed.
These are a particular type of processor-embedded cards, and are different from credit cards. The actual decryption work by the researchers was done on the widely deployed Mifare Classic wireless smartcard, now manufactured by a Philips spinoff, NXP Semiconductors. Decrypted, the cards can be counterfeited, and users’ personal and bank data is exposed.That card is the basis of such new systems as the Dutch OV-Chipkaart, being rolled out in The Netherlands as part of a multi-billion dollar nationwide transportation ticketing system, and the so-called CharlieCard, used in the Boston subway system. The decryption breach triggered a firestorm of controversy, and Dutch authorities apparently have halted the rollout and are investigating the vulnerabilities.The card can be used in debit/credit transactions with the user’s bank account. This personal and important data is encrypted on the Mifare Classic with a proprietary encryption scheme.The newest attack was demonstrated at the 24th Congress of the Chaos Computer Club in Berlin last December. Interest in the study has been spreading steadily from the arcane world of security hackers. One of the researchers is Karsten Nohl, a graduate student in the University of Virginia’s Computer Science Department, in Charlottesville, the other two are Henryk Plotz and “Starbug.” The trio apparently demonstrated a practical and effective way to break the Mifare encryption key, confirming what many cryptographers had suspected.
The team used an inexpensive RFID reader to collect encrypted data, and then reverse-engineered the chip to figure out the encryption key to decipher that data. They examined the chip under an optical microscope and used micro-polishing sandpaper to remove a few microns of the surface at time, photographing each of the five layers of circuitry. Nohl wrote his own optical recognition software to refine and clarify the images, and then patiently worked through the arrangement of the logic gates to deduce the encryption algorithm, a task made possible by the fact that the Mifare Classic relies on a secret key of no more than 48 bits.
“Regardless of the cryptographic strength of the cipher, the small key space therefore permits counterfeiting of any card that is read wirelessly,” the team wrote in a follow-up statement issued on Jan. 8. “Knowing the details of the cipher would permit anyone to try all possible keys in a matter of days,” the researchers noted. “Given basic knowledge of cryptographic trade-offs and sufficient storage, the secret keys of cards can be found in a matter of minutes.”
The Dutch transit system actually uses two other types of tickets or cards, and both have been successfully attacked by other researchers.
Nohl and his colleagues noted that other types of Phillips RFID tags, such as the Hitag2+ and Mifare DESfire, are not affected by their findings.
RFID security concerns have become pronounced over the past year or so, as hackers and researchers make more concerted efforts to understand the vulnerabilities. In mid-2007, one team used readily available RFID gear to read the Electronic Product Code data on tagged boxes loaded on a tractor-trailer. A year earlier, another group raised the specter that RFID tags could be infected with computer viruses.
