This jargon buster explains some of the terms commonly associated with FMD and its operation. Short explanations are given for items in bold text.
Section 1: FMD legislation and organisations
FMD: Falsified Medicines Directive (FMD). FMD is often used as shorthand for the scanning and verification of medicines (see Section 2), but can also refer legally to the European Directive on Falsified Medicinal Products [2011/62/EU] which amended the European Directive on Medicinal Products for Human Use [2001/83/EC]. The legal requirements for FMD have been transposed in to UK law through the Human Medicines Regulations 2012 (as amended).
Delegated Regulation: Directive 2011/62/EU set out an overall requirement for prescription medicines to bear safety features and for these to be authenticated through the use of a repositories system. The technical details for these requirements are set out in Delegated Regulation 2016/161. The Regulation is binding on all Member States from 9th February 2019, three years after it was published in the Official Journal of the European Union. References to “Articles” in this jargon buster are to Article numbers in the Delegated Regulation (DR).
EMVO: European Medicines Verification Organisation. The EMVO is the governing body responsible for setting up and running the European Medicines Verification System (EMVS). The EMVO was established under the “European Stakeholder Model” by the five European trade bodies representing research-led manufacturers (EFPIA), generic manufacturers (Medicines for Europe), parallel distributors (EAEPC), wholesalers (GIRP) and pharmacies (PGEU). The EMVO is responsible for the “User Requirement Specifications” (URS) that National Medicines Verification Systems will have to meet. It has also established the Blueprint model for setting up National Medicines Verification Organisations and for appointing Blueprint Service Providers to run each NMVS.
EMVS/European Hub: European Medicines Verification System or “European Hub”. The EMVS lies at the heart of the repositories system (see diagram). It provides a system through which manufacturers and parallel distributors can upload active unique identifiers, which are then shared with relevant national systems. The EMVS also synchronises data, so that once a pack of medicine is decommissioned in one EU Member State, all other national verification systems can be made aware of this. The EMVS holds “master data” about products (i.e. the name, strength, pack size, etc.) but does not keep records of unique identifiers once this data has been transmitted to the relevant national systems. The EMVS is a cloud-based system operated by Solidsoft Reply, one of the three Blueprint Service Providers, on behalf of EMVO.
NMVO: National Medicines Verification Organisation. Each Member State is required to have an NMVO to establish and run an NMVS in its country (although multi-country regional NMVOs are possible). These are generally incorporated under the Blueprint model by representatives of national organisations representing research-led manufacturers, generic manufacturers, parallel distributors, wholesalers and pharmacies, although the exact nature of the governing boards and the number of directors can vary from country to country. The key task of the NMVO is to appoint a Blueprint Service Provider to operate the NMVS.
NMVS: National Medicines Verification System. The NMVS holds details of the unique identifiers for all medicinal products subject to FMD and which are intended for sale in that Member State (including multi-market packs licensed for sale in more than one country). Wholesalers and persons authorised to supply medicines to the public (including community pharmacies) will connect the NMVS in their country and will use this to authenticate medicine packs in their possession by scanning packs’ unique identifiers and comparing this with data held on the NMVS.
Blueprint model: A generic model for establishing National Medicines Verification Organisations in each Member State, providing draft memorandums of understanding and other documentation, aimed at speeding up the process and achieving equality of status for all of the main sectors in the medicines supply chain, including wholesalers and pharmacies.
Blueprint Service Provider: Under the Blueprint model, three large IT providers pre-qualified to compete for the right to establish NMVS in each Member State. The aim is to bring a degree of harmonisation between NMVSs while introducing some competition in order to keep costs down and ensure that future tenders will also attract competitive bids. The three companies were selected: Aegate, Arvato and Solidsoft Reply. Each has experience in managing large-scale serialisation projects. Note: Since the start of the process Aegate has withdrawn from the market.
National Competent Authority: A generic European term covering Government or Ministerial functions and bodies responsible for licensing, inspecting, regulating and legislating around the medicines supply chain. In the UK, the National Competent Authorities are the Department of Health and Social Care and the Medicines and Healthcare products Regulatory Agency (MHRA), for manufacturers and wholesalers, with lesser roles for the Health Departments of devolved administrations, and the General Pharmaceutical Council (GPhC) and Pharmaceutical Society of Northern Ireland (PSNI) with respect to pharmacies.
Persons authorised to supply medicines to the public: A generic European term covering community pharmacies, as well as other healthcare professions and organisations that use, administer or supply medicines to patients and the public as part of their work.
Repositories system: A generic term used in Delegated Regulation covering all parts of the verification system, including EMVO and NMVOs and the associated EMVS and NMVSs, as well as parties that are connected to them.
Healthcare institutions: A generic European term covering hospitals (including hospital pharmacies), in- and out-patient clinics, and health centres.
End users: A generic term for all organisations, institutions or locations that are handling medicines and which will need to be connected to the NMVS for their country. These include individual community pharmacies (even if part of a larger chain), hospital pharmacies, wholesale service centres, etc.
Onboarding: The process through which each end user location has its identity verified and is then connected securely to the NMVS for their country. Identity verification may use existing official lists or registers as well as the generation and use of software security certificates. NMVOs (and their BSPs) will be responsible for onboarding end users in their countries (e.g. pharmacies, hospitals and wholesalers). The EMVO is responsible for onboarding manufacturers to the European hub (EMVS) so that they can upload master data and unique identifiers relating to their products.
White List/Black List: The requirement for safety features applies to all prescription medicines placed on the market in Europe on or after 9th February 2019. Non-prescription medicines, unlicensed products and “specials” are excluded. Certain other products or product categories normally subject to prescription are excluded under Article 45(1) and are listed in Annex 1 of the DR, commonly referred to as the White List. Examples include medical gases, homoeopathic medicines, radionuclide kits and generators and some parenteral nutrition products. These are all normally subject to specialist handling and logistics and are not considered to be at high risk of falsification. The European Commission can also require under Article 45(2) that some non-prescription medicine packs to bear safety features, particularly if they have been subject to falsification. These are listed in Annex 2, commonly referred to as the Black List. Only two products – omeprazole 20mg and 40mg gastro-resistant hard capsules – are currently included in Annex 2.
Section 2: FMD operations
Safety features: Under FMD, all prescription medicines placed on the market from 9th February 2019 onwards are required to bear safety features in order to reduce the risk of falsified products reaching patients. These features are the serialised unique identifiers and an anti-tampering device.
Unique identifiers: (UI). Each and every pack of prescription medicine will have to carry its own unique identifier, encoded in a machine-readable 2D data matrix (or barcode) that meets ISO standards. Unless the packaging is very small, part of this information will also appear in printed human-readable form. The unique identifier will contain the following information [Article 4]:
- Product code: the name, common name, pharmaceutical form, strength, pack size and pack type
- Serial number: randomised numeric or alphanumeric sequence of up to 20 characters
- National reimbursement number: national identifying code, if required by Member State
- Batch number: up to 20 characters
- Expiry date: in YYMMDD form
Anti-tampering device: (ATD). Every pack has to have some sort of anti-tampering device which allows visual identification as to whether the pack may have been tampered with since it was originally manufactured (or repacked, for parallel traded products). Neither the Directive nor the Delegate Regulation specifies the nature of the ATDs that can be used, but typical devices could include glued-down flaps, seals or labels that have to be broken when opening, shrink or film wraps, breakable or tear-away closures, film or foil blister packs, and blow-fill-seal unit packs. Because of the variable type and locations for ATDs, inspection of them is always likely to be a human activity that would be difficult to automate.
Verify/verification: In order to verify a product in their possession, the person holding the medicine (normally a wholesaler or pharmacy) scans the unique identifier and then uses the NMVS to compare the data in the pack UI with corresponding data held in the NMVS. If the two match, and the anti-tampering device is still intact, then the pack is considered authentic. As long as it still has an active status, it can be moved through the supply chain or supplied to a patient (after decommissioning). Packs can be verified multiple times as they pass through the supply chain, as long has the person doing the verification has the product in their possession. Packs must be verified at certain points – if they have been bought from a secondary supplier rather than the original manufacturer or their agent; before they are repackaged for parallel trading; if they have been returned from a pharmacy back to a wholesaler.
Authentication: The processes of verification and authentication are closely linked and involve similar steps. In practice, authentication generally refers to the final step in the process, leading to decommissioning. Under Article 25, persons authorised to supply medicines to the public must authenticate the product by verifying the unique identifier using a NMVS and check that the anti-tampering device is still intact. This needs to be done “at the time of supplying it to the public”, although for most pharmacies it is likely that authentication will take place during the assembly and dispensing of prescribed medicines, rather than in front of the patient at the point of hand-over.
Decommissioning: Once the product has been authenticated during the dispensing process, it must have its status in the NMVS changed from active to inactive – decommissioned/supplied. This indicates that it has been dispensed and prevents any other pack bearing the same unique identifier from being dispensed, as the second attempt to verify the product would fail. This process of decommissioning underpins the operation of the repositories system and is aimed at preventing falsified products from reaching patients.
Active/inactive status: Each unique identifier that is uploaded to the repositories system has a status associated with it. Products with an active status can be dispensed or moved through the supply chain. Products with an inactive status cannot be supplied further, other than in certain circumstances (set out in Article 12), such as the product is intended for export from the EU, it is intended for destruction, or that it has been taken as a sample for official purposes. Packs can have an inactive status for several reasons – the product has been withdrawn from the market; the product (or a batch) has been recalled; the pack has already been dispensed, exported, repacked, supplied as a sample, destroyed or is part of a consignment known to have been stolen. If a product passes its expiry date, it will also have its status set to inactive automatically.
“10-day rule”: Once a pack has been decommissioned and had its status set to inactive – decommissioned/supplied there is a short period of 10 days during which this process can be reversed and the pack status set back to active. Reversal of decommissioning is only permitted [under Article 13] when:
- Same location The reversal is undertaken by the same “person” (i.e. organisation) as the original decommissioning and from the same set of premises
- 10-day rule The reversal takes place not longer than 10 days (240 hours) after the decommissioning
- Not expired The product has not expired since the decommissioning
- Not recalled The pack has not been registered as recalled, withdrawn, intended for destruction or stolen during the intervening period
- Not supplied The product was not supplied to the public (and thus has not left the premises)
The 10-day rule is crucial to the smooth operation of assembly and dispensing within pharmacies. If products are decommissioned at an early stage, there is a risk that they might not be collected or handed over within the 10-day period. After this, decommissioning cannot be reversed and the product “shall not be returned to saleable stock” [Article 13] which could massively increase wastage. One way around this is the use of aggregated codes generated within pharmacies’ dispensing systems.
Article 23 groups: As well as community and hospital pharmacies, and dispensing medical practices, many other healthcare professionals and institutions are entitled to use, administer or supply medicines to the public as part of their normal work. Such use may not be a core part of their work and may be infrequent or unpredictable. In such circumstances, having a connection to the NMVS might be difficult or disproportionately expensive. Article 23 recognises that Member States may need flexibility to take these different organisations (collectively referred to as “Article 23 groups”) in to account. Under Article 23, wholesalers can undertake verification and decommissioning on their behalf. It should be noted that persons operating within a healthcare institution or a pharmacy are specifically excluded from this. The groups covered by Article 23 are:
- Veterinarians and retailers of veterinary medicinal products (in relation to human medicines for veterinary use)
- Dental practitioners
- Optometrists and opticians
- Paramedics and emergency medical practitioners
- Armed forces, police and other governmental organisations maintaining stocks of products for the purposes of civil protection and disaster control
- Universities and other higher education establishments using medicinal products for research and education
- Nursing homes
Note that where pharmacies supply these organisations (or patients resident within them) with medicines supplied under a prescription, then the pharmacy would undertake the decommissioning as part of the normal dispensing process.
Accumulators/concentrators: These are hardware devices that will streamline the way in which end users are connected to each NMVS. Accumulators can be used within individual locations (e.g. pharmacies) to connect multiple terminals. The accumulator would also synchronise messages to and from the NMVS to ensure that they are presented and received in the correct order. They may also temporarily hold messages if the connection to the NMVS is lost. Concentrators can be used by larger organisations, such as pharmacy chains or national wholesalers, to connect multiple locations through a single gateway to the NMVS. Each location within the chain would retain its own secure identity for purposes of auditing and alert monitoring. Smaller locations, such as an individual community pharmacy business, may use an accumulator but would probably have a direct connection to the NMVS without needing a concentrator.