Christiane Wirrig, PhD, Spherity and OCI

In the pharmaceutical supply chain, many entities are involved in the manufacture, packaging, distribution, and dispensing of prescription drugs. As they trade with each other, unscrupulous actors may attempt to infiltrate this complex network for financial or other reasons. Hence, it is essential to know for patient safety that only trusted and authorized entities are involved.

In November 2013, the Congress enacted the Drug Supply Chain Security Act (DSCSA) in order to enforce assurance over pharmaceutical drug distribution from manufacturers all the way to dispensers. The DSCSA postulates new requirements to enhance drug distribution security by fall 2023. This is to be achieved by:

Preventing harmful drugs from entering the supply chain

Detecting harmful drugs that have entered the supply chain

Responding rapidly when harmful drugs are found

Aside from adhering to relevant product verification, tracing, and serialization requirements, each supply chain actor needs to ensure that the counterparty of an interaction is indeed authorized to partake in this exchange, i.e., they are an authorized trading partner (ATP) as defined by DSCSA. Broadly, “authorized” means that a trading partner holds a valid state-issued license or registration with FDA. When trading partners interact, they must check whether the other party is authorized. They are permitted to proceed only if both sides meet the relevant criteria. This DSCSA requirement aims to ensure that only trustworthy entities participate in the supply chain.

Ideally, unscrupulous actors who may try to sneak in fake or tempered products will be identified swiftly by electronic (rather than manual) mechanisms which ensure that only ATPs interact with each other. An interoperable electronic system to facilitate such ATP checks is to be fully operational by November 2023.

Industry expectations call for novel approaches

To ensure that only legitimate products are in the supply chain, DSCSA requires trading partners to perform verifications on returned or suspicious products. This means that, for example, a dispenser may have to inquire about a product with a manufacturer whom they have never dealt with before, due to reliance on intermediaries in their supply chain. In such a case, there is an indirect trading relationship between the two companies. They do not know each other. How can both parties be sure that the other side is indeed who they claim to be? How do they ascertain that the other party is properly authorized to trade at this point in time?

There are systems that assign unique identifiers to business entities in order to aid accurate identification, such as global location numbers (GLN) or data universal numbering system (DUNS) numbers. However, in electronic interactions, the receiving party cannot be sure that an entity providing such an identifier is indeed who they say they are because their identity and provided details cannot be independently verified. In addition, there have been cases where GLN were not well maintained, e.g., they were not active or not associated with the expected entity. Finally, such identifiers do not inform about the current authorized status. Thus, they leave a compliance gap.

While DSCSA allows for up to 24 hours, there is a drive by trading partners to achieve response times of under one minute to product identifier (PI) verification requests by using automated electronic systems. Consequently, the ATP check must happen in the same time frame. Thus, the system must be able to handle both the ATP and the PI verification requests within one minute. This is no mean feat for more than 60,000 active trading partners involved in the US life sciences industry.

Despite the looming deadline on Nov. 27, 2023, until recently, US pharma supply chain actors have had no interoperable, electronic mechanism to validate each others’ authorized status. Sure, there have been prior delays in FDA’s enforcement of DSCSA requirements to enable technology and companies to catch up with the implementation of scalable, functional new systems. However, it is unwise to bank on any further postponement of this often cited and emphasized ultimate deadline. As it stands, there is no credible sign of the FDA allowing for any further delays.

Industry collaboration to accelerate innovation

While the pharma industry had been working on solutions for other provisions within the DSCSA, the ATP check was the can that kept being kicked down the road. Finally, in April 2020, companies representing different segments of the US pharmaceutical supply chain came together in a cross-functional group to pilot the use of digital credentials for ATP checks as part of automated PI verifications for saleable returns. The pilot successfully concluded in February 2021.

To build on this work, the non-profit industry collaboration Open Credentialing Initiative (OCI) was founded in April 2021. Since then, OCI has been crucial in evolving, validating, and standardizing the piloted credentialing architecture and has seen growing support from across the pharmaceutical industry. The result is the currently only available solution for ATP checks mature enough to meet the 2023 DSCSA deadline. While OCI itself does not offer the software, it provides an industry framework and open technical specifications for service providers to furnish trading partners with practical interoperable solutions, such as mobile or desktop apps.

Credentials exist in the physical and digital world. They are essentially certifications that attest to a certain status or achievement. Within the digital world, electronic credentials can be issued following due diligence on electronic and/or physical documentation. Credentialing in the context of DSCSA is the process of verifying documentation that proves the required legal or regulatory status, e.g., the formal review of a pharmacy’s state license and proof of the company’s existence. This real-world evidence is then captured in the form of electronic credentials, such as ATP credentials for properly registered trading partners. These are stored securely in a digital wallet.

This piece of software is the foundation for the automated exchange of credentials or information about them between trading partners. Hence, using digital credentials allows instant confirmation of a trading partner’s identity and ATP status in line with DSCSA requirements and industry players’ aspirations.

Within OCI’s architectural framework, the identity credential confirms that a trading partner organization is indeed who they claim to be. This credential is the basis for all further authentication. Once this crucial step has been completed, an ATP credential can be issued for the same entity as long as they comply with the applicable DSCSA criteria. With these two indispensable credentials in place, DSCSA-compliant trading interactions can be conducted between ATP. Note that credentials are revoked when an entity’s compliance with the relevant requirements fails. It is the task of a credential issuer to issue and revoke credentials by performing due diligence assessments.

The key advantage of the described digital credentials is that they can be independently automatically verified, unlike the aforementioned identifiers currently in use.

Let’s return to the earlier example of the indirect trading relationship between dispenser and manufacturer. Using their digital wallet app, the dispenser would launch a PI verification request regarding the suspicious product to the manufacturer. Thanks to the automatic inclusion of the dispenser’s ATP credential in the message, the manufacturer will respond instantly even though they have never dealt with the dispenser 

before. Because the manufacturer also attaches its ATP credential to the reply, the dispenser can be sure that the answer is trustworthy and the entire interaction is DSCSA-compliant. Should the ATP credential from one of the two trading partners be invalid, the process flow would stop at the point of ATP status verification and no further messages regarding the product would be exchanged in this interaction. It may then be appropriate to raise a red flag about the product in question with the relevant authorities and trading partners. The digital wallet stores transaction data of the described exchanges and, thus, automatically creates an audit trail.

Functional solutions based on OCI’s framework have been tested with industry partners. Stakeholder involvement is important for OCI to incubate not only practical software solutions but also to set reasonable technical conformance criteria within this ecosystem. As a result, the OCI architecture has primarily focused on its integration into the existing verification routing service (VRS) infrastructure for PI verification but is open to developing further use cases by building on suggestions from ecosystem participants.

The beauty of utilizing VRS is that the dispenser in our example does not need to figure out whom to contact at which manufacturer organization because the VRS takes care of the message routing. The figure at left outlines the OCI architecture for a PI verification roundtrip, including credential issuance.

OCI puts great emphasis on working in line with internationally respected technical standards setters, such as W3C and GS1, to lay a solid foundation for future-proof, adaptable technology and interoperability between OCI-conformant service providers.

Both industry stakeholders and regulators have recognized interoperability as paramount to allow trading partners free choice between service providers.

A further benefit of building on shared international standards and industry-wide conformance criteria is that the OCI architecture is expandable to further business use cases within and outside DSCSA, such as tracing, order-to-cash or drop shipments.

True industry-wide innovation does not happen in isolation. The key to the rapid development of a workable ATP authentication solution, and, consequently, OCI’s growth was the pioneering spirit of organizations willing to allocate resources to a collaboration that solves a pressing industry challenge. This initiative involved small and large technical service providers, pharmaceutical trading partners, and trade associations, as well as technical standards bodies. The initiative’s progress demonstrates how important it is to create a space where participants can communicate freely to exchange ideas, practical insights and co-create for a shared purpose.

OCI facilitates an open ecosystem constantly welcoming new entrants interested in contributing to future enhancements of the architecture and use cases.

Christiane Wirrig, PhD, is Product Manager at Spherity and a member of OCI.

Articles

Outlining the work of the Open Credentialing Initiative in establishing digital proof of identity, licensure status, and authorship using digital wallets and verifiable credentials