Scan that drug!
With 91 Americans dying every day from opioid overdose and a fragmented pharmaceutical supply chain, a new company is leveraging technology to trace drugs from manufacturer to patient.
A young woman slumped over in her chair, breathing slowly, with pupils the size of a pencil tip. “What’s your name?!” we asked. “Huh..? Wha…?” she muttered. Classic signs of an opioid overdose – the epidemic was at our doorstep.
Background: The U.S. opioid epidemic
The U.S. Centers for Disease Control and Prevention (CDC) estimates that 91 Americans die every day from opioid overdose.[1] From 1997 to 2007, U.S. physicians increased the number of opioid prescriptions by >600%, with drug distribution through the pharmaceutical supply chain increasing from the equivalent of 96 to 700 mg of morphine per person. 40% of opioid overdoses are due to 10% of patients who are prescribed opioids; these individuals seek care from multiple doctors and divert drugs to others who use them without prescriptions. Of non-medical users, 76% report the use of drugs prescribed to someone else, with only 20% acquiring them from their own doctor.[2]
Significant national resources are now being focused on the problem. In 2013, the Drug Supply Chain Security Act (DSCSA) was passed, requiring pharmaceutical companies to keep detailed track drugs from manufacture to the patient. According to DSCSA provisions, unit-level traceability will be fully enforceable in ten years.[3] Similarly, patients are now being tracked as well, and the Prescription Drug Monitoring Act of 2017 is currently under consideration – an initiative that would impose strict compliance with electronic databases that provide physicians with information regarding a patient’s controlled substance prescription history.[4]
TraceLink: Seizing an opportunity
According to DSCSA, pharmaceutical companies and their contractors must begin tracing large pallets of drugs in November 2017. By 2023, the granularity will increase substantially, requiring distributors to engage with an interconnected network through which drugs are tracked.
To capitalize on these requirements, TraceLink was born.[5] The new company is leveraging pressure induced by the law to digitize the pharmaceutical supply chain, creating a track-and-trace network for drugs. Its system uses bar codes to serialize products, then integrates the drug’s supply chain data into its network – including the type of drug, where it was made, and when it was shipped. Pharmaceutical companies and distributors then utilize the network to share data and comply with DSCSA regulations. The eventual goal would be “complete visibility of every step [of the supply chain], from manufacturer to patient.”[6]
Serialized products in the pharmaceutical supply chain
TraceLink’s interoperable network currently boasts more than 257,000 supply chain members on its cloud-based system. DSCSA mandates that manufacturers, wholesale distributors, repackagers, hospitals, and pharmacies all communicate with one another. Critical points of communication include product identification (electronically-read barcodes), tracing, verification, detection (of potentially counterfeit drugs), notification (to the FDA), and wholesaler and third-party logistics providers licensing.[7] In the short- and medium-term, the company’s U.S. strategy is centered around the progressive rollout of DSCSA. For example, while the law is in effect for pharmaceutical companies in 2017, the serialization deadline for hospitals and pharmacies is not until 2020 – suggesting that the company will target different segments of the supply chain in coming years. As such, they will increasingly manage a more complex network of inputs – from serial number creation to management of transaction histories for complete end-to-end tracking of drugs. Similar laws will take effect internationally, such as EU 2016/161, which requires member states to implement a drug authentication process by February 2019.[8]
Recommendations: Security risks and EHR integration
While TraceLink’s business is propelled by domestic and international laws, the most glaring concern is the threat of hackers. The pharmaceutical supply chain contains enormous amounts of sensitive data including medical records, insurance claims, and employee information. There is significant risk in TraceLink’s interconnected system, which can be accessed by all players in the supply chain. Beyond hackers, “insiders” (whether malicious or ignorant) also pose a threat, and experts recommend strict background checks, regimented security protocols, and limited access whenever possible.[7] The company should invest heavily in security systems given its centralized localization of the industry’s data.
Furthermore, TraceLink should consider ways of integrating drug supply chain data with hospital electronic health records (EHR) systems. Data interoperability among hospitals in the U.S. is extremely poor, as EHR adoption is fragmented across multiple products. As a result, hospitals are often unable to communicate with one another, and the ability to track drugs may be limited at this step. Enabling EHR integration with the TraceLink system may ease the burden on providers and help improve traceability – particularly for drugs like opioids subjected to significant diversion.
What’s next?
Going forward, TraceLink aims to integrate the international drug supply chain’s data. Will the company be able to meet each country’s unique regulatory demands? Can it keep such a highly accessible and integrated system safe? What other regulations or initiatives will be necessary to curb the opioid epidemic and hold the pharmaceutical supply chain accountable to appropriately high standards?
(799 words)
References
[1] Centers for Disease Control and Prevention (CDC). “Opioid overdose: Understanding the epidemic.” 30 Aug 2017. https://www.cdc.gov/drugoverdose/epidemic/index.html
[2] Centers for Disease Control and Prevention (CDC). “CDC grand rounds: prescription drug overdoses – a U.S. epidemic.” MMWR Morbidity and Mortality Weekly Report. 2012 Jan 13;61(1):10-3.
[3] U.S. Food and Drug Administration (FDA). “Drug Supply Chain Security Act (DSCSA).” 13 Oct 2017. https://www.fda.gov/Drugs/DrugSafety/DrugIntegrityandSupplyChainSecurity/DrugSupplyChainSecurityAct/
[4] The President’s Commission on Combating Drug Addiction and the Opioid Crisis. “Final Report.” 1 Nov 2017. https://www.whitehouse.gov/sites/whitehouse.gov/files/images/Meeting%20Draft%20of%20Final%20Report%20-%20November%201%2C%202017.pdf
[5] Crook, J. “TraceLink, helping the pharma industry trace and track drugs, lands $51.5M from Goldman Sachs.” 20 Nov 2016. https://techcrunch.com/2016/11/30/tracelink-helping-the-pharma-industry-trace-and-track-drugs-lands-51-5m-from-goldman-sachs/
[6] Weisman, R. “With its software, TraceLink capitalizes on drug counterfeiting crackdown.” 11 Sept 2016. https://www.bostonglobe.com/business/2016/09/11/with-its-software-tracelink-capitalizes-drug-counterfeiting-crackdown/gBGYcbVcv5z2Xf2DvmqZAK/story.html
[7] Roberts SJ. “The necessity of information security in the vulnerable pharmaceutical industry.” Journal of Information Security. 2014 Oct;5:147-53.
[8] The European Commission. “Commission Delegated Regulation (EU) 2016/161 of 2 October 2015.” Official Journal of the European Union. 2016 Sept 2. https://ec.europa.eu/health//sites/health/files/files/eudralex/vol-1/reg_2016_161/reg_2016_161_en.pdf
While I was conceptually aware of the current Opioid epidemic I had no concept of where the supply was coming from and how some level of traceability could improve the situation. While TraceLink certainly offers an interesting solution I echo your security concerns as they will be creating a massive central repository of sensitive data, particularly if they bridge the gap with EMRs. In order to do their best to ensure security they need to design it into the system from step one (well-written APIs, no open access, etc) while also ensuring they manage the human factor as tightly as possible (think the Target data breach). You also mention the concept of an international market and I wonder if TraceLink offers any value proposition without regulation, currently they add cost to meet an externally imposed condition, but if that condition is not present in an international market I’m unsure if TraceLink offers any fundamental value to drive adoption.
The opioid epidemic is a clear and present danger; costing both lives and increasing healthcare costs. That said, I am not convinced that tracking drugs alone will solve this issue. Although there is fair amount of drug smuggling that happens, legislation like DSCSA and TraceLink end up affecting (and complicating) legitimate drug prescriptions much more than addressing the misuse of these drugs. For example, it is already much harder for providers to prescribe cancer patients or those with chronic pain opioid medications; and these patients arguably really need the drug. This article also raises the issue that visibility of the supply chain needs to be contrasted with patient confidentiality. In an era of fragmented EMRs, tangible investments in data security will only be made if many large hospital system buy into these startups and their platform.
This is a fascinating company, and I did not realize that there were real regulatory tailwinds behind the adoption of digital tracking in the pharma supply chain. While managing the opioid crisis is an immediate and useful application of this technology, I would think that the ability to track & monitor drugs could also have enormous consequences on patients´ medication adherence (post-Rx) more generally, which would also have a positive societal impact, though would bring a host of patient privacy concerns.
Do you worry that the current administration will take measures to reverse the legislative momentum that supports this digitization? The level of accountability brought about by this new supply chain requirement seems high and potentially onerous to pharma companies (and other value chain participants). Said otherwise, this doesn’t seem “incumbent friendly” (big pharma). I’m curious to hear your thoughts on where various stakeholders stand on this emerging technology (AMA, PhRMA, etc.).
Chris, thank you for such an interesting and valuable blog post. Addressing your question regarding the integration of the international drug supply chain’s data, I would say that TraceLink should definitely be concerned – due to regulation constraints (access hurdle) and lack of digital capabilities (lack of tools/data hurdle).
First, regulation varies significantly across countries. Even in Europe, where one would expect to have one single regulation, that is not the case – both European and local laws apply. [1] The regulatory burden is a significant hurdle to the international integration. Additionally, given that this is a problem only affecting the US for now, several challenges may arise to convince countries to share their own EMR (given the sensitive nature of the data and the lack of incentives to do it).
Second, countries are still struggling with health digital capabilities and integration of data – even looking to the most developed countries. [2] If this is the case in developed countries, I feel that is fair to say that the situation is even more challenging in developing countries.
One potential solution may be to look for third parties support (e.g. industry associations) to support with local regulations, advocate for healthcare digital capabilities and offer financing to local governments. Additionally, TraceLink should start partnering with countries with higher penetration of EMR (e.g. UK, Sweden), that could work as proof of concept. [3]
Countries may be open to integrate their health data, but such a supply chain disruption requires incentives and examples of success.
—
[1] European Patient Forum, “The new EU Regulation on the protection of personal
data: what does it mean for patients?”. Retrieved from: http://www.eu-patient.eu/globalassets/policy/data-protection/data-protection-guide-for-patients-organisations.pdf, accessed on November 2017.
[2] EFPIA (2017, July 20), “Building the European health data eco-system”. Retrieved from: https://www.efpia.eu/news-events/the-efpia-view/blog-articles/20072017-building-the-european-health-data-eco-system/, accessed on November 2017.
[3] Primary Care Physicians’ Use of Electronic Medical Records, 2015. Retrieved from: http://international.commonwealthfund.org/stats/electronic_medical_records/, accessed on November 2017.