Brazil RDC 54 Regulatory Overview

Rx-360 Traceability Data Exchange Architecture

Working Group
September 2014

Agenda
Brazil High-Level Compliance Summary and Network
Serialization, Tracking/Data Exchange and Reporting Requirements
Funding Model
Governance Model
Data and System Security

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Brazil Track and Trace Regulatory Overview

Establishment of a National Drug Control System (SNCM) for the Tracking of Medicines
Scope
All drug products subject to ANVISA registration (including free samples) produced, dispensed or sold in Brazil

Summary Regulatory Requirements

Serialization (Unit-level, Manufacturer issued, Aggregation)
Supply Chain Tracking (All product movements/events from Manufacturer to Dispenser)
Government Reporting (All product movements/events from registration holder repository)

Deadlines
Dec. 10, 2015

Dec. 10, 2016

Serialization (unit-level)

Serialization (unit-level)

Supply Chain Tracking

Supply Chain Tracking

Government Reporting

Government Reporting

3 lots of manufactured product

All pharmaceuticals

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Brazil Track and Trace Network

Brazil
ANVISA

ANVISA System

(industry developed)

Industry Cloud System(s)?

Industry Cloud System(s)?

XML

Pharmaceutical Company

3PL

Carrier

(registration holder)

Wholesale
Distributor

Pharmacies /
Hospitals / Dispensers

Event Repositories and Data Exchanges

Product Tracking Event Repository
Government Query Access to Registration Holder SNCM System
Government Reports
Supply Chain Transactions and Product Movement Events (primary)

Packaging Site
4

CMO / CPO

Supply Chain Transactions and Product Movement Events (potential)

Business and Serialization Data Exchange

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Serialization Requirements
Drug registration holders (manufacturer, importer) are responsible for serializing drug products
- Unit level
- Transport container (case) level

A Brazilian IUM is applied to each unit of product in a 2D datamatrix (must be in this order)
ANVISA Registry Number
13 digits
SN
13 digits
Expiry
MM/YY format
Lot
* Note: a GTIN may be added but must not come within the four required IUM data elements

Transport container identification requirements are not yet fully documented

Unit-level serial numbers must be Unique and Random
- SNs must not repeat between products of the same manufacturer (even across product lines)

Aggregation is required
- Transport packaging container must contain an identifier linking the container to the unit IUMs
5

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Product Tracking and Data Exchange

Requirements
Registration holders must capture all product movements and events - manufacture to dispenser
Supply chain participants capture movements and events related to their business, must publish
such events back to the registration holder (and potentially back to the immediate supplier)
Product movement data which must be captured by individual drug tracking systems
Registration Holder (Manufacturer, etc.)
Product IUM
Transport Package identifier
Brazil CNPJ identifier (receiver)
Brazil CNPJ identifier (carrier)
Date of transaction
Type of transaction (sale, transfer, etc.)

Distributor
Product IUM
Transport Package identifier
Brazil CNPJ identifier (sender)
Brazil CNPJ identifier (receiver)
Brazil CNPJ identifier (carrier-if applicable)
Date of transaction
Type of transaction (sale, transfer, etc.)

Transaction events and movements exchanged and captured

Packaging
Aggregation
Verification

Receiving
Purchase
Transfer
Donation
Return
Payment
Free Sample

Delivery
Sale
Transfer
Donation
Return
Payment
Free Sample

Production
IUM

Import
Carrier
Packing

Disposition
Dispensation
Shortage
Deviation
Loss/Damage
Destruction

Pharmacy Dispenser
Product IUM
Transport Package identifier
Brazil CNPJ identifier (sender)
Brazil CNPJ identifier (receiver)
Brazil CNPJ identifier (carrier-if applicable)
Date of transaction
Type of transaction (sale, transfer, etc.)

(*interpretation still being verified)

Recall

Error Correction
Invalid event
Replacement event

Reporting
Transmission
Receipt

Expected that supply chain members will use XML and other means to exchange event data
All product movement data must be stored for 1 year post product expiration date
6

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Reporting Requirements
Product and supply chain event reporting by registration holders to ANVISA
- Web service XML-based communication
Defined in XSD schema files documented on the ANVISA website

- On-demand user access by ANVISA via web browser

Registration holders have two types of reporting requirements

- Normal product and supply chain events (as product moves from point of manufacture to point of
dispensation)
- Suspicious or unexpected supply chain events

Scenarios for reporting suspicious supply chain events include:

- IUM identifiers reported by supply chain members that have not been generated by the manufacturer
- IUM identifiers that inappropriately appear multiple times in the supply chain (across multiple links, etc.)
- Duplicate IUMs for products that have left the supply chain

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Funding Model
ANVISA central repository
- ANVISA has started to develop the specifications of a central repository system
- ANVISA will ask industry to develop and manage such a system on their behalf
- Funding requirements for this system (from registration holders or from all stakeholders) has not yet been
publicly defined

Industry stakeholder SNCM repositories

- Development of industry stakeholder SNCM systems are funded by the stakeholder themselves

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Governance Model
ANVISA has developed a formal group steering committee to advise on the structure, operational processes
and technical design
- 25 core members (ANVISA, Brazil Ministries, National Councils, Industry Associations)
- Subcommittees focus on specific aspects of RDC 54 readiness

Standards and Technical Criteria

Public Sector

Etc.

ANVISA is generally leaving it to industry to develop and manage the process of implementation of
interoperable data exchange systems
- Industry stakeholders may have their own private SNCM system or use a system shared with other stakeholders

There will be qualification/certification of service providers

- Initial guidelines and standards at first, a formal process is expected to follow
- Unknown who will run the certification process

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Data and System Security

RDC 54 defines that any SNCM system (owned or used by a stakeholder) must guarantee
- Confidentiality, integrity, interoperability, authenticity, availability of data

ANVISA has not yet extensively documented explicit requirements for security
Events and data captured by the SNCM system for RDC 54 must be protected and remain unchanged
- Any update/removal of historical data throughout record retention period will be considered a regulatory infraction

NOTE: A Replacement Event or Declaration of Invalidity should be used to correct regulatory records

- After the record retention period expires for a specific event, records related to that event may be removed
- Data managed by the SNCM system beyond that required for regulatory purposes may be modified

Future Normative Instructions (rules) will specifically address

- Communication security between registration holder and ANVISA

Authentication, Encryption

- Data access controls for ANVISA to access registration holders SNCM systems

Additional security issues expected to be left to industry to define (but may be part of certification)
- Data security within SNCM systems
- Transaction security across supply chain stakeholder data exchanges
10

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission

Questions

11

2014 TraceLink Inc. All Rights Reserved Confidential Not for Redistribution Without Express Permission