A young woman slumped over in her chair, breathing slowly, with pupils the size of a pencil tip. “What’s your name?!” we asked. “Huh..? Wha…?” she muttered. Classic signs of an opioid overdose – the epidemic was at our doorstep.
Background: The U.S. opioid epidemic
The U.S. Centers for Disease Control and Prevention (CDC) estimates that 91 Americans die every day from opioid overdose. From 1997 to 2007, U.S. physicians increased the number of opioid prescriptions by >600%, with drug distribution through the pharmaceutical supply chain increasing from the equivalent of 96 to 700 mg of morphine per person. 40% of opioid overdoses are due to 10% of patients who are prescribed opioids; these individuals seek care from multiple doctors and divert drugs to others who use them without prescriptions. Of non-medical users, 76% report the use of drugs prescribed to someone else, with only 20% acquiring them from their own doctor.
Significant national resources are now being focused on the problem. In 2013, the Drug Supply Chain Security Act (DSCSA) was passed, requiring pharmaceutical companies to keep detailed track drugs from manufacture to the patient. According to DSCSA provisions, unit-level traceability will be fully enforceable in ten years. Similarly, patients are now being tracked as well, and the Prescription Drug Monitoring Act of 2017 is currently under consideration – an initiative that would impose strict compliance with electronic databases that provide physicians with information regarding a patient’s controlled substance prescription history.
TraceLink: Seizing an opportunity
According to DSCSA, pharmaceutical companies and their contractors must begin tracing large pallets of drugs in November 2017. By 2023, the granularity will increase substantially, requiring distributors to engage with an interconnected network through which drugs are tracked.
To capitalize on these requirements, TraceLink was born. The new company is leveraging pressure induced by the law to digitize the pharmaceutical supply chain, creating a track-and-trace network for drugs. Its system uses bar codes to serialize products, then integrates the drug’s supply chain data into its network – including the type of drug, where it was made, and when it was shipped. Pharmaceutical companies and distributors then utilize the network to share data and comply with DSCSA regulations. The eventual goal would be “complete visibility of every step [of the supply chain], from manufacturer to patient.”
Serialized products in the pharmaceutical supply chain
TraceLink’s interoperable network currently boasts more than 257,000 supply chain members on its cloud-based system. DSCSA mandates that manufacturers, wholesale distributors, repackagers, hospitals, and pharmacies all communicate with one another. Critical points of communication include product identification (electronically-read barcodes), tracing, verification, detection (of potentially counterfeit drugs), notification (to the FDA), and wholesaler and third-party logistics providers licensing. In the short- and medium-term, the company’s U.S. strategy is centered around the progressive rollout of DSCSA. For example, while the law is in effect for pharmaceutical companies in 2017, the serialization deadline for hospitals and pharmacies is not until 2020 – suggesting that the company will target different segments of the supply chain in coming years. As such, they will increasingly manage a more complex network of inputs – from serial number creation to management of transaction histories for complete end-to-end tracking of drugs. Similar laws will take effect internationally, such as EU 2016/161, which requires member states to implement a drug authentication process by February 2019.
Recommendations: Security risks and EHR integration
While TraceLink’s business is propelled by domestic and international laws, the most glaring concern is the threat of hackers. The pharmaceutical supply chain contains enormous amounts of sensitive data including medical records, insurance claims, and employee information. There is significant risk in TraceLink’s interconnected system, which can be accessed by all players in the supply chain. Beyond hackers, “insiders” (whether malicious or ignorant) also pose a threat, and experts recommend strict background checks, regimented security protocols, and limited access whenever possible. The company should invest heavily in security systems given its centralized localization of the industry’s data.
Furthermore, TraceLink should consider ways of integrating drug supply chain data with hospital electronic health records (EHR) systems. Data interoperability among hospitals in the U.S. is extremely poor, as EHR adoption is fragmented across multiple products. As a result, hospitals are often unable to communicate with one another, and the ability to track drugs may be limited at this step. Enabling EHR integration with the TraceLink system may ease the burden on providers and help improve traceability – particularly for drugs like opioids subjected to significant diversion.
Going forward, TraceLink aims to integrate the international drug supply chain’s data. Will the company be able to meet each country’s unique regulatory demands? Can it keep such a highly accessible and integrated system safe? What other regulations or initiatives will be necessary to curb the opioid epidemic and hold the pharmaceutical supply chain accountable to appropriately high standards?
 Centers for Disease Control and Prevention (CDC). “Opioid overdose: Understanding the epidemic.” 30 Aug 2017. https://www.cdc.gov/drugoverdose/epidemic/index.html
 Centers for Disease Control and Prevention (CDC). “CDC grand rounds: prescription drug overdoses – a U.S. epidemic.” MMWR Morbidity and Mortality Weekly Report. 2012 Jan 13;61(1):10-3.
 U.S. Food and Drug Administration (FDA). “Drug Supply Chain Security Act (DSCSA).” 13 Oct 2017. https://www.fda.gov/Drugs/DrugSafety/DrugIntegrityandSupplyChainSecurity/DrugSupplyChainSecurityAct/
 The President’s Commission on Combating Drug Addiction and the Opioid Crisis. “Final Report.” 1 Nov 2017. https://www.whitehouse.gov/sites/whitehouse.gov/files/images/Meeting%20Draft%20of%20Final%20Report%20-%20November%201%2C%202017.pdf
 Crook, J. “TraceLink, helping the pharma industry trace and track drugs, lands $51.5M from Goldman Sachs.” 20 Nov 2016. https://techcrunch.com/2016/11/30/tracelink-helping-the-pharma-industry-trace-and-track-drugs-lands-51-5m-from-goldman-sachs/
 Weisman, R. “With its software, TraceLink capitalizes on drug counterfeiting crackdown.” 11 Sept 2016. https://www.bostonglobe.com/business/2016/09/11/with-its-software-tracelink-capitalizes-drug-counterfeiting-crackdown/gBGYcbVcv5z2Xf2DvmqZAK/story.html
 Roberts SJ. “The necessity of information security in the vulnerable pharmaceutical industry.” Journal of Information Security. 2014 Oct;5:147-53.
 The European Commission. “Commission Delegated Regulation (EU) 2016/161 of 2 October 2015.” Official Journal of the European Union. 2016 Sept 2. https://ec.europa.eu/health//sites/health/files/files/eudralex/vol-1/reg_2016_161/reg_2016_161_en.pdf