Malta Medicines Verification System Overview

MALTA MEDICINES VERIFICATION SYSTEM Time to put away the crystal ball

MaMVS BY THE NUMBERS >300 >300 days of days of live connection live connection to the EU hub to the EU hub >3,000 >3,000 product codes product codes >15,000 >15,000 batches batches >200 end user >200 end user organisations organisations >100,000 >100,000 scans weekly scans weekly >232 million >232 million packs packs >200 marketing >200 marketing authorisation authorisation holders holders >800 alerts >800 alerts weekly weekly

THE ONBOARDING SITUATION 250 Not connected Connected 200 Digital wholesalers and manufacturers with Digital wholesalers and manufacturers with wholesale distribution licences may have no wholesale distribution licences may have no practical need to connect to the practical need to connect to the MaMVS MaMVS 150 100 50 0 Wholesalers Pharmacies Healthcare Institutions

THE MaMVS RELEASE TIMELINE 31 31- -Oct Authentication tokens expire after 30 minutes Prime contact has to be a super user. New URL domains for the portal (https://portal- mt.nmvo.eu/), the EVA (https://eva-mt.nmvo.eu/), and end user software. Old domains supported until Autumn 2020. Rate limitations imposed to avoid abuse of the system Authentication token requests limited to 600 requests / 5 minutes Report requests limited to 200 requests / 5 minutes Verification or pack state change requests configurable by MaMVO, based on justified need, to a maximum of 800 requests / 5 minutes. Oct- -2019: Release 5 and 6 2019: Release 5 and 6

THE MaMVS RELEASE TIMELINE Release 6.1 Scheduled for 12th -13th December Alert ID will change format (MT-XXX-XXX-XXX-XXX to MT-XXX-XXX-XXX-XXX- -XXX Public system status dashboard XXX) Release 6.2 Planned for April 2020 Support for TLS 1,0 and 1.1 security protocols will be fully withdrawn. Dates are subject to the releases passing validation activity (IT Acceptance Testing - ITAT, User Acceptance Testing - UAT, Interoperability Testing - IOT) There will be future, less frequent major releases.

ALERTS: LOCAL VS EXTERNAL USERS 30000 135000 Trends in local vs externally raised alerts in the MaMVS Trends in local vs externally raised alerts in the MaMVS Impact when manufacturers Impact when manufacturers cause alerts in the cause alerts in the MaMVS 25000 MaMVS 115000 20000 Number of Scans Number of Scans Number of Alerts Number of Alerts Local scans Incoming IMT MMP synchronisation OBP-generated Total local scans 15000 95000 10000 Impact when MAH s upload Impact when MAH s upload numbers of multimarket numbers of multimarket packs to other NMVO s but packs to other NMVO s but not the not the MaMVS MaMVS Impact when end users in Impact when end users in other member states raise other member states raise alerts in the alerts in the MaMVS 75000 MaMVS 5000 0 55000 42 43 44 45 46 47 Week Number Week Number

ALERTS: CLASSIFICATION BY PROCESS 100000 Single pack Single pack operations show operations show all types of alerts all types of alerts A2 Distribution of Error Codes in MaMVS by Source Process Distribution of Error Codes in MaMVS by Source Process - - Nov Nov- -2019 2019 A24 Alerts caused by Alerts caused by end users in other end users in other member states member states A3 Bulk of pack (BOP) Bulk of pack (BOP) only supports operations against only supports operations against the national system. Thus pack is either not found (A3) the national system. Thus pack is either not found (A3) or pack is found but already in the requested state (A7) or pack is found but already in the requested state (A7) Pack state changes will either not find the pack (A3) , or Pack state changes will either not find the pack (A3) , or the pack is found but is already in the requested state (A7) the pack is found but is already in the requested state (A7) 10000 A52 A68 Alerts caused by Alerts caused by OBPs (MAHs) OBPs (MAHs) A7 1000 100 10 1 MAH PPSU Request MAH PPV Request National System Bulk Pack API National System Intermarket National System PPSU Request National System Single Pack API

ALERTS 900 120000 Trends in Alert Types Raised by Local End Users in the MaMVS Trends in Alert Types Raised by Local End Users in the MaMVS 800 A2 A3 A7 Total scans A68 A52 A24 100000 700 A52: Expiry date mismatch A52: Expiry date mismatch - - < <0.05% Pack exists but expiry date does not Pack exists but expiry date does not match. Most frequently an issue of match. Most frequently an issue of incorrect data upload. incorrect data upload. 0.05% 600 80000 A68: Batch number mismatch A68: Batch number mismatch - - < <0.05% Pack exists but batch number does not Pack exists but batch number does not match. Most frequently scanner issues. match. Most frequently scanner issues. 0.05% Number of Scans Number of Scans Number of Alerts Number of Alerts 500 A3: Pack not found A3: Pack not found - - <0.1% Most common current root cause is Most common current root cause is incomplete batch upload, thus incomplete batch upload, thus increasing as more FMD increasing as more FMD- -compliant batches are released. batches are released. of double dispense by IMT to of double dispense by IMT to Arvato as more FMD as more FMD- -compliant packs placed on market. compliant packs placed on market. <0.1% 60000 400 A2: Batch ID Unknown A2: Batch ID Unknown <1% (End user sees an A3); (End user sees an A3); 90 90- -95% being caused by packs 95% being caused by packs that should not be authenticated that should not be authenticated (missing ATD) (missing ATD) <1% A7 & A24: A7 & A24: Pack Most common Most common root Pack already in a requested state already in a requested state - - < <0.2% root cause is cause is repeat scanning, and failure 0.2% compliant repeat scanning, and failure Arvato systems. Increasing systems. Increasing 300 40000 200 20000 100 0 0 27 31 35 39 43 47 Week Number Week Number

ALERTS AND WHOLESALE DEALERS Alerts raised by wholesale dealers have The purpose of the investigation in Article 37(d) is to rule out that alerts triggered in the system have been caused for technical reasons, such as issues with the repository system, data upload, data quality, incorrect end-user scanning or other similar technical issues. Responsiveness to MaMVO Responsiveness to MaMVO a slightly different distribution. Alerts Profile Alerts Profile Adequately responsive 28% A3 33% A2 have a lower frequency since only a few packs are scanned before realising there is a problem, as opposed to all packs scanned at pharmacy level. A2 56% A52 alerts have a higher frequency since these are commonly detected at wholesaler level and resolved before releasing the batch. National competent authorities, EMA and the European Commission should be informed as soon as it is clear that alert cannot be explained by technical reasons. [Commission Q&A, Q7.17] A7 1% A24 0% Poorly responsive 28% Highly responsive 44% lower frequency since they are related to scanning activity. A68 1% A52 9% A7, A24 and A68 alerts have a much No response = No explanation No response = No explanation

LESSONS LEARNT Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement A wholesaler shall not supply or export a medicinal product where he has reason to believe that its packaging has been tampered with, or where the verification of the safety features of the medicinal product indicates that the product may not be authentic. He shall immediately inform the relevant competent authorities. [DR, Article 24] MaMVO Position MaMVO Position MaMVO Position MaMVO Position MaMVO Position MaMVO Position I ll destroy the pack/s. I m sending the pack/s back to the supplier. (when root cause of an alert has not yet been determined) determined) determined) Wholesale distributors must immediately inform the competent authority and the marketing authorisation holder of any medicinal products they identify as falsified or suspect to be falsified. A procedure should be in place to this effect. It should be recorded with all the original details and investigated. [GDP Guidelines, Section 6.4] I ll destroy the pack/s. I m sending the pack/s back to the supplier. (when root cause of an alert has not yet been (when root cause of an alert has not yet been I ll destroy the pack/s. I m sending the pack/s back to the supplier. What if the pack should turn out to be a suspected falsified medicine? MAH s have complained of lack of availability of photographic evidence. photographic evidence. photographic evidence. What if the pack should turn out to be a suspected falsified medicine? MAH s have complained of lack of availability of MAH s have complained of lack of availability of What if the pack should turn out to be a suspected falsified medicine? [The supplier said that]There s a stabilisation period in <country of source> stabilisation period in <country of source> [The supplier said that]There s a Stabilisation periods authorised in other countries don t apply to Malta. countries don t apply to Malta. Stabilisation periods authorised in other Downstream actors in the supply chain, who have neither placed the unique identifier on the medicinal product nor uploaded the data to the repositories system, are not in a position to be 100% confident that a particular pack is not a falsified medicinal product. Any falsified medicinal products found in the supply chain should immediately be physically segregated and stored in a dedicated area away from all other medicinal products. All relevant activities in relation to such products should be documented and records retained. [GDP Guidelines, Section 6.4] I m purchasing from the same (wholesale dealer) supplier I always used. I m 100% confident the packs are not falsified.

LESSONS LEARNT Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement Safety feature Safety feature MaMVO Position MaMVO Position MaMVO Position MaMVO Position MaMVO Position MaMVO Position Placed on market Placed on market before 9 before 9th th February Placed on market Placed on market after 9 after 9th th February February February [The supplier said that]he is not obliged to scan every pack (in cases where verification has generated pack level alerts) has generated pack level alerts) has generated pack level alerts) Any medicine with a UI but not but not ATD [The supplier said that]he is not obliged to scan every pack (in cases where verification scan every pack (in cases where verification [The supplier said that]he is not obliged to The alert still remains unresolved. The alert still remains unresolved. The alert still remains unresolved. No need (Not an FMD-compliant pack) No need (Not an FMD-compliant pack) The [fully FMD-compliant] packs were The [fully FMD-compliant] packs were released before the 9th February. released before the 9th February. Any medicine having both both a UI and an and an ATD The transitional measures do not apply to packs that are fully FMD-compliant. that are fully FMD-compliant. Transitional measures do not Transitional measures do not apply to packs that are fully apply to packs that are fully FMD FMD- -compliant compliant The transitional measures do not apply to packs Yes Yes (FMD-compliant pack) There s [still] a stabilisation period at pharmacy level [in Malta]. (for packs which cannot be authenticated) The stabilisation period guidance instructs not to withhold product due to alerts. It does not instruct not to authenticate.

LESSONS LEARNT Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement Wholesaler Statement MaMVO Position MaMVO Position MaMVO Position MaMVO Position MaMVO Position MaMVO Position [The supplier said that] The manufacturer said that <technical reason> reason> reason> [The supplier said that] The manufacturer said that <technical manufacturer said that <technical [The supplier said that] The MaMVO cannot resolve alerts on the basis of hearsay. Original manufacturer statements must be provided. Original manufacturer statements must be provided. Original manufacturer statements must be provided. MaMVO cannot resolve alerts on the basis of hearsay. MaMVO cannot resolve alerts on the basis of hearsay. The data in the system belongs to the MAH. Original communication of authorisation must be provided to MaMVO MaMVO The data in the system belongs to the MAH. Original communication of authorisation must be provided to The MAH has appointed me to deal with alerts.. with alerts.. The MAH has appointed me to deal The decommissioning of packs as Supplied requires national legislation permitting this activity. In the absence of said legislation, it is a breach of terms of use, and subject to suspension of account. {Wholesalers marking packs as Supplied}

AUTHORISED & UNAUTHORISED ACTIONS Parallel Parallel Distributor Distributor Use Case Use Case Reactivation* Reactivation* Manufacturer Manufacturer Pharmacist Pharmacist Wholesaler Wholesaler Recall batch Verify pack - Mark pack as supplied *** Mark pack as checked-out Export pack from EU Withdraw product Mark pack as stolen Mark pack as destroyed Mark pack as free sample Mark pack as sample (NCA) Mark pack as locked ** *from same location within 10 days; **from same location (no time limit); ***if permitted by local law

KNOWN UN/EXPECTED BEHAVIOURS Bulk of pack (BOP) is not supported in intermarket transaction Bulk of pack (BOP) is not supported in intermarket transaction (IMT). (IMT). Therefore verification in BOP mode will only verify against the national system and generate a pack not found (A3) alert if the pack is not present in the MaMVS. An An IMT cannot function without a batch number. IMT cannot function without a batch number. A pack not found alert will be generated in manual verification if only PC and SN are used, and an IMT is needed to find the pack. Arvato Arvato systems differ from SSR systems in alert generation: systems differ from SSR systems in alert generation: Pack not found generates an alert in Arvato systems but not in SSR. Double dispense works in IMT between SSR systems, but generates alerts in IMT to an Arvato system. Arvato systems, but not SSR systems, generate an alert when attempting to reactivate a pack past 10-day limit. Work is under way to harmonise these alerts at European level.

KNOWN UN/EXPECTED BEHAVIOURS If a product code is incorrectly formatted in the UI (e.g. parentheses around the Application Identifiers), software can block requests from reaching the MaMVS, to prevent false alerts. Arvato systems currently require all 4 elements (PC, SN, Lot, Exp). If a manual verification triggers an IMT to an Arvato system (e.g. UK) PC, SN, Batch (no EXP) triggers a serial number unknown alert (even if the pack does exist), but no Alert ID will be generated by the Arvato system. PC, SN, Batch and Exp only works if full expiry date is known. If human format of Exp is month-year, manual verification with EXP is guesswork and can generate an A52 error. Arvato systems should be corrected in January.

ALERT MANAGEMENT SYSTEM With lessons learnt to date and end of stabilisation period approaching, MaMVO will be looking to put in place an alert management system (AMS) to facilitate coordination of communication amongst all players when handling alerts. MaMVO is participating in discussions at EMVO level to learn from best practices, and ensure that common decisions taken are feasible in view of Malta s particular pharmaceutical supply chain. MaMVO will probably consider an AMS favoured by other small countries, to ensure the system is suitable for Malta, whilst benefiting from shared costs in the validation and auditing of the system. MAH s will have the advantage of interacting with a system that they are already familiar with in other countries at an EU level.

BREXIT It is anticipated that EMVO will take over the GB repository so that data uploaded before the withdrawal date is maintained in the EU system, to allow medicines bought from UK before the withdrawal date or end of transition period to be authenticated by end users. The EMVO database should not allow upload of data by UK MAH s nor operations by UK end users after the withdrawal date. There would be no requirement to decommission medicines physically located in the UK after the withdrawal date or end of the transition period. Medicinal products leaving EU, destined for UK market, will have to be decommissioned as Exported before they leave the EU. If the products are subsequently re-imported back into the EU, the rules for batch release upon importation apply, i.e. the importer should have a MIA to allow them to place and upload safety features to the hub.

CONCLUSIONS AND OUTLOOK The MaMVS is a single national repository but exists and operates within a European Medicines Verification System. Keeping the system stable and operating reliably, whilst engaging in all the other activities needed to curate Malta's interests and responsibilities in this context requires a huge investment of time and effort. Many lessons have been learnt along the way on what is a very steep learning curve. Continued progress requires the collaboration of all parties involved.

QUESTIONS? MaMVO website: http://www.mamvo.org MaMVO e-mails: General queries: info@mamvo.org Alert-related communication: fmdalert@mamvo.org