MALTA MEDICINES VERIFICATION SYSTEM Time to put away

MALTA MEDICINES VERIFICATION SYSTEM Time to put away the crystal ball

Ma. MVS BY THE NUMBERS >300 days of live connection to the EU hub >200 end user organisations >200 marketing authorisation holders >3, 000 product codes >100, 000 scans weekly >800 alerts weekly >15, 000 batches >232 million packs

THE ONBOARDING SITUATION 250 200 Not connected Connected Digital wholesalers and manufacturers with wholesale distribution licences may have no practical need to connect to the Ma. MVS 150 100 50 0 Wholesalers Pharmacies Healthcare Institutions

THE Ma. MVS RELEASE TIMELINE � 31 -Oct-2019: Release 5 and 6 Authentication tokens expire after 30 minutes � Prime contact has to be a super user. � New URL domains for the portal (https: //portalmt. nmvo. eu/), the EVA (https: //eva-mt. nmvo. eu/), and end user software. Old domains supported until Autumn 2020. � Rate limitations imposed to avoid abuse of the system � � Authentication token requests limited to 600 requests / 5 minutes � Report requests limited to 200 requests / 5 minutes � Verification or pack state change requests configurable by Ma. MVO, based on justified need, to a maximum of 800 requests / 5 minutes.

THE Ma. MVS RELEASE TIMELINE � Release 6. 1 � � Scheduled for 12 th -13 th December Alert ID will change format (MT-XXX-XXX to MT-XXX-XXXXXX-XXX) Public system status dashboard Release 6. 2 � � Planned for April 2020 Support for TLS 1, 0 and 1. 1 security protocols will be fully withdrawn. � Dates are subject to the releases passing validation activity (IT Acceptance Testing - ITAT, User Acceptance Testing - UAT, Interoperability Testing - IOT) � There will be future, less frequent major releases.

ALERTS: LOCAL VS EXTERNAL USERS Trends in local vs externally raised alerts in the Ma. MVS Impact when manufacturers cause alerts in the Ma. MVS 25000 Number of Alerts 135000 115000 20000 Local scans Incoming IMT MMP synchronisation OBP-generated Total local scans 15000 10000 Impact when end users in other member states raise alerts in the Ma. MVS 5000 95000 Impact when MAH’s upload numbers of multimarket packs to other NMVO’s but not the Ma. MVS 75000 0 55000 42 43 44 45 Week Number 46 47 Number of Scans 30000

ALERTS: CLASSIFICATION BY PROCESS 100000 A 24 A 3 10000 A 52 A 68 A 7 1000 Distribution of Error Codes in Ma. MVS by Source Process - Nov-2019 Alerts caused by Bulk of pack (BOP) supports operations endonly users in against the national system. Thus pack is either other member Pack state changes either not find the pack (A 3) not found (A 3) orwill pack is found but already in the, states or the pack is found but is already in the requested state (A 7)Alerts caused by OBPs (MAHs) Single pack operations show all types of alerts 100 10 1 MAH PPSU Request MAH PPV Request National System Bulk Pack API National System Intermarket National System PPSU Request National System Single Pack API

ALERTS 800 A 2 A 3 A 7 Total scans 700 Number of Alerts 120000 Trends in Alert Types Raised by Local End Users in the Ma. MVS A 68 A 52 A 24 100000 A 52: Expiry date mismatch - <0. 05% Pack exists but expiry date does not match. Most frequently an issue of incorrect data upload. A 68: Batch number mismatch <0. 05% Pack exists but batch number does not match. Most scanner A 3: frequently Pack not found - <0. 1% issues. Most common current root is incomplete batch state - <0. 2% A 7 & A 24: cause Pack already in a requested A 2: Batch ID Unknown – <1% upload, thus as more Most common rootincreasing cause is repeat scanning, and (End user sees an A 3); FMD-compliant batches failure of double dispense byare IMT to Arvato 90 -95% being caused by released. systems. Increasing as more FMD-compliant packs that should not be placed on market. authenticated (missing ATD) 600 500 400 300 200 80000 60000 40000 20000 100 0 0 27 31 35 39 Week Number 43 47 Number of Scans 900

ALERTS AND WHOLESALE DEALERS “The purpose of the investigation in Article 37(d) is to rule out that alerts triggered in the Alerts Profile system have been caused for technical reasons, such as issues with the A 3 repository 33% system, data upload, data quality, incorrect end-user scanning or other similar technical A 2 issues. ” 56% “National competent authorities, EMA and the European Commission should be informed as soon as it is clear that alert A 7 reasons. ” A 24 cannot be explained by technical 1% 0% [Commission Q&A, Q 7. 17] A 68 A 52 1% 9% No response = No explanation Alerts raised by wholesale dealers Responsiveness to Ma. MVO have a slightly different distribution. Adequately responsive A 2 have a lower frequency since only a 28% few packs are scanned before realising there is a problem, as opposed to all packs scanned at pharmacy level. A 52 alerts have a higher frequency since these are commonly detected at wholesaler level and resolved before releasing the batch. Poorly Highly responsive A 7, A 24 and A 68 alerts have a much 28% 44% lower frequency since they are related to scanning activity.

LESSONS LEARNT Wholesaler Statement Ma. MVO Position “A wholesaler shall not supply or export a medicinal product where he has reason to believe that itspack/s. ” packaging has been tampered with, or where the verification of the safety “I’ll destroy the What if the pack should turn out to be a thepack/s medicinal “I’mfeatures sendingofthe backproduct to the indicates that the product may not be authentic. He suspected falsified medicine? shall immediately inform the relevant competent authorities. ” [DR, Article 24] supplier. ” MAH’s have complained of lack of availability (when root cause of an alert has not yet of photographic evidence. “Wholesale distributors must immediately inform the competent authority and the been determined) marketing authorisation holder of any medicinal products they identify as falsified or “[The suspect supplierto said a Stabilisation periods authorised in other be that] There’s falsified. A procedure should be in place to this effect. It should be stabilisation <country source>” countries don’t apply to Malta. recorded period with allinthe originalofdetails and investigated. ” [GDP Guidelines, Section 6. 4] Downstream actors in the supply chain, who “Any falsified medicinal products found in the supply chain should immediately be have neither placed the unique identifier on “I’m physically purchasingsegregated from the same (wholesale and stored in a dedicated area away from all other medicinal the medicinal product nor uploaded the data to dealer) supplier I alwaysactivities used. I’min 100% products. All relevant relation to such products should be documented and the repositories system, are not in a position to confident the packs are not falsified. ” records retained. ” [GDP Guidelines, Section 6. 4] be “ 100% confident” that a particular pack is not a falsified medicinal product.

LESSONS LEARNT Wholesaler Statement Ma. MVO Position Placed on market Safety feature before 9 th February after 9 th February “[The supplier said that] he is not obliged to scan every pack” (in cases where The alert still remains unresolved. verification has generated pack level Any medicine with a No need alerts) UI but not ATD (Not an FMD-compliant pack) “The [fully FMD-compliant] packs were The transitional measures do not apply to released before the 9 th February. ” Yes packs that are fully FMD-compliant. Any medicine having Transitional measures do not Yes both a UI and an apply to packs that are fully (FMD-compliant pack) “There’s The stabilisation period guidance instructs not ATD [still] a stabilisation period at FMD-compliant pharmacy level [in Malta]. ” (for packs to withhold product due to alerts. It does not which cannot be authenticated) instruct not to authenticate.

LESSONS LEARNT Wholesaler Statement Ma. MVO Position “[The supplier said that] The manufacturer said that <technical reason>” Ma. MVO cannot resolve alerts on the basis of hearsay. Original manufacturer statements must be provided. The data in the system belongs to the MAH. Original “The MAH has appointed me to deal communication of authorisation must be provided to with alerts. . ” Ma. MVO {Wholesalers marking packs as Supplied} The decommissioning of packs as Supplied requires national legislation permitting this activity. In the absence of said legislation, it is a breach of terms of use, and subject to suspension of account.

AUTHORISED & UNAUTHORISED ACTIONS Reactivation* Manufacture r Parallel Distributor Pharmacist Wholesaler Recall batch ✔ ✔ Verify pack - ✔ ✔ Mark pack as supplied ✔ ✔ ✔*** Mark pack as checked-out ✔ Export pack from EU ✔ ✔ Withdraw product ✔ ✔ Mark pack as stolen ✔ ✔ ✔ Mark pack as destroyed ✔ ✔ Mark pack as free sample ✔ ✔ Mark pack as sample (NCA) ✔ ✔ ✔ Use Case Mark pack as locked ✔** ✔ ✔ ✔ *from same location within 10 days; **from same location (no time limit); ***if permitted by local law

KNOWN UN/EXPECTED BEHAVIOURS � � � Bulk of pack (BOP) is not supported in intermarket transaction (IMT). Therefore verification in BOP mode will only verify against the national system and generate a pack not found (A 3) alert if the pack is not present in the Ma. MVS. An IMT cannot function without a batch number. A pack not found alert will be generated in manual verification if only PC and SN are used, and an IMT is needed to find the pack. Arvato systems differ from SSR systems in alert generation: � � “Pack not found” generates an alert in Arvato systems but not in SSR. “Double dispense” works in IMT between SSR systems, but generates alerts in IMT to an Arvato systems, but not SSR systems, generate an alert when attempting to reactivate a pack past 10 -day limit. Work is under way to harmonise these alerts at European level.

KNOWN UN/EXPECTED BEHAVIOURS � � If a product code is incorrectly formatted in the UI (e. g. parentheses around the Application Identifiers), software can block requests from reaching the Ma. MVS, to prevent false alerts. Arvato systems currently require all 4 elements (PC, SN, Lot, Exp). If a manual verification triggers an IMT to an Arvato system (e. g. UK) � PC, SN, Batch (no EXP) triggers a serial number unknown alert (even if the pack does exist), but no Alert ID will be generated by the Arvato system. � PC, SN, Batch and Exp only works if full expiry date is known. If human format of Exp is month-year, manual verification with EXP is guesswork and can generate an A 52 error. � Arvato systems should be corrected in January.

ALERT MANAGEMENT SYSTEM � � With lessons learnt to date and end of stabilisation period approaching, Ma. MVO will be looking to put in place an alert management system (AMS) to facilitate coordination of communication amongst all players when handling alerts. Ma. MVO is participating in discussions at EMVO level to learn from best practices, and ensure that common decisions taken are feasible in view of Malta’s particular pharmaceutical supply chain. Ma. MVO will probably consider an AMS favoured by other small countries, to ensure the system is suitable for Malta, whilst benefiting from shared costs in the validation and auditing of the system. MAH’s will have the advantage of interacting with a system that they are already familiar with in other countries at an EU level.

BREXIT � � It is anticipated that EMVO will take over the GB repository so that data uploaded before the withdrawal date is maintained in the EU system, to allow medicines bought from UK before the withdrawal date or end of transition period to be authenticated by end users. The EMVO database should not allow upload of data by UK MAH’s nor operations by UK end users after the withdrawal date. There would be no requirement to decommission medicines physically located in the UK after the withdrawal date or end of the transition period. Medicinal products leaving EU, destined for UK market, will have to be decommissioned as Exported before they leave the EU. If the products are subsequently re-imported back into the EU, the rules for batch release upon importation apply, i. e. the importer should have a MIA to allow them to place and upload safety features to the hub.

CONCLUSIONS AND OUTLOOK � � � The Ma. MVS is a single national repository but exists and operates within a European Medicines Verification System. Keeping the system stable and operating reliably, whilst engaging in all the other activities needed to curate Malta's interests and responsibilities in this context requires a huge investment of time and effort. Many lessons have been learnt along the way on what is a very steep learning curve. Continued progress requires the collaboration of all parties involved.

QUESTIONS? � Ma. MVO website: http: //www. mamvo. org � Ma. MVO e-mails: � General queries: info@mamvo. org � Alert-related communication: fmdalert@mamvo. org