Commission Delegated Regulation (EU) 2016/161Show full title

CHAPTER VII ESTABLISHMENT, MANAGEMENT AND ACCESSIBILITY OF THE REPOSITORIES SYSTEM

Article 31 Establishment of the repositories system

1. The repositories system where the information on the safety features shall be contained, pursuant to Article 54a(2)(e) of Directive 2001/83/EC, shall be set up and managed by a non-profit legal entity or non-profit legal entities established in the Union by manufacturers and marketing authorisation holders of medicinal products bearing the safety features.

2. In setting up the repositories system, the legal entity or entities referred to in paragraph 1 shall consult at least wholesalers, persons authorised or entitled to supply medicinal products to the public and relevant national competent authorities.

3. Wholesalers and persons authorised or entitled to supply medicinal products to the public are entitled to participate in the legal entity or entities referred to in paragraph 1, on a voluntary basis, at no cost.

4. The legal entity or entities referred to on paragraph 1 shall not require manufacturers, marketing authorisation holders, wholesalers or persons authorised or entitled to supply medicinal products to the public to be members of a specific organisation or organisations in order to use the repository system.

5. The costs of the repositories system shall be borne by the manufacturers of medicinal products bearing the safety features, in accordance with Article 54a(2)(e) of Directive 2001/83/EC.

Article 32 Structure of the repositories system

1. The repositories system shall be composed of the following electronic repositories:

(a) a central information and data router (‘hub’);

(b) repositories which serve the territory of one Member State (‘national repositories’) or the territory of multiple Member States (‘supranational repositories’). Those repositories shall be connected to the hub.

2. The number of national and supranational repositories shall be sufficient to ensure that the territory of every Member State is served by one national or supranational repository.

3. The repositories system shall comprise the necessary information technology infrastructure, hardware and software to enable the execution of the following tasks:

(a) upload, collate, process, modify and store the information on the safety features that enables the verification of the authenticity and identification of medicinal products;

(b) identify an individual pack of a medicinal product bearing the safety features and verify the authenticity of the unique identifier on that pack and decommission it at any point of the legal supply chain.

4. The repositories system shall include the application programming interfaces allowing wholesalers or persons authorised or entitled to supply medicinal products to the public to query the repositories system by means of software, for the purposes of verifying the authenticity of the unique identifiers and of decommissioning them in the repositories system. The application programming interfaces shall also allow national competent authorities to access the repositories system by means of software, in accordance with Article 39.

The repositories system shall also include graphical user interfaces providing direct access to the repositories system in accordance with Article 35(1)(i).

The repositories system shall not include the physical scanning equipment used for reading the unique identifier.

Article 33 Uploading of information in the repositories system

1. The marketing authorisation holder or, in case of parallel imported or parallel distributed medicinal products bearing an equivalent unique identifier for the purposes of complying with Article 47a of Directive 2001/83/EC, the person responsible for placing those medicinal products on the market, shall ensure that the information referred to in paragraph 2 is uploaded to the repositories system before the medicinal product is released for sale or distribution by the manufacturer, and that it is kept up to date thereafter.

The information shall be stored in all national or supranational repositories serving the territory of the Member State or Member States where the medicinal product bearing the unique identifier is intended to be placed on the market. The information referred to in paragraphs 2(a) to (d) of this Article, with the exception of the serial number, shall also be stored in the hub.

2. For a medicinal product bearing a unique identifier, at least the following information shall be uploaded to the repositories system:

(a) the data elements of the unique identifier in accordance with Article 4(b);

(b) the coding scheme of the product code;

(c) the name and the common name of the medicinal product, the pharmaceutical form, the strength, the pack type and the pack size of the medicinal product, in accordance with the terminology referred to in Article 25(1)(b) and (e) to (g) of the Commission Implementing Regulation (EU) No 520/2012(1);

(d) the Member State or Member States where the medicinal product is intended to be placed on the market;

(e) where applicable, the code identifying the entry corresponding to the medicinal product bearing the unique identifier in the database referred to in Article 57(1)(l) of Regulation (EC) No 726/2004 of the European Parliament and the Council(2);

(f) the name and address of the manufacturer placing the safety features;

(g) the name and address of the marketing authorisation holder;

(h) a list of wholesalers who are designated by the marketing authorisation holder, by means of a written contract, to store and distribute the products covered by his marketing authorisation on his behalf.

3. The information referred to in paragraph 2 shall be uploaded to the repositories system either through the hub or through a national or supranational repository.

Where the upload is performed through the hub, the hub shall store a copy of the information referred to in paragraph 2(a) to (d), with the exception of the serial number, and transfer the complete information to all national or supranational repositories serving the territory of the Member State or Member States where the medicinal product bearing the unique identifier is intended to be placed on the market.

Where the upload is performed through a national or supranational repository, that repository shall immediately transfer to the hub a copy of the information referred to in paragraph 2(a) to (d), with the exception of the serial number, using the data format and data exchange specifications defined by the hub.

4. The information referred to in paragraph 2 shall be stored in the repositories where it was originally uploaded for at least one year after the expiry date of the medicinal product or five years after the product has been released for sale or distribution in accordance with Article 51(3) of Directive 2001/83/EC, whichever is the longer period.

Article 34 Functioning of the hub

1. Each national or supranational repository composing the repositories system shall exchange data with the hub using the data format and data exchange modalities defined by the hub.

2. When the authenticity of the unique identifier cannot be verified because a national or supranational repository does not contain a unique identifier with the product code and serial number that are identical to those of the unique identifier being verified, the national or supranational repository shall transfer the query to the hub in order to verify whether that unique identifier is stored elsewhere in the repositories system.

When the hub receives the query, the hub shall identify, on the basis of the information contained therein, all national or supranational repositories serving the territory of the Member State or Member States where the medicinal product bearing the unique identifier was intended to be placed on the market, and shall transfer the query to those repositories.

The hub shall subsequently transfer the reply of those repositories to the repository which initiated the query.

3. Where notified by a national or supranational repository of the change of status of a unique identifier, the hub shall ensure the synchronisation of that status between those national or supranational repositories serving the territory of the Member State or Member States where the medicinal product bearing the unique identifier was intended to be placed on the market.

4. When it receives the information referred to in Article 35(4), the hub shall ensure the electronic linking of the batch numbers before and after the repackaging or re-labelling operations with the set of unique identifiers decommissioned and with the set of equivalent unique identifiers placed.

Article 35 Characteristics of the repositories system

1. Each repository in the repositories system shall satisfy all of the following conditions:

(a) it shall be physically located in the Union;

(b) it shall be set up and managed by a non-profit legal entity established in the Union by manufacturers and marketing authorisation holders of medicinal products bearing the safety features and, where they have chosen to participate, wholesalers and persons authorised or entitled to supply medicinal products to the public;

(c) it shall be fully interoperable with the other repositories composing the repositories system; for the purposes of this Chapter, interoperability means the full functional integration of, and electronic data exchange between repositories regardless of the service provider used;

(d) it shall allow the reliable electronic identification and authentication of individual packs of medicinal products by manufacturers, wholesalers and persons authorised or entitled to supply medicinal products to the public, in accordance with the requirements of this Regulation;

(e) it shall have application programming interfaces able to transfer and exchange data with the software used by wholesalers, persons authorised or entitled to supply medicinal products to the public and, where applicable, national competent authorities;

(f) when wholesalers and persons authorised or entitled to supply medicinal products to the public query the repository for the purposes of verification of authenticity and decommissioning of a unique identifier, the response time of the repository, not considering the speed of the internet connection, shall be lower than 300 milliseconds in at least 95 % of queries. The repository performance shall allow wholesalers and persons authorised or entitled to supply medicinal products to the public to operate without significant delay;

(g) it shall maintain a complete record (‘audit trail’) of all operations concerning a unique identifier, of the users performing those operations and the nature of the operations; the audit trail shall be created when the unique identifier is uploaded to the repository and be maintained until at least one year after the expiry date of the medicinal product bearing the unique identifier or five years after the product has been released for sale or distribution in accordance with Article 51(3) of Directive 2001/83/EC, whichever is the longer period;

(h) in accordance with Article 38, its structure shall be such as to guarantee the protection of personal data and information of a commercially confidential nature and the ownership and confidentiality of the data generated when manufacturers, marketing authorisation holders, wholesalers and persons authorised or entitled to supply medicinal products to the public interact with it;

(i) it shall include graphical user interfaces providing direct access to it to the following users verified in accordance with Article 37(b):

(i)

wholesalers and persons authorised or entitled to supply medicinal products to the public, for the purposes of verifying the authenticity of the unique identifier and decommissioning it in case of failure of their own software;

(ii)

national competent authorities, for the purposes referred to in Article 39;

2. Where the status of a unique identifier on a medicinal product intended to be placed on the market in more than one Member State changes in a national or supranational repository, that repository shall immediately notify the change of status to the hub, except in case of decommissioning by marketing authorisation holders in accordance with Articles 40 or 41.

3. National or supranational repositories shall not allow the upload or storage of a unique identifier containing the same product code and serial number as another unique identifier already stored therein.

4. For each batch of repackaged or relabelled packs of a medicinal product on which equivalent unique identifiers were placed for the purposes of complying with Article 47a of Directive 2001/83/EC, the person responsible for placing the medicinal product on the market shall inform the hub of the batch number or numbers of the packs which are to be repackaged or relabelled and of the unique identifiers on those packs. He shall additionally inform the hub of the batch number of the batch resulting from the repackaging or re-labelling operations and the equivalent unique identifiers in that batch.

Article 36 Operations of the repositories system

The repositories system shall provide for at least the following operations:

(a)

the repeated verification of the authenticity of an active unique identifier in accordance with Article 11;

(b)

the triggering of an alert in the system and in the terminal where the verification of the authenticity of a unique identifier is taking place when such verification fails to confirm that the unique identifier is authentic in accordance with Article 11. Such an event shall be flagged in the system as a potential incident of falsification except where the product is indicated in the system as recalled, withdrawn or intended for destruction;

(c)

the decommissioning of a unique identifier in accordance with the requirements of this Regulation;

(d)

the combined operations of identification of a pack of a medicinal product bearing a unique identifier and verification of the authenticity and decommissioning of that unique identifier;

(e)

the identification of a pack of a medicinal product bearing a unique identifier and the verification of the authenticity and the decommissioning of that unique identifier in a Member State which is not the Member State where the medicinal product bearing that unique identifier was placed on the market;

(f)

the reading of the information contained in the two-dimensional barcode encoding the unique identifier, the identification of the medicinal product carrying the barcode and the verification of the status of the unique identifier, without triggering the alert referred to in point (b) of this Article;

(g)

without prejudice to Article 35(1)(h), the access by verified wholesalers to the list of wholesalers referred to in Article 33(2)(h) for the purposes of determining whether they have to verify the unique identifier of a given medicinal product.

(h)

the verification of the authenticity of a unique identifier and its decommissioning by manually querying the system with the data elements of the unique identifier;

(i)

the immediate provision of information concerning a given unique identifier to the national competent authorities and the European Medicines Agency, upon request;

(j)

the creation of reports that allow competent authorities to verify compliance of individual marketing authorisation holders, manufacturers, wholesalers and persons authorised or entitled to supply medicinal products to the public with the requirements of this Regulation or to investigate potential incidents of falsification;

(k)

the reverting of the status of a unique identifier from decommissioned to active, subject to the conditions referred to in Article 13;

(l)

the indication that a unique identifier has been decommissioned;

(m)

the indication that a medicinal product has been recalled, withdrawn, stolen, exported, requested as a sample by national competent authorities, indicated as a free sample by the marketing authorisation holder, or is intended for destruction;

(n)

the linking, by batches of medicinal products, of the information on unique identifiers removed or covered to the information on the equivalent unique identifiers placed on those medicinal products for the purposes of complying with Article 47a of Directive 2001/83/EC.

(o)

the synchronisation of the status of a unique identifier between the national or supranational repositories serving the territory of the Member States where that medicinal product is intended to be placed on the market.

Article 37 Obligations of legal entities establishing and managing a repository which is part of the repositories system

Any legal entity establishing and managing a repository which is part of the repositories system shall perform the following actions:

(a)

inform the relevant national competent authorities of its intention to physically locate the repository or part of it in their territory and notify them once the repository becomes operational;

(b)

put in place security procedures ensuring that only users whose identity, role and legitimacy has been verified can access the repository or upload the information referred to in Article 33(2);

(c)

continuously monitor the repository for events alerting to potential incidents of falsification in accordance to Article 36(b);

(d)

provide for the immediate investigation of all potential incidents of falsification flagged in the system in accordance with Article 36(b) and for the alerting of national competent authorities, the European Medicines Agency and the Commission should the falsification be confirmed;

(e)

carry out regular audits of the repository to verify compliance with the requirements of this Regulation. Audits shall take place at least annually for the first five years after this Regulation becomes applicable in the Member State where the repository is physically located, and at least every three years thereafter. The outcome of those audits shall be provided to competent authorities upon request;

(f)

make the audit trail referred to in Article 35(1)(g) immediately available to competent authorities upon their request;

(g)

make the reports referred to in Article 36(j) available to competent authorities upon their request.

Article 38 Data protection and data ownership

1. Manufacturers, marketing authorisation holders, wholesalers and persons authorised or entitled to supply medicinal products to the public shall be responsible for any data generated when they interact with the repositories system and stored in the audit trail. They shall only have ownership of and access to those data, with the exception of the information referred to in Article 33(2) and the information on the status of a unique identifier.

2. The legal entity managing the repository where the audit trail is stored shall not access the audit trail and the data contained therein without the written agreement of the legitimate data owners except for the purpose of investigating potential incidents of falsification flagged in the system in accordance with Article 36(b).

Article 39 Access by national competent authorities

A legal entity establishing and managing a repository used to verify the authenticity of or decommission the unique identifiers of medicinal products placed on the market in a Member State shall grant access to that repository and to the information contained therein, to competent authorities of that Member State for the following purposes:

(a)

supervising the functioning of the repositories and investigating potential incidents of falsification;

(b)

reimbursement;

(c)

pharmacovigilance or pharmacoepidemiology.

(1)

Commission Implementing Regulation (EU) No 520/2012 of 19 June 2012 on the performance of pharmacovigilance activities provided for in Regulation (EC) No 726/2004 of the European Parliament and of the Council and Directive 2001/83/EC of the European Parliament and of the Council (OJ L 159, 20.6.2012, p. 5).

(2)

Regulation (EC) No 726/2004 of the European Parliament and of the Council of 31 March 2004 laying down Community procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency (OJ L 136, 30.4.2004, p. 1).