Russia confirms shorter ‘crypto-code’ for pharma traceability

Russia has cut the length of the codes that will be used to verify pharmaceuticals in the supply chain in response to industry concerns.

From January 1, 2020, medicinal product packs distributed in Russia will have to have a unique, serialised product identification (UPID) code that will allow them to tracked through the supply chain.

Unlike other track-and-trace systems in Europe and the US, Russia opted for a code with a cryptographic element – or ‘crypto-code’ – in a bill published last December. The cryptographic ‘tail’ consisted of a verification key and an electronic signature, adding to the identification element which included a Global Trade Item Number (GTIN) and serial number.

The move came despite industry concerns that going down that route raised serious technical difficulties that could make compliance with the new requirements a challenge, and came despite the fact the cryptographic element wasn’t included in a pilot phase started in 2017.

Some pharma companies had been arguing that the crypto-code should be abandoned altogether, but it has some important advantages, including allowing offline authentication of products.

Recently the Russian government revised its official position on the printable code via a new decree (No. 1118) that cut the length of the cryptographic element of the code to 44 characters from 88, and the overall length of the code from 122 characters to 78.

The move means that smaller and easier-to-print codes can now be printed to meet the 2020 requirement, although they will still be larger than those used in the US and Europe.

The Russian requirements still introduce a level of detail beyond other systems, however, including need to provide updates to the central database at every major step in the supply chain.

The cryptographic tail is generated by the national system operator CRPT (Centre for Advanced Technology Development) rather than the medicine manufacturer. The manufacturer sends GTIN and serial number data to CRPT via the cloud, and receives the corresponding crypto-code for incorporation into the UPID.

Any product released to market prior to January 1, 2020, do not need to comply with the new requirements.