Frequently Asked Questions - SecurMedSecurMed

Frequently Asked Questions

Click on a category below to see the appropriate questions and answers.

General

Will FMD compliant packs only have the 2D barcode? Therefore, by default, non FMD packs will have the 1D barcode and not require scanning ?

FMD compliant packs will have the 2D Matrix, Human-readable information and the Anti-tamper device. FMD Source is creating some guidance to help determine which packs are in scope of FMD and which are not based on their physical characteristics.

What is the process for dispensing if the system goes down and we queue up messages. Are we expected to withhold all medicines until the items are verified and dispensed through the mixed bulk transactions?

In these cases, professional judgement will need to be used. The RPS and other professional bodies are writing guidance for their members. It is not expected that medication, particularly essential medication, should be withheld due to a system error. Many systems have implemented a queuing system that will allow dispensing to continue and the items will be decommissioned when the system is back on line, any error messages returned can be retrospectively dealt with by exception. It should be noted that the NMVS has a resilient architecture and so outages should be very rare.

Where can GPs get further information?

There is plenty of information available online in relation to the Falsified Medicines Directive. A GP FMD Toolkit is currently in development by NHS Digital and will be available on the MHRA website shortly. The BMA and DDA also have information for doctors on their websites; https://www.bma.org.uk/ https://www.dispensingdoctor.org/ and the MHRA website - https://www.gov.uk/guidance/implementing-the-falsified-medicines-directive-safety-features Doctors can also email the BMA directly info.gpc@bma.org.uk

Will the NHS Digital presentation from 15th Nov 2018 be made available?

A recording of the webinar can be viewed on YouTube: https://hscic.webex.com/hscic/ldr.php?RCID=d90be3df4d1f60f69a69c9eeb424bd94 The Presentation can be downloaded from this link: Webinar – End user registration presentation 15 Nov 18  

Is aggregation data available in the NMVS/EMS?

Aggregation data is not available in the NMVS/EMVS. Off-system solutions may be available dependent on the particular supply chain system. Further guidance is expected from the UK NCAs.

Is supply-side aggregation only being considered for hospitals?

Aggregation for Hospitals has been considered by stakeholders but will not be implemented in the near term (up to 3 years).

What happens in the result of a negative response to a pack scan?

Work on 'Exceptions and Alerts', including the risk of false positives, is underway in multiple stakeholder forums and guidance will ultimately be published. SecurMed UK is actively engaged in the process.

Can you provide product codes so that we can map to local inventory codes?

The Master Data Download (G101) transaction will supply a list of GTINs in the system and the NHRN field will include the AMPP code that links to the dm+d directory maintained by NHS Digital. See the SecurMed UK FAQ at https://www.securmed.org.uk/wp-content/uploads/2018/10/AMPP-code-FAQ.pdf

How many manufacturers are now supplying codes to SecurMed UK?

Product, Batch and Pack data started being transmitted to the UK MVS when SecurMed UK was connected to the European Hub (EMVS) on 31st October 2018. Data for millions of packs is already downloaded. SecurMed UK is monitoring the position but will not publish metrics for volumes of packs held in the system.

I am a Community Pharmacist; where can I find more information on FMD specifically related to my sector?

SecurMed UK is engaging Community Pharmacy through the FMD Working Group set up by NPA, CCA and CP inductry associations. The FMDSource web-site is a good reference for pharamcists interested in FMD. We are also working with Community Pharamcy Scotland, Community Pharmacuy Wales and Pharmacy Services Northern Ireland. www.fmdsource.co.uk

Will anti-tamper devices be allowed on OTCs and other out-of-scope products after February 2019?

The MHRA has confirmed that subject to the outcome of a public consultation anti-tamper devices may continue to be placed on out-of-scope products after 9th February 2019 if the relevant manufacturer considers that it is necessary to do so in the interests of patient safety. Similarly, anti-tamper devices may be placed on new out-of-scope products introduced to the market after February 2019, based on a similar risk assessment and on a voluntary basis.

How will the FMD be enforced?

Enforcement of FMD in Member States is the responsibility of national competent authorities. In the UK this will mean that the MHRA will consult on amending legislation which will introduce new sanctions against all those in the medicines supply chain who are impacted by the Delegated Regulation. The MHRA is responsible for enforcement against marketing authorisation holders, manufacturers and wholesalers. Further information will be made available in due course. Input will be required from GPhC and other regulator.

Where can I find a copy of the Delegated Regulation?

You can find the Delegated Regulation at: https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-1/reg_2016_161/reg_2016_161_en.pdf . Please copy the link into your browser.

Which medicines are in scope of FMD?

For details of the scope of the regulation please check: FMD Delegated Regulation 2016_161 Where stakeholders are unclear on the proposed legislation, for example - whether types of medicine are in/out of scope, please contact DHSC/MHRA at fmd.safetyfeatures@mhra.gov.uk All Pharmacy Only (P), General Supply List (GSL) - except Annex II, Unlicensed and Specialty medicines are out of scope.

We have a radio-pharmaceutical MA that is a POM medicines, do we need to register with SecurMed UK?

Radiopharmaceuticals are out of scope of the FMD requirements as set out in Annex I Delegated Regulation.  Therefore you do not need to register with SecurMed UK or pay fees to us.

How will Brexit affect the Falsified Medicines Directive and its' processes?

The current information we have on Brexit is that the UK remains a part of the EU and all rights and obligations of EU Membership remain in force until we leave.  That means the FMD and Delegated Regulation will come into force on 09-Feb-2019 and all obliged stakeholders need to prepare for this regulation.   That is our guidance and direction from Dept of Health & Social Care and MHRA and was re-confirmed on 23-Jan-2018.  

What is the EMVO and how can I contact them?

The European Medicines Verfication Organsiation (EMVO) is a Belgian non-profit organisation representing stakeholders united in securing the legal supply chain from falisified medicines. For more details go to their website: www.emvo-medicines.eu  

I operate within the Secondary Care sector; where can I find information related to FMD Specifically related to my sector?

The NHS publish information, including frequently asked questions about FMD on their Specialist Pharmacy website: www.sps.nhs.uk

Where can I find more information on FMD for Hospital Pharmacies, Doctiors, GPs and Health Centres?

SecurMed UK is working with NHS Digital to support NHS organisations in England for Hospital Pharmacy and Doctors, GPs and Health Centres. Through NHS Digital SecurMed UK will be engaging with NHS Services/Informatics in Scotland, Wales, Northern Island, Channel Islands and Isle of Man. For more info please contact NHS Digital at: FMD@nhs.net

I am a Wholesaler/Distributor; where can I find more information on FMD specifically related to my sector in the UK?

SecurMed UK is supported by the Healthcare Distribution Association (HDA) to engage with  and communicate with Wholesalers and Distributors. Pease refer to the HDA webiste for further information about the FMD implementation. www.hdauk.com

I am a biopharmaceutical operating within the research sector; where can I find more information about FMD?

The Association of the Brtiish Pharmaceutical Inducstry (ABPI) is the trade association for the researh-based pharamceutical industry in the UK. Please visit their website. www.abpi.org.uk

I am a Manufacturer; where can I find more information?

I am a European Parrallel Distributor/Importer; where can I find more information?

Please visit: www.eaepc.org

Where can I find the EU Commission Q&A on FMD?

How can I keep up-to-date on the latest developments with implementation?

MHRA circulates a monthly FMD Safety Features Newsletter - its aim is to keep stakeholders posted on the latest developments with implementation. If you don't currently receive a copy of the newsletter and would like to, please email the FMD mailboxb with the following - your name, your organisation (if applicable) and your title (if applicable). FMD.safetyfeatures@mhra.gov.uk

Where can I get more information of the safety features aspects of FMD?

The Department of Health and Medicines & Healthcare products Regulatory Agency (MHRA) have set up a dedicted mailbox to receive enquiries about the implementation of the safety features aspects of the Falsified Medicines Directive. The mailbox is monitored daily and you can expect to receive a response within 5 working days. Please contact : FMD.safetyfeatures@mhra.gov.uk

Where can I find information about packaging and labelling changes as a result of FMD?

Where stakeholders are unclear on the proposed legislation, for example - packaging and labelling changes, please contcat DHSC/MHRA at FMD.safetyfeatures@mhra.gov.uk

What is the definition of a Healthcare Institution in scope of FMD for the UK

Article 3(f) Delegated Regulation identifes a Healthcare Institution as a Hospital, In- or Out-Patient Clinic or a Health Centre.   DHSC, MHRA and the GMC/BMA agreed in July 2016 that all GP Surgeries and Practices in the UK are considered Healthcare Institutions.

Does Article 37(d) require that a national medicine verification organisation (NMVO) directly alerts the relevant national competent authorities, the EMA and the Commission about a falsification? Is there is a time limit for such alerting?

The use of the term "provide for" in Article 37(d) of Commission Delegated Regulation (EU) 2016/161 means that an NMVO has to ensure that the National Competent Authorities (NCA), the EMA and the Commission are informed. The NMVO can fulfil this obligation either directly or by ensuring this task is performed by someone else.

I am a Clinic (health centre). What is the position related to FMD for clinics e.g. abortion clinics?

Article 3 Delegated regulation states healthcare institution 'means a hospital, in- or out-patient clinic or health centre.' Clinics are included within the scope of FMD so will need to decommision medicines.

I am an IT Company who supplies track & trace software. Where do I register? 

Manufacturers upload data to the European hub - information regarding becoming an Onboarding Partner can be found at www.emvo-medicines.eu 

How do I contact the UK National Medicines Verification Organisation (UK NMVO) – SecurMed UK?

SecurMed UK can be contacted via email at info@securmed.org.uk and or via www.securmed.org.uk

Does the European Commission have a FAQ / Q&A document?

The European Commission publishes and regularly updates a Q&A at the following link to facilitate consistent implementation of the new safety feature requirements across Europe. https://ec.europa.eu/health/sites/health/files/files/falsified_medicines/qa_safetyfeature_v9.pdf

Will there be a consultation? Will there be an impact assessment?

The consultation and impact assessment have now been published and can be viewed here: https://www.gov.uk/government/consultations/implementing-safety-features-under-the-falsified-medicines-directive

What is the difference between decommissioning and verification?

Verification is a process that can take place at any time during movement of the medicine through the supply chain. It checks the Unique Identifier of the product against data held in the national repository to verify that the product is authentic and is available for supply to the patient.

Does FMD apply to clinical trials materials? If an existing licensed drug is used in a clinical trial, when would it need to be decommissioned?

No, the clinical trial supply chain sits outside the scope of the Delegated Regulation. However, if a pack of medicines within the scope of the Delegated Regulation is to enter the clinical trial supply chain and intended to be used as an investigational medicinal product, it must be decommissioned before it leaves the ‘commercial’ supply chain and becomes part of the trial medication stock.

Who will have to decommission homecare supplied drugs?

Where medicines are dispensed for a named patient as a homecare supplied drug, the medicine will be decommissioned by the homecare service provider ‘at the time of supply’ to that patient.

What are the UK pack labelling requirements?

The UK pack labelling requirements are: - Product code in GTIN format - Batch Number - Expiry Date - Unique serialisation number - 2D matrix

Will the UK require a reimbursement code as well? Can additional information be included in the 2D matrix?

The UK is planning not to require a reimbursement code and will allow additional information to be included in the 2D matrix provided this has been formally assessed as part of the marketing authorisation (both items subject to DHSC/MHRA public consultation).  

Can ‘soft-wrap (e.g. cellophane) bundle of packs be labelled with an individual label showing the UK pack labelling requirements (above)

The safety features legislation sits within point o of Article 54 of Council Directive 2001/83/EC. The expectation therefore is that the 2D data matrix code and associated information along with the anti-tampering device must be applied to packaging components which meet the full labelling provisions in Article 54 of the Directive. This has been considered by the European Commission and the recent version of the FAQs addresses this in more detail. https://ec.europa.eu/health/human-use/falsified_medicines_en

How does FMD link to dm+d and GS1?

The information stored in the 2D data matrix bar code will include a product code. The product code will comprise of the GTIN (Global Trade Identification Number). This is a GS1 code and creates a useful link to the EMA proposed ISO IDMP coding system. The EMVS Master data which will be uploaded for packs intended for the UK market will require the inclusion of a National Number – the dm+d AMPP. This will create a useful look-up facility between the GTIN and the AMPP.

Is there any order that the text has to appear in the 2D Matrix or as ‘human readable’ on the pack?

The UK will not require the text to appear in any particular order in the 2D matrix or on the pack. Changes to packs need to be submitted to the MHRA in the usual manner for approval.

Is it possible to convert EAN codes to GTIN by adding 0 at the beginning of GTIN or new GTIN will be issued?

Please refer to the European Pack Coding Guidelines from EFPIA

Is the Product Code (PC) taken obligatory from the Agency or it can be taken from MAH internal database assigned by GS1?

Please refer to the European Pack Coding Guidelines from EFPIA

Does SecurMed UK have a database of 14-digit GTIN codes?

No SecurMed - does not currently hold a database of these codes and recommend you contact the GS1 organisation if you need to find this information. However, as the EMVS is populated the NMVO will provide a useful look-up facility and link between GTIN and AMPP.

How does a company affiliate to GS1

Contact the GS1 organisation in your respective country or at www.gs1.org/contact

Are EMA Marketing Authorisations the same as UK MHRA Marketing Authorisations?  

No. EMA Marketing Authorisations are issued by the EMA under the Centralised Marketing Authorisation process. Once granted this entitles the MAH to market and distribute medicines within all EU member states without an additional local UK MA. It is recognised many medicines were issued in the EU member states before EMA was created so there are two additional processes - De-Centralised Process (DCP) and Mutual Recognition (MR) that are also used by companies to register medicines across the EU. In these cases, the marketing authorisations issues by each NCA will be national authorisations. Authorisations which permit marketing in the UK only will include either PL number or a PLPI number.

How will the EMVS & UK MVS cater for manufacturers of medicines who have multi-market packs labelled and supplied to UK and Ireland?

The EMVS system will manage data transfer and synchronise information relating to multi-market packs. OBP’s are expected to retrospectively upload data for multi-market packs as and when National repositories come on-line.

Do dental pharmaceuticals company need to comply with the FMD regulatory requirements?

Pharmaceutical companies manufacturing or supplying prescription only dental pharmaceuticals will need to comply with the FMD regulatory requirements. Dental practitioners are part of the MHRA consultation under Article 23.

Is Gibraltar in scope of the FMD implementation and what about British Crown Dependencies and British Overseas Territories?

MHRA have confirmed with UK Foreign Office that the Crown Dependencies of Jersey and Guernsey (including the other Channel Islands) and the Isle of Man are included within the FMD implementation. Gibraltar and all other British Overseas Territories e.g. Bermuda, British Virgin Islands, Falkland Islands, etc are out of scope of the FMD implementation.         

What is the definition of a Healthcare Institution in scope of FMD for the UK?

Article 3(f) Delegated Regulation defines a Healthcare Institution as a Hospital, In- or Out-Patient Clinic or a Health Centre.  The UK has classed General Practitioners (GPs) and Dispensing Doctors as health centres and therefore healthcare institutions.

A manufacturer has a WDA as does its' 3rd party logistics provider (3PL).  The 3PL was intending to decommission medicines on behalf of the manufacturer but the manufacturer wants to do all decommissioning itself in the EMVS using its WDA. Is this allowed?

Manufacturers point of upload of data should be as an OBP to the EMVS Hub. However, if the manufacturer holds a WDA at a National level, they will be expected to connect up to the national repository where they will have the facility available to a wholesaler, to verify and decommission medicines as described in Article 23.

Is aggregation permitted, in particular for use of downstream wholesalers?

The Delegated Regulation allows for aggregation but does not stipulate the need for pack aggregation and the EMVS / NMVS system does not support aggregation. It is for manufacturers and MAHs to decide unilaterally whether their IT functionality extends to aggregation of pack data.

If stock is transferred from one nominated site to another, does the receiving nominated site have to do full checks of the stock received?

If stock is transferred within the same designated wholesaler or to another designated wholesaler, then there is no need for packs to be verified under FMD. Normal GDP rules apply.

Who is going to pay for software and hardware changes in healthcare institutions, pharmacy and wholesaler systems - and how much will it cost?

Each healthcare institution, pharmacy and wholesaler will need to purchase the equipment required to enable it to scan the unique identifier and undertake verification and decommissioning. This will require the development of software to link through to the repository system via software changes and/or stand-alone systems depending on how systems are configured, and the support provided by your software supplier.

The national code does not need to be embedded in the 2D data matrix, however, according to the EMVO coding requirements, it is still required to be sent to the UK Medicines Verification System. Is there a document that explains the configuration, format, and dependencies on the national code requirement for the UK?

The UK National number is expected to be the dm+d AMPP (as of May 2018) -official dm+d browser: https://apps.nhsbsa.nhs.uk/DMDBrowser/DMDBrowser.do, alternate browser: http://dmd.medicines.org.uk/DesktopDefault.aspx?tabid=2 The UK regulator (MHRA) will confirm this following their consultation, which has now been published as can be seen at this link: https://www.gov.uk/government/consultations/implementing-safety-features-under-the-falsified-medicines-directive There is no need to share this number with the UK verification organisation – but it should be uploaded into the Master Data via the EU Hub. Any data upload questions involving the European Hub should be sent to EMVO.

Are medical devices in the scope of serialisation?

Medical Devices are not part of the FMD. There is a separate serialisation project outside of the FMD dealing with medical devices and suggest enquiries are directed to the MHRA about this.

There are some standalone devices without medicine and devices which contain medicinal product, do MAH have to apply serialisation on both?

If the medicine associated with a device has an MA and is included in the list or products within scope (virtually all POMs) then under the FMD, it should be labelled with safety features.

Who is responsible for implementing serialisation when an MAH is manufacturing and supplying ‘own label suppliers’?

The MAH of the medicine being placed on the market is the person legally responsible for compliance with the legislation. When a MAH is manufacturing for a certain national retail pharmacy but in their own label and the MA belongs to the MAH, then the MAH is responsible.  

How should serialisation be implemented for ‘titration’ packs, only to outer box or it should also be applied to the inner boxes too?

Serialisation should be applied to the pack which is the unit of sale and to which the labelling provisions in Article 54 of Council Directive 2001/83/EC apply. In the case of titration packs where different strengths of a medicine are included in separate blister strips within a single outer carton, the single outer carton will be serialised.

If product is manufactured outside the EU and batch released in the UK, who will be responsible for releasing the serial number in the HUB and when?

The On-Boarding partner (OBP) has the responsibility to upload data to the European Hub on behalf of its MAH’s. Please see the EMVO website for further details of how to register OBPs https://emvo-medicines.eu/pharmaceutical-companies. https://emvo-medicines.eu/pharmaceutical-companies

What is scan4safety? Is there a relationship to FMD?

Adoption of GS1 and PEPPOL standards associated with common ways of working have been selected by the UK Government to help transform the NHS. More information is available at https://www.scan4safety.nhs.uk/ Scan4safety is not part of the FMD. https://www.scan4safety.nhs.uk/Scan4safety

What is PEPPOL? Is there a relationship to FMD?

PEPPOL enables government organisations such as the NHS and private companies to exchange electronic trading documents over an interoperable, European-wide network. In simple terms it offers a standardised network connection for electronic ordering, invoicing and shipping. https://www.scan4safety.nhs.uk/Scan4safety

Does the UK Regulator, the MHRA produce guidance and advice on FMD?

The MHRA publishes a regular FMD Safety Features Newsletter. To receive copies, or place questions about FMD please use the dedicated mailbox, FMD.safetyfeatures@mhra.gov.uk

End User Registration

Will the NHS Digital presentation from 15th Nov 2018 be made available?

A recording of the webinar can be viewed on YouTube: https://hscic.webex.com/hscic/ldr.php?RCID=d90be3df4d1f60f69a69c9eeb424bd94 The Presentation can be downloaded from this link: Webinar – End user registration presentation 15 Nov 18  

Which registers are going to be used to verify end user locations?

The following may not be an exhaustive list:
  • General Pharmaceutical Council (GPhC)
  • Care Quality Commission (CQC)
  • Pharma Services Northern Ireland (PSNI)
  • Healthcare Improvement Scotland (HIS)
  • Wholesalers (EudraGDMP)
  • Health Inspectorate Wales
  • Health of Wales Information service
  • Care Inspectorate Wales
  • Care Inspectorate (Scotland)
  • NHS National Services Scotland (Common Services Agency)
Please contact DHSC for any queries FMD.safetyfeatures@MHRA.gov.uk  

Hospital pharmacies in Wales are not necessarily registered with GPhC. If not, who would they put?

Hospitals are expected to be registered with CQC in England, and similar organisations in Scotland (HIS), Wales (CIW, HIW), NI (PSNI, or other).

Is each GP a separate legal entity?

We would expect each GP surgery (with one or more GP partners) to be separate legal entities. SecurMed UK are required to register locations, not people.

If you have wholly owned subsidiaries across the trust hospitals, do the individual subsidiaries need to be registered separately to the hospital it is located in?

We will verify against the entry in CQC (or equivalent). The company/organisation/entity name which appears will be required for registration to verify the location. If you have any doubts about being one or more locations please seek advice from the DHSC via fmd.safetyfeatures@MHRA.gov.uk.

One hospital has several 'goods in' locations. Is this a single or bulk registration?

Each location must be identifiable within the UK NMVS. Bulk files can contain 1 or more locations from 1 or more legal entities. The credentials will be returned by an email to the requestor and a letter to the location (for each entry) as the standard process. If you are unsure if your location is one location or more than one you should seek guidance from the appropriate National Competent Authority (NCA) who can be contacted via FMD.safetyfeatures@MHRA.gov.uk SecurMed UK will provide credentials for locations registered by professional/sectoral registration bodies (Namely: GPhC, CQC, EudraGMDP, HIW, NIS, PSNI etc). You may find that by applying the same logic used for these registrations will help determine how to register with SecurMed.

Will a legal entity with multiple locations require a unique user ID and certificate per location?

A location needs to be registered uniquely. It is recommended that you follow what exists on GPhC, CQC (or equivalent). For example: There are two community pharmacies from the same company in Othertown town centre, each requires to be registered and individual credentials assigned.

If you have 2 dispensaries in the same hospital, do they each need a certificate?

If you are in doubt about whether you need to register your location with SecurMed, the only authorised source of guidance is the DHSC, who can be contacted via FMD.safetyfeatures@MHRA.gov.uk If you are unsure if your location is one location or more than one, you should seek guidance from the appropriate National Competent Authority (NCA) who can be contacted via FMD.safetyfeatures@MHRA.gov.uk SecurMed UK will provide credentials for locations registered by professional/sectoral registration bodies (Namely: GPhC, CQC, EudraGMDP, HIW, NIS, PSNI etc). You may find that applying the same logic used for these registrations will help determine how to register with SecurMed. If you have a wholesaler license and a pharmacy at your location, you will require separate access for each (the transactions assigned vary slightly). Please register both functions.

With bulk registrations, will each location have a unique user id/ certificate for us to access against the corresponding location?

Yes, each location will have a unique user id / certificate.

When using the bulk registration method for onboarding locations, can our organisation to provide authorisation on behalf of all locations in a single notification?

Authorisation is required from each legal entity, for any number of locations. If you submit a bulk file for multiple legal entities, the EULA can only be accepted once for each file, so ensure you have permission from each legal entity before submission.

Is the end user registration process scalable for 9000 GP Practices across the UK, many with multiple Branch locations?

Yes, we will recruit sufficient staff to deal with this workload. It would be helpful if you could forecast when you plan to register with us. Please email registration@securmed.org.uk If you send us a large bulk file, it may be processed in weekly batches.

I've received certificate access via email but no username by post as yet. How long does this normally take?

The postal credentials should arrive within 5 days of the email. It will have been addressed to the name and location you provided during registration.

Is it possible for software providers to register their list of customers without having a service agreement regarding the provision of the FMD service/software?

It is not recommended. It is necessary for the registering person to accept the EULA T&Cs to create a request, it is hard to see how that could be justified without an agreement in place.

Is there a specification for the format of the data returned for bulk registrations in the password protected attachment?

Bulk files that qualify for non-standard processing: Credentials will be returned as Excel attachments (not password protected as previously suggested) in two separate emails.

Can an end user register several times but for different software suppliers?

Yes, they will appear to us as a duplicate if you request for the same location and we will ask you to justify the request to ensure they are not errors.

How does bulk upload for multiple locations work in the concentrator model?

Each location must be identifiable within the UK NMVS. Bulk files can contain 1 or more locations from 1 or more legal entities. The credentials will be returned by an email to the requestor and a letter to the location (for each entry) as the standard process. To qualify for non-standard the following two conditions must be met: The file is for a single legal entity The file has 6 or more locations The result of which is that (subject to the approval from a suitable representative of the legal entity) the credentials can be sent back as 2 separate emails rather than multiple emails and postal letters. Example for clarity: A file has 10 locations, 6 of which are for the same legal entity. We will not process 4 as standard and 6 as non-standard – they are all processed as standard

Community Pharmacy

Will manufacturers and wholesalers be able to see data on products I have dispensed?

No. The Delegated Regulation is clear that all parties that are connected to the repositories system, including manufacturers, wholesalers and pharmacies, have sole responsibility, ownership and access to any data that they generate. This data is not shared with any other parties, other than the National Competent Authority, where necessary. The only exception is the status (“active”/“inactive”) of products’ UIs, which is available to any party that has a relevant pack in their possession. Each national medicines verification system will maintain an audit trail of when and where product information was uploaded and access, and where and when UIs are decommissioned. This data cannot be shared with other parties, other than with the express written permission of the data owner. The only exception is when there is an investigation into an incident of potential falsification.

Who can see/use FMD information in the pharmacy?

As FMD will affect dispensing, all pharmacy staff involved in the dispensing process will need to be trained to follow FMD protocols on verification / decommissioning of products. It is expected that dispensing software / PMRs will be updated so that they ask for and receive the live status of product unique identifiers during the prescription assembly process.

I am an End-user. How do I register with SecurMed?

SecurMed UK is developing its end-user registration processes. SecurMed will manage the process via a web-facing registration page accommodating registration for single locations and a bulk registration process for organisations registering multiple locations. a) Under Article 37(b) of the Delegated Regulation, SecurMed is obliged to verify the identity, role and legitimacy of all users. SecurMed will provide a set of credentials (User Name, Password and Certificate) for each location of a particular type; e.g. Pharmacy, Hospital, Wholesaler location. b) The credentials will be provided in two parts; the first via e-mail and the second sent separately to the location. c) Look out for news of registration processes at https://www.securmed.org.uk/

Will pharmacies be able to return stock to their wholesaler or a DTP manufacturers’ distributor?

This will depend upon the wholesaler’s and manufacturer terms and conditions, but in general, as long as the stock has not be decommissioned and the anti-tamper device is still intact, it is expected the current returns process will remain valid. Wholesalers and distributors will have to verify the status of any products returned to them, to ensure it is authentic and to confirm its ‘active’ status.

I am a Community Pharmacist; where can I find more information on FMD specifically related to my sector?

SecurMed UK is engaging Community Pharmacy through the FMD Working Group set up by NPA, CCA and CP inductry associations. The FMDSource web-site is a good reference for pharamcists interested in FMD. We are also working with Community Pharamcy Scotland, Community Pharmacuy Wales and Pharmacy Services Northern Ireland. www.fmdsource.co.uk

Can Pharmacists still dispense the product to patients without serialisation after 9th of February 2019?

Yes, Pharmacists can still dispense the product to patients without serialisation after 9th of February 2019, until all the stocks get depleted which was batch released before 9th of February 2019.

Can pharmacy and wholesalers sell data to IMS?

Pharmacy contractors and wholesalers will be able to sell dispensing data generated by their PMR & wholesaler systems in the normal way, but it is likely that commercial restrictions will be placed on the use of individual pack data derived from the FMD system, in line with the data ownership rules outlined above. Reference: FAQs – The UK FMD Working Group for Community Pharmacy (www.fmdsource.co.uk)

Doctors/GPs

Where can GPs get further information?

There is plenty of information available online in relation to the Falsified Medicines Directive. A GP FMD Toolkit is currently in development by NHS Digital and will be available on the MHRA website shortly. The BMA and DDA also have information for doctors on their websites; https://www.bma.org.uk/ https://www.dispensingdoctor.org/ and the MHRA website - https://www.gov.uk/guidance/implementing-the-falsified-medicines-directive-safety-features Doctors can also email the BMA directly info.gpc@bma.org.uk

Dispensing doctor end-users have been informed by the DDA not to commit to any SSPs currently (15/11/18)?

“Article 3 of the Delegated Regulation lists a number of definitions including a ‘healthcare institution’ as meaning ‘a hospital, in-or outpatient clinic or health centre’. The UK has classed General Practitioners (GPs) and Dispensing Doctors as health centres and therefore healthcare institutions. However, to remain equitable to what pharmacies have to do, we would expect Dispensing Doctors to decommission as pharmacies.” Source: DHSC & MHRA Public consultation on FMD

Where can I find more information on FMD for Hospital Pharmacies, Doctiors, GPs and Health Centres?

SecurMed UK is working with NHS Digital to support NHS organisations in England for Hospital Pharmacy and Doctors, GPs and Health Centres. Through NHS Digital SecurMed UK will be engaging with NHS Services/Informatics in Scotland, Wales, Northern Island, Channel Islands and Isle of Man. For more info please contact NHS Digital at FMD@nhs.net

Are out of hours GP services included within the scope of FMD?

Yes. The Dept of Health & Social Care agreed in July 2016 that all GP surgeries, practices and health centres are considered healthcare institutions so within the scope of FMD. Out of Hours GP providers are deemed to be a Healthcare Institution and under the FMD requirements they will need to decommission the stock themselves – although they could that at any time the stock was in their possession.

I am an End-user. How do I register with SecurMed?

SecurMed UK is developing its end-user registration processes. SecurMed will manage the process via a web-facing registration page accommodating registration for single locations and a bulk registration process for organisations registering multiple locations. a) Under Article 37(b) of the Delegated Regulation, SecurMed is obliged to verify the identity, role and legitimacy of all users. SecurMed will provide a set of credentials (User Name, Password and Certificate) for each location of a particular type; e.g. Pharmacy, Hospital, Wholesaler location. b) The credentials will be provided in two parts; the first via e-mail and the second sent separately to the location. c) Look out for news of registration processes at https://www.securmed.org.uk/

Can Pharmacists still dispense the product to patients without serialisation after 9th of February 2019?

Yes, Pharmacists can still dispense the product to patients without serialisation after 9th of February 2019, until all the stocks get depleted which was batch released before 9th of February 2019.

Hospital Pharmacy

Will manufacturers and wholesalers be able to see data on products I have dispensed?

No. The Delegated Regulation is clear that all parties that are connected to the repositories system, including manufacturers, wholesalers and pharmacies, have sole responsibility, ownership and access to any data that they generate. This data is not shared with any other parties, other than the National Competent Authority, where necessary. The only exception is the status (“active”/“inactive”) of products’ UIs, which is available to any party that has a relevant pack in their possession. Each national medicines verification system will maintain an audit trail of when and where product information was uploaded and access, and where and when UIs are decommissioned. This data cannot be shared with other parties, other than with the express written permission of the data owner. The only exception is when there is an investigation into an incident of potential falsification.

Who can see/use FMD information in the pharmacy?

As FMD will affect dispensing, all pharmacy staff involved in the dispensing process will need to be trained to follow FMD protocols on verification / decommissioning of products. It is expected that dispensing software / PMRs will be updated so that they ask for and receive the live status of product unique identifiers during the prescription assembly process.

Where can I find more information on FMD for Hospital Pharmacies, Doctiors, GPs and Health Centres?

SecurMed UK is working with NHS Digital to support NHS organisations in England for Hospital Pharmacy and Doctors, GPs and Health Centres. Through NHS Digital SecurMed UK will be engaging with NHS Services/Informatics in Scotland, Wales, Northern Island, Channel Islands and Isle of Man. For more info please contact NHS Digital at FMD@nhs.net

I am an End-user. How do I register with SecurMed?

SecurMed UK is developing its end-user registration processes. SecurMed will manage the process via a web-facing registration page accommodating registration for single locations and a bulk registration process for organisations registering multiple locations. a) Under Article 37(b) of the Delegated Regulation, SecurMed is obliged to verify the identity, role and legitimacy of all users. SecurMed will provide a set of credentials (User Name, Password and Certificate) for each location of a particular type; e.g. Pharmacy, Hospital, Wholesaler location. b) The credentials will be provided in two parts; the first via e-mail and the second sent separately to the location. c) Look out for news of registration processes at https://www.securmed.org.uk/

I operate within the Secondary Care sector; where can I find information related to FMD Specifically related to my sector?

The NHS publish information, including frequently asked questions about FMD on their Specialist Pharmacy website. www.sps.nhs.uk

Will pharmacies be able to return stock to their wholesaler or a DTP manufacturers’ distributor?

This will depend upon the wholesaler’s and manufacturer terms and conditions, but in general, as long as the stock has not be decommissioned and the anti-tamper device is still intact, it is expected the current returns process will remain valid. Wholesalers and distributors will have to verify the status of any products returned to them, to ensure it is authentic and to confirm its ‘active’ status.

Can Pharmacists still dispense the product to patients without serialisation after 9th of February 2019?

Yes, Pharmacists can still dispense the product to patients without serialisation after 9th of February 2019, until all the stocks get depleted which was batch released before 9th of February 2019.

MAH

What is an AMPP code and how can I identify it?

An AMPP code is the Active Medicinal Product Pack code stored in the UK NHS dm+d database with a maximum permitted length of 18 digits and a minimum length of 6 digits. GTIN product codes in the UK MVS will be mapped by the AMPP code to dm+d for reimbursement purposes. Please click here for additional information in the AMPP code FAQ.

What is the process for onboarding to FMD?

There are two processes Marketing Authorisation Holders (MAHs) need to perform to onboard for FMD:
  1. Onboarding to EMVO - all MAHs must onboard to EMVO to be able to upload pack information into the EMVS/ NMVS repositories system. EMVO will perform a detailed set of assessments, contract with the MAH and require payment of a fee before granting access to EMVS. You can onboard to EMVO at https://emvo-medicines.eu/pharmaceutical-companies.
  2. Contracting with SecurMed UK and paying fees to fund the EMVS/NMVS repositories system. All MAHs are required under Article 31 (5) of the Delegated Regulation to bear the costs of the EMVS/NMVS repositories system. This will mean contracting with and paying fees for access to the SecurMed UK Medicines Verification System. SecurMed UK have a published contracting and fee payment model (available upon request). All MAHs are requested to pre-register with SecurMed UK providing company and address details, listing of all MAHs (both EMA and MHRA) and the name and contact details of the Responsible Person for your respective MAHs. Click here for details of the SecurMed UK MAH onboarding procedure.

Is it possible to convert EAN codes to GTIN by adding 0 at the beginning of GTIN or new GTIN will be issued? 

Please refer to the European Pack Coding Guidelines from EFPIA.

Is the Product Code (PC) taken obligatory from the Agency or it can be taken from MAH internal database assigned by GS1?

Please refer to the European Pack Coding Guidelines from EFPIA.

Are EMA Marketing Authorisation Holdings (MAHs) the same as UK MHRA Marketing Authorisation Holdings?

No. EMA Marketing Authorisation Holdings (MAH) are issued by the EMA under the Centralised (CP). Once granted this entitles the MAH to market and distribute medicines within all EU member states without an additional local UK MAH. It is recognised many medicines were issued in the EU member states before EMA was created so there are two additional processes - De-Centralised Process (DCP) and Mutual Recognition (MR) that are also used by EMA. In these cases the manufacturer will additionally need to apply for a local market MAH from the UK regulator for DCP and MR registered medicines - see MHRA MAH below. The UK regulator, MHRA, issues MAHs that are specific to the UK market alone and entitles the MAH to market and distribute medicines only within the UK. The UK regulator MHRA has two types - a Marketing Authorisation Holding (MAH) and a parallel import license (PLPI). Where a company holds both an MAH and a PLPI the same MAH number is granted. MAH holders can identify the MAH/ PLPI number from the product license which will be in the format PL nnnnn/mmmm,  the first 5 digits give the Marketing Authorisation Holder number.

How will SecurMed UK count the number of Marketing Authorisation Holdings?

1. EMA Centralised Procedure (CP) MA Holdings: -  Applicable to all member states -  Each named business entity CP MA holding counts as 1 MAH 2. MHRA MA Holding (Manufacturer Licenses) - UK Local, EMA Mutual Recognition or EMA De-Centralised Procedure (DCP) - Each medicine authorised is assigned a UK product license number in the format: PL nnnnn/mmmm - The first 5 digits identify the MAH for that named business entity - For each named business entity and associated PLs the MAH number counts as 1 MAH 3. MHRA PLPI (Parallel Importer License) - Follows same format for MHRA MA holding and will be counted the same way. - For each named business entity 1 PLPI MAH number counts as 1 MAH - Where a manufacturer/ PI holding both an MAH and PLPI with the same MA holding number this is counted as 1 MAH 4. EMA Parallel Import Notification Letters - EMA does not issue Parallel Import MAHs but SecurMed is aware EMA issues Parallel Import Notification letters in some countries. - These are expected to be few and will be dealt with as they arise, if at all, in the UK. - Assumption is that 1 Parallel Import Notification Letter will count as 1 MAH."

Our company needs to affiliate to GS1, is SecurMed the company to contact for this?

No, you need to contact the GS1 organisation in your respective country or at www.gs1.org/contact

We are a manufacturer of medicines and have multi-market packs labelled and supplied to UK and Ireland. Will the EMVS and NMVS system cater for this?

Yes, in fact multi-market packs can be supplied for UK, Ireland and Malta. The EMVS system will know when multi-market packs are uploaded into EMVS which systems to send the pack data to and will also manage the decommissioining activity between them.

Will there be interaction between the UK national hub and each MAH for downloading pack data?

No, the MAH will upload the pack data to EMVS and EMVS will determine which packs need to be sent to the UK national hub.  This is managed at EMVS system level.  EMVS will be the master system of record for MAH pack data.

Where the MA holder/manufacturer has a separate WDA will the warehouse need to be linked in to the UK MVS for decommissioning of packs or will this be done via an MA holder/manufacturer link?

Each manufacturer who also holds a WDA(H) will need to review their business operations and wholesaling processes and where applicable will need to create a connection to the UK MVS for medcines verification and decommissioning.  It is up to each manufacturer/MA holder to perform this assessment.

Will there be any requirement for the WDA holder to have an interaction with the EMVS?

Unless the WDA holder is also a manufacturer (MA holder) or a parallel distributor (PI) there should be no need to connect to the EMVS.

We are a Marketing Authorisation Holder who have an active MAH for UK but we do not market any medicines here at the moment?  Are we required to contract with SecurMed UK and pay fees for the UK system?

The MHRA position on this is that as you have an active MAH for the UK market you may decide at any point to start marketing and distributing medicines so you should contract with SecurMed UK. SecurMed UK has decided that if an MAH is not actively marketing a medicine in the UK you do not need to contract/ pay fees.  However, if at any point in the future you decide to start marketing or distributing medicines you are obliged under the Article 31(5) Delegated Regulation to apply the FMD safety features to your packs, onboard to EMVO to upload pack data and contract with SecurMed UK to pay fees for the UK MVS.  

MAHs are requested to submit a Notification pursuant to article 61(3) of Directive 2001/83/EC, providing an updated version of the QRD template confirming implementation of the safety features on the packaging, well in advance of the 9th of February 2019. Do you think 6 months before the FMD go-live will be enough time?

MHRA have informed SecurMed UK they expect to receive a rush of applications in the latter half of 2018 and we would recommend all MAHs start this process as early as possible.

How will medicines originally destined for one market but then sold to another market under an Art.126a/Exceptional MA be handled?

1. Pharmacist scans medicine to decommission. Message goes to local NMVO system. 2. Local NMVO does not contain relevant pack data because the pack was not originally intended to be sold in that market. 3. Local NMVO then queries that number with the EMVO to determine where the data is/if it exists. 4. EMVO sources data from the NMVO in the relevant market, decommissions it, and returns the result to the NMVO from step 2. 5. Pharmacist sees positive scan/decommissioning result. The same process will happen in if recommissioning an Article 126a pack in the 10 day window.

A manufacturer has a WDA as does its' 3rd party logistics provider (3PL). The 3PL was intending to decommission medicines on behalf of the manufacturer but the manufacturer wants to do all decommmissioning itself in the EMVS using its WDA. Is this allowed?

MHRA stated on 25-Sep-17 at the SecurMed presentation in Twickenham that decommissioning directly by manufacturers in the NMVS or EMVS for Article 23 customers would not be allowed.

Does the GTIN product code for UK require 13 characters or 14 characters?

GTIN products codes require 14 characters, please refer to the Pack Coding Guidelines issued by EMVS: https://www.medicinesforeurope.com/docs/European%20Pack%20Coding%20Guideline%20V4_0.pdf

I am a Manufacturer; where can I find more information?

Can I get a copy of the registration form for a Marketing Authorisation Holder?

How does my company apply for the Micro MAH fee waiver?

  1. Fill out an MAH Registration Form and submit it to SecurMed UK at: mah@securmed.org.uk
  2. Complete a SecurMed MAH Agreement for your MAH legal entity, sign it and submit it to : mah@securmed.org.uk
  3. a) For those legal entities that have filed their first set of audited accounts with Companies House, please submit to SecurMed UK a copy of the audited accounts filed with Companies House for the relevant legal entity and, where relevant, confirm to SecurMed UK in writing (signed by a director of the relevant legal entity) that the relevant legal entity employs 10 employees or less; OR b) For those legal entities that have yet to file their first set of audited accounts with Companies House, please submit a copy of the business projections for the relevant legal entity for the next 12 months, in a form that has been adopted and signed by the directors of the relevant legal entity,  along with such other financial information as may be pertinent to enable SecurMed UK to assess the financial standing of the relevant legal entity. In addition, and where relevant, confirm to SecurMed UK in writing (signed by a director of the relevant legal entity) that the relevant legal entity employs 10 employees or less.
SecurMed UK will then assess your eligibility for the micro MAH fee waiver.  If Micro status is approved, you will receive a fee waiver letter which you will need to sign and send back to : mah@securmed.org.uk.  

Are the MAH Setup Fees inclusive or exclusive of VAT?

The MAH Setup Fees are exclusive of VAT. VAT will be charged based on where you are located:
  • If your fees are paid by a Company Registered for VAT in the UK are UK-based VAT at 20% will be charged
  • If your fees are paid by a Company Registered for VAT in the EU, VAT will be Zero-rated (i.e. 0%)
  • If your fees are paid by a Company based outside of the UK and the EU, VAT is not applicable and will not be charged.

The MHRA wrote to companies in 2014 asking for products to put forward for the White List which would be exempt from the FMD changes. As we were not aware of the letter at the time we did not submit any products. Can products still be added to the White List?

Yes. Article 46 Delegated Regulation deals with notifications to the commission of additional medicinal products that are at risk or not at risk of falsification. Annex III and IV Delegated Regulation provide forms for submission of these. All submissions must be made by the MHRA. Please contact MHRA at : FMD.safetyfeatures@mhra.gov.uk

Can you confirm what relationship a wholesale dealer needs to have with the MAH to allow them to be registered as a designated wholesaler for that MAH. Does it have to be a 3PL relationship?

There needs to be a signed contract between the MAH and the wholesaler.

How do manufacturers (MAHs) who also hold a WDA register with the SecurMed UK contracting process for connectivity of the wholesaling FMD/DR functionality required under?

All wholesalers, healthcare institutions, community pharmacies and persons authorised or entitled to supply medicines to the public are obliged under the Delegated Regulation (DR) to register to use the system. The process and means of registering with SecurMed UK will be communicated later in 2018.

Where the MAH/manufacturer has a separate WDA will the warehouse need to be linked in to the UK MVS for decommissioning of packs or will this be done via an MA holder/manufacturer link?

Each manufacturer who also holds a WDA will need to review their business operations and wholesaling processes and where applicable will need to create a connection to SecurMed for medicines verification and decommissioning as a wholesaler.  It is up to each manufacturer/MAH to perform this assessment.

Where can I find information about packaging and labelling changes as a result of FMD?

Where stakeholders are unclear on the proposed legislation, for example - packaging and labelling changes, please contcat DHSC/MHRA at FMD.safetyfeatures@mhra.gov.uk

Who is responsible for implementing serialisation when an MAH is manufacturing and supplying ‘own label suppliers’?

The MAH of the medicine being placed on the market is the person legally responsible for compliance with the legislation. When a MAH is manufacturing for a certain national retail pharmacy but in their own label and the MA belongs to the MAH, then the MAH is responsible.  

MHRA

Does the UK Regulator, the MHRA produce guidance and advice on FMD?

The MHRA publishes a regular FMD Safety Features Newsletter. To receive copies, or place questions about FMD please use the dedicated mailbox, FMD.safetyfeatures@mhra.gov.uk

Will anti-tamper devices be allowed on OTCs and other out-of-scope products after February 2019?

The MHRA has confirmed that subject to the outcome of a public consultation anti-tamper devices may continue to be placed on out-of-scope products after 9th February 2019 if the relevant manufacturer considers that it is necessary to do so in the interests of patient safety. Similarly, anti-tamper devices may be placed on new out-of-scope products introduced to the market after February 2019, based on a similar risk assessment and on a voluntary basis.

How will the FMD be enforced?

Enforcement of FMD in Member States is the responsibility of national competent authorities. In the UK this will mean that the MHRA will consult on amending legislation which will introduce new sanctions against all those in the medicines supply chain who are impacted by the Delegated Regulation. The MHRA is responsible for enforcement against marketing authorisation holders, manufacturers and wholesalers. Further information will be made available in due course. Input will be required from GPhC and other regulator.

Software Suppliers

Do we need to test bulk transactions even though we have no intention of doing bulk executions?

Your solution should employ bulk transactions in order to reduce the load on the MVS. It is possible to implement and successfully Baseline a solution based on single transactions but an appropriate justification for doing this should be recorded in the Baseline testing protocol.

Will the v2 endpoints be available for testing purposes following the release of v3?

Baselining will continue on v2 for a period to be defined (and communicated) after which baselining will migrate to v3.

If baseline testing has already been completed in interface v2, will it need to be redone in v3?

Baselining will continue on v2 for a period to be defined (and communicated) after which baselining will migrate to v3.

Do you consider multi-factor authentication?

SecurMed UK have no opinion on Pharmacy: Concentrator security. The requirements of the UK MVS are for one set of User Credentials (including certificate) per location. The requirements for multi-factor authentication are not part of this consideration.

Will the live endpoints be different for v2 and v3?

Yes, the v3 interfaces will have different endpoints.

Will Test Packs be updated to include non-UK MVS Packs once the Intermarket Transactions function is available?

IMT is not currently in the scope of the Test Packs. SecurMed UK have registered this as a possible improvement.

What is the 'Sub User ID' to be used for if each location has a separate User ID?

'Sub-user ID' is an optional field in the interface and, in the case of a cumulator model, is only useful to identify terminals in a location. Sub-user ID will not routinely be monitored by SecurMed UK.

While the "Concentrator" approach is not acceptable, Arvato's initial "Cumulator" concept will still be acceptable for a few terminals in a SINGLE location

The cumulator approach in a single user location is aligned to the system architecture. SecurMed UK will only monitor transactions to the location (User-ID level).

How should I change my password on initial log-in once my credentials are received?

The end user location has only one set of credentials which are used for both web GUI and web services connection. The user should carefully manage the use of those credentials. The initial one-time password can only be used to log on and change the password and immediately it is changed, the user is logged out and has to log in with the newly set password. If the initial one-time password is used via the web services connection, in the first instance an exception is returned and transactions cannot be submitted until the password is changed. This can be completed in a web services transaction. When a password is changed subsequent to the initial one-time password change, the superseded password can still be used for 5 days. The situation described cannot occur on the initial one-time password.

When will the "likely to be accepted" concentrator model be accepted?

The guidance on concentrators is provided by SecurMed UK to inform the Software Community of key considerations. SecurMed UK does not determine if the design, implementation or operation of any End-user solution is acceptable. This will be determined by the appropriate regulatory body as part of a regulatory inspection of an End-user operation.

Has the password expiry changed from 90 days to 365?

Yes, SecurMed UK will implement a 365day Password expiry in Release 1.02

Can a single location have multiple sets of credentials for different software solutions?

Duplicate credentials can be requested for the same location. SecurMed UK will validate the request.

How can an end user live test a software supplier’s system without committing to a supplier?

'Live/Production' and 'Test' are incompatible. Demonstration in the Sandbox is possible using online code generators to produce scannable 2D Matrix codes from the Sandbox datasets. The option to use IQE is currently up for discussion.

What will the process be for renewing certificates?

The certificate renewal processes are partially automated in the MVS. Process improvements are being scoped.

Does resetting the password also require a new certificate?

No, the certificate remains valid for the user.

Can the initial certificate download be done via the web service?

Yes, this service is available.

What is the certificate renewal process?

Certificate Expiry Certificates are valid for two years Automatic Creation of New Certificate 30 days before the expiry date of a valid certificate, a new certificate will automatically be generated by the NMVS and stored ready for retrieval. Notification of New Certificate Notification of the new certificate will be delivered by email to the end user location, to the NMVS contact that was defined for the end user location during registration. The email will contain a one-time TAN to access the certificate. Retrieval of the Certificate The certificate can be retrieved either in the UK MVS web GUI or via the web services interface. The certificate can be retrieved and used immediately it has been created 30 days prior to the expiry of the existing certificate. The certificate will be stored on the certificate server for 60 days. Collecting the Certificate - Web GUI Log on to the certificate server web GUI using the URL in the notification email. Select Certificate Download from the menu and enter the TAN from the notification email. Record the certificate passphrase and download the certificate. Collecting the Certificate - Web Services (SOAP) Execute process G615 using the TAN supplied in the notification email. In both cases, the TAN will approve validity of the request. The NMVS provides a response consisting of a passphrase protected PKCS#12 container holding the user certificate, the user’s key-pair as well as the root CA.

Will the certificate renewal email be sent to the requestor or the user at the location?

The process for this is currently being developed by SecurMed UK.

Are there target resolution times for service issues, and how will the Change and Release process work for changes to the production services?

Service issues should be reported to our IT service provider, Arvato. At this time, all service tickets are responded to on a reasonable endeavours basis (ie. by priority). Any changes to service level targets will be published on this website. The operational Change and Release Management processes are also operated by Arvato; they impact assess, plan and manage the deployment of all production changes and releases, managing approvals and communications. SecurMed are engaged with Arvato to review the on-going development of these processes to ensure approvals and communications are appropriate. Up to date information related to changes and releases will also be published on this website.

How do I test my end-user software solution and verify it is ready to connect to the UK MVS?

SecurMed UK’s Blueprint System provider Arvato Systems are introducing a Baseline Testing process where software suppliers can test and verify their own solutions. Changes to the shared integration environment (aka Sandbox) system have been made and a package of supporting documentation is available on the NMVS Software Supplier Portal: www.sws-nmvs.eu and details will be announced via e-mail to those suppliers who have registered on the portal.

How do I register for the Arvato developers toolkit (SDK)?

SecurMed UK, through our IT Service Provider Arvato Systems, are providing an IT Solutions Developers Toolkit (SDK) to IT software providers and departments to enable them to create interface (web-services) connections to the UK MVS. To register for the SDK please visit https://sws-nmvs.eu. PDF versions of the workshop presentations held in September 2017 can be downloaded here: A recording of the webcast workshop held in early November is now available on YouTube . If you have any questions, please contact SecurMed at:tech@securmed.org.uk

How do I register as a software supplier for the UK?

The wholesalers and dispensing communities in the UK will connect to the UK database which is supplied by Arvato systems. If you wish to register as a software supplier for the UK you should register at : www.sws-nmvs.eu

Will SecurMed UK be publishing a list of Approved Suppliers?

SecurMed UK as the UK Medicines Verification Organisation wishes to remain independent in terms of recommending any specific IT providers or other suppliers for any of the areas in the scope of FMD. We do not approve or accredit suppliers as that is not our role. We will provide on our independent web-site (once in place) a list of the providers who have registered to use the Arvato toolkit together with point of contact details. It will be up to organisations seeking a supplier to identify if any of the registered suppliers are suitable for their needs and perform the necessary selection processes. Please follow the link below to see the current list of Software Suppliers : https://www.securmed.org.uk/list-of-it-software-providers/

Does SecurMed UK have a database of 14-digit GTIN codes?

No - we do not hold a database of these codes and recommend you contact the GS1 organisation if you need to find this information.

I am designing my software solution connection to the NMVS. Are Concentrator/Aggregator type architectures acceptable in the UK?

Following consultation with UK national competent authorities we can provide some clarification on connection methodologies: Software solutions for the wholesaler and dispensing communities must provide for transparency of end-user locations (i.e. physical location, place of business, registered premises) and therefore direct connection to the NMVS where the certificate is stored on the terminal, is the preferred methodology. Where thin-client/aggregator/concentrator type architecture is used, alignment between certificate and location may be maintained via a centralised certificate-management application. Compliant operation of this type of system will rely on accurate association of credentials (User-ID, Password and Certificate) with a single Location. For clarity, ‘Hiding’ of locations behind a single connection to a central system (User ID obscured to the NMVS) will not be compliant.

The Arvato toolkit only allows one certificate per developer, is there a way to get a group or enterprise level certificate?

Arvato only provides per user certificates.  Each company can apply for more than one developer user.

I am an IT Company who supplies track & trace software. Where do I register? 

Manufacturers upload data to the European hub - information regarding becoming an Onboarding Partner can be found at www.emvo-medicines.eu 

Technical

Document FD-002 talks about the T&C's web service. Can the portal be used to accept the revised version or only via the web service?

SecurMed UK has not implemented the T&Cs module in Release 1.02.

Can you confirm the master data (Message G101) allows the software provider to differentiate between FMD and non-FMD products?

The Master Data Download (G101) transaction will allow positive confirmation that the product is in the system and likely therefore in scope of FMD. It cannot define the scope of FMD. FMD Source is creating some guidance to help determine which packs are in scope of FMD and which are not based on their physical characteristics.

Why is it essential to present a unique certificate as well as a unique username and password?

The use of multi-factor authentication is mandated by the Delegated Regulation.

Is there further guidance on False Negatives - out of date, recalled pack, status error, data error, etc?

Several groups, including FMD Source, SecurMed UK and others, are working on establishing guidance for the various stakeholders. This guidance will be communicated in due course.

If the serial number is unknown in the SecurMed NMVS from a verification request of an intermarket pack, does the UK NMVS further the search with the EMVS and return the response?

Yes, this is the 'Inter-Market' or IMT functionality being introduced with Release 1.02.

Will the return codes be more user friendly, and if a "pack not recognised" code is returned due to the pack not being on your database, is there guidance to treat this as a positive return code?

SecurMed UK will be using new functionality in Release 1.02 to 'translate' the existing exception descriptions into less technical language. The existing return codes are retained with new codes implemented to support new functionality. Work is ongoing to determine how to react to this particular message (part of Alerts Working Party scope)

Should I add a sub-user ID?

We have no plans currently to utilise the sub-user functionality within the UKNMVS. Adding a sub-user ID may limit the ability to recommission an item so this field should be left blank.

How long is my certificate available to download?

The certificate is only available for download for 60 days after its creation. You should make sure that you store a local copy of the certificate together with its passphrase.

How do I test my end-user software solution and verify it is ready to connect to the UK MVS?

SecurMed UK’s Blueprint System provider Arvato Systems are introducing a Baseline Testing process where software suppliers can test and verify their own solutions. Changes to the shared integration environment (aka Sandbox) system have been made and a package of supporting documentation is available on the NMVS Software Supplier Portal: www.sws-nmvs.eu and details will be announced via e-mail to those suppliers who have registered on the portal.

Will I have to change my password frequently?

Password & Certificate Renewal processes are included in the transaction set of the UK MVS and software solutions should be designed to trigger renewal of passwords and security certificates automatically. SecurMed UK will configure an appropriate password renewal frequency carefully balancing security and practical considerations.

Where can a manufacturer obtain the AMPP codes for its products?

Contact the dm+d team at nhsbsa.dmdenquiries@nhs.net

How do I register for the Arvato developers toolkit (SDK)?

SecurMed UK, through our IT Service Provider Arvato Systems, are providing an IT Solutions Developers Toolkit (SDK) to IT software providers and departments to enable them to create interface (web-services) connections to the UK MVS. To register for the SDK please visit https://sws-nmvs.eu. PDF versions of the workshop presentations held in September 2017 can be downloaded here: A recording of the webcast workshop held in early November is now available on YouTube . If you have any questions, please contact SecurMed at:tech@securmed.org.uk

Are there technical standards to which the 2D codes should conform?

Data Matrix standard is Higher than ECC200, ISO/IEC 16022:2006 is presumed to conform •  Printed Quality must be rated 1.5 or better according to ISO/IEC 15415:2011 •  Coding of the Unique Identifier conforms to ISO/IEC 15418:2009 •  For multiple coding schemes, Unique Identifiers conform to  ISO/IEC 15434:2006 •  Coding of the Product code conforms to ISO/IEC 15459-3:2014 or ISO/IEC 15459-4:2014 •  https://barcode.tec-it.com/en/DataMatrix?data=This%20is%20a%202%20D%20Matrix%20Code

What are the mixed-bulk transactions?

The G195 – Submit Mixed Bulk, process is used to submit a cache of individual transactions that have buffered while connection to the NMVS has been interrupted. The G195 is an asynchronous process and the result of the individual transactions it contains are obtained by using the corresponding G196 – Request Mixed Bulk Transaction Result process. An example scenario would be where a pharmacy system has encountered an Internet connectivity issue but dispense activities are continuing for patients and those dispense activities are stored by the pharmacy system until the connection is restored, when the G195 will be played.

Why is the mixed-bulk transaction not available to wholesalers?

The mixed-bulk transaction is a bulk of individual transactions as opposed to a single transaction type to be applied to a bulk of packs. It is only for the purpose of running cached individual transactions when connectivity has been interrupted; it is not intended for bulk processing of transactions.

I am designing my software solution connection to the NMVS. Are Concentrator/Aggregator type architectures acceptable in the UK?

Following consultation with UK national competent authorities we can provide some clarification on connection methodologies: Software solutions for the wholesaler and dispensing communities must provide for transparency of end-user locations (i.e. physical location, place of business, registered premises) and therefore direct connection to the NMVS where the certificate is stored on the terminal, is the preferred methodology. Where thin-client/aggregator/concentrator type architecture is used, alignment between certificate and location may be maintained via a centralised certificate-management application. Compliant operation of this type of system will rely on accurate association of credentials (User-ID, Password and Certificate) with a single Location. For clarity, ‘Hiding’ of locations behind a single connection to a central system (User ID obscured to the NMVS) will not be compliant.

I am an End-user. How do I register with SecurMed?

SecurMed UK is developing its end-user registration processes. SecurMed will manage the process via a web-facing registration page accommodating registration for single locations and a bulk registration process for organisations registering multiple locations. a) Under Article 37(b) of the Delegated Regulation, SecurMed is obliged to verify the identity, role and legitimacy of all users. SecurMed will provide a set of credentials (User Name, Password and Certificate) for each location of a particular type; e.g. Pharmacy, Hospital, Wholesaler location. b) The credentials will be provided in two parts; the first via e-mail and the second sent separately to the location. c) Look out for news of registration processes at https://www.securmed.org.uk/

Wholesaler/Distributor

Will veterinary wholesalers need to comply with the FMD regulatory requirements?

Although veterinary medicines fall outside the scope of the Delegated Regulation, veterinary wholesalers who handle human medicines for supply to veterinary surgeons will need to connect up to National systems. Veterinarians and retailers of veterinary medicinal products are part of the MHRA consultation under Article 23. For further information, veterinary wholesalers are advised to contact the MHRA.

Will a wholesaler performing QP batch release against the manufacturers MA and then wholesales these products under a WDA to hospitals, pharmacies and GPs, need to register with SecurMed UK?

A wholesaler is not allowed to perform QP batch release.All wholesalers will need to register and connect to SecurMed UK to verify and decommission medicines as required under the Delegated Regulation. Only manufacturers and specifically MAHs and holders of parallel import authorisations will be expected to pay fees to SecurMed UK. All wholesale dealers will need to create a connection to the UK Medicines Verification System.

Can pharmacy and wholesalers sell data to IMS?

Pharmacy contractors and wholesalers will be able to sell dispensing data generated by their PMR & wholesaler systems in the normal way, but it is likely that commercial restrictions will be placed on the use of individual pack data derived from the FMD system, in line with the data ownership rules outlined above. Reference: FAQs – The UK FMD Working Group for Community Pharmacy (www.fmdsource.co.uk)

Can Pharmacists still dispense the product to patients without serialisation after 9th of February 2019?

Yes, Pharmacists can still dispense the product to patients without serialisation after 9th of February 2019, until all the stocks get depleted which was batch released before 9th of February 2019.