Traceability Regulations and Guidelines

Serialization of pharmaceutical products in Iran started out in 2008 subsequent to an IFDA mandate requiring pharmaceutical products with the monetary value of exceeding 500000 IRR to be serialized. This phased operation was later on completed by firstly including previously excluded pharmaceutical products, followed by other health-related products namely: medical devices, cosmetics and hygiene products, food and beverage, and supplements, towards the goal of creating a comprehensive digital health ecosystem.
Through the years and parallel with the implementation of the system, regulations started to take shape and got revised multiple times. The reason for this seemingly reverse process of inferring regulations partly from practice and not the other way around (which added the language barriers, has led to misconceptions with regards to the actual starting date of pharmaceuticals serialization in Iran) simply is that, the day we set out on this journey, there were no previously implemented models and therefore no clearly established roadmap to follow.
Following is a translation of the latest revision of said regulations dated October 23, 2015. The original version (in Persian) is published here on the IFDA website.

Implementation Guidelines
for Tracking, Tracing, and Authentication control of health-related products

Title:   Implementation Guidelines for Tracking, Tracing, and Authentication control of health-related products
Document No:  TT940715 Implementation Date:  October 23, 2015
Revision No. 2 Validity Period 2 Years

Table Of Contents


1-Definitions
2-Goals
3-TTAC Steering Committee
4-Roles and Responsibilities
5-Required Criteria for Identifiers
6-generation and application of identifiers
7-Third Party Service Providers
8-Distribution and Dispensing
9-service fees
10- Violations and Penalties

This directive is created/revised in accordance with Section A.11 and Item 17 of Article 1 of the Law on the “Duties of the Ministry of Health and Medical Education, enacted 1988”, Articles 13 and 27 of the “Goods and Currency smuggling prevention act, passed in 2013”, and “Proclamation No. 172172 of The Supreme National Security Council dated March 13, 2014”; and is meant to outline the regulations, standards and best practice for tracking, tracking and controlling the authenticity of health-related products.

1-Definitions

To avoid any confusions, words and phrases frequently used within this text have been described in greater detail:

1.1- Unit of Use/Salable Unit: the smallest salable item\unit\packaging size of every product. Each salable unit is required to be uniquely identifiable.
1.2- Health-related products/Products: throughout this text, the word “product” refers to all the products which as required by the law are produced, imported, and marketed under the supervision of the IFDA. Namely: medical products, herbal medicine, biological products, dietary supplements, baby formula, and other products meant for infants, food and beverages, cosmetics, hygiene products, and medical equipment.
1.3-Authentic Product: A product which has been procured/produced through admissible routes as designated by the IFDA such that, for the said product and at every touch point throughout the route (even after it is dispensed) there would be a legitimate entity as recognized by the IFDA accountable for whatever implications possession, trade, or consumption of said product might have.
1.4-Under-control products: all the products which as specified by the directorate general of narcotic drugs or international rules are subject to special controls applicable to narcotic drugs, psychotropic substances, and their precursors.
1.5-inauthentic products: is a product with forged identity trying to imitate a genuine product and thereby benefitting its creators/dealers while avoiding the responsibilities resulting therefrom. Inauthentic products as specified above encompasses SSFFC products as well as smuggled, stolen, and genuine products imported by unknown entities.
1.6-IFDA: Iranian food and drug administration
1.7-University: Food and Drug Deputies/Directorates under universities of medical sciences
1.8-committee: the steering committee under the IFDA formed to oversee the implementation of TTAC system.
1.9-secretariat: the secretariat of the committee responsible for performing the administrative duties of the committee
1.10-License Holder: the legal person under whose name the product is registered and the license is issued. The license holder is the primary entity which is held accountable for the quality defects of the product from the point of production through consumption. This, however, does not deny the responsibility of other stakeholder involved with the production and distribution of said product.
1.11-Distributor: the Legal person licensed for the distribution of health-related products.
1.12-Dispensary: The final link of the chain which stands between the consumer and the distributor from whom the consumer receives the product. Pharmacies fall within this category.
1.13-Qualified Warehouse: warehouses which meet the technical and qualitative standards set out by the IFDA.
1.14-TTAC program (Tracking, Tracing and Authentication Control): the program developed to reliably verify the authenticity of products mainly through creating a clear and well-established association between the product and licensed person which must bear the liability of whatever implications possession, trade, or consumption of said products might have.
1.15-track and trace procedure: the collective procedures which are carried out with the aim of determining the current possessor and location (tracking) of a product and the route taken leading thereto involving both relocations as well as the transfer of possession/ownership (tracing).
1.16-aggregated package: higher level packaging such as shrink wrap, palette, cartons, etc.
1.17-aggregation ID: As smaller packages are bundled together forming higher-level packaging, another unique identifier known as the aggregation ID is generated and applied on the bundle, carton, palette, etc. which represents the plurality of said smaller packages contained therein. Use of aggregation ID’s serves to boost the performance of capturing the identifiers as packages travel down the supply chain.
1.18-Electronic Pedigree: an electronic record of the preceding and current locations, possessors, and otherwise relevant information regarding tracing of a product, queryable from the IFDA repository.
1.19-Iran Registration Code (IRC): each and every health-related product such as food, medicine, cosmetics, hygiene products, etc. is assigned a unique code called an IRC. IRC is designed to be a very specific and detailed coding system. For instance, the exact same product manufactured by the same company would be assigned a different IRC if the packaging is changed. In other words, each IRC denotes as well as the product type, the manufacturing company, country of origin, packaging shape and the quantity included therein.
1.20-prefix: A 5 digit number unique to every license holder company. The Prefix comprises the first portion of UIDs.
1.21-Unique Identifier (UID): is a unique 20 digit ID which is according to the Article 5 of this directive and is required to be assigned and printed on each salable unit thereby identifying it throughout the supply chain. UID’s shall be produced in accordance with the guidelines laid out in the Information Exchange Protocol. UID shall not be confused with the authentication ID (described in article 1.25). Both the UID and Authentication ID are printed on the TTAC label. However, UID is only used for track and trace purposes whereas the authentication ID is concealed beneath a scratchable coat and is used to authenticate the product.
1.22-Global Trade Item Number (GTIN): The GTIN (the GTIN-14 for this guideline) is a globally unique number used to identify trade items, products, and services and is issued in accordance with GS1 standards. The first digit is an indicator of the packaging level which is usually zero for the lowest packaging level.
1.23-Batch/Lot number: A single number assigned to products manufactured during the same manufacturing cycle and subject to the same processes/circumstances. Having the same batch number usually implies uniformity in both quality and character among products.
1.24-expiration date: expiration date should be included on the packaging in the format YYMMDD and based on Georgian calendar.
1.25-Authentication ID: is a numerical 16 digit ID which is attached to each salable unit of every health-related product and is concealed beneath a scratchable coat. Authentication ID is issued by the license holder company and according to the standards set out by the IFDA. After commissioning, ID’s would be submitted to IFDA servers where a hash of the ID’s is stored.
1.26-2D Barcodes (data matrix): 2D Barcode of ECC200 version (in accordance with ISO/IEC 16022 standard) and compliant with GS1 standards and containing GTIN (14 digits), UID (20 digits), LOT (3 digits), Expiration Date (6 digits) and with the following structure:
01GTIN21UID17YYMMDD10LOT
1.27-Authenticity Label/Print: is a security feature either printed directly on the packaging or in the form of a label affixed to the product packaging. Authenticity label contains authentication ID, GTIN, UID, Lot/Batch No, Expiry Date and a data matrix; and is used for tracking the product as well as authentication control.
1.28-personalization print: the process of printing unit specific information required for tracking either directly on the product packaging or on the label which is to be affixed thereto. This process should be carried out by the license holder company. Printed labels should be controlled and verified according to ISO/IEC 15415:2011 standard.
1.29-TTAC system: TTAC encompasses a collection of databases, softwares, services, procedures, protocols, and standards which are created and maintained under the supervision of the IFDA through which tracking, tracing, product authentication, auditing, and enforcement of policies is carried out.

2-Goals

This directive aims to provide a unified, coherent and sustainable framework to efficiently regulate the tracking, tracing, and authentication of health-related products. Main goals pursued by this directive are:

2.1-Improving procurement and supply chain management
2.2-Reassuring consumers about the safety of the products and making the supply chain participants accountable towards the consumer
     Creating the infrastructure which would also serve as the enabler for other applications such as:
2.3-Tools for quality control and managing other procedures such as PMS, ADR, and Recalls.
2.4-“Electronic Health Record”
2.5- tools to efficiently identify and handle any sort of misconduct with regards to health-related products.
2.6-management of financial support from the government and non-governmental organizations


3-TTAC Steering Committee

To ensure proper implementation of this directive, provide the required oversight, and propose the necessary updates, a committee is formed under the IFDA which is made up of the following members:

- President of the IFDA (Head of the committee)
-Deputy Director of Administrative support (vice president of the committee)
-Deputy Director of planning affairs and Control (secretary of the committee)

And Deputy Directors of the IFDA departments including:
- Assessment and control of Medicine and Narcotics,
- Assessment and control Food, beverage, Cosmetics, and Hygiene products
- Assessment and control Supplements and herbal products
- Assessment and control Medical Devices
- Statistics and Information Technology
- Internal Audits and Assessment
-Security Office
+ An information technology expert person appointed by the president of the IFDA

Committee’s main responsibilities are:
-Policy making as well as inter/intra-organizational Coordination
-Assembling technical and otherwise needed working groups in different areas
-Developing, ratification and implementation of standards and regulations for TTAC
-Select and supervise the company(s) to which the development and support of software /hardware systems are contracted out

4-Roles and Responsibilities

All the stakeholders of the health-related products supply chains (including Iranian and foreign manufacturers, importers, wholesalers, distributors as well as their legal representatives) are obliged to adhere to all the guidelines set out in this document. Technical director and the CEO of each company are responsible for correct implementation of this guideline in their respective companies.

4.1-All licensed companies are required to affix a unique identifier to their products (preferably at the source) before introducing said products to the market. However, companies are authorized to outsource the task of serialization to a third party company. Nonetheless, companies must be aware that, outsourcing the serialization task to a third party company does not imply delegation of the responsibilities as well. In any case, the license holder company would be ultimately responsible for compliance with TTAC requirements.
Primary registration of products, verification, producing UID’s and Authentication ID’s, printing the required information on the packaging, aggregation, ID’s activation, uploading to the repository and authorizing releasing of products are all considered part of the quality control process and therefore fall within the responsibility domain of the company’s technical director.
4.2-Even in cases where the distribution of a product (such as biologic, blood products, etc.) requires direct authorization of one of the regulatory/supervising bodies such as Iranian Food and Drug Administration or Medical Sciences University, the responsibility of systematic releasing of the product for market and activation of the Unique ID’s remains with the technical director of the license holder company.
4.3-Distributors and dispensaries In addition to verification of the product ID’s, are responsible for registration and communication of the data (data based on product ID’s and resulting from daily operations) to the central repository in the manner conforming to the standards and protocols set out by the IFDA.
4.4-Distributors, warehouses, and dispensaries shall not under any circumstances receive, move or sell medical products which lack a unique valid identifier. Same applies to Medical Devices, Food and Beverage, Cosmetics and Hygiene Products, and Supplements. Technical directors are responsible for compliance of their respective companies in this regard.
4.5-The technical directors of the companies are obliged to convey standards, protocols, and promulgations regarding TTAC system to their respective companies and must make sure that the CEO, Quality Control Department, Planning manager, and IT manager remain informed and updated.
4.6-Technical directors are representatives of the IFDA in the license holder companies and are responsible for overseeing the implementation of TTAC requirements. Once all said requirements with respect to one batch of a product have been fulfilled, technical directors may then authorize product release. However, Should there be any incident of non-compliance or violation while doing so, technical directors are obliged to report to the IFDA immediately.

5-Required Criteria for Identifiers

5.1-Directly Printed Identifiers: manufacturers may print the TTAC required data elements directly on the packaging. Inclusion of Global Trade Item Number, UID, Lot/Batch No, Expiration Date, and 2D barcode within the authenticity label is mandatory.


Authentication ID must as well be included on the packaging, concealed beneath a scratchable coat.

5.2-Authenticity Labels: If for whatever reason the manufacturing company couldn’t print the required data elements directly on the product, alternatively may print said elements on labels and affix said labels to the product packaging. Labels should contain the following information: Batch No, Expiry date, GTIN, product UID, and authentication ID as well as authentication routes which are: telephone hotline No. 0216185, SMS Line No.20008822, and the website address www.ttac.ir. The labels should be accurately readable both by a human and by scanners, should not be easily detachable, and should withstand different weather conditions without incurring substantial damage. The scratchable coat must render the authentication ID completely hidden beneath and upon scratching shall not negatively affect the readability of the authentication ID.
5.2.1-The mere existence of a TTAC label does not stand witness to the authenticity of a product and the authentication ID must always be queried from the IFDA repository to ascertain authenticity. Consequently, the Authenticity Label shall not contain any security elements such as holograms which might be interpreted by the consumer as the authenticity mark as intended by the authorities/manufacturer, nor should it contain any writings that imply so. Moreover, it should not be used as the sealing label.
5.2.2-The presence of other 2D barcodes, serial numbers such as IRC, and 1D barcodes on the packaging is allowed provided that, said barcodes are considerably smaller in size compared to TTAC 2D barcode so not to sway the attention from the Authenticity Label.
5.2.3-Authenticity labels should be printed 20mm x 40mm in size with white background and yellow borders (Yellow cC0 M0 Y100 K0).
5.2.4-Labels should be applied on a flat surface on the packaging in a way that doesn’t block other important information which are printed on the package.
5.2.5-The designated area for the application of the authenticity label should be specified in the packaging artwork which must be confirmed and documented by the technical director.
5.2.6-Use of Smaller labels than indicated in 5.2.3 is permissible in case of smaller packaging and is subject to inclusion of required key data elements, being recommended by the technical director, and being confirmed by the IFDA.



5.3-incorporate into Persian product label: those imported products which as ordered by law are required to affix a Persian product label to their product may, subject to the approval of the technical director, incorporate the TTAC data elements into the said label so to save on the space and work.

6-generation and application of identifiers



Once all the required licenses and permissions are viewable and marked as approved on the company’s online dashboard, the technical director of the company may move on to initiating the process of generation and application of identifiers as described below:

a) License Holder Company shall procure the hardware, software, and human resources necessary for the task as ordered by IFDA.
b) For each salable unit/unit of use of a batch number, a unique identifier will be generated which after verification is either printed on the packaging or applied as label.
c) Affixed labels are controlled in terms of quality and accuracy, and are checked against other relevant data such as IRC, order size, custom clearance documents, physical attributes of the product, batch No and expiration date.
d) Once the required criteria for 6.3 are met, and as packages are bundled together in higher level packaging, the identifiers associated with said package items will also be associated with one aggregation ID. Aggregation label containing the aggregation ID is then printed and applied on the bundled pack.
e) Data regarding labeled products are uploaded to the IFDA repository. After data is verified and the applicable fee is paid off, it would show on the dashboard for the technical director of the company.
f) The technical director after reviewing the information will release the products. At this point, the identifiers become activated and are queryable (some products, however, might require additional permissions to be issued by other relevant organizations as well). If a product is on the market before it is flagged as released on the system if queried would be reported as fake in which case the IFDA would recall them from the market.
f-a) Before mass application of the TTAC required data elements, the designated application site for the TTAC label\print on the packaging should be delineated in the artwork, and upon confirmation by the technical director shall be documented and preserved along with other documents relating to the product.

6.1-serialization at the source: all the licensed companies having acquired their prefix and based on the standards specified in article 5, may generate the unique identifiers and apply them on their products. Applying the identifiers at the source includes two phases:
a) Printing the identifiers and other required data elements on the packaging (Authenticity ID should be concealed beneath a scratchable coat).
b) Controlling the applied identifiers, aggregating them into a higher order of packaging and applying the aggregation ID label.

6.2-serialization after the product has departed from its origin (before entering the distribution company): all the required information as specified in article 5.2 and according to the defined structure, would be printed on labels (Authenticity ID should be concealed beneath a scratchable coat) And then the labels are applied on the packaging. The label application spot on the packaging should be chosen in a manner which doesn’t block other important information that is printed on the product packaging. Moreover, it should be accurately readable and not easily detachable.
Postponing the application of labels to the point where it has entered the warehousing facility of Distribution Company is not allowed. Distribution companies may only accept products which already have the verifiable TTAC data elements included. However, under special circumstances and subject to IFDA authorization, using the warehousing facilities of a distribution company for the purpose of applying TTAC label might be allowed; in which case the following criteria must be satisfied:
- Designating and separating part of the warehouse and equipping that area with cameras so that the entire process of entering the products, applying TTAC label, verification, aggregation, and exiting could be monitored.
-the application of labels should be carried out under direct supervision of the license holder company.
- Adhered UID’s must be controlled and validated as specified herein
- Aggregation IDs must be generated and applied as specified herein
- All the steps and procedures from the point of product entry till it is handed over to Distribution Company must be documented. Said documents must be preserved for at least a year

7-Third Party Service Providers



Licensed companies including importers and manufacturers are allowed to outsource all or part of their serialization procedure to a third party contractor company. However, from the date of issuance of this document, IFDA will not issue any sort of license nor will it implicitly or explicitly endorse any of the contractor companies.

7.1-contractor companies previously licensed by the IFDA may continue their cooperation with the license holder companies as before. However, The licenses issued under their names remain valid only until October 22, 2015, because Form which point forward the IFDA will no longer assume the responsibility of overseeing the contractor companies nor will it license them, and therefore the choice of cooperating with third-party service provider companies remains with the license holder company.
7.2-License holder companies are solely responsible for their company’s compliance with the requirements of TTAC and guidelines set out here regardless of outsourcing/in-house management of the serialization process.

8-Distribution and Dispensing

Distribution companies and their branches as well as dispensaries are obliged to procure and install the necessary hardware and software prerequisites of traceability as ordered by the IFDA, utilizing which they must register and report all the transactions of buying, selling, moving, returns, and any sort of change in physical/chemical attributes, location, ownership and identity of the products according to the protocols and timings specified by the IFDA.

9-service fees

IFDA will charge license holder companies based on the number of UID’s issued to cover the costs associated with the implementation of TTAC. Applicable fees must be paid off as the UID’s are uploaded to the IFDA repository. Service fees and rates are specified by the TTAC committee and are applicable once approved by the IFDA president.

10-violations and penalties

Given the critical importance of the TTAC system in assuring safe and reliable access to health-related products, IRFDFA will take all the necessary measures to protect the integrity of the system and will penalize all incidents of violation accordingly:

10.1-following occurrences might, subject to the judgment of TTAC committee, result in disqualification and dismissing of the technical director. Obviously, the above action does not replace legal prosecutions ensued which face the company and its technical director.

- Dispensed medicine/supplements which lack TTAC required data elements
- Authorizing release of the products which lack TTAC required data elements
- Releasing products despite the discrepancy between products attributes such as UID, IRC, etc.
- Releasing products bearing invalid data elements, low quality or misplaced labels
- Failure to meet the requirements of the Article 6 of this directive
- Higher order packaging missing aggregation IDs/labels
- Failure on the part of technical directors to accomplish the requirements of the article 5.2, resulting in poor performance/compliance of their respective companies

10.2-following will result in product recall by the IFDA

- Health-related products distributed on the market but, lacking TTAC required data elements
- Products bearing valid but repetitive ID’s
- Distribution of products on the market before being released by the company’s technical director
- Erasure or poor readability of the TTAC labels
- Discrepancy between the UID and other attributes of the product
- Irreconcilability with expiry date and LOT number
- Discrepancy in quantity between generated UID’s and the declared number in the import permit
- Distribution of products in unintended geographical locations
- Product bearing fake label, or with appearance different from the structure specified in this guideline
- Products bearing misplaced labels/printed data elements
- Products missing TTAC required data elements handed over or found in warehousing facilities of a distribution company with the exception of article 6.2
- Product lacking TTAC data elements and distributed in pharmacies

This directive has been ratified by the TTAC committee and the president of the IFDA on October 7, 2015, effectively preempting prior guidelines and coming into force starting from October 23, 2015.