Role in the system | System access | News | FAQs | Downloads
Pharmaceutical companies that have prescription medicines in their portfolio must equip them with safety features from February 9, 2019 so that they can be checked for authenticity before being dispensed to patients. Without these safety features, prescription medicines that are released for sale by the manufacturer after this date will no longer be marketable. In order for their products to undergo the legally required authenticity check, pharmaceutical companies must connect to the national authenticity check system. This is being set up in Germany by securPharm e. V.. The connection to the securPharm system for pharmaceutical companies is provided by ACS PharmaProtect GmbH, the operator of the database system of the pharmaceutical industry.
The EU Commission lists the obligations of the individual parties involved in the implementation of the Falsified Medicines Directive in the letter of October 18, 2018
.ACS PharmaProtect GmbH as the operator of the database system for the pharmaceutical industry, is responsible for the contractual and technical connection of pharmaceutical companies whose products are affected by the Falsified Medicines Directive on the German market. Companies wishing to connect to the securPharm system for the authentication of pharmaceuticals should therefore contact ACS PharmaProtect directly.
A checklist provides an initial overview of the required data and contracts.
From May 19, 2025, all authorities that already have access to the securPharm system will have access to an additional module: the National Alert Management System (NAMS).
Many system actions can be tracked with the help of so-called authority reports, but this is not possible in all cases. Especially in …
In a letter dated 11 May 2022, the Federal Ministry of Health, Department 1 (Medicinal Products, Medical Devices, Biotechnology) informed that it is acceptable to donate medicinal products to Ukraine without deactivating the unique identifier (by the pharmaceutical manufacturers). The procedure has been coordinated with the state authorities. The BMG …
The checklist contains information and requirements for accessing the securPharm system.…
The recommendation of April 3, 2020 relates to the handling of inquiries from pharmacists about individual codes.…
On June 20, 2019, the EU Commission issued an Aide Memoire for the inspection of pharmaceutical companies with regard to the implementation of the Falsified Medicines Directive and the Delegated Regulation.…
How do medicinal products manufactured in India that are subject to serialization obtain correct coding in accordance with the Delegated Regulation? Information on the procedure and contacts can be found here.…
Do you have any questions or need help? Don't worry, we are here to help you. Simply use our contact form and we will forward your request to the right contact person, who will get back to you as quickly as possible. Your stress is our concern – let us help you.
contact ussecurPharm e. V. is the German organization for the authentication of medicinal products and
responsible for the operation of the system for the authentication of medicinal products in accordance with the
requirements of the Falsified Medicines Directive and the Delegated Regulation. The association is supported
by ABDA, BAH, BPI, PHAGRO and the vfa. securPharm e. V. is the German component of the EU-wide network EMVS against counterfeit medicines.
ACS PharmaProtect GmbH (ACS) operates the database system of the pharmaceutical industry (PU system). Pharmaceutical companies (marketing authorization holder: MAH),
who place medicinal products on the German market that must bear the new safety features in accordance with Delegated Regulation (EU) No.
2021/161, connect to securPharm
through ACS. If you are interested, please contact info@pharmaprotect.de directly.
The ACS is the operating company of the database system of the pharmaceutical industry (PU-
System) and thus part of the data storage and retrieval system for which securPharm e.V. is responsible, which is required by the Delegated Regulation (EU) 2016/161 for the implementation of the
Falsified Medicines Directive. The shareholders of the ACS are the pharmaceutical associations BAH,
BPI, Pro Generika and vfa.
For a successful verification check, it is necessary for the pharmaceutical
company/supplier to report the two so-called verification indicators Verification
in compulsory use from upload date and Verification in compulsory use from expiry date to the Information Center for Medicinal Specialties - IFA GmbH for each PZN affected by the
Falsified Medicines Directive
(see also www.ifaffm.de). The IFA reporting deadlines must be observed. With a
31.03.2021, version 4 created by securPharm e. V. 5
Correct and complete reporting by the pharmaceutical entrepreneur/supplier creates a
(further) necessary prerequisite for goods subject to verification to be recognized as such, for the
verification check to be carried out successfully and for stock goods to be dispensed unhindered.
Further information on IFA reporting can be found in the IFA FAQs
4. scope of application
In the database system of the pharmaceutical industry (PU system), the complete packaging data remaining in the ownership of the
pharmaceutical companies are stored for the German market and prepared for verification in the pharmacy.
market and stored for verification in the pharmacy. Every pharmaceutical
company that places medicinal products subject to mandatory verification on the German market must
upload its pack-related data via the EU hub.
For every pharmaceutical company that has a medicinal product in its portfolio that is subject to verification in accordance with
the new safety features in accordance with Delegated Regulation (EU) No. 2016/161, a connection to the
connection to the database system of the pharmaceutical industry (PU system) is necessary.
Please contact the ACS (info@pharmaprotect.de) directly regarding the connection.
Association membership is not a prerequisite for this. The contractual partner of the ACS provides the
maximum 5-digit IFA provider number (address number) as the MAH ID as part of the
master data upload via the EU-HUB. This is explained in the EMVS Master Data Guide, which
provided by the EMVO.
No, this is not possible if the subsidiary places medicinal products on the market in Germany under its own responsibility. ACS concludes a contract with each pharmaceutical company individually.
ACS only concludes a contract with pharmaceutical companies that market their medicinal products in Germany.
Germany. Companies that act exclusively as contract manufacturers
therefore cannot conclude a contract with ACS. However, CMOs can and must be involved in the serialization process by their
be involved in the serialization process by their clients. Therefore, as a CMO
approach your client.
The pharmaceutical company is responsible for the implementation of the processes in the pharmaceutical company and for the connection to the securPharm system and the EU hub.
company.
ACS PharmaProtect GmbH (ACS) has developed a fee model that also takes into account the needs of small and medium-sized companies.
small and medium-sized companies. The fee model is based on a
one-off set-up fee and a fee that is calculated on the basis of the annual turnover and
the annual turnover and sales of the medicines subject to verification of the respective company.
of the respective company. For more information, please contact ACS (info@pharmaprotect.de).
The ACS concludes a contract with the pharmaceutical companies. Within the scope of
master data uploads and product data uploads via the EU Hub, the ACS MAH system takes over the data provided.
takes over the data provided.
The Delegated Regulation (EU) 2016/161 provides for a legitimacy check for pharmaceutical
companies before they can connect to the national database. ACS is therefore
obliged to check the identity, role and legitimacy of each user. As part of the
ACS requests the necessary documents as part of the legitimacy check.
ACS concludes a contract with each pharmaceutical company individually.
Pharmaceutical companies must conclude a contract with the ACS in order to use the entire European
verification system, pharmaceutical companies must conclude a contract with the operator of the EU Hub. This is independent
regardless of whether they market their medicinal products in just one or several EU member states.
member states. The operator of the EU Hub is the European Medicines Verification Organization (EMVO).
Further information is available at www.emvo-medicines.eu.
If companies place affected medicinal products on the market in other EU member states,
then these companies require a contract with the respective national organization, the so-called
National Medicines Verification Organization (NMVO), for the data storage and retrieval system.
retrieval system. An overview of all NMVOs can be found at https://emvo-
medicines.eu/mission/emvs/#countries
A contract with ACS is still necessary because the PU system stores the serial numbers that
uploaded by the pharmaceutical company via the EU Hub are stored in the PU system
and stored for verification and write-off in Germany. The development and
development of the EMVO system is also financed by the funds that the pharmaceutical
pharmaceutical company pays to the national verification organizations.
If a data record of a pharmaceutical package does not match the data record stored in the PU system,
stored in the PU system cannot be confirmed, the securPharm system reports an alert.
reports a so-called alert. For each alert, it must be clarified whether it is a false alarm,
due to handling errors or technical faults, for example, or whether it is a suspected
a suspected case of falsification.
Each alert is marked with a standardized Europe-wide alert ID, under which the
affected parties can view the status of the qualification of the conflict. The alert ID
begins with the country code of the country in which it was generated (example: DE-d83c3187-
3107-4de0-bc52-77a0e452574f).
The basic definition of an alert is regulated in Article 36(b) of the Implementing Regulation.
In addition, the EMVO has divided the alerts into different levels. This is defined in the EMVO URS
Part IV and for intermarket transactions in the “IMT Design Note” of the EMVO
can be seen.
A simplified overview of the Level 5 alerts (potentially relevant to the authorities) can be found in the following table
the following table:
Return code
HUB
Description HUB Returncode PUS Description PUS
Pack Identifier
#A2 Batch not found LOT_03 Failed to find a batch (or serial
number) for the given data.
#A3 Pack not found PC_02 Unknown serial number.
#A52 Expiry date mismatch LOT_12 Expiry date does not match the date
held in the NMVS.
#A68 Batch number mismatch LOT_13 The batch ID does not match the serial number in the NMVS.
serial number in the NMVS.
Pack State
#A7 Pack already in requested
state
PCK_19 Property is already set on pack.
#A24 Status change could not be
performed
PCK_06,
PCK_22, PCK_27
PCK_06: Actual pack status doesn’t
match the undo transaction (set and
undo status must be equivalent).
PCK_22: Pack is already inactive.
PCK_27: Status change could not be
performed.
31.03.2021, Version 4 created by securPharm e. V. 9
In the alert management system of the PU system, e.g. in the alert detail view of the relevant alert.
alert.
In order to use the alert management system, the administrator named in the PU system must
must assign a specific role with rights to the user. Further information on using the
tool can be found in the manual for the PU system. Use of the Alert Management System
is not mandatory for the pharmaceutical company.
Alerts can be triggered by all user groups. This example of how an alert
how an alert is generated is an alert triggered by a verifying body in Germany.
alert.
1. the pharmaceutical package is scanned by the pharmacy (or another verifying entity) and the request
and the request (e.g. verification or write-off) is forwarded to the pharmacy system (AP system).
system).
2. the AP system forwards the request anonymously to the PU system
3. the PU system checks the request.
4. if there is an anomaly, the PU system generates a unique alert ID and forwards this, together with the scan result, back to the pharmacy system.
together with the scan result back to the AP system. At the same time, the associated alert
is forwarded to the EU hub and stored in the PU system.
5. the AP system returns the scan result to the verifying body (including the alert ID if applicable).
In the event of a positive test result, the verifying body is informed of the positive result (scan result).
(scan result).
The pharmaceutical company concerned must clarify whether it is a false alarm or a suspected case of falsification.
a suspected case of falsification, as far as possible. The result of the
The result of the investigation can be noted in the alert management system, e.g. in the detailed view of the
alerts concerned.
The pharmaceutical company can clarify:
- Errors in printing (e.g. print quality, coding)
- Errors when uploading the data
In the best case scenario, he includes this check in his quality assurance before placing a medicinal product on the market.
How is an alert processed?
If the PU system detects a conspicuous event, the alert ID of the alert generated is sent both
forwarded to both the AP system and the EU Hub.
If the pharmaceutical company does not use the alert management system, the alert is
the alert is automatically and immediately forwarded to the authority portal.
However, if he uses this additional function of the ACS, the following steps are possible:
1) The alerts can be evaluated within a period of seven calendar days. For this purpose
the pharmaceutical company can view information in the alert management system.
for this purpose.
2) If an alert is unfounded (e.g. technical error), the alert can be deleted by the
de-escalated by the pharmaceutical company in the PU system (after rectification of the technical
error). Otherwise, the alert can be escalated by the pharmaceutical entrepreneur in the
PU system.
Note: If an alert is not processed within seven days, it is automatically escalated.
escalated.
Irrespective of this, the usual statutory reporting obligations apply to pharmaceutical companies.
reporting obligations.
As a rule, the pharmaceutical company can only check whether an alert was caused by internal errors
(e.g. missing batch upload, incorrect expiry date uploaded, incorrectly printed pack, etc.).
printed packaging, etc.). If this is the case, the alert can be sent via the Alert Management
system of the ACS can be de-escalated by the pharmaceutical entrepreneur (use of the tool
see 6.5). As long as this error - if possible - has not been rectified, the pack remains unavailable for the
verifying body. The correction (e.g. subsequent data upload) should therefore take place as quickly as possible, but at least within the period of seven calendar days (see 6.9).
In the case of the alert type “A68 - NMVS_FE_LOT_13” (the batch ID does not match the serial number in the NMVS), the pharmaceutical company can de-escalate the alert if the error in the batch number is due to incorrect capitalization, for example. The unique identifier (product code (GTIN/NTIN/PPN) and serial number) is correct for this alert type. However, if the batch is unknown to the pharmaceutical company, it is advisable to escalate this alert. should the pharmaceutical company decide to use the alert management system for manual processing of alerts, the entry of a comment that is as meaningful as possible is requested.
comment is requested. The comment is an important component in the communication with the other
other system participants (e.g. terminals). Access to this comment is independent of
of the status manually set by the pharmaceutical entrepreneur (“Escalated” or
“De-escalated”) and may help the initiating department to analyze the error.
The market participant can view the result of the qualification via a user interface provided by the NGDA (NGDA GUI) at https://securpharm-gui.ngda.de/. If the alert is classified as a false alarm after the investigation by the pharmaceutical company, this does not result in a reporting obligation. If the alert is classified by the pharmaceutical company as a suspected case of falsification, the pharmaceutical company is obliged to report it to the competent supervisory authority. The classification as a suspected falsification also results in a reporting obligation for the verifying body. If, for example, the test result is already known after three days, then the period of seven calendar days for reporting does not have to be waited for. However, if, in addition to the negative verification by the securPharm system, further indications point to a suspected case of falsification, there is an immediate obligation to notify the competent supervisory authority.
Only the pharmaceutical company using the alert management system has seven calendar
days to classify an alert as a false alarm or suspected falsification.
If a pharmaceutical company does not use the alert management system, then
an alert is escalated immediately and automatically.
For companies that do not use the alert management system, alerts are escalated immediately and automatically.
and automatically escalated.
For companies that use the alert management system, the alert is only escalated after the period
of seven calendar days is the alert automatically classified as a suspected case of counterfeiting. The
securPharm system reports these cases to the Federal Institute for Drugs and Medical Devices.
Medical Devices. The reporting obligations of the market players remain unaffected.
Yes.
According to the Delegated Regulation, it is possible to verify the status of a deregistered pack.
verified. This function is used by the pharmacist to check the status of a pack
e.g. if he wants to check whether the pack has already been dispensed/booked out by him.
has already been dispensed/checked out. The actual display of the result varies depending on the
software used. As no alert is triggered by such a verification, you will not find an alert ID in the
alert ID in the alert management system - and therefore no - pack history for this process.
pack history for this process.
6.16.: Since December 1, 2020, the securPharm GUI for verifiers has been expanded to include additional tools.
tools have been added. What are they?
The NGDA has added an alert monitoring tool to the securPharm GUI. Verifying bodies
(wholesalers, pharmacies) can find out about the details and processing status of an alert by the pharmaceutical
the pharmaceutical company. If the pharmaceutical company has already
the alert, the verifying body can view the status and the comment entered by the pharmaceutical
and the comment entered by the pharmaceutical entrepreneur. It is also planned
that the verifying body itself can also enter comments on the alert for the pharmaceutical
entrepreneur. In the medium term, this step is intended to provide an opportunity for dialog
between the parties involved.
The Falsified Medicines Directive applies to medicinal products that are subject to prescription
and do not fall under the exemption set out in Annex I of Delegated Regulation (EU)
2016/161 and OTC medicinal products listed in Annex II of the Delegated Regulation.
are listed. It should be noted that OTC medicines in Germany may be subject to prescription in other EU countries.
may be subject to prescription.
No. The application of a Data Matrix code to the packaging of medicinal products that do not bear the
safety features is only permitted if the Data Matrix Code neither contains the individual safety feature
the individual safety feature nor serves the purpose of identifying the medicinal product and
as long as the requirements of EU Directive 2001/83/EC Title V are met. According to current information
According to current information, this is fulfilled if the Data Matrix Code does not contain a serial number.
Yes, this was decided by the Federal Institute for Drugs and Medical Devices (BfArM) and the Paul
Ehrlich Institute (PEI) announced this in a joint announcement on April 11, 2017.
https://www.pei.de/SharedDocs/bekanntmachungen/2017/banz-vorabveroeffentlichung-
announcement-pei-bfarm-anti-tampering-device.html. The German Institute for Standardization has
adopted the standard DIN EN 16679:2015-03 for the anti-tampering device.
No, they do not apply to medicinal products manufactured for research and development purposes
and do not yet have marketing authorization.
31.03.2021, Version 4 created by securPharm e. V. 6
According to Delegated Regulation (EU) 2016/161, medical samples pursuant to Article 96 of Directive 2001/83/EC must also be
Regulation (EU) 2016/161 (Articles 2 and 41), medical samples must also bear the safety features. The pharmaceutical
The pharmaceutical company generates the serial number during the packaging process and uploads it
into the ACS pharmaceutical industry database system via the EU HUB. Before the
the pack is dispensed to the doctor, the pharmaceutical company deactivates the serial
serial number with the status “doctor’s sample”. This ensures that this pack cannot be dispensed elsewhere.
can be dispensed elsewhere. As a doctor’s sample, packs can be taken from the production
from the production of commercial goods, which are then marked with the corresponding labeling for
labeling for medical samples. The PZN of the product in question is retained. Alternatively
specific packs can be produced with a specially allocated PZN, exclusively for
use as medical samples. Applying for a PZN with the
separate article type “Physician’s sample according to AMG” must be submitted to the Informationsstelle für
Arzneispezialitäten GmbH (IFA). It is generally recommended that the PZN is also printed in plain text
on the medical sample pack, as this facilitates handling and documentation in the doctor’s surgery.
in the doctor’s surgery.
No, the provisions only apply to medicinal products for human use. Contact for questions about
veterinary medicinal products or in the event of suspected falsification of veterinary medicinal products are the Federal Office of
Consumer Protection and Food Safety (BVL) or the source of supply, i.e. the veterinarian or pharmacy.
the pharmacy.
Coding
What regulations apply?
The generation of serial numbers is the responsibility of each individual pharmaceutical
company. However, requirements must be observed that are specified in the securPharm
coding rules “Rules for the coding of medicinal products subject to mandatory verification in the German market“
are set out. The document can be viewed or downloaded on the securPharm website at
https://www.securpharm.de/codierung/ or downloaded.
The obligation to verify a product must be reported by the pharmaceutical company to the
The pharmaceutical company must notify the Informationsstelle für Arzneispezialitäten GmbH (IFA) of a product’s verification obligation when it is offered for sale.
For this purpose, the provisions and editorial deadlines of IFA GmbH must be observed so that the
31.03.2021, Version 4 created by securPharm e. V. 7
labeling is available in good time for forwarding to the software information systems
(see also 3.1).
The order of the data elements is arbitrary. By means of the data identifiers, the interpretation of the
of the data string is unambiguous. If a data element with variable length is listed as the last element in the
data string, a separator can be saved (according to the specifications of the
GS1 specifications, the separator can be omitted after data elements with a fixed length anyway).
The PZN required for pharmaceutical packaging in Germany can be wrapped with both the NTIN and the PPN.
as well as with the PPN. Both product number variants can be used without
be used without restriction. Please note the different data identifiers and the differences in syntax
differences in the syntax (header, separator). Use of the PPN (IFA GmbH) is generally free of charge.
free of charge. Regarding the use of an NTIN, please contact GS1 Germany. (Technically
NTIN corresponds to the GTIN).
Since 09.02.2019, it has been permitted to display the PZN exclusively in the Data Matrix Code (DMC)
to be machine-readable. If code 39 is omitted, the PZN must still be printed in
in plain text with the abbreviation “PZN: “.
The Delegated Regulation allows other one- or two-dimensional codes to be affixed to the
packaging, provided that these are not used to verify the pharmaceutical packaging.
of the pack. If several codes are applied to a pack, it is possible in accordance with the
securPharm coding rules version 2.04a, it is necessary to apply the PPN emblem directly next to the
Data Matrix Code to be verified.
The anti-tampering device is an anti-tampering device that makes the first opening of a pack
of a pack is visible (tamper verification). Information on the various options is provided by
the international standard EN ISO 21g76:2020, which replaces the previous European standard DIN EN
16679:2015-03, which replaces it.
31.03.2021, Version 4 created by securPharm e. V. 8
6 Dealing with alarms
According to the Delegated Regulation, a higher risk of falsification is assumed for medicinal products that are returned by end users. Therefore, verification of the pack throughout the
entire supply chain is mandatory. Returns can occur for various reasons, e.g.
delivery damage or expired expiry date (see question 9.1.). The packs are
therefore available with both the status “Active” and the status “Inactive”. In the case of
returns, it is therefore advisable to verify the pack in order to
check the status of the pack before inactivating a pack that is still “Active”, e.g. as “Destroyed”.
8. recall
8.1: What to consider in the event of a recall
If a batch has to be recalled, this must also be carried out by “recalling” the batch in the system
via access to the EU Hub (see Article 40(a) Delegated Regulation (EU)
2016/161). By setting the “Recall” status for a batch in the system, all packages
of this batch are given the status “Recalled” in addition to the existing status. This
status leads to an inactivation of the pack, which is reported back to a
dispensing site during decommissioning, which prevents dispensing to the patient. The company must
ensure that the status change performed in the system is carried out before the actual
publication of the recall in the trade press, so that the entire supply chain is
automatically informed of the new
status of the pack when verification or decommissioning is attempted.
9. Status changes
9.1 A pack subject to FMD reaches its expiry date. What do I have to do?
As soon as a pack reaches its expiry date, the unique identifier of this
pack is automatically deactivated in the securPharm system. It is therefore important that market players
do not attempt to additionally deactivate
individual identifiers of expired packs (e.g. setting them to “Destroyed”). No additional status changes are necessary in the
securPharm system. Possible other obligations (e.g. documentation of disposal)
remain unaffected by this.
A check of the authenticity of the unique identifier (verification) of the pack
is still possible, however: The securPharm system then responds with the message that the expiry date has been exceeded and the pack
may not be dispensed. The pack must
be handled in accordance with the existing specifications.
In der Verfassung vom 03. April 2020pdf, 576,81 KB
In der Verfassung vom 31. März 2021pdf, 263,33 KB
In der Verfassung vom 31. März 2021pdf, 263,33 KB
In der Verfassung vom 29. April 2022pdf, 139,92 KB
In der Verfassung vom 29. April 2022pdf, 139,92 KB
In der Verfassung vom 20. Juni 2019pdf, 713,25 KB