Team of Research Scientists Working With Personal Computer, Analysing Test Trial New Generation Drug Data. They Work in a Modern Laboratory/ Medical Center.

Phar­maceu­ti­cal com­pa­ny

Role in the system | System access | News | FAQs | Downloads Role in the system Pharmaceutical companies that have prescription medicines in their portfolio must equip them with safety features from February 9, 2019 so that they can be checked for authenticity before being dispensed to patients. Without...

Role in the sys­tem | Sys­tem access | News | FAQs | Down­loads

Role in the sys­tem

Phar­maceu­ti­cal com­pa­nies that have pre­scrip­ti­on medi­ci­nes in their port­fo­lio must equip them with safe­ty fea­tures from Febru­ary 9, 2019 so that they can be che­cked for authen­ti­ci­ty befo­re being dis­pen­sed to pati­ents. Wit­hout the­se safe­ty fea­tures, pre­scrip­ti­on medi­ci­nes that are released for sale by the manu­fac­tu­rer after this date will no lon­ger be mar­ke­ta­ble. In order for their pro­ducts to under­go the legal­ly requi­red authen­ti­ci­ty check, phar­maceu­ti­cal com­pa­nies must con­nect to the natio­nal authen­ti­ci­ty check sys­tem. This is being set up in Ger­ma­ny by secur­Ph­arm e. V.. The con­nec­tion to the secur­Ph­arm sys­tem for phar­maceu­ti­cal com­pa­nies is pro­vi­ded by ACS Phar­ma­Pro­tect GmbH, the ope­ra­tor of the data­ba­se sys­tem of the phar­maceu­ti­cal indus­try.

The EU Com­mis­si­on lists the obli­ga­ti­ons of the indi­vi­du­al par­ties invol­ved in the imple­men­ta­ti­on of the Fal­si­fied Medi­ci­nes Direc­ti­ve in the let­ter of Octo­ber 18, 2018 

.

Sys­tem access

ACS Phar­ma­Pro­tect GmbH as the ope­ra­tor of the data­ba­se sys­tem for the phar­maceu­ti­cal indus­try, is respon­si­ble for the con­trac­tu­al and tech­ni­cal con­nec­tion of phar­maceu­ti­cal com­pa­nies who­se pro­ducts are affec­ted by the Fal­si­fied Medi­ci­nes Direc­ti­ve on the Ger­man mar­ket. Com­pa­nies wis­hing to con­nect to the secur­Ph­arm sys­tem for the authen­ti­ca­ti­on of phar­maceu­ti­cals should the­r­e­fo­re cont­act ACS Phar­ma­Pro­tect direct­ly.

check­list pro­vi­des an initi­al over­view of the requi­red data and con­tracts.

Mitteilungen

Alarm pro­ces­sing as an important pie­ce of the puz­zle: sup­port for offi­ci­al recon­nais­sance

From May 19, 2025, all aut­ho­ri­ties that alre­a­dy have access to the secur­Ph­arm sys­tem will have access to an addi­tio­nal modu­le: the Natio­nal Alert Manage­ment Sys­tem (NAMS).

Many sys­tem actions can be tra­cked with the help of so-cal­led aut­ho­ri­ty reports, but this is not pos­si­ble in all cases. Espe­ci­al­ly in …

Learn More ...

Phar­maceu­ti­cal dona­ti­ons to Ukrai­ne

In a let­ter dated 11 May 2022, the Fede­ral Minis­try of Health, Depart­ment 1 (Medi­cinal Pro­ducts, Medi­cal Devices, Bio­tech­no­lo­gy) infor­med that it is accep­ta­ble to dona­te medi­cinal pro­ducts to Ukrai­ne wit­hout deac­ti­vat­ing the uni­que iden­ti­fier (by the phar­maceu­ti­cal manu­fac­tu­r­ers). The pro­ce­du­re has been coor­di­na­ted with the sta­te aut­ho­ri­ties. The BMG …

Learn More ...

Check­list for sys­tem access

The check­list con­ta­ins infor­ma­ti­on and requi­re­ments for acces­sing the secur­Ph­arm sys­tem.…

Learn More ...

Recom­men­da­ti­ons

The recom­men­da­ti­on of April 3, 2020 rela­tes to the hand­ling of inqui­ries from phar­macists about indi­vi­du­al codes.…

Learn More ...

Inspec­tions

On June 20, 2019, the EU Com­mis­si­on issued an Aide Memoi­re for the inspec­tion of phar­maceu­ti­cal com­pa­nies with regard to the imple­men­ta­ti­on of the Fal­si­fied Medi­ci­nes Direc­ti­ve and the Dele­ga­ted Regu­la­ti­on.…

Learn More ...

Path to an “Exemp­ti­on from Bar­co­ding” in India

How do medi­cinal pro­ducts manu­fac­tu­red in India that are sub­ject to seria­liza­ti­on obtain cor­rect coding in accordance with the Dele­ga­ted Regu­la­ti­on? Infor­ma­ti­on on the pro­ce­du­re and cont­acts can be found here.…

Learn More ...

Find a contact

Do you have any questions or need help? Don't worry, we are here to help you. Simply use our contact form and we will forward your request to the right contact person, who will get back to you as quickly as possible. Your stress is our concern – let us help you.

contact us

Questions and Answers

Who is secur­Ph­arm e.V.?

secur­Ph­arm e. V. is the Ger­man orga­niza­ti­on for the authen­ti­ca­ti­on of medi­cinal pro­ducts and
respon­si­ble for the ope­ra­ti­on of the sys­tem for the authen­ti­ca­ti­on of medi­cinal pro­ducts in accordance with the
requi­re­ments of the Fal­si­fied Medi­ci­nes Direc­ti­ve and the Dele­ga­ted Regu­la­ti­on. The asso­cia­ti­on is sup­port­ed
by ABDA, BAH, BPI, PHAGRO and the vfa. secur­Ph­arm e. V. is the Ger­man com­po­nent of the EU-wide net­work EMVS against coun­ter­feit medi­ci­nes.

How do phar­maceu­ti­cal com­pa­nies con­nect to the secur­Ph­arm sys­tem?

ACS Phar­ma­Pro­tect GmbH (ACS) ope­ra­tes the data­ba­se sys­tem of the phar­maceu­ti­cal indus­try (PU sys­tem). Phar­maceu­ti­cal com­pa­nies (mar­ke­ting aut­ho­riza­ti­on hol­der: MAH),
who place medi­cinal pro­ducts on the Ger­man mar­ket that must bear the new safe­ty fea­tures in accordance with Dele­ga­ted Regu­la­ti­on (EU) No.
2021/161, con­nect to secur­Ph­arm
through ACS. If you are inte­res­ted, plea­se cont­act info@pharmaprotect.de direct­ly.

Who is ACS Phar­ma­Pro­tect GmbH (ACS)?

The ACS is the ope­ra­ting com­pa­ny of the data­ba­se sys­tem of the phar­maceu­ti­cal indus­try (PU-
Sys­tem) and thus part of the data sto­rage and retrie­val sys­tem for which secur­Ph­arm e.V. is respon­si­ble, which is requi­red by the Dele­ga­ted Regu­la­ti­on (EU) 2016/161 for the imple­men­ta­ti­on of the
Fal­si­fied Medi­ci­nes Direc­ti­ve. The share­hol­ders of the ACS are the phar­maceu­ti­cal asso­cia­ti­ons BAH,
BPI, Pro Gene­ri­ka and vfa.

What data must phar­maceu­ti­cal com­pa­nies report to the Infor­ma­ti­on Cen­ter for
Drug Spe­cial­ties - IFA GmbH?

For a suc­cessful veri­fi­ca­ti­on check, it is neces­sa­ry for the phar­maceu­ti­cal
company/supplier to report the two so-cal­led veri­fi­ca­ti­on indi­ca­tors Veri­fi­ca­ti­on
in com­pul­so­ry use from upload date and Veri­fi­ca­ti­on in com­pul­so­ry use from expiry date to the Infor­ma­ti­on Cen­ter for Medi­cinal Spe­cial­ties - IFA GmbH for each PZN affec­ted by the
Fal­si­fied Medi­ci­nes Direc­ti­ve
(see also www.ifaffm.de). The IFA report­ing dead­lines must be obser­ved. With a

31.03.2021, ver­si­on 4 crea­ted by secur­Ph­arm e. V. 5

Cor­rect and com­ple­te report­ing by the phar­maceu­ti­cal entrepreneur/supplier crea­tes a
(fur­ther) neces­sa­ry pre­re­qui­si­te for goods sub­ject to veri­fi­ca­ti­on to be reco­gni­zed as such, for the
veri­fi­ca­ti­on check to be car­ri­ed out suc­cessful­ly and for stock goods to be dis­pen­sed unhin­de­red.
Fur­ther infor­ma­ti­on on IFA report­ing can be found in the IFA FAQs

4. scope of appli­ca­ti­on

Why do I need a con­tract with ACS Phar­ma­Pro­tect GmbH (ACS)?

In the data­ba­se sys­tem of the phar­maceu­ti­cal indus­try (PU sys­tem), the com­ple­te pack­a­ging data remai­ning in the owner­ship of the
phar­maceu­ti­cal com­pa­nies are stored for the Ger­man mar­ket and pre­pared for veri­fi­ca­ti­on in the phar­ma­cy.
mar­ket and stored for veri­fi­ca­ti­on in the phar­ma­cy. Every phar­maceu­ti­cal
com­pa­ny that places medi­cinal pro­ducts sub­ject to man­da­to­ry veri­fi­ca­ti­on on the Ger­man mar­ket must
upload its pack-rela­ted data via the EU hub.

Who is a con­trac­tu­al part­ner of ACS Phar­ma­Pro­tect GmbH (ACS)?

For every phar­maceu­ti­cal com­pa­ny that has a medi­cinal pro­duct in its port­fo­lio that is sub­ject to veri­fi­ca­ti­on in accordance with
the new safe­ty fea­tures in accordance with Dele­ga­ted Regu­la­ti­on (EU) No. 2016/161, a con­nec­tion to the
con­nec­tion to the data­ba­se sys­tem of the phar­maceu­ti­cal indus­try (PU sys­tem) is neces­sa­ry.
Plea­se cont­act the ACS (info@pharmaprotect.de) direct­ly regar­ding the con­nec­tion.

Asso­cia­ti­on mem­ber­ship is not a pre­re­qui­si­te for this. The con­trac­tu­al part­ner of the ACS pro­vi­des the
maxi­mum 5-digit IFA pro­vi­der num­ber (address num­ber) as the MAH ID as part of the
mas­ter data upload via the EU-HUB. This is explai­ned in the EMVS Mas­ter Data Gui­de, which
pro­vi­ded by the EMVO.

Can I con­clude a con­tract with ACS Phar­ma-Pro­tect GmbH (ACS) tog­e­ther with my sub­si­dia­ry?

No, this is not pos­si­ble if the sub­si­dia­ry places medi­cinal pro­ducts on the mar­ket in Ger­ma­ny under its own respon­si­bi­li­ty. ACS con­cludes a con­tract with each phar­maceu­ti­cal com­pa­ny indi­vi­du­al­ly.

Can I con­clude a con­tract with ACS Phar­ma­Pro­tect GmbH (ACS) as a con­tract manu­fac­tu­rer (CMO)?

ACS only con­cludes a con­tract with phar­maceu­ti­cal com­pa­nies that mar­ket their medi­cinal pro­ducts in Ger­ma­ny.
Ger­ma­ny. Com­pa­nies that act exclu­si­ve­ly as con­tract manu­fac­tu­r­ers
the­r­e­fo­re can­not con­clude a con­tract with ACS. Howe­ver, CMOs can and must be invol­ved in the seria­liza­ti­on pro­cess by their
be invol­ved in the seria­liza­ti­on pro­cess by their cli­ents. The­r­e­fo­re, as a CMO
approach your cli­ent.

Who is respon­si­ble for the con­nec­tion to the secur­Ph­arm sys­tem?

The phar­maceu­ti­cal com­pa­ny is respon­si­ble for the imple­men­ta­ti­on of the pro­ces­ses in the phar­maceu­ti­cal com­pa­ny and for the con­nec­tion to the secur­Ph­arm sys­tem and the EU hub.
com­pa­ny.

What does par­ti­ci­pa­ti­on in secur­Ph­arm e. V. cost and how are the­se cos­ts bro­ken down?
made up?

ACS Phar­ma­Pro­tect GmbH (ACS) has deve­lo­ped a fee model that also takes into account the needs of small and medi­um-sized com­pa­nies.
small and medi­um-sized com­pa­nies. The fee model is based on a
one-off set-up fee and a fee that is cal­cu­la­ted on the basis of the annu­al tur­no­ver and
the annu­al tur­no­ver and sales of the medi­ci­nes sub­ject to veri­fi­ca­ti­on of the respec­ti­ve com­pa­ny.
of the respec­ti­ve com­pa­ny. For more infor­ma­ti­on, plea­se cont­act ACS (info@pharmaprotect.de).

How does the data get into the ACS PU sys­tem?

The ACS con­cludes a con­tract with the phar­maceu­ti­cal com­pa­nies. Within the scope of
mas­ter data uploads and pro­duct data uploads via the EU Hub, the ACS MAH sys­tem takes over the data pro­vi­ded.
takes over the data pro­vi­ded.

What do phar­maceu­ti­cal com­pa­nies have to do befo­re they can con­nect to ACS Phar­ma­Pro­tect
GmbH (ACS) befo­re they can con­nect?

The Dele­ga­ted Regu­la­ti­on (EU) 2016/161 pro­vi­des for a legi­ti­ma­cy check for phar­maceu­ti­cal
com­pa­nies befo­re they can con­nect to the natio­nal data­ba­se. ACS is the­r­e­fo­re
obli­ged to check the iden­ti­ty, role and legi­ti­ma­cy of each user. As part of the
ACS requests the neces­sa­ry docu­ments as part of the legi­ti­ma­cy check.
ACS con­cludes a con­tract with each phar­maceu­ti­cal com­pa­ny indi­vi­du­al­ly.

Are the­re any other con­tracts that phar­maceu­ti­cal com­pa­nies must con­clude?

Phar­maceu­ti­cal com­pa­nies must con­clude a con­tract with the ACS in order to use the enti­re Euro­pean
veri­fi­ca­ti­on sys­tem, phar­maceu­ti­cal com­pa­nies must con­clude a con­tract with the ope­ra­tor of the EU Hub. This is inde­pen­dent
regard­less of whe­ther they mar­ket their medi­cinal pro­ducts in just one or seve­ral EU mem­ber sta­tes.
mem­ber sta­tes. The ope­ra­tor of the EU Hub is the Euro­pean Medi­ci­nes Veri­fi­ca­ti­on Orga­niza­ti­on (EMVO).
Fur­ther infor­ma­ti­on is available at www.emvo-medicines.eu.
If com­pa­nies place affec­ted medi­cinal pro­ducts on the mar­ket in other EU mem­ber sta­tes,
then the­se com­pa­nies requi­re a con­tract with the respec­ti­ve natio­nal orga­niza­ti­on, the so-cal­led
Natio­nal Medi­ci­nes Veri­fi­ca­ti­on Orga­niza­ti­on (NMVO), for the data sto­rage and retrie­val sys­tem.
retrie­val sys­tem. An over­view of all NMVOs can be found at https://emvo-
medicines.eu/mission/emvs/#countries

Do I need a con­tract with ACS Phar­ma­Pro­tect GmbH (ACS) if I have a con­tract with the EMVO?
with EMVO?

A con­tract with ACS is still neces­sa­ry becau­se the PU sys­tem stores the seri­al num­bers that
uploa­ded by the phar­maceu­ti­cal com­pa­ny via the EU Hub are stored in the PU sys­tem
and stored for veri­fi­ca­ti­on and wri­te-off in Ger­ma­ny. The deve­lo­p­ment and
deve­lo­p­ment of the EMVO sys­tem is also finan­ced by the funds that the phar­maceu­ti­cal
phar­maceu­ti­cal com­pa­ny pays to the natio­nal veri­fi­ca­ti­on orga­niza­ti­ons.

What is an alert in the secur­Ph­arm sys­tem?

If a data record of a phar­maceu­ti­cal packa­ge does not match the data record stored in the PU sys­tem,
stored in the PU sys­tem can­not be con­firm­ed, the secur­Ph­arm sys­tem reports an alert.
reports a so-cal­led alert. For each alert, it must be cla­ri­fied whe­ther it is a fal­se alarm,
due to hand­ling errors or tech­ni­cal faults, for exam­p­le, or whe­ther it is a suspec­ted
a suspec­ted case of fal­si­fi­ca­ti­on.

How can alerts be assi­gned?

Each alert is mark­ed with a stan­dar­di­zed Euro­pe-wide alert ID, under which the
affec­ted par­ties can view the sta­tus of the qua­li­fi­ca­ti­on of the con­flict. The alert ID
beg­ins with the coun­try code of the coun­try in which it was gene­ra­ted (exam­p­le: DE-d83c3187-
3107-4de0-bc52-77a0e452574f).

Which alerts are gene­ra­ted?

The basic defi­ni­ti­on of an alert is regu­la­ted in Artic­le 36(b) of the Imple­men­ting Regu­la­ti­on.
In addi­ti­on, the EMVO has divi­ded the alerts into dif­fe­rent levels. This is defi­ned in the EMVO URS
Part IV and for inter­mar­ket tran­sac­tions in the “IMT Design Note” of the EMVO
can be seen.
A sim­pli­fied over­view of the Level 5 alerts (poten­ti­al­ly rele­vant to the aut­ho­ri­ties) can be found in the fol­lo­wing table
the fol­lo­wing table:
Return code
HUB
Descrip­ti­on HUB Return­code PUS Descrip­ti­on PUS
Pack Iden­ti­fier
#A2 Batch not found LOT_03 Fai­led to find a batch (or seri­al
num­ber) for the given data.
#A3 Pack not found PC_02 Unknown seri­al num­ber.
#A52 Expiry date mis­match LOT_12 Expiry date does not match the date
held in the NMVS.
#A68 Batch num­ber mis­match LOT_13 The batch ID does not match the seri­al num­ber in the NMVS.
seri­al num­ber in the NMVS.
Pack Sta­te
#A7 Pack alre­a­dy in reques­ted
sta­te
PCK_19 Pro­per­ty is alre­a­dy set on pack.
#A24 Sta­tus chan­ge could not be
per­for­med
PCK_06,
PCK_22, PCK_27
PCK_06: Actu­al pack sta­tus does­n’t
match the undo tran­sac­tion (set and
undo sta­tus must be equi­va­lent).
PCK_22: Pack is alre­a­dy inac­ti­ve.
PCK_27: Sta­tus chan­ge could not be
per­for­med.

31.03.2021, Ver­si­on 4 crea­ted by secur­Ph­arm e. V. 9

Whe­re can the phar­maceu­ti­cal com­pa­ny record the result of its inves­ti­ga­ti­on of an alert so that this infor­ma­ti­on is available to the veri­fy­ing body?

In the alert manage­ment sys­tem of the PU sys­tem, e.g. in the alert detail view of the rele­vant alert.
alert.

How can a phar­maceu­ti­cal com­pa­ny use the ACS Alert Manage­ment Sys­tem?

In order to use the alert manage­ment sys­tem, the admi­nis­tra­tor named in the PU sys­tem must
must assign a spe­ci­fic role with rights to the user. Fur­ther infor­ma­ti­on on using the
tool can be found in the manu­al for the PU sys­tem. Use of the Alert Manage­ment Sys­tem
is not man­da­to­ry for the phar­maceu­ti­cal com­pa­ny.

How is an alert gene­ra­ted?

Alerts can be trig­ge­red by all user groups. This exam­p­le of how an alert
how an alert is gene­ra­ted is an alert trig­ge­red by a veri­fy­ing body in Ger­ma­ny.
alert.
1. the phar­maceu­ti­cal packa­ge is scan­ned by the phar­ma­cy (or ano­ther veri­fy­ing enti­ty) and the request
and the request (e.g. veri­fi­ca­ti­on or wri­te-off) is for­ward­ed to the phar­ma­cy sys­tem (AP sys­tem).
sys­tem).
2. the AP sys­tem for­wards the request anony­mously to the PU sys­tem
3. the PU sys­tem checks the request.
4. if the­re is an anoma­ly, the PU sys­tem gene­ra­tes a uni­que alert ID and for­wards this, tog­e­ther with the scan result, back to the phar­ma­cy sys­tem.
tog­e­ther with the scan result back to the AP sys­tem. At the same time, the asso­cia­ted alert
is for­ward­ed to the EU hub and stored in the PU sys­tem.
5. the AP sys­tem returns the scan result to the veri­fy­ing body (inclu­ding the alert ID if appli­ca­ble).
In the event of a posi­ti­ve test result, the veri­fy­ing body is infor­med of the posi­ti­ve result (scan result).
(scan result).

Who cla­ri­fies whe­ther the alert is a fal­se alarm or a suspec­ted for­gery?
a suspec­ted case of fal­si­fi­ca­ti­on?

The phar­maceu­ti­cal com­pa­ny con­cer­ned must cla­ri­fy whe­ther it is a fal­se alarm or a suspec­ted case of fal­si­fi­ca­ti­on.
a suspec­ted case of fal­si­fi­ca­ti­on, as far as pos­si­ble. The result of the
The result of the inves­ti­ga­ti­on can be noted in the alert manage­ment sys­tem, e.g. in the detail­ed view of the
alerts con­cer­ned.

Which fal­se alerts can the phar­maceu­ti­cal com­pa­ny cla­ri­fy?

The phar­maceu­ti­cal com­pa­ny can cla­ri­fy:
- Errors in prin­ting (e.g. print qua­li­ty, coding)
- Errors when uploa­ding the data
In the best case sce­na­rio, he includes this check in his qua­li­ty assu­rance befo­re pla­cing a medi­cinal pro­duct on the mar­ket.

What can the phar­maceu­ti­cal com­pa­ny do after an alert occurs in the Alert
manage­ment sys­tem?

How is an alert pro­ces­sed?
If the PU sys­tem detects a con­spi­cuous event, the alert ID of the alert gene­ra­ted is sent both
for­ward­ed to both the AP sys­tem and the EU Hub.
If the phar­maceu­ti­cal com­pa­ny does not use the alert manage­ment sys­tem, the alert is
the alert is auto­ma­ti­cal­ly and imme­dia­te­ly for­ward­ed to the aut­ho­ri­ty por­tal.
Howe­ver, if he uses this addi­tio­nal func­tion of the ACS, the fol­lo­wing steps are pos­si­ble:
1) The alerts can be eva­lua­ted within a peri­od of seven calen­dar days. For this pur­po­se
the phar­maceu­ti­cal com­pa­ny can view infor­ma­ti­on in the alert manage­ment sys­tem.
for this pur­po­se.
2) If an alert is unfoun­ded (e.g. tech­ni­cal error), the alert can be dele­ted by the
de-escala­ted by the phar­maceu­ti­cal com­pa­ny in the PU sys­tem (after rec­ti­fi­ca­ti­on of the tech­ni­cal
error). Other­wi­se, the alert can be escala­ted by the phar­maceu­ti­cal entre­pre­neur in the
PU sys­tem.
Note: If an alert is not pro­ces­sed within seven days, it is auto­ma­ti­cal­ly escala­ted.
escala­ted.
Irre­spec­ti­ve of this, the usu­al sta­tu­to­ry report­ing obli­ga­ti­ons app­ly to phar­maceu­ti­cal com­pa­nies.
report­ing obli­ga­ti­ons.

What is expec­ted of the phar­maceu­ti­cal entre­pre­neur in the con­text of alert pro­ces­sing?
expec­ted?

As a rule, the phar­maceu­ti­cal com­pa­ny can only check whe­ther an alert was cau­sed by inter­nal errors
(e.g. miss­ing batch upload, incor­rect expiry date uploa­ded, incor­rect­ly prin­ted pack, etc.).
prin­ted pack­a­ging, etc.). If this is the case, the alert can be sent via the Alert Manage­ment
sys­tem of the ACS can be de-escala­ted by the phar­maceu­ti­cal entre­pre­neur (use of the tool
see 6.5). As long as this error - if pos­si­ble - has not been rec­ti­fied, the pack remains unavailable for the
veri­fy­ing body. The cor­rec­tion (e.g. sub­se­quent data upload) should the­r­e­fo­re take place as quick­ly as pos­si­ble, but at least within the peri­od of seven calen­dar days (see 6.9).
In the case of the alert type “A68 - NMVS_FE_LOT_13” (the batch ID does not match the seri­al num­ber in the NMVS), the phar­maceu­ti­cal com­pa­ny can de-esca­la­te the alert if the error in the batch num­ber is due to incor­rect capi­ta­liza­ti­on, for exam­p­le. The uni­que iden­ti­fier (pro­duct code (GTIN/NTIN/PPN) and seri­al num­ber) is cor­rect for this alert type. Howe­ver, if the batch is unknown to the phar­maceu­ti­cal com­pa­ny, it is advi­sa­ble to esca­la­te this alert. should the phar­maceu­ti­cal com­pa­ny deci­de to use the alert manage­ment sys­tem for manu­al pro­ces­sing of alerts, the ent­ry of a com­ment that is as meaningful as pos­si­ble is reques­ted.
com­ment is reques­ted. The com­ment is an important com­po­nent in the com­mu­ni­ca­ti­on with the other
other sys­tem par­ti­ci­pan­ts (e.g. ter­mi­nals). Access to this com­ment is inde­pen­dent of
of the sta­tus manu­al­ly set by the phar­maceu­ti­cal entre­pre­neur (“Escala­ted” or
“De-escala­ted”) and may help the initia­ting depart­ment to ana­ly­ze the error.

Can the mar­ket actor whe­re the alert occur­red see the result of the phar­maceu­ti­cal entrepreneur’s qua­li­fi­ca­ti­on?

The mar­ket par­ti­ci­pant can view the result of the qua­li­fi­ca­ti­on via a user inter­face pro­vi­ded by the NGDA (NGDA GUI) at https://securpharm-gui.ngda.de/. If the alert is clas­si­fied as a fal­se alarm after the inves­ti­ga­ti­on by the phar­maceu­ti­cal com­pa­ny, this does not result in a report­ing obli­ga­ti­on. If the alert is clas­si­fied by the phar­maceu­ti­cal com­pa­ny as a suspec­ted case of fal­si­fi­ca­ti­on, the phar­maceu­ti­cal com­pa­ny is obli­ged to report it to the com­pe­tent super­vi­so­ry aut­ho­ri­ty. The clas­si­fi­ca­ti­on as a suspec­ted fal­si­fi­ca­ti­on also results in a report­ing obli­ga­ti­on for the veri­fy­ing body. If, for exam­p­le, the test result is alre­a­dy known after three days, then the peri­od of seven calen­dar days for report­ing does not have to be wai­ted for. Howe­ver, if, in addi­ti­on to the nega­ti­ve veri­fi­ca­ti­on by the secur­Ph­arm sys­tem, fur­ther indi­ca­ti­ons point to a suspec­ted case of fal­si­fi­ca­ti­on, the­re is an imme­dia­te obli­ga­ti­on to noti­fy the com­pe­tent super­vi­so­ry aut­ho­ri­ty.

How long may the qua­li­fi­ca­ti­on of the alert take?

Only the phar­maceu­ti­cal com­pa­ny using the alert manage­ment sys­tem has seven calen­dar
days to clas­si­fy an alert as a fal­se alarm or suspec­ted fal­si­fi­ca­ti­on.
If a phar­maceu­ti­cal com­pa­ny does not use the alert manage­ment sys­tem, then
an alert is escala­ted imme­dia­te­ly and auto­ma­ti­cal­ly.

What hap­pens if the phar­maceu­ti­cal com­pa­ny does not qua­li­fy the alert?
the alert?

For com­pa­nies that do not use the alert manage­ment sys­tem, alerts are escala­ted imme­dia­te­ly and auto­ma­ti­cal­ly.
and auto­ma­ti­cal­ly escala­ted.
For com­pa­nies that use the alert manage­ment sys­tem, the alert is only escala­ted after the peri­od
of seven calen­dar days is the alert auto­ma­ti­cal­ly clas­si­fied as a suspec­ted case of coun­ter­feit­ing. The
secur­Ph­arm sys­tem reports the­se cases to the Fede­ral Insti­tu­te for Drugs and Medi­cal Devices.
Medi­cal Devices. The report­ing obli­ga­ti­ons of the mar­ket play­ers remain unaf­fec­ted.

Do the same pro­vi­si­ons app­ly to par­al­lel importers?

Yes.

What does the sta­tus mes­sa­ge “Pack inac­ti­ve” in the veri­fy­ing enti­ty mean?

Accor­ding to the Dele­ga­ted Regu­la­ti­on, it is pos­si­ble to veri­fy the sta­tus of a dere­gis­tered pack.
veri­fied. This func­tion is used by the phar­macist to check the sta­tus of a pack
e.g. if he wants to check whe­ther the pack has alre­a­dy been dispensed/booked out by him.
has alre­a­dy been dispensed/checked out. The actu­al dis­play of the result varies depen­ding on the
soft­ware used. As no alert is trig­ge­red by such a veri­fi­ca­ti­on, you will not find an alert ID in the
alert ID in the alert manage­ment sys­tem - and the­r­e­fo­re no - pack histo­ry for this pro­cess.
pack histo­ry for this pro­cess.

6.16.: Sin­ce Decem­ber 1, 2020, the secur­Ph­arm GUI for veri­fiers has been expan­ded to include addi­tio­nal tools.
tools have been added. What are they?
The NGDA has added an alert moni­to­ring tool to the secur­Ph­arm GUI. Veri­fy­ing bodies
(who­le­sa­lers, phar­maci­es) can find out about the details and pro­ces­sing sta­tus of an alert by the phar­maceu­ti­cal
the phar­maceu­ti­cal com­pa­ny. If the phar­maceu­ti­cal com­pa­ny has alre­a­dy
the alert, the veri­fy­ing body can view the sta­tus and the com­ment ente­red by the phar­maceu­ti­cal
and the com­ment ente­red by the phar­maceu­ti­cal entre­pre­neur. It is also plan­ned
that the veri­fy­ing body its­elf can also enter comm­ents on the alert for the phar­maceu­ti­cal
entre­pre­neur. In the medi­um term, this step is inten­ded to pro­vi­de an oppor­tu­ni­ty for dia­log
bet­ween the par­ties invol­ved.

Which medi­cinal pro­ducts are affec­ted by the Fal­si­fied Medi­ci­nes Direc­ti­ve?

The Fal­si­fied Medi­ci­nes Direc­ti­ve appli­es to medi­cinal pro­ducts that are sub­ject to pre­scrip­ti­on
and do not fall under the exemp­ti­on set out in Annex I of Dele­ga­ted Regu­la­ti­on (EU)
2016/161 and OTC medi­cinal pro­ducts lis­ted in Annex II of the Dele­ga­ted Regu­la­ti­on.
are lis­ted. It should be noted that OTC medi­ci­nes in Ger­ma­ny may be sub­ject to pre­scrip­ti­on in other EU count­ries.
may be sub­ject to pre­scrip­ti­on.

May medi­cinal pro­ducts that are neither sub­ject to pre­scrip­ti­on nor on the black list
bear the indi­vi­du­al safe­ty fea­ture?

No. The appli­ca­ti­on of a Data Matrix code to the pack­a­ging of medi­cinal pro­ducts that do not bear the
safe­ty fea­tures is only per­mit­ted if the Data Matrix Code neither con­ta­ins the indi­vi­du­al safe­ty fea­ture
the indi­vi­du­al safe­ty fea­ture nor ser­ves the pur­po­se of iden­ti­fy­ing the medi­cinal pro­duct and
as long as the requi­re­ments of EU Direc­ti­ve 2001/83/EC Title V are met. Accor­ding to cur­rent infor­ma­ti­on
Accor­ding to cur­rent infor­ma­ti­on, this is ful­fil­led if the Data Matrix Code does not con­tain a seri­al num­ber.

May medi­cinal pro­ducts that are neither sub­ject to pre­scrip­ti­on nor on the black list
vol­un­t­a­ri­ly car­ry the anti-tam­pe­ring device?

Yes, this was deci­ded by the Fede­ral Insti­tu­te for Drugs and Medi­cal Devices (BfArM) and the Paul
Ehr­lich Insti­tu­te (PEI) announ­ced this in a joint announce­ment on April 11, 2017.
https://www.pei.de/SharedDocs/bekanntmachungen/2017/banz-vorabveroeffentlichung-
announcement-pei-bfarm-anti-tampering-device.html. The Ger­man Insti­tu­te for Stan­dar­diza­ti­on has
adopted the stan­dard DIN EN 16679:2015-03 for the anti-tam­pe­ring device.

Do the safe­ty fea­tures also app­ly to medi­cinal pro­ducts manu­fac­tu­red for rese­arch and deve­lo­p­ment pur­po­ses?
deve­lo­p­ment pur­po­ses?

No, they do not app­ly to medi­cinal pro­ducts manu­fac­tu­red for rese­arch and deve­lo­p­ment pur­po­ses
and do not yet have mar­ke­ting aut­ho­riza­ti­on.

31.03.2021, Ver­si­on 4 crea­ted by secur­Ph­arm e. V. 6

What is the pro­ce­du­re for medi­cal samples?

Accor­ding to Dele­ga­ted Regu­la­ti­on (EU) 2016/161, medi­cal samples pur­su­ant to Artic­le 96 of Direc­ti­ve 2001/83/EC must also be
Regu­la­ti­on (EU) 2016/161 (Artic­les 2 and 41), medi­cal samples must also bear the safe­ty fea­tures. The phar­maceu­ti­cal
The phar­maceu­ti­cal com­pa­ny gene­ra­tes the seri­al num­ber during the pack­a­ging pro­cess and uploads it
into the ACS phar­maceu­ti­cal indus­try data­ba­se sys­tem via the EU HUB. Befo­re the
the pack is dis­pen­sed to the doc­tor, the phar­maceu­ti­cal com­pa­ny deac­ti­va­tes the seri­al
seri­al num­ber with the sta­tus “doctor’s sam­ple”. This ensu­res that this pack can­not be dis­pen­sed else­whe­re.
can be dis­pen­sed else­whe­re. As a doctor’s sam­ple, packs can be taken from the pro­duc­tion
from the pro­duc­tion of com­mer­cial goods, which are then mark­ed with the cor­re­spon­ding labe­l­ing for
labe­l­ing for medi­cal samples. The PZN of the pro­duct in ques­ti­on is retai­ned. Alter­na­tively
spe­ci­fic packs can be pro­du­ced with a spe­ci­al­ly allo­ca­ted PZN, exclu­si­ve­ly for
use as medi­cal samples. App­ly­ing for a PZN with the
sepa­ra­te artic­le type “Physician’s sam­ple accor­ding to AMG” must be sub­mit­ted to the Infor­ma­ti­ons­stel­le für
Arz­nei­spe­zia­li­tä­ten GmbH (IFA). It is gene­ral­ly recom­men­ded that the PZN is also prin­ted in plain text
on the medi­cal sam­ple pack, as this faci­li­ta­tes hand­ling and docu­men­ta­ti­on in the doctor’s sur­gery.
in the doctor’s sur­gery.

Do the regu­la­ti­ons also app­ly to vete­ri­na­ry medi­cinal pro­ducts?

No, the pro­vi­si­ons only app­ly to medi­cinal pro­ducts for human use. Cont­act for ques­ti­ons about
vete­ri­na­ry medi­cinal pro­ducts or in the event of suspec­ted fal­si­fi­ca­ti­on of vete­ri­na­ry medi­cinal pro­ducts are the Fede­ral Office of
Con­su­mer Pro­tec­tion and Food Safe­ty (BVL) or the source of sup­p­ly, i.e. the vete­ri­na­ri­an or phar­ma­cy.
the phar­ma­cy.

Coding

Who gene­ra­tes seri­al num­bers (SN)?

What regu­la­ti­ons app­ly?
The gene­ra­ti­on of seri­al num­bers is the respon­si­bi­li­ty of each indi­vi­du­al phar­maceu­ti­cal
com­pa­ny. Howe­ver, requi­re­ments must be obser­ved that are spe­ci­fied in the secur­Ph­arm
coding rules “Rules for the coding of medi­cinal pro­ducts sub­ject to man­da­to­ry veri­fi­ca­ti­on in the Ger­man mar­ket“
are set out. The docu­ment can be view­ed or down­loa­ded on the secur­Ph­arm web­site at
https://www.securpharm.de/codierung/ or down­loa­ded.

How do the soft­ware sys­tems of who­le­sa­lers, phar­maci­es and hos­pi­tals know that a pro­duct
that it is a medi­cinal pro­duct sub­ject to man­da­to­ry veri­fi­ca­ti­on?

The obli­ga­ti­on to veri­fy a pro­duct must be repor­ted by the phar­maceu­ti­cal com­pa­ny to the
The phar­maceu­ti­cal com­pa­ny must noti­fy the Infor­ma­ti­ons­stel­le für Arz­nei­spe­zia­li­tä­ten GmbH (IFA) of a product’s veri­fi­ca­ti­on obli­ga­ti­on when it is offe­red for sale.
For this pur­po­se, the pro­vi­si­ons and edi­to­ri­al dead­lines of IFA GmbH must be obser­ved so that the

31.03.2021, Ver­si­on 4 crea­ted by secur­Ph­arm e. V. 7

labe­l­ing is available in good time for for­war­ding to the soft­ware infor­ma­ti­on sys­tems
(see also 3.1).

Is the order of the infor­ma­ti­on in the Data Matrix Code pre­scri­bed, and how can space be saved by
and how can space be saved by a cer­tain arran­ge­ment?

The order of the data ele­ments is arbi­tra­ry. By means of the data iden­ti­fiers, the inter­pre­ta­ti­on of the
of the data string is unam­bi­guous. If a data ele­ment with varia­ble length is lis­ted as the last ele­ment in the
data string, a sepa­ra­tor can be saved (accor­ding to the spe­ci­fi­ca­ti­ons of the
GS1 spe­ci­fi­ca­ti­ons, the sepa­ra­tor can be omit­ted after data ele­ments with a fixed length any­way).

What is the dif­fe­rence bet­ween the various pro­duct num­ber vari­ants?

The PZN requi­red for phar­maceu­ti­cal pack­a­ging in Ger­ma­ny can be wrap­ped with both the NTIN and the PPN.
as well as with the PPN. Both pro­duct num­ber vari­ants can be used wit­hout
be used wit­hout rest­ric­tion. Plea­se note the dif­fe­rent data iden­ti­fiers and the dif­fe­ren­ces in syn­tax
dif­fe­ren­ces in the syn­tax (hea­der, sepa­ra­tor). Use of the PPN (IFA GmbH) is gene­ral­ly free of char­ge.
free of char­ge. Regar­ding the use of an NTIN, plea­se cont­act GS1 Ger­ma­ny. (Tech­ni­cal­ly
NTIN cor­re­sponds to the GTIN).

Does the PZN bar­code (Code 39) have to be prin­ted in addi­ti­on to the Data Matrix Code?
be prin­ted?

Sin­ce 09.02.2019, it has been per­mit­ted to dis­play the PZN exclu­si­ve­ly in the Data Matrix Code (DMC)
to be machi­ne-rea­da­ble. If code 39 is omit­ted, the PZN must still be prin­ted in
in plain text with the abbre­via­ti­on “PZN: “.

Is it pos­si­ble to have seve­ral codes on one pack?

The Dele­ga­ted Regu­la­ti­on allows other one- or two-dimen­sio­nal codes to be affi­xed to the
pack­a­ging, pro­vi­ded that the­se are not used to veri­fy the phar­maceu­ti­cal pack­a­ging.
of the pack. If seve­ral codes are appli­ed to a pack, it is pos­si­ble in accordance with the
secur­Ph­arm coding rules ver­si­on 2.04a, it is neces­sa­ry to app­ly the PPN emblem direct­ly next to the
Data Matrix Code to be veri­fied.

Whe­re can I find infor­ma­ti­on on the anti-tam­pe­ring device?

The anti-tam­pe­ring device is an anti-tam­pe­ring device that makes the first ope­ning of a pack
of a pack is visi­ble (tam­per veri­fi­ca­ti­on). Infor­ma­ti­on on the various opti­ons is pro­vi­ded by
the inter­na­tio­nal stan­dard EN ISO 21g76:2020, which replaces the pre­vious Euro­pean stan­dard DIN EN
16679:2015-03, which replaces it.

31.03.2021, Ver­si­on 4 crea­ted by secur­Ph­arm e. V. 8

6 Deal­ing with alarms

What to con­sider when deal­ing with returns?

Accor­ding to the Dele­ga­ted Regu­la­ti­on, a hig­her risk of fal­si­fi­ca­ti­on is assu­med for medi­cinal pro­ducts that are retur­ned by end users. The­r­e­fo­re, veri­fi­ca­ti­on of the pack throug­hout the
enti­re sup­p­ly chain is man­da­to­ry. Returns can occur for various reasons, e.g.
deli­very dama­ge or expi­red expiry date (see ques­ti­on 9.1.). The packs are
the­r­e­fo­re available with both the sta­tus “Acti­ve” and the sta­tus “Inac­ti­ve”. In the case of
returns, it is the­r­e­fo­re advi­sa­ble to veri­fy the pack in order to
check the sta­tus of the pack befo­re inac­ti­vat­ing a pack that is still “Acti­ve”, e.g. as “Des­troy­ed”.

8. recall

What to con­sider in the event of a recall?

8.1: What to con­sider in the event of a recall

If a batch has to be recal­led, this must also be car­ri­ed out by “recal­ling” the batch in the sys­tem
via access to the EU Hub (see Artic­le 40(a) Dele­ga­ted Regu­la­ti­on (EU)
2016/161). By set­ting the “Recall” sta­tus for a batch in the sys­tem, all packa­ges
of this batch are given the sta­tus “Recal­led” in addi­ti­on to the exis­ting sta­tus. This
sta­tus leads to an inac­ti­va­ti­on of the pack, which is repor­ted back to a
dis­pen­sing site during decom­mis­sio­ning, which pre­vents dis­pen­sing to the pati­ent. The com­pa­ny must
ensu­re that the sta­tus chan­ge per­for­med in the sys­tem is car­ri­ed out befo­re the actu­al
publi­ca­ti­on of the recall in the trade press, so that the enti­re sup­p­ly chain is
auto­ma­ti­cal­ly infor­med of the new
sta­tus of the pack when veri­fi­ca­ti­on or decom­mis­sio­ning is attempt­ed.

9. Sta­tus chan­ges
9.1 A pack sub­ject to FMD rea­ches its expiry date. What do I have to do?
As soon as a pack rea­ches its expiry date, the uni­que iden­ti­fier of this
pack is auto­ma­ti­cal­ly deac­ti­va­ted in the secur­Ph­arm sys­tem. It is the­r­e­fo­re important that mar­ket play­ers
do not attempt to addi­tio­nal­ly deac­ti­va­te
indi­vi­du­al iden­ti­fiers of expi­red packs (e.g. set­ting them to “Des­troy­ed”). No addi­tio­nal sta­tus chan­ges are neces­sa­ry in the
secur­Ph­arm sys­tem. Pos­si­ble other obli­ga­ti­ons (e.g. docu­men­ta­ti­on of dis­po­sal)
remain unaf­fec­ted by this.
A check of the authen­ti­ci­ty of the uni­que iden­ti­fier (veri­fi­ca­ti­on) of the pack
is still pos­si­ble, howe­ver: The secur­Ph­arm sys­tem then responds with the mes­sa­ge that the expiry date has been excee­ded and the pack
may not be dis­pen­sed. The pack must
be hand­led in accordance with the exis­ting spe­ci­fi­ca­ti­ons.

Downloads & Links

Empfehlung zum Umgang mit Anfragen von Apothekern

In der Verfassung vom 03. April 2020pdf, 576,81 KB

FAQs (deutsch)

In der Verfassung vom 31. März 2021pdf, 263,33 KB

FAQs (englisch)

In der Verfassung vom 31. März 2021pdf, 263,33 KB

Checkliste für den Systemzugang (deutsch)

In der Verfassung vom 29. April 2022pdf, 139,92 KB

Checkliste für den Systemzugang (englisch)

In der Verfassung vom 29. April 2022pdf, 139,92 KB

Aide Memoire der EU-Kommission für Inspektionen

In der Verfassung vom 20. Juni 2019pdf, 713,25 KB

News

Updated BAK working aid

01 September 2025 | reading time: <1 Minute

Alarm pro­ces­sing as an important pie­ce of the puz­zle: sup­port for offi­ci­al recon­nais­sance

16 Mai 2025