Blockchain: The Answer to Medtech Traceability?

Pressures to control supply chains are increasing while governments are adding new requirements for companies to better track individual products. Blockchain technology is most often associated with cryptocurrencies like Bitcoin, but it has a lot to offer to the medtech space as a tool to enhance product traceability and address new EU regulatory requirements. Lydia Torne, with law firm Simmons & Simmons LLP, explores the prospects.

About The Author

Lydia Torne is a Managing Associate at the international law firm Simmons & Simmons LLP. She specializes in all types of transactions involving intellectual property, with a particular focus on the life sciences sector. She also advises on life sciences regulatory compliance issues including product classification, interactions with health-care professionals, clinical trials, market access, supply chain requirements, marketing and pharmacovigilance.

Having revolutionized the financial markets sector with the creation of cryptocurrencies such as Bitcoin, other sectors are now exploring whether blockchain technology could transform their own industries. The life sciences sector, including devices and diagnostics, is no exception and one promising application for blockchain in this space is traceability solutions.

Pressures to control supply chains are increasing while governments are adding new requirements for companies to better track individual products. This article explores how blockchain technology could help address these challenges, in particular, compliance with the regulatory reforms in the EU.

Blockchain Basics

So what is blockchain? Blockchain comprises blocks of data and encrypted operations that are linked to create a digital register of transactions between people in the same network. The blockchain is distributed across a peer-to-peer network: updates are made in near real-time; each user can see, and maintains, the original version of the entire blockchain; each user can add to the chain; and all users validate updates to the chain via a consensus process. This consensus requirement means the blocks of data are almost immutable, preventing one user from subsequently altering the records contained in the blockchain. The distributed nature of the technology means that there is no central body “controlling” the entries and, therefore, no central database vulnerable to cyberattack. Although blockchain was originally used actively (that is, to process cryptocurrency transactions), it can also be used passively to record information.

Blockchain could allow real-time recording of each stage of the supply, manufacture and distribution process, up to the point the product reaches the end-purchaser.

Traditionally, a blockchain is public – freely accessible for anyone to view and participate in. It is this accessibility that underpins blockchain and, paradoxically, provides the security and integrity of the chain. The vast number of participants ensures the chain is well-distributed, reducing the risk of a cyberattack. The engagement of numerous, unrelated participants also ensures integrity by reducing the risk of wholesale collusion to alter data because consensus is required to alter the chain.

However, whilst secure, the data on a public blockchain is not private. It is transparent for all to view, although the identity of participants is pseudonymized with digital “keys.” To facilitate privacy, “private” blockchains have developed where only certain entities can participate in, view and amend the blockchain.

Medtech Possibilities

In the life sciences industries, businesses increasingly need to monitor their supply chain to ensure continuity of supply, prevent falsified products, identify defective products, and comply with regulatory obligations. Blockchain could allow real-time recording of each stage of the supply, manufacture and distribution process, up to the point the product reaches the end-purchaser.

Information such as place of production of active substances or component parts, manufacturing locations, shipping dates, batch numbers, expiry dates, storage temperature and unique identification numbers, could all be stored and monitored on blockchain. Each party involved in the supply chain could independently update the blockchain ledger with the product’s progress (e.g., receipt of products by the shipping provider) and view the product’s journey to date. The blockchain might be accessed and updated via the reading of a bar code on the product or by other means.

This type of system could assist in the event of a product liability issue. Significant damage to company reputation and patient mistrust can result from a product recall, and this can be exacerbated if the business is unable to ascertain quickly the scale of the problem, the location of the defective products and remove them from circulation. Blockchain-based supply tracing may minimize this problem: the business could review the ledger and pinpoint which products are defective (e.g., which products were handled at a contaminated site) and where they are located.

Evolving EU Requirements

This type of technology is becoming more attractive with the advent of additional traceability obligations, such as those advanced in Articles 25 and 27 of the EU Medical Devices Regulation (MDR) and Article 22 of the EU In Vitro Medical Devices Regulation (IVDR). Currently in transition periods, the MDR will apply from 2020 and the IVDR from 2022 respectively. 

The two new regulations require a unique device identifier (UDI) to be included on all product packaging in both human-readable and machine-readable form. Annex VI of the MDR addresses use of automatic identification and data capture technology such as QR codes or bar codes, which might be used in conjunction with blockchain technology. Machine-readable information can be encoded within a bar code, which could also contain additional information. Arguably, this might include access to a blockchain traceability system within the one bar code, or a separate radio-frequency identification (RFID) or bar code could be used to access the traceability system. If additional information, such as access to a blockchain traceability system, is to be provided, this should be approved as part of the device’s conformity assessment procedure, as described in the regulations.

Economic operators are defined in the new regulations as manufacturers, authorized representatives, importers, distributors, a person who combines CE marked devices and a person who sterilizes the same. According to Article 25 of the MDR and Article 22 of the IVDR, an economic operator is required to be able to identify: (a) any economic operator to whom they have directly supplied a device; (b) any economic operator who has directly supplied them with a device; and (c) any health institution or health-care professional to which they have directly supplied a device, for at least 10 years after the last device covered by the EU declaration of conformity has been placed on the market (or, for implantables, 15 years after the last device has been placed on the market).

The EU Commission announced on Feb. 1 the launch of an EU Blockchain Observatory and Forum to, among other things, monitor developments, analyze trends, address emerging issues and become a knowledge hub on blockchain.

Using a blockchain-based traceability tool, which records each stage of the supply chain and each interaction with the product, any economic operator engaged with that product could access the blockchain and view all the interactions of that product to provide relevant information quickly and easily to the authorities. Monitoring the supply chain so closely may also reduce the potential for counterfeit products to enter the supply chain downstream and accelerate the reporting of adverse events upstream. Further, by accessing the blockchain, end-recipients could independently confirm that a product is genuine before using it by verifying against the UDI database. A similar model is already being adopted in the context of monitoring the supply chain of food products.

Interestingly, Article 28 of the MDR requires (among other things) that the design of the UDI database ensures “maximum accessibility to information stored therein, including multi-user access” and which shall “validate, collate, process and make available to the public [the information].” The regulation requires “appropriate methods…for validation of the data provided” and that “manufacturers… periodically verify the correctness of all of the data relevant to devices they have placed on the market."

It seems that a blockchain-based repository might, inherently, provide some of the functionality the EU legislators require. But, there are stumbling blocks to using a public blockchain. In particular, the MDR and IVDR still envision one or several central controlling bodies, as well as compliance with confidentiality requirements. These challenges might be mitigated with the use of a private blockchain. However, it is unlikely that just the UDI database within the Eudamed database could be blockchain based. Rather, the whole of the Eudamed database might need to be converted to a blockchain system. Although this seems unlikely, there are efforts within the EU system to look closer at the promise of blockchain.  

The EU Commission announced on Feb. 1 the launch of an EU Blockchain Observatory and Forum to, among other things, monitor developments, analyze trends, address emerging issues and become a knowledge hub on blockchain. The project is part of an effort to develop a common approach to blockchain for the EU. Notably, the EU Commission specifically commented on the possibilities for blockchain in the context of clinical trials reporting and medicines registration – perhaps this might extend to the Eudamed database in due course.

It may be important to ensure that the details on the blockchain ledger remain confidential. Depending on the data stored, businesses may be content to rely on the relative anonymity offered by hashing and access keys. However, if the business remains concerned, or the data is particularly sensitive or likely to identify the business or product, a public blockchain may not be viable. In such cases, a business might consider additional encryption or a private blockchain for added privacy and control.

However, the restricted nature of a private blockchain prevents businesses from enjoying some of the advantages of a public blockchain. For example:

• Bespoke software infrastructures may need to be built to facilitate the operation of the blockchain whereas this infrastructure may already exist for public blockchains;
• Individually approving participants and providing them with access rights incurs both a time and monetary cost; and
• The operational cost may be higher as the private blockchain will not have the benefits offered by the scale of a public blockchain.

It should be remembered that the inclusion of a machine and/or human readable code on the packaging of a product to access and update the blockchain must also comply with local product labeling requirements and may require consent from the relevant competent authority.

Although questions remain, blockchain-based solutions certainly provide an interesting possibility for complementary supply chain management systems, which could offer businesses a wealth of advantages, including assisting with new compliance obligations.

The author would like to thank the contributions of her colleagues Julien Moiroux, Emilie Danglades-Perez, Annabelle Bruydonckx and Vladimir Murovec in preparing this article.

[Editor's note: Guest columns do not necessarily reflect the views of Medtech Insight.]