Cardinal Health Technical Requirements for Serialization
Version 1.1
May 13, 2016
Contents
Introduction ...................................................................................................................................... 2
Testing With Cardinal Health ........................................................................................................... 3
Important Reference Material .......................................................................................................... 4
Serial Number Data Carriers ........................................................................................................... 5
Master Data ..................................................................................................................................... 7
EPCIS Events .................................................................................................................................. 8
Setup Data for EPCIS Events .......................................................................................................... 9
Cardinal Health AS2 Profile Information for EPCIS Event Files ...................................................... 9
Appendix – Complete Annotated List of External Documents Referenced by Cardinal Health .... 10
Version Notes
Version 1.1 – 05/13/2016 – Added additional requirements for AS2 exchange.
Cardinal Health Technical Requirements for Serialization
Introduction
The purpose of this document is to overview the EPCIS pilot/testing process and communicate technical
requirements in order to facilitate the successful transmission and processing of EPCIS lot-level and serialized
data pursuant to meeting current and future DSCSA requirements.
To meet the November 2023 regulation, Cardinal Health requires the use an EPCIS document that contains the
DSCSA TI/TS along with unit-level and container-level serial numbers that indicate the containment hierarchy.
Before November 2023 we anticipate manufacturers to be on different preparation paths to implement EPCIS for
full traceability and expect several scenarios occurring simultaneously for which we need to provide separate
guidance. We understand your situation may change over time.
Migration to a DSCSA-compliant EPCIS lot-level file to comply with current DSCSA requirements.
Migration to a DSCSA-compliant EPCIS serialized file (GS1 standards for this are not yet finalized).
Sending serial number aggregation only using EPCIS in parallel with your current DSCSA lot-based
methodology.
Cardinal Health welcomes this opportunity to learn the costs and benefits of utilizing serialized product information
along with you. In these early stages of piloting where serialized EPCIS for DSCSA is not finalized, Cardinal
Health is more concerned with testing various data exchange approaches and less concerned about compliance.
As the November 2023 deadlines approach, we will focus more on exactly what is needed for compliance.
Consequently it is possible that not all of the technical approaches we test today will meet our compliance needs
in the future.
Page 2 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization
Testing With Cardinal Health
With the uncertainty when manufacturers will begin passing serial numbers before 2023, Cardinal Health will not
incorporate automated SGTIN validation as part of our Receiving process at this time. What this means for
piloting purposes is that our EPCIS system will be decoupled from our production receiving processes, and we
will conduct pilots using our EPCIS repository in a manual and highly controlled fashion, providing feedback on
labeling, aggregation quality and DSCSA content (if applicable) for each Manufacturer who participates.
For situations where the partner is readying for permanent production transmissions, at the close of the pilot a
permanent production arrangement can be negotiated provided both parties agree on readiness and anticipated
consistency.
Requests for testing engagement can be sent to [email protected] .
Expectations for Manufacturers
-
-
We expect the Manufacturer or third party participants to be adept at:
o Constructing and self-validating lot level or serialized level EPCIS files;
o Implementing FDA labeling requirements following HDMA and/or GS1 guidance;
o Understanding DSCSA data element requirements as they relate to Transaction Data;
o Understanding Master Data requirements for EPCIS exchange.
We will exchange Master Data for the pilots (GLNs, GTINs, addresses, etc.) in advance.
We require a technical single point of contact (or email distribution list).
We require use of our email contact [email protected] for all correspondence.
Mutual agreement on scenarios and scenario planning and sequence.
Pilot scenarios we anticipate include but are not limited to:
o File transmissions;
 EPCIS DSCSA-compliant Lot-level;
 EPCIS DSCSA-compliant Serialized;
 EPCIS serial numbers only, with or without aggregation.
o Various methods for exchanging Master Data;
o Serial number verification with manufacturer or 3rd party;
o Exception processing (TBD pending GS1 EPCIS “VoidShipping” event).
Pilot Goals (some or all depending on mutually agreed scenarios)
-
Confirm electronic data delivery.
Confirm completeness and data quality of TI/TH/TS.
Using barcode labels or images, confirm serial number and/or aggregation accuracy with electronic feed.
Confirm barcode quality and content.
Confirm scenarios and document results and conclusions.
Pilot Process Overview
Due to limitations in this interim period before 2023 and the number of manufacturers that we anticipate
approaching us for pilots, we may need to limit the pilot to a fixed number of iterations which we will negotiate with
the manufacturer.
The steps below overview initial data exchange and testing, which may lead to production testing for serialized
and aggregated product in the supply chain.
Page 3 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization
-
Initial Non-Production data exchange and testing – Steps for preliminary testing, no accompanying
physical shipment, repeatable as necessary:
o Mutually agree/define scenarios.
o Master Data exchange via Cardinal Health-provided spreadsheet.
o Manufacturer provides PO information by defining PO, NDCs and quantities for scenario in
advance.
o Manufacturer provides initial electronic transmission (via email or non-prod URL).
o If scenario requires, Manufacturer provides accompanying labels (either label stock, scanned
barcode images, e.g.).
o Cardinal Health will attempt to import the electronic information into our repository.
o Cardinal Health will provide feedback on success or list reasons for failure.
o Cardinal Health will evaluate any barcodes and provide feedback on content and acceptability.
o Once usable electronic data and labels are in hand, Cardinal Health will scan labels to reconcile
to the electronic data feed.
-
Optional testing in Production if product is already serialized:
o Manufacturer and Cardinal Health can coordinate receipt of a pre-determined shipment at our
National Logistics Center in Groveport, Ohio. At this time this will be the only facility we will
inspect product for pilot purposes.
o Manufacturer will send an electronic file corresponding to the physical shipment which we will
receive and import into our serial event repository.
o We will obtain special permission internally to hold the shipment receipt and open cases
(serialization test only).
o We will manually scan all case and item barcodes for the shipment which will update our serial
event repository (serialization test only).
o We will re-seal cases as needed and allow the shipment to go through normal Receiving.
-
Feedback – For both non-production and production testing described above, Cardinal Health will
provide feedback (as applicable) that will encompass:
o Confirmation of cases counts and unit counts received;
o Confirmation of parent-child relationships (serialization test only);
o Confirmation of number of serial number matches (serialization test only);
o List individual serial number mismatches (serialization test only);
o List Lot and Expiration mismatches.
o DSCSA data completeness and quality.
o Feedback on case and item barcode quality, placement, etc.
Important Reference Material
It is our desire to align tightly with GS1 standards and HDMA industry guidance for serialization in order to
minimize or eliminate any special requirements that manufacturers will need to follow for Cardinal Health. Our
hope is that all companies in the supply chain will do the same so that efficiencies are maximized for everyone.
In recognition of that, and so that we don’t duplicate guidance content published by those organizations, most of
this document contains references to external documents published by FDA, GS1 and HDMA. For a complete
Page 4 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization
listing of these documents, including where you can obtain them, see Appendix 1. The following list explains the
reference codes we use in this document to refer to content that can be found in these external documents:
CAH
Reference
code
Document
publisher
HBC
HDMA
GGS
GS1
EPCIS
GS1
GIG
GS1 US
GDM
GS1
FDA
FDA
Document Title
HDMA Guidelines for Bar Coding in the Pharmaceutical Supply Chain
http://www.healthcaredistribution.org/publications/hdma-guidelines-forbar-coding-in-the-pharmaceutical-supply-chain-quick-start-guide . Please
note, a copy of this can be found on our Pharmaceutical Tracing site. For
more details click here.
GS1 General Specifications
http://www.gs1.org/barcodes-epcrfid-id-keys/gs1-general-specifications
GS1 Electronic Product Code Information Services
EPCIS 1.1 Standard http://www.gs1.org/epcis
GS1 US Healthcare Implementation Guide, Applying GS1 Standards to
U.S. Pharmaceutical Supply Chain Business Processes To Support
DSCSA
http://www.gs1us.org/industries/healthcare/gs1-healthcare-usinitiative/dscsa/implementation-guide
GS1 DataMatrix Guide
From this page, follow the link for the “GS1 DataMatrix User Guide” Twodimensional (2D) barcodes | GS1
H.R. 3024; Drug Quality and Security Act (DQSA), Title II – Drug Supply
Chain Security Act (DSCSA)
http://www.fda.gov/Drugs/DrugSafety/DrugIntegrityandSupplyChainSecuri
ty/DrugSupplyChainSecurityAct/ucm376829.htm
Serial Number Data Carriers
Cardinal Health currently has the capability to make use of multiple barcoded serial number data carriers;
however we no longer support RFID. Products must be serialized at the case and individual package levels.
Pallets may also be serialized but Cardinal Health currently will not make use of that level, although we may in the
future.
DSCSA Requirements:
“Unless the Secretary allows, through guidance, the use of other technologies for data instead of,
or in addition to, the technologies the applicable data:
- Shall be included in a 2-dimensional data matrix barcode when affixed to, or imprinted upon, a package
- Shall be included in a linear or 2-dimensional data matrix barcode when affixed to, or imprinted upon, a
homogeneous case.”
Please refer to the chart below for data carrier-specific formatting preferences for each level and each carrier. For
more information on bar coding requirements in the U.S. pharma supply chain, please refer to HBC. For more
information about barcode formatting see GGS, GDM and HBC. Cardinal Health strongly supports the specific
recommendations contained within the HBC document produced by the HDMA and trading partners are strongly
encouraged to follow that guidance to streamline their work with Cardinal Health.
Barcode Data Carriers
Item Level
 2D GS1 Data Matrix ECC200
o <FNC1>+Al(01)+Al(21)+AI(17)+AI(10) in a single barcode
o Human readable
Case Level
Required
 GS1-128 Linear barcodes – Homogeneous Cases
Page 5 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization
o <FNC1>+Al(01)+Al(21) in a single barcode
o <FNC1>+AI(17)+AI(10)

(AI(30) is optional)
o Human readable
Required
 GS1-128 Linear barcodes – Mixed or Partial Cases
o AI(00) SSCC
o Human readable
Optional
 GS1 Data Matrix ECC200 – Homogenous Cases
o <FNC1>+Al(01)+Al(21)+AI(17)+AI(10) in a single barcode
o Human readable
Pallet Level
Optional
 GS1-128 Linear barcodes
o Al(00) SSCC
o Human readable
Optional
Barcode Requirements
Whenever applying 2D barcodes to drug packages (item-level) or cases we expect suppliers to follow GS1
standards and HDMA guidance. In following the EPCIS standard we expect manufacturers’ product to be
identified using a GS1 GTIN (Global Trade Item Number). The GGS and HBC documents provide information on
exactly how to encode data into GS1-128 linear, and GS1 DataMatrix ECC200 2D barcodes for the U.S. supply
chain. The following information is provided to help make it clear what the barcodes must contain.
-
All barcodes be quality grade B or higher.
All barcodes, whether on drug packages or case labels, must encode data in GS1 “element strings” using
Application Identifiers as explained in GGS (HBC contains additional guidance).
Item-level barcodes must contain at least the following Application Identifiers:
o AI 01 14-digit GTIN.
o AI 21 The serial number that is globally unique to the GTIN above.
o AI 17 Expiration date
o AI 10 Lot/Batch number
The encoded data should appear as:
< FNC1>+AI(01)+GTIN+AI(21)+SerialNumber+<FNC1>+AI(17)+ExpirationDate+AI(10)+Lot Number
The first FNC1 is used to indicate that this is a GS1 bar code. The second FNC1 (also known as a Group
Separator) is used to terminate the variable length serial number prior to starting the next AI. Since the lot
number is last data element encoded in the bar code, there is no need to terminate using FNC1. The
parentheses are not encoded in the bar code — they are only shown as human-readable.
Cardinal Health does not have a requirement for the specific sequence of the application identifiers. This
is just an example.
-
Product labels on cases must contain the following Application Identifiers encoded in two GS1-128 Linear
barcodes as explained in HBC:
o Barcode 1
 AI 01 14-digit GTIN. This is the GTIN of a full, homogeneous case.
 AI 21 The serial number that is globally unique to the GTIN above.
The encoded data should appear as:
< FNC1>+AI(01)+GTIN+AI(21)+SerialNumber
o
Barcode 2
 AI 17 Expiration date
 AI 10 Lot/Batch number
Page 6 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization

AI 30 Quantity of units inside case. (Read the explanation in HBC about the use of this
AI in the U.S. Pharma supply chain differs from the GS1 standard as explained in GGS.
For this AI, please follow the HBC guidance rather than the GGS.)
The encoded data should appear as:
< FNC1>+AI(17)+ExpirationDate+AI(10)+Lot/Batch+<FNC1>+AI(30)+Quantity
(AI(30) is optional and the second FNC1 is only required if the lot is less than 20 and followed by another
application identifier.)
-
Product labels on cases may also contain one GS1 2D DataMatrix barcode on them but this single 2D
barcode must contain the exact same AIs and data content as the two linear barcodes.
For barcode placement and size, please follow the guidance in HBC. Please consider the HDMA
recommendations as Cardinal Health requirements. Note: HDMA will soon be making an update to their
Quick Start Guide (HBC) to change the wrap-around label layout to mirror-image.
Master Data
The following data is necessary for the construction and exchange of EPCIS Events. At some point during the
Cardinal Health testing/onboarding process we will need to exchange with you the data listed below and will
provide you a spreadsheet for the exchange.
EPCIS
Lot-Level
Aggregation Serialized
Product
EPCIS
Only
EPCIS
Attribute
Required
Required
Required
GTIN**
Yes
Yes
Yes
NDC
Yes
Yes
Name
Yes
Yes
Strength
Yes
Yes
Dosage
Yes
Yes
Container Size
Yes
Yes
** If you do not have a GTIN we advise you obtain one.
Page 7 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization
Location (seller)
Attribute
GLN/SGLN**
Company Prefix
Business Name
Address Line 1
Address Line 2
City
State/Territory
Zip Code
Lot-Level
EPCIS
Required
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
EPCIS
Aggregation
Only
Required
Yes
Yes
Serialized
EPCIS
Required
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
** If you do not have a GLN we advise you obtain one; however HIN or DEA can be used.
Cardinal Health location information will be provided in the spreadsheet mentioned above. Our corporate Bill To
location information is:
SGLN: urn:epc:id:sgln:0096295.00000.0
Company Prefix: 0096295
Cardinal Health, 7000 Cardinal Place, Dublin, OH 43017
Our Ship To for testing:
SGLN: urn:epc:id:sgln:0096295.00099.0
Cardinal Health, 5995 Commerce Center Road, Groveport, OH 43125
EPCIS Events
Cardinal Health accepts GS1 EPCIS events for the purpose of receiving information about serial numbers on
drugs shipped from suppliers. Event files must contain standard GS1 EPCIS events that are structured and
extended as documented in the GIG document from GS1 US.
EPCIS Event Requirements
The following requirements are Cardinal Health requirements in addition to those found in the GIG document that
we want to underscore:
-
-
-
Before we can begin receiving EPCIS events we will need to receive your product and location master data.
As mentioned above, we will provide a detailed spreadsheet in which both parties can define and reference
master data. Contact us at [email protected] for more information once you are ready to
engage in testing.
All EPCIS sent must conform to GS1 EPCIS 1.1 XSD and we expect trading partners to validate them for
accuracy before submitting them to Cardinal Health. To help minimize delays, we recommend using a free
utility like www.vizworkbench.com to validate your EPCIS prior to sending to Cardinal Health. As of this
writing we understand vizworkbench has a 1MB file size limitation for upload.
For any single unit, the Event Time of the commissioning, packing and shipping events must be in
chronological order not sharing the same timestamp (commission < packing < shipping).
Within the document, events are to be arranged in the order commission, packing, and shipping.
All serial numbers in the shipping and packing events must be present in commission event.
If sending shipping events as well as packing events, only send the EPCs of the outermost packaging of
container serial numbers in the shipping event (most likely that of the case or pallet).
Page 8 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization
-
The full packaging hierarchy must be expressed in the Packing event provided.
Serial numbers are to be in SGTIN EPC URI format.
Location source and destination data elements must adhere strictly to those values exchanged with Cardinal
Health.
Shipping Event – bizTransactionList MUST include PO number.
For DSCSA-compliant EPCIS lot-level file
- Consult “Part 6: Application of EPCIS for Lot-Level Management” in the GIG document to understand
data elements required for transmission. Within Part 6, reference subsection 21 which shows various
relationship choreographies with sample XML depicting the EPCIS events.
For Serial number aggregation only
- Consult “Part 7: Application of EPCIS for Serialized Item-Level Traceability” in the GIG document to
understand data elements required for transmission.
- We require commission, packing (aggregation) and shipping events for this use case.
For DSCSA-compliant EPCIS serialized file
- Consult “Part 7: Application of EPCIS for Serialized Item-Level Traceability” in the GIG document to
understand data elements required for transmission. At this time the GIG has TBD for some data
elements such as the Transaction Statement. At this time, this can be omitted or we will support this in
the Shipping Event Extension as described in Part 6 for Lot-Level Management.
- We require commission, packing (aggregation) and shipping events for this use case.
Setup Data for EPCIS Events
Cardinal Health AS2 Profile Information for EPCIS Event Files
This profile provides the URL and server IP addresses for access through the firewall into Cardinal Health’s
EPCIS Event Community
Test Environment:
AS2 ID: CARDINALEPCISTEST
AS2 URL: http://stgedigateway.cardinalhealth.com:4080/exchange/CARDINALEPCISTEST
Production Environment:
AS2 ID: CARDINALEPCIS
AS2 URL: http://edigateway.cardinalhealth.com:4080/exchange/CARDINALEPCIS
-
To transact, we will need your AS2 ID, AS2 URL and AS2 certificate for any production and nonproduction source from which you will send your EPCIS.
If you need an AS2 certificate from Cardinal Health, please request it from the email address below. The
same AS2 certificate will work for both production and non-production URLs above.
Many, if not most AS2 solutions automatically request MDNs (acknowledgments) for file transfers by
default. If your AS2 requests an MDN, Cardinal Health will send an MDN for your EPCIS transmission.
Please send the requirements above to [email protected].
Page 9 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization
Appendix – Complete Annotated List of External Documents
Referenced by Cardinal Health
This is a complete listing of the documents published by HDMA and GS1 that Cardinal Health references in this
Onboarding Guideline. We highly recommend that our trading partners obtain these documents and use them as
our requirements.
HDMA Guidelines for Bar Coding in the Pharmaceutical Supply Chain (referenced as “HBC”)
This document explains how to apply various barcode and labeling standards in the U.S. pharmaceutical supply
chain. It was written by a group of technical experts from manufacturers and distributors within the U.S. supply
chain and it is intended to provide specific guidance for labeling and marking shipping containers (inner pack,
case and pallet) and even some for drug package labeling. The guidance was updated in 2012 to cover
serialization.
This document is available from the HDMA and can be downloaded from their Marketplace website. With
permission from HDMA we offer a free download from our Pharmaceutical Tracing site at
www.cardinalhealth.com/trace. From there, select the “Pharmaceutical Tracing – Manufacturers” link on the left
side menu.
GS1 General Specifications (referenced as “GGS”)
This document contains GS1 standards specifications for the “GS1 System”, which is a unified set of standards
that include barcode symbologies, formatting and encoding of data that is contained within barcodes. We expect
our suppliers to conform to one or more of the following standards, depending on which barcodes will be used:
-
GS1-128 linear barcode symbology
GS1 DataMatrix 2D barcode symbology
GS1 Element String construction
GS1 keys including SSCC, GLN, GTIN and GTIN plus serial number
GS1 Application Identifiers (AI) including SSCC (00), GTIN (01), serial number (21), lot/batch (10),
expiration date (17), quantity (30)
This document may be obtained from GS1 by following the instructions at this GS1 web page.
GS1 Electronic Product Code Information Services (EPCIS) (referenced as “EPCIS”)
This document is the EPCIS standard that explains each data element and how they must be formatted to
conform to the standard. EPCIS is highly extensible and to have meaning and utility in the U.S. pharmaceutical
supply chain it must be extended with additional data elements that are not documented in the standard. For this
reason if you are planning to make use of EPCIS, you should also obtain a copy of GIG below.
As of this writing the referenced document is the EPCIS 1.1 standard. This free document can be downloaded
from the GS1 website.
GS1 US Healthcare Implementation Guide (Referenced as “GIG”)
This document explains how to apply GS1 standards to communicate serialization information using EPCIS
events specifically within the U.S. pharmaceutical supply chain. At this time the document is written for EPCIS
version 1.1 which solidifies DSCSA compliance at the lot level. There is within guidance for the serialized level
compliance, but the compliance to DSCSA is not yet complete. If you are planning to make use of EPCIS events
then you should obtain a copy of this document.
A copy of this free document may be obtained by downloading from the GS1 website.
Page 10 of 11
Technical questions in applying this guide should be sent to: [email protected].
Cardinal Health Technical Requirements for Serialization
GS1 DataMatrix Guide (referenced as “GDM”)
This document provides a good introduction and technical overview of the GS1 DataMatrix barcode. Its primary
value is as background information for those who choose to use the DataMatrix ECC200 2D barcode to carry their
serialization information.
This free document may be downloaded from this page, follow the link for the “GS1 DataMatrix User Guide”.
Page 11 of 11
Technical questions in applying this guide should be sent to: [email protected].