Decentralized track-and-trace for drug provenance — GS1 EPCIS events anchored across manufacturer, distributor, and regulator ledgers, from raw API to pharmacy shelf
Roughly 80% of active pharmaceutical ingredients sold in the United States are manufactured or sourced overseas, often through multi-tier chemical supply chains that are opaque even to the branded drug maker. Provenance tracking starts at the earliest verifiable point: the fine-chemical or fermentation plant producing the API itself, where a GS1-standard identifier and a hashed Certificate of Analysis become the permanent, unfalsifiable root of everything downstream.
Every trackable object in the GS1 standard ecosystem is identified, not merely described:
GTIN (Global Trade Item Number): a 14-digit code identifying the product itself (e.g., "Metformin HCl API, USP grade") — the same GTIN applies to every unit of that specific product from that specific manufacturer.
Lot/Batch number: identifies a specific production run of that GTIN — critical because pharmaceutical quality events (contamination, potency drift) are almost always lot-specific, not product-wide.
SGTIN (Serialized GTIN): once the API is formulated into finished, saleable units downstream, each individual package additionally receives a unique serial number — GTIN + serial = one specific, physical box traceable to one specific patient dispensation.
The commissioning ObjectEvent (GS1 EPCIS 2.0 standard): { "type": "ObjectEvent", "action": "ADD", "bizStep": "commissioning", "epcList": ["urn:epc:id:sgtin:series.APImfr.LOT2026-0417"], "eventTime": "2026-04-17T08:12:00Z", "bizLocation": "urn:epc:id:sgln:plant.Hyderabad.IN", "extension": { "coaHash": "9f3a...e21", "supplierID": "DUNS-860214477" } }
This event — hashed and submitted as a blockchain transaction to the API manufacturer's private ledger node — is the provenance root. No later event in the chain can be verified as authentic without ultimately tracing back to a valid, hash-matched commissioning event at origin. If a counterfeiter fabricates a mid-chain shipment record, it will fail because it cannot reference a genuine, cryptographically-anchored root event.
A finished drug product typically passes through three to five distinct manufacturing entities before it is ready to ship: the API producer, a drug-product formulator who blends and tablets/fills, a fill-finish site for injectables, and a serialization/packaging line that applies the final unique identifier. Each transformation is a discrete, auditable event — GS1 EPCIS models exactly this with AggregationEvent and TransformationEvent types.
Two EPCIS event types capture what physically happens on a packaging line:
TransformationEvent — inputs consumed, new outputs created: { "type": "TransformationEvent", "inputEPCList": ["urn:epc:id:sgtin:...LOT2026-0417-API"], "outputEPCList": ["urn:epc:id:sgtin:...LOT2026-0501-TABLET x 50000"], "bizStep": "formulating", "eventTime": "2026-05-01T14:00:00Z" } This models the irreversible fact that 12kg of bulk API became 50,000 finished tablets — the input lot is consumed and a new, distinct output lot is born, with a recorded genealogical link back to the parent.
AggregationEvent — physical nesting of already-serialized units: { "type": "AggregationEvent", "action": "ADD", "parentID": "urn:epc:id:sscc:case.88291047", "childEPCs": ["sgtin:...unit001", "sgtin:...unit002", "... x144"], "bizStep": "packing" } This captures 144 individually serialized cartons being packed into one case (SSCC — Serial Shipping Container Code), then cases aggregated onto a pallet — a three-level hierarchy (item→case→pallet) that lets a single pallet scan at a warehouse dock instantly resolve to all 20,000+ individual serialized units it contains, without manually scanning each one.
Each of these events, hashed, becomes a transaction on the manufacturer's permissioned ledger node. Because inputEPCList genealogically links a finished lot back to its consumed raw-material lot (which itself links back to the origin commissioning event from Stage 1), a full "who touched this exact box of pills and in what order" query becomes a single graph traversal rather than a multi-week paper-trail reconciliation across five separate companies' internal ERP systems.
Once packaged, a drug shipment enters the physical distribution network: third-party logistics (3PL) warehouses, national wholesalers, regional distribution hubs, and finally the dispensing pharmacy or hospital. Geographic track-and-trace layers real-world location and condition data — GPS coordinates, IoT temperature/humidity sensors — onto the same EPCIS event stream, so the digital custody chain and the physical route can be cross-verified against each other.
Every physical handoff generates a matched pair of EPCIS events — one bizStep:"shipping" from the sender, one bizStep:"receiving" from the receiver, both referencing the identical EPC list and a location code (GS1 SGLN — Serialized Global Location Number):
Ship event (Distributor A, Newark hub): { "bizStep":"shipping", "bizLocation":"sgln:hub.Newark.US", "eventTime":"2026-06-02T03:14Z", "epcList":["sscc:case.88291047"] }
Receive event (Wholesaler B, Columbus): { "bizStep":"receiving", "bizLocation":"sgln:wholesaler.Columbus.US", "eventTime":"2026-06-03T11:02Z", "epcList":["sscc:case.88291047"] }
Because both events reference the same case-level EPC and are independently submitted by two different organizations to two different ledger nodes (later reconciled via the cross-network bridge in Stage 4), a mismatch — receiving without a corresponding prior shipping event, or a shipping event with no matching receipt anywhere on the network — is immediately visible as a chain-of-custody gap, a classic early signal of diversion.
Cold-chain telemetry integration: Many biologics and vaccines require 2–8°C storage throughout transit. IoT data loggers (e.g., Bluetooth/LoRaWAN temperature tags inside the shipping case) stream readings every 1–5 minutes. Rather than writing every raw reading on-chain (impractically high volume), the logger's full temperature curve is hashed and the digest anchored to the corresponding shipping/receiving event pair — an SensorEvent extension in EPCIS 2.0. Anyone with the original logger export can verify it matches the hash and hasn't been edited after the fact to hide an excursion; nobody needs to trust the carrier's word alone that "cold chain was maintained."
Geographic plausibility check: Because every event carries a location and timestamp, the system can flag physically impossible routes — e.g., the same serialized case "received" in Columbus at 11:02 and "shipped" from a facility in Mumbai forty minutes later. This kind of geotemporal impossibility is one of the strongest, most automatable diversion signals available (developed further in Stage 5).
No manufacturer, distributor, or regulator will put its full commercial transaction history on one shared blockchain controlled by a competitor. The practical architecture — pioneered by consortiums like the MediLedger Network — is a federation of independent private/permissioned chains, one per organization or organization-type, connected by a thin interoperability layer that exchanges only standardized GS1 EPCIS event hashes and zero-knowledge-style existence proofs, never full commercial data.
The bridging problem: Manufacturer M runs Chain A. Wholesaler W runs Chain B. Regulator R runs Chain C (often a lighter-weight repository, not a full blockchain — the FDA's DSCSA pilot systems are one example). When W receives a shipment from M, W needs to verify "was this exact serialized unit legitimately produced and shipped by M?" without M granting W direct read access to its entire private ledger (which would leak competitor pricing, volumes, and other partners).
Bridge/relay architecture: 1. Each organization runs a relay node that subscribes to a shared, standards-only "verification network" — not a blockchain itself, but a routing layer that knows which chain holds which EPC's history. 2. When W's system needs to verify a unit, it submits a verification request (product GTIN + serial + expected origin) through its relay node. 3. M's relay node receives the request, checks its own private ledger for a matching, valid commissioning + custody chain, and returns a cryptographic attestation — a signed yes/no plus the relevant event hashes — without exposing M's full ledger contents. 4. W's system checks the attestation signature against M's known public organizational identity (established via a shared PKI / GS1 Global Location Number registry) and, if valid, proceeds with receiving.
Why hashes, not raw data, cross the bridge: This architecture satisfies two competing requirements simultaneously — competitive data sovereignty (M never has to reveal its supplier costs or production volumes to W) and regulatory/patient-safety verifiability (anyone in the network can cryptographically confirm a product's legitimacy). It mirrors how DSCSA envisions the "interoperable, electronic" system mandated for November 2023: not one government mega-database, but a federated verification network where trading partners can query each other in near real time.
Practical result: a pharmacist scanning a suspicious bottle can trigger an automated verification request that traverses three or four independent private ledgers in under a second and returns a definitive "genuine, full custody chain intact" or "unable to verify — do not dispense" response.
Drug diversion — genuine product illegally rerouted outside its authorized distribution channel, often to gray-market resellers or across borders to exploit price differentials — and outright counterfeiting both leave a specific fingerprint in the event data: serial numbers appearing where they should not, custody chains with gaps, or the same identifier scanned as "sold" more than once. A blockchain-anchored, geotagged event stream makes these patterns automatically and continuously detectable rather than something discovered only after a patient harm report.
Four detection patterns run continuously against the event graph:
1. Duplicate-scan / clone detection: The same serial number (SGTIN) is decommissioned (dispensed/sold) in two different, geographically distant locations within an implausible timeframe. This is the classic signature of a counterfeiter cloning a legitimate serial number onto fake product — the real unit and the fake unit both eventually get scanned as "sold." Rule: flag if decommissioning events for one EPC occur >2 in its lifetime, or in locations >500km apart within <24h.
2. Custody chain gap: A "receiving" event exists with no matching upstream "shipping" event anywhere on the federated network, or vice versa — product materializing without a traceable legitimate source, or vanishing from the authorized chain (likely diverted to an unauthorized reseller) before reappearing later at an unexpected node.
3. Geotemporal implausibility: Sequential events for the same EPC imply a travel speed exceeding any real transport mode (e.g., 6,000 km in 3 hours by truck) — nearly always indicates either a fraudulent event injection or two different physical objects sharing one (cloned) serial number.
4. Channel-deviation / gray-market routing: Product commissioned for one authorized market (e.g., a lower-price national tender) reappears in the custody chain of a distributor serving a different, higher-price market — parallel importation that may violate distribution agreements and, more importantly, bypasses that second market's own pharmacovigilance and cold-chain assurance.
Regulatory-mandated verification points: DSCSA (US) requires wholesalers to verify product identifiers on any saleable return before it can be redistributed — exactly the "hasValidCustodyChain(serial)" query the bridge network in Stage 4 enables in real time. EU FMD requires the unique identifier be checked against the European Medicines Verification System (EMVS) and decommissioned at the point of dispense — functionally the same pattern, standardized region-wide since 2019.
Alert workflow: a flagged anomaly generates a case in the regulator's and manufacturer's shared alert queue, referencing the specific EPC, the conflicting event hashes, and the two implicated network locations — giving investigators a cryptographically-grounded starting point instead of a consumer complaint and a guess.
The most powerful anti-diversion property is architectural, not just algorithmic: because every custody event is hashed and cross-referenced across independently-operated ledgers, an actor would need to compromise multiple organizations' systems simultaneously to inject a fully consistent fraudulent chain — vastly harder than falsifying one company's internal paper or spreadsheet records, which remains the dominant failure mode in pre-blockchain pharmaceutical supply chains.