The Next Big Thing:
Radiofrequency Identification Technology in Industries 
Regulated by the Food and Drug Administration

Daniell Newman
Harvard Law School Class of 2005

Submitted in Fulfillment of the
Course and Third Year Written Work Requirement
April 2005

Abstract
Radio-frequency identification  (RFID) is an emerging technology that could have the most significant transformative effect on the world of commerce since the Internet became available to the masses  Currently, RFID has hundreds of applications including the tracking of objects, animals, and people; the effects of RFID are not only rippling throughout the United States economy, but are spurring sweeping changes in the way the world does business.  The Food and Drug Administration is responsible for the oversight and regulation of approximately one-quarter of the goods and services exchanged in the United States each year.  For this reason, the FDA is in the best position to monitor the impact of developments in RFID and to exercise regulatory control over its development, implementation and ongoing use.   This paper first provides an introduction to the relevant technology including a description of the most common radio-frequency identification systems and examination of the market forces driving its mass-adoption. Secondly, this paper outlines the FDA’s broad scope of regulatory authority and surveys the landscape, detailing many of the applications of RFID within the industries that operate under the watchful eye of the FDA.  Finally, this paper examines the numerous legal issues attendant to the use of this technology, with particular emphasis on questions of privacy.   

I.	What is RFID and How Does it Work?

Radio frequency identification is a technology that uses wireless radio signals to transmit and collect information about an object such as that object’s unique identifying code.  In its most common application, an RFID system uses a device called a reader to capture information from, or to send information to, small tags embedded in objects.  It then transmits that information to a computer system that processes the data.   RFID is an automated process of identification, but unlike bar code systems which require manual scanning, RFID does not require human involvement; radio frequency is different from optical scanning technology which requires a direct line of sight between the reader and the tag.  This technology makes it possible for hundreds of tags to be simultaneously read and processed by readers.  It is expected that someday soon supermarket checkers will become obsolete, as people will simply push their shopping carts past a reader that will instantly process all of their groceries at once and provide them with a total.  That same reader might also be able to read an RFID tag the purchaser is carrying as a means of payment and automatically debit the price of the groceries from the user’s account.  
Radio frequency identification is not an entirely new field.  It originated during the World War II in the form of an aircraft identification system developed by the British.  The system was designed to assist radar operators in identifying which of the aircraft on their monitors belonged to allies and which of them were German enemy planes.  The way it worked was relatively simple, and similar to the way some RFID systems work today.    When the plane received radar signals from British monitoring stations on the ground, a transmitter on board would send a reply signal indicating that it was a friendly aircraft.     
Today, the highest profile and most ubiquitous uses of this technology have been in automatic tollbooths, livestock tracking, and building access security pass cards.  One of the most widely publicized uses has been ExxonMobil’s SpeedPass, a keychain containing an RFID tag that when waved near a gas pump automatically charges the owner’s fuel or Mobil convenience store purchases to their Mobil gas, debit or credit card. For each of the few uses the general public is aware of, there are thousands of current or potential applications for RFID about which most people are oblivious.  
Most RFID tags are quite small.  The basic components are a microchip or integrated circuit which contains data, and a radio antenna through which the data is transmitted.  In the simplest of tags, the circuit and antenna can be etched or printed onto a paper thin sheet of plastic enabling the tag to be affixed to products like a label or sticker.  Tags come in any number of shapes and sizes, the smallest of which are only slightly larger than a grain of sand.  Some tags are being designed for maximum durability in order to withstand harsh environmental conditions.  One company has even announced the development of RFID tags that can survive being regularly subjected to the laundering or even the mechanical dry cleaning process.  The distance over which data can be transmitted also varies greatly depending on the size of the antenna, the power source, the radio frequency being used, and the clarity of the signal.
There are two main kinds of RFID systems, those that use active tags and those that employ passive ones.  Passive tags are powered by the electromagnetic energy that is sent by the reader in the form of radio waves.  Such tags have just a few seconds of power when read, but since they generally contain only a few pieces of information, the energy source is more than adequate.  To function, passive tags must be significantly closer to readers than active tags, and the readers used are more powerful. By contrast, active RFID tags last longer, are significantly larger, are more complex, and cost a good deal more than their passive counterparts.  As they have more data to transmit and that data often must be sent over significantly greater distances, active tags contain an internal source of power such as a battery or solar panel.  The cost of passive tags or labels is currently as low as twenty cents per piece.   The RFID industry hopes that number will drop to five cents per tag.  The more expensive active RFID tags range in cost from as little as ten dollars to more than one hundred dollars per piece.  
The most powerful active systems can exchange data at distances of over one hundred yards, while the effective distance of passive tags varies by technology from a few inches up to approximately ten yards.  Active tags are often employed in larger items such as cars, cargo containers and rail cars, which often need to be read from a distance and require longer effective tag life.  Unlike passive tags which for the most part use a read-only technology, active RFID enables users to transmit, write and store information on the tag’s silicon chip as well.  This is useful when the history of an item needs to be monitored or when the contents of a tagged container might change frequently.  These tags can also be programmed to lock information in place so that once it is transmitted it can only be added to but not overwritten.  There are several types of active RFID systems.   One class of systems uses a transponder mechanism that only becomes active and transmits when the presence of a nearby reader is detected.  This system allows the tag to preserve maximum battery life because the signal is only being sent from the tag when it perceives that it has the potential to be read.  An example of this technology is the fast track tollbooth, a tool that is currently being used in many major American cities.     The second type of active tag is a beacon which is used to find items in real time.   Beacon type tags repeatedly send out a signal with their unique identifying code which signal repeats at set time periods that are determined at the time of installation.  To work properly, a beacon system requires a triangulation of a minimum of three readers to establish an accurate fix on the tag’s location.    
The market for RFID technology is expanding rapidly, as more and more companies adopt tagging to monitor their supply chains.  All the while, countless technology firms are scrambling to create new and innovative applications.  In a recent report, independent experts wrote that over the next three years, the market for RFID will exceed seven billion dollars.    Mandates by some of the largest purchasing contractors in the world are the primary market forces motivating businesses across all industries to move quickly to incorporate RFID into their operations.  Wal-Mart, the largest retail sales company in the world issued a blanket mandate requiring its one-hundred highest-volume suppliers to place RFID tags on every pallet and every case they send.  Wal-Mart’s original deadline was January 1, 2005, but it is now estimated that full implementation will take another year.  Despite the setback, many of Wal-Mart’s smaller suppliers hoping to gain favor with their largest client have adopted RFID in anticipation of the day when anyone hoping to sell to the company will be forced to use the technology.    Following Wal-Mart’s lead, several of the country’s other major retailers have issued similar commands.  
Another influential mandate that has coerced RFID compliance was one issued by the U.S. Department of Defense (DOD).  In addition to the desire for enhanced efficiency, one of the main reasons for the Defense Department's RFID requirement was to “take the hands off the keyboards--that's where errors start;” DOD analysts have found that millions of dollars are lost fixing errors that result from mistyping, finding that an error occurs in approximately one out of every 700 manual keystrokes, costing roughly $200 to correct each one.  The DOD mandate for its top one-thousand suppliers had the same January 1, 2005 target date as Wal-Mart and although the rest of the Defense Department’s suppliers have been allotted more time, by 2007 every one of the more than 43,000 companies that do business with DOD, from those shipping soap to those supplying weapons, will be required to tag every single shipment.  This program could be particularly significant, because if it proves successful, the rest of the government, the world’s wealthiest and perhaps its most prolific buyer could extend the RFID requirement to every company that sells any shipped item to the federal government.   

II.	RFID and The FDA
The Food and Drug Administration: An Overview
The FDA, the largest regulatory agency in the United States, is part of the Department of Health and Human Services. According to Congress, the mission of the FDA is to safeguard the nation’s well-being by making sure that “foods are safe, wholesome, sanitary and properly labeled; human and veterinary drugs are safe and effective; there is reasonable assurance of the safety and effectiveness of devices intended for human use; cosmetics are safe and properly labeled; and public health and safety are protected from electronic product radiation.” The agency is responsible for the regulation of most food products and ingredients (except poultry and other meats); all prescription and over the counter medications; products derived from blood, biological materials such as vaccines or tissues intended for human transplantation; medical devices; all medical and consumer radiological products (a category which includes mobile communications devices and phones); drugs for the treatment of animals; animal feed; and all cosmetic products.  It is estimated that one out of every four dollars spent in the United States is used to purchase a good or service that is regulated by the Food and Drug Administration (FDA).  The aggregate value of the annual sale of FDA regulated goods totals approximately one trillion dollars.       
Like Wal-Mart and the Department of Defense, the FDA has issued a mandate of its own, motivated not by supply chain efficiency but by protection of the public welfare.  In a report issued last February on the subject of counterfeit pharmaceuticals, the FDA recommended the rapid adoption of RFID technology to protect the supply chain of drugs from the factory to the pharmacy.  According to the report, the system is not ready for immediate implantation, but that by 2007, RFID should be sufficiently common in the pharmaceutical sector to permit all companies to comply.

Applications of RFID Technology in Areas under FDA Regulation
Counterfeit pharmaceuticals are only the tip of the FDA’s regulatory iceberg. A survey of current and prospective uses of radio-frequency identification in industries within the regulatory scope of the Food and Drug Administration produces a list that is too long to detail for the purposes of this paper. For this reason, discussion here is limited to applications that are either already in place or that are sufficiently developed to possess a genuine likelihood of real-world implementation.   

A.	RFID Applications for Drugs
i.	Counterfeit Pharmaceuticals
In developing a plan to implement a requirement for RFID in its effort to protect the drug supply from knock-off drugs, the FDA first evaluated the potential effectiveness of such a system for tracking and tracing all drug products.  The analysts found that while it was not ready for immediate widespread use, “there was universal support for the adoption” of RFID within the pharmaceutical industry.
The FDA report has identified “mass serialization” as the “single most powerful tool available to secure the U.S. drug supply.”  Mass serialization is the process by which an object is labeled with its own unique code.  Unlike the bar code on most items today (also known as a Universal Product Code or UPC) that gives all products of the same type the same number, mass serialization uses a new numbering system at the individual item level, enabling the system to identify a particular item.  While there is no universal standard, the one that has made the most headway and gained widest acceptance is the EPC or Electronic Product Code, an expanded version of the UPC.  The EPC is a longer code that identifies what the item is, the item’s manufacturer, its version, and a general serial number.  Unlike the bar code it also incorporates additional numbers to uniquely identify each item and also contains an RFID tag.  EPC tags are applied to products in the manufacturing process, as is a logo on the product packaging that alerts the consumer about the presence of an EPC tag.  
RFID may be the only technology in existence that has the capability of managing a system with so many individual identifiers to track and monitor.  By placing a unique tag inside of each bottle RFID could allow companies to keep track of drugs from the moment they leave the factory until the moment they are delivered to the retailer.  This is precisely the sort of pedigree for which the FDA is asking.  RFID readers at store exits would be used by retailers to ensure that EPCs of legitimately purchased items leaving the store would be recorded.  Records of when a particular EPC tagged item had been sold or stolen could keep counterfeiters from taking pill bottles that had once been legitimately sold and repackaging them with fake pills.  Criminal activity of this sort costs the pharmaceutical industry over $30 billion annually.    Diluted, fake or mislabeled drugs and other counterfeit products also place countless lives at risk.   
The electronic pedigree is necessary, because a package of medication could pass through as many as ten different distribution centers or retailers before arriving at its final point of sale, and it is only with a record of each stop along that route that the authorities have any hope of determining where the malfeasance occurred.   Another potential indicator of the fact that an item is not genuine would be the complete absence of an RFID tag or the failure of a tag to register on a properly functioning RFID reader, indicating that the bottle itself is a fake.  According to the FDA report, "[r]eliable RFID technology will make the copying of medications either extremely difficult or unprofitable.  FDA is working with RFID product developers, sponsors, and participants of RFID feasibility studies to ensure that FDA's regulations facilitate the development and safe and secure use of this technology. FDA is also working with other governmental agencies to coordinate activities in this area."  
The FDA outlined a rough timeline for what the agency expects will be the key developments in the implementation of radio-frequency identification as “the standard track and trace technology.”   The mass serialization will begin in 2005 with pallets and individual packages of those pharmaceuticals that are most likely to be counterfeited.   By early 2006, most major “manufacturers, large wholesalers, some large chain drug stores, most hospitals, and some small retailers” would acquire and start using RFID readers and would be able to access the appropriate database to obtain information about the tagged items those readers scanned.  By the end of 2007, the FDA expects that every pallet and every case of pharmaceuticals will carry an individual RFID enabled unique identifying tag, and that most of the individual packages within these cases will also carry such tags.  The FDA also predicts that by then, “all manufacturers, all wholesalers, all chain drug stores, all hospitals, and most small retailers” will have RFID. 
In outlining its expectations, the FDA also made it clear to the pharmaceutical industry that the agency will make a serious effort to assist in the adoption of this emerging technology.  According to the report:
FDA plans to assist, to the extent necessary and appropriate, in facilitating the rapid, widespread adoption of RFID in the drug distribution system by working with stakeholders in the following areas:
 
•	Addressing any regulatory and policy issues related to the performance of feasibility studies; 
•	Addressing any regulatory and policy issues relating to the notification requirements associated with implementation of RFID; 
•	Addressing any product quality concerns and data issues related to the performance of feasibility studies; 
•	Reviewing protocols for feasibility studies; 
•	Working with other governmental agencies to coordinate activities;
•	Encouraging stakeholders to convene meetings of supply chain participants to identify, discuss, and propose solutions to technical, business, and policy issues related to the use of RFID technology in the pharmaceutical distribution system; and 
•	Exploring the need for any other processes and venues that might be needed to assist stakeholders as they migrate towards the use of RFID technology. 

These are just initial steps; the FDA also gives assurances that they will conduct regular reviews of the pace of adoption of RFID within the system of pharmaceutical distribution, continue to publish regulatory standards and guidance, and will weigh other steps the agency can take to “facilitate the adoption of mass serialization.”
A number of major pharmaceutical firms are already using RFID technology or have started the process of placing read-only passive tags on their bottles.  Purdue Pharma places RFID tags under the labels of bottles of OxyContin, a highly addictive medication designed for the treatment of pain that is often abused, stolen and illicitly sold. Tags could help not only in the prevention of counterfeiting, but also in tracking the supply chain in order to prevent theft.   GlaxoSmithKline will soon begin using RFID on drugs independent experts have deemed “susceptible to adulteration, counterfeiting or diversion.” Pfizer has announced that by the end of the year it hopes to have tags in place on all of its bottles of Viagra.  According to Pfizer, Viagra is one of the most recognizable and among the most counterfeited drugs in the country, and RFID will help protect consumers from counterfeit pills.       
There is evidence that the technology is already having an impact in the effort to fight counterfeiting.  Forty-four pharmacies in England recently completed a trial of an RFID system which demonstrated the incredible accuracy of the technology.  During the trial 20,000 RFID tagged products were scanned including 1,000 phony bottles that were purposefully inserted into the test to assess the accuracy of the system.  The system accurately identified counterfeit packages 100 percent of the time.   Given early successes and the FDA recommendation, it appears that within the next two years RFID tagging of pill bottles and drug packaging will be the standard practice.
   
ii.	Recalled or Expired Pharmaceuticals
RFID could also be used to facilitate the process of locating and quickly removing from sale any medications that have either been recalled for safety reasons or that have passed their expiration dates.  Since the tags typically contain information such as where and when a drug was manufactured or packaged, it easy for the system to determine when a drug is part of a specific batch that has been recalled.  This could save an enormous amount of money by limiting mass recalls to the offending batches of a product, while leaving identical non-offending products on the shelf.  Whereas currently all bottles of a product have the same identical UPC, there is no way to know whether a particular bottle was manufactured at a time or location other than the one subject to recall.  This is what forces manufacturers to issue mass-market recalls pulling perfectly good drugs from the market along with ones that might not be suitable for sale.  Not only could this be avoided with an RFID tag, under the new system recalls would not even necessarily require retailers to pull offending bottles from store shelves (though they likely still would choose to do so to ensure the highest degree of safety) because theoretically, when a tag from a recalled shipment was scanned at the checkout counter it would immediately signal an alert to the cashier that the package was part of a recall or that it had passed its date of expiration.  This would prompt the cashier to set the product aside for destruction or return to the manufacturer.  Even if the cashier elected to disregard the prompt, the scanner would not allow the offending product to register a price for purchase.   
Microsoft created a theoretical case study to illustrate how the presence of tags on the shipped pallets of pharmaceuticals could make the recall process faster, more efficient, and limit its scope to the specific packages of concern.   In this case study, a truck delivering pharmaceutical products: 
lost its refrigeration mechanism in transit. The driver did not realize there was a problem until after the delivery had been made to the distribution center, and the drug cartons had been sent out to various destinations. As a precautionary measure, [the drug company] issued a recall for all of the cartons that were on the shipment. Fortunately, the RFID tags for these cartons contained the EPC, manufacturing lot number, and expiration date. When the driver delivered the shipment to the distribution center, each item was scanned as it was unloaded, and then scanned again when it was reloaded for its final destination. Because all of the information was accessible in a centralized database, the [pharmaceutical firm] was able to identify and track each of the recalled cartons in transit by using the lot number and verifying the EPC. In addition to making a note in the database that would send an alert flag when the items were next scanned, they were able to notify the pharmacies of the recall so that the cartons could be pulled immediately upon delivery.

	RFID facilitation of small scale recalls provides numerous benefits.  Defective products can quickly be identified, pulled from shelves and accounted for, leaving the unaffected stock in place and available for sale.  This speedy and quiet remedy could also help to avoid both the negative publicity and the public panic that inevitably result from mass-recalls.

iii.	Drug Testing and Approval Process
RFID also has applications in the testing of drugs before they are offered for sale on the market.  The FDA oversees a prolonged and elaborate process of drug testing that must be completed before a new drug can be sold on the open market.  The FDA makes the final determination of whether there is sufficient evidence to establish that a drug is safe, effective, and that it performs the function its manufacturer claims it will have.  In the evaluation process, all new drugs are subjected to “well-controlled investigations, including clinical investigations, by experts qualified by scientific training and experience to evaluate the effectiveness of the drug involved . . .”  
According to FDA standards, pharmaceutical evaluation usually begins with testing on animals which is almost always followed by clinical tests with human subjects.  This stage, the clinical trial, is one area of the drug development process where RFID could have a major impact.  Generally, clinical trials involve the random assignment of patients into two groups; one group is given the medication that is being evaluated, while the other, the control group, is given an inert placebo.  Clinical trials allow scientists to record any differences in patients taking the actual drug compared with the condition of those in the control group.  
According to analysts, RFID could accelerate the process of the average clinical trial “by up to 5 percent as well as reduce start-up delays and decrease trial errors and dropouts.”  According to former Secretary of Health and Human Services Tommy Thompson’s speech to the Biotechnology Industry Organization, experts predict that RFID has the potential to cut the costs of clinical trials by 50 percent.  One of the most important parts of a clinical trial is monitoring compliance of the patients in the study with prescribed times of dosage ingestion.  It is estimated that patient non-compliance in U.S. clinical trials may be as high as 80 percent in some cases, and may cost American drug companies hundreds of millions of dollars each year.   Standard clinical trials are conducted in three distinct phases, with each involving significantly more patients than the preceding phase.  A phase III trial can include several thousand patients, many of whom will be taking the drug at home.  This makes it impossible to monitor compliance in each person.  One RFID application would place electronic tags in the bottle and reader equipment in patient’s medical cabinets.  This system would identify when the container was removed from the cabinet and would communicate that information back to the trial’s administrators.  Another option would be to tag each segment of a blister pack of medication to keep track of when each individual pill was removed.  
RFID could also speed up the new drug evaluation process by taking tasks that are currently accomplished through the manual input of information such as recording, sharing and storing data, and performing them automatically in real-time.  Drug evaluation generates massive amounts of information.  Once testing is complete, a company hoping to FDA gain approval is required to submit a New Drug Application (NDA) that includes among other things: “(A) full reports of investigations which have been made to show whether or not such drug is safe for use and whether such drug is effective in use; (B) a full list of the articles used as components of such drug; (C) a full statement of the composition of such drug; (D) a full description of the methods used in, and the facilities and controls used for, the manufacture, processing, and packing of such drug . . .”  This can amount to a hundred or more volumes of information.   RFID transmission of medical results and compliance information to a central database could facilitate the compilation and organization of much of this information.  It could also assist a company marketing a drug with keeping the FDA apprised of any issues that arise concerning the drug’s safety and effectiveness per FDCA requirements.

iv.	Drug Re-importation
In recent years, there has been a significant amount of attention devoted to the issues of the re-importation of American drugs from Canada.  The drugs at issue are generally manufactured in the United States and offered for sale at much higher price in this country than in Canada where government subsidies and price-controls keep the cost down.  U.S. manufacturers counter that they are being irreparably harmed by the practice and that the prices charged in the United States are necessary to raise enough money to fund development and trial of new medications.  While RFID technology may have important applications in the area, its development is somewhat impeded by questions of the legality of re-importation. Under the current state of the law, the re-importation of prescription drugs from Canada is illegal, though recent legislation has given the Secretary of Health and Human Services the discretion to permit such importation in certain circumstances.  The Secretary has yet to exercise that discretion.   The law governing prescription drug importation is codified in the Federal Food, Drug, and Cosmetic Act ("FDCA").  Prescription drug importation law has changed significantly over the past several decades and continues to develop.  
The following is a brief summary of the key amendments to the FDCA and the current state of federal statutory law concerning drug imports.  The first major amendment was the Prescription Drug Marketing Act of 1987 (“PDMA”).  Without completely prohibiting the general importation of FDA-approved drugs into the United States, the PDMA completely banned parallel imports, unless the manufacturer imported the drugs on its own.  Parallel importing is the resale of foreign-purchased goods back into their original market of manufacture (such as the re-importation of United States drugs back from Canada).  Parallel imported drugs (also known as “gray market" goods) are not illegal themselves, but their means of distribution is unauthorized.  The purpose of the PDMA is to protect the health and safety of consumers in the United States. However, the PDMA also contains an exception for consumer purchase of drugs solely for personal use, which allows such purchasers to circumvent the blanket ban on parallel importing.  Specifically, the PDMA allows consumers to purchase prescription drugs in Mexico and Canada, including those drugs not even approved by the FDA, as long as they are for personal use and do not pose any serious health hazard.  The PDMA requires manufacturers to keep a type of pedigree that tracks drugs along the line of distribution.  This has not been effectively accomplished to date because it is a complicated process that up until now required an enormous amount of paper record keeping.  RFI D could eliminate this problem by automatically keeping an electronic pedigree of each stop a drug takes on the way to its final sale.   This would far exceed the PDMA’s requirements and do so at a price that could not have been envisioned back in 1987 when the Act was drafted.   
The next major change came in the form of the Medicine Equity and Drug Safety Act of 2000 ("MEDSA").   MEDSA allowed pharmacists and wholesalers to re-import American-made, FDA-approved drugs into the United States by amending Chapter VIII of the Federal Food, Drug, and Cosmetic Act ("FDCA"). The express intent of MEDSA was to encourage the resale of foreign-purchased drugs in the United States. MEDSA also repealed provisions of the PDMA, which previously allowed only for the re-importation of pharmaceuticals by manufacturers regulated by the FDA.  MEDSA never took effect however, because even though President Clinton signed it into law, none of the Secretaries of Health and Human Services who have held office since the law was enacted have taken steps to promulgate its regulations.     
	The most recent major development in re-importation law is the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (“Medicare Act”), which also amended the FDCA.  Its main goal is to lower consumers' payments for pharmaceuticals by employing a Medicare outpatient prescription drug benefit for seniors, providing prescription drug coverage starting in 2006, and offering a Medicare drug discount card.   It leaves the ultimate decision on reimportation in the hands of the Secretary of Health and Human Services to "promulgate regulations permitting pharmacists and wholesalers to import prescription drugs from Canada into the United States."  It restates the assertion that governmental concerns over re-importation center on safety.  Though the Medicare Act is not preoccupied with re-importation issues, it does lift the supposed ban on drug re-importation from Canada, albeit dependent on the certification of product safety by the HHS Secretary.   The Secretary of Health and Human Services is given significant authority, including the power to approve state-run pilot programs for re-importation of drugs from Canada.   However, the last time the issue arose, now former Secretary Thompson refused to authorize the re-imports, citing the concern that such pharmaceuticals would not meet U.S. safety standards.  At the moment, all such importation is still illegal.
As the profile of this issue remains high, RFID may play an important role in reducing the number of illegal drug sales that violate U.S. re-importation policy.  There are prospective uses for RFID technology in preventing re-importation that mirror applications for the prevention of counterfeiting, theft, and tampering.  Scanners at the nation’s borders scanning a tag on a package of medication could identify whether that item was purchased in Canada or the U.S., and could even link that data to information about the purchaser, revealing whether that purchase and attempted importation violated the law.  One limitation however, is that the technology would only work as long as the drugs coming in from Canada remained in their trade packaging, something that is not the case for a good portion of the current flow.  

B.	RFID Applications for Food

i.	Safeguarding the Food Supply

As discussed at the beginning of this section, the FDA is also responsible for maintaining the safety and integrity of the nation’s food supply.   This could be facilitated by monitoring food’s pedigree in a manner similar to that employed for drugs.  RFID makes it possible to track food products from the moment of manufacture or harvest through distribution and final point of sale.  In the wake of the terrorist attacks of September 11, 2001, the threat of an attack on the food supply has been identified as a major national vulnerability.  In his resignation speech marking his departure from his post as Secretary of Health and Human Services, Tommy Thompson drew attention to the nation’s threat exposure remarking, "I, for the life of me, cannot understand why the terrorists have not attacked our food supply, because it is so easy to do."  Several statutes have been enacted that require the food industry and the government to develop the means to track and trace food products and to identify country of origin.  RFID may provide a key tool in fulfilling the requirements of these statutes and could prove to play an important national defense role in protecting the food supply.  
The primary piece of post 9/11 legislation governing increased FDA regulation, the Public Health Security and Bioterrorism Preparedness Act (Bioterrorism Act), was passed by Congress in 2002.  The act imposes a number of major requirements on industry and the FDA including: Increased inspections, testing, and research to detect when food items have been adulterated; Improvements to FDA information management systems that relate to imported foods and reports to Congress on the subject; Expanded authority to order the administrative detention of food where a credible threat is identified; Debarment of people convicted of a felony related to food importation, or those who have repeatedly imported adulterated food items.; Increased food records maintenance and inspection requirements mandating recordkeeping related to every step of a food’s journey from manufacture to importation; Required advance notice of a food import in advance of importation;  Authority to clearly mark articles of food that have been refused at the border with a clear label or stamp; Classification of foods as adulterated if refused admission into the United States to prevent efforts to bring it in through a different port (“port shopping”); and Notification to States in which rejected or detained food is being held as well as to the States where the distributor of the food awaits the imported shipment 
It is easy to envision how RFID could play a pivotal role in facilitating compliance with each of the above listed provisions of the Bioterrorism Act.  A database keeping a record could use RFID to automatically log each time a food item was inspected, enabling inspectors to quickly identify the time frame and location during which an item became adulterated.  These reports are precisely the sort of improved information management and reporting the act requires.  Such recordkeeping could also tie the food to the individuals attempting to import it.   One scan could bring up an importer’s entire importation history revealing any red flags about previous practices and whether he or she has been debarred.  The RFID scan record would also reveal whether a particular food item had been rejected at another port of entry.   The database could also be made accessible to states and to distributors, allowing them to look up the information on a particular import to find out if it has been detained and if so, where the articles are being held.   RFID tags could even be marked with an undeletable alert identifying items as having been refused.  Such marking would alert U.S. Customs, potential retailers,  distributors, and anyone else with the ability to read the tag that the food has failed inspection.
ii.	Temperature Exposure Tracking

Several companies have developed a RFID “smart label” that contains a built-in sensor that continuously monitors the temperature of the product to which it is attached.  One example, the “TempSens” label manufactured by KSW-Microtec, a German company, is as thin as paper.  It contains a microchip, antenna, and a battery that lasts for up to a year.   At present it is available for less than three dollars, and prices should continue to decrease over time.   What makes the product particularly convenient, is that it keeps a running log of the product’s temperature history, and with RFID that information can be accessed wirelessly.  Such a device could be affixed to perishable foods, temperature sensitive pharmaceuticals, biological materials that cannot survive exposure to temperature extremes, and even temperature sensitive medical devices.  A simple scan could reveal if an item had been transported or stored at temperatures that could have rendered it unsafe under FDA guidelines, and could be pulled from the stream of commerce before reaching the consumer.  The technology is also being used in regulating food safety in areas that fall under the jurisdiction of the United States Department of Agriculture (USDA); namely meat and dairy products. The temperature sensing labels also perform the traditional RFID functions of tracking (following path of product from production to sale), and tracing (identifying item’s origin and where it has been).  A German company has developed a way to put the power of this temperature scanning information in the hands of potential purchasers.  Metro Group has developed a reader that would allow consumers to scan items themselves before buying them to see the temperature and transport history of the products they consider buying.  Infratab, a California based company, is developing a similar, though less-expensive product that will generate a scan color of green, yellow, or red to indicate whether the safe temperature threshold has been approached or crossed. 
 This technology may lead to the abandonment of the traditional practice of assigning a static expiration date to food at the time of packaging.   Current practices lead to the wasteful destruction of an enormous amount of food that meets FDA standards.  A USDA study estimated that over 96 billion pounds of food are wasted in the United States each year. This is roughly 27 percent of the food produced in the country.  In addition to the wasted food, there is food that should be destroyed because harmful storage conditions have rendered the items harmful, but because the dates of expiration have not passed, such items remain on store shelves.  This is a serious problem, as food pathogens cause many deaths and many more serious bouts of illness.      Experts have proposed the development of a system based on computer modeling that would use RFID to measure the current quality of food and communicate that information to the retailer.  This would allow the expiration date to adjust automatically to reflect the actual state of the food based on the conditions in which it was stored.  

C.	RFID Applications for Medical Devices
The FDA’s jurisdiction over the regulation of medical devices dates back to the Federal Food, Drug and Cosmetic Act of 1938, a law which stands as the framework for the modern agency’s current enforcement authority.  As defined today, a device regulated by the FDA is: 
an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including any component, part, or accessory, which is— 
   (1) recognized in the official National Formulary, or the United States Pharmacopeia, or any supplement to them,
   (2) intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or
   (3) intended to affect the structure or any function of the body of man or other animals, and which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of its primary intended purposes. 

i.	Tracking the Use of Medical Devices
Small RFID tags could be imbedded in numerous types of medical devices to ensure that those designed or intended to be used only once and then discarded are not reused.  There are public health and safety justifications for designating particular pieces of medical equipment single-use.  For example, there are some disease causing agents such as the protein that causes mad cow disease and its human equivalent Creutzfeldt-Jakob Disease (CJD) that cannot be destroyed through standard sterilization practices.   For this reason, surgical equipment used on patients that may suffer from such diseases must be destroyed after a single use.  The failure to properly catalogue and destroy such equipment has led to over 250 incidents where CJD was spread through the use of “tainted surgical equipment”.     Such tragedies could easily have been averted if the equipment had passive RFID tags inside.  These tags could be read by a reader affixed to the door of the operating room.  The simple act of bringing the equipment into the room would trigger a warning detailing where and when the equipment had previously been used, and instructing the person preparing the room to dispose of the used equipment immediately.	
RFID tagging of surgical tools could provide additional benefits.  The scanning of medical equipment would  produce a detailed catalogue of all of the tools in use in an operating room.  Such a list could be used to account for each item at the end of a procedure to avoid the potentially fatal error of suturing up a patient with a surgical clamp or tool inside.  For those devices that can be re-used following sterilization, RFID readers in a sterilization chamber could be used to validate that such instruments had been cleaned.   RFID could even be used to monitor lavatory hand washing to ensure sanitary cleansing practices by physicians, nurses, other healthcare providers, food service workers, and other vocational workers in a position to transmit illness.  

ii.	RFID Chips for Medical Patients
The FDA recently issued approval for the use of an RFID chip that is designed to be implanted in humans.  The product, called VeriChip, contains a unique 16 numeral identifying number, which when scanned by an authorized reader, provides access to a secured and encrypted database that contains a patient’s medical records and treatment information.  According to the manufacturer, the chip is designed to reduce medical errors by ensuring that the patient’s information is readily available.  This could be particularly useful for patients who are frequently moved for medical testing.  The RFID chip is small enough to be injected in a process the company calls “painless.”
The FDA has also approved a product called the SurgiChip, a different kind of RFID tag for use on surgical patients.  Unlike the VeriChip, which is inserted below the skin, SurgiChip is an external marker that is designed to reduce incidents of what the FDA terms “wrong-site, wrong-procedure and wrong-patient surgeries.” According to the Department of Health and Human Service’s Agency for Healthcare Research and Quality, there have been more than a thousand cases of surgeries performed on the wrong site.  The tag, which contains information about the patient, the planned procedure, and the name of the surgeon, adheres to a patient’s skin at the site of the planned surgery.  The RFID tag is scanned by a handheld reader in the operating room.   Upon verification of the information by the patient and the surgeon, the chip is removed and placed in the patient’s medical file.  
A third RFID application would involve attachment of a tag to the patient’s wrist.  The primary motivation behind RFID wristbands is to reduce medial errors.  The mistakes the SurgiChip are designed to avoid are only a tiny fraction of the total number of medical mistakes made in the United States each year.  It is estimated that medical errors cause the deaths of as many as 100,000 Americans every year. One study found that roughly 5% of wristbands in American hospitals misidentified patients or were illegible.  RFID enabled wristbands could be used to verify patient identity; track treatment history including which medications were administered and when; alert medical personnel about the existence of any allergies; and other relevant medical information.  The wristband itself would not contain the information; it would only contain the patient’s unique identification number.  Scanning the number would provide the interested healthcare provider with access to a secure database containing the information.  RFID would help ensure that a patient received the correct drugs or blood products, and would catch incidents of missed doses or attempted double dosing.  A reader in the field of the patient’s bed could be programmed to recognize when a potentially harmful treatment is about to be administered.  For example, a system already containing information scanned from the wristband indicating that a patient is allergic to penicillin would sound an alert if a RFID tagged bottle of penicillin were brought within read range of the patient’s bed.  
RFID wristbands for patients are already on the market.  The first U.S. Hospital to test the technology, the Jacobi Medical Center in New York, uses a system developed by Siemens.  The patients’ wristbands contain a medical history number that is automatically scanned by the PDA’s used by hospital nurses and physicians.  The process is fully automatic; when the PDA comes within read range of the tag, it immediately pulls up the “patient's name, diagnosis, medicine regimen, allergies” and any other relevant information.  
These various forms of patient tagging and tracking provide benefits that the old paper based medical chart and plastic wristband do not.   The RFID system eliminates the need to constantly record every administered treatment, physician consultation, or change in condition in the patient’s paper chart.  It also allows the chart to be stored in a central location and updated automatically, eliminating the need to ensure that the paper chart remains with the patient as he or she moves through the hospital.  An added benefit is that such real-time information about all of the patients in a medical facility could assist the people running a medical facility by providing them awareness about the percentage of beds that are occupied, the speed with which patients are treated, and whether hospital  resources are being used efficiently.  

iii.	Real-Time Location
A reduction in the amount of time it takes to locate medical devices and hospital personnel would result in improved patient care and could save lives in the most serious emergency cases.  RFID based real-time location systems are already in place in a few hospital pilot programs and could eventually be standard elements of American emergency departments and intensive care units.  
Mobile monitoring systems and medical devices can frequently be moved throughout a hospital making it difficult to keep track of their location.  One test program at Boston’s Beth Israel Deaconess Medical Center uses active RFID tags on vital equipment like artificial respirators and electro-cardiogram machines.  These RFID tags send out a signal that is picked up by readers mounted on walls which in turn transmit the data to a computer program.  This program maintains an up to date display of the exact location of each of the emergency unit’s five breathing machines and simultaneously tracks the location of patients and doctors so that the right person or equipment can be located instantly.  Other Boston medical facilities including two Harvard affiliated institutions, Massachusetts General Hospital and Brigham and Women's Hospital have similar RFID programs.  Results so far are finding that the tags do not interfere with other radiological equipment or medical devices.  As in the retail environment, RFID tagging could also result in reduced theft of medical equipment.  A system being used in three Virginia hospitals not only tracks over 10,000 pieces of medical equipment, but notifies the system administrator when an item requires servicing.  Another program at the Washington Hospital Center in Washington D.C. uses active tags transmitting signals once per second that can be pinpointed within an area that is approximately the size as a basketball.   A key security application would be the tagging of newborn babies to signal an alert when a baby is potentially being kidnapped.
 RFID could also be used to monitor hospital medical supply inventories to ensure that necessary items are kept in stock and that expired items that have been on the shelf too long are not used on patients.  RFID cabinets like the “Intelligent Radio-Frequency Inventory System (iRIS) collect and maintain data tracking supply use and viability by reading the tags on every item stored within it.  The system also automatically sends billing information to a patient’s medical file and reorders dwindling supplies automatically.  The cabinet records which hospital employee removes each item, what is removed, and for which patient the item is intended.  In monitoring the shelf life of items such as “steel mesh stents that are used to open clogged arteries” the cabinet can reduce the estimated 8-12 percent of billable medical items hospitals lose each year.  

iv.	Talking Pharmaceutical Labels for the Blind
One innovative use of RFID is a device that is designed to help the visually impaired understand the information and instructions printed on drug labels.  ScripTalk is a talking label system that uses RFID tags attached to pill bottles and a handheld reader that contains a speaker.  The user just holds the reader close to the bottle, and a computer generated voice within the reader states the information contained within the tag.  This technology could also be used to benefit the illiterate.  According to the manufacturer of the device in a statement before the United States Senate, there are 120 million Americans who have difficulty reading and understanding drug labels for a variety of reasons; a problem that could result in serious medical complications or death.  The ScripTalk tag can be programmed to include such information as “the name of the patient, drug, dosage, general instructions, warnings, prescription number and doctor's name and telephone number” all of which could be made audible by the reader device.  Currently, ScripTalk readers are sold for $325 each, while the RFID tags cost users about $1 per piece. Pilot programs are testing the technology at several hospitals operated by the U.S. Department of Veterans Affairs.   

v.	Medical Testing: Test Tubes
RFID systems are being developed to speed up and automate the process of collecting information from specimens in test tubes.  Maxell has developed a system that can read and write to tags embedded in test tubes.  The system is designed to read trays of 96 test tubes simultaneously, and will eventually complete the task in less than 5 seconds.  A company called Smart Medical recently placed the technology on the market. The tags list “patient name, address, insurance, doctor, special instructions, lab address, required tests,” blood collection times etc. in encrypted form. According to Smart Medical, the reason for the application is to automate the data entry process, eliminate human error, and to comply with the FDA’s anti-counterfeiting and consumer safety standards.  The company claims that the RFID test tubes will cost $1 each. 

vi.	Dental Prosthesis Production
Perhaps the most unusual application for RFID that is currently in place is a system developed by a French company to improve the manufacturing process for dental prosthetic devices.  Dentalax uses RFID to cut down on human error, reduce paperwork, and save time in production.   The system works by embedding high frequency read-writeable RFID chips inside of a mold taken of a patient’s teeth.  The details of each step of the process of manufacturing the prosthetic are programmed onto that writeable chip.    This information includes who did the work, when it was done, and what materials were employed.  Before the dentures, dental bridge, or other dental prosthetic is shipped to the customer, technicians scan the tag and save all of its data onto a smart card which is also RFID readable.  “The advantage of such a card is that if a patient requires another prosthesis for other teeth at another stage in his life, he can present [the smart card] to the practitioner, who will retrieve all the data related to all the prostheses of the patient”.

D.	RFID and Blood Products
The FDA regulates blood and all products derived from blood.  Such products are defined as biologics, which under the Public Health Service Act of 1944 were made a part of the FDA’s zone of regulation.  FDA authority also derives from the fact that biologics can also be classified as drugs under the definition used in the FDCA.
Tagging every bag of blood could have many benefits.  A tag could reveal whether and when the blood had been tested for safety, as well as its blood type.  A RFID system could provide a real-time picture of how much of each type of blood is available and where it is stored.  This information could save lives in the event of a major emergency.  
Blood tagging could also save lives by preventing medical errors.  It is estimated that each year in the United States there are nearly one thousand mistaken blood transfusions where blood intended for one person is wrongly given to another.  The resulting complications can and do prove fatal in at least 20 cases each year.  To address this problem, several facilities including Massachusetts General Hospital, have started placing RFID tags on all operative patients and on all bags of blood.   Whenever a bag of blood is brought near the patient that does not match the type recorded on the patient’s tag, scanners located in the operating table send an alert that cannot be missed.  The bags carry passive ID tags that derive a few seconds of power from the signal from the reader.  Georgetown University Hospital has also adopted an RFID system aimed at reducing transfusion errors and increasing efficiency that uses patient wristbands to confirm that blood matches a patient’s type.  

III.	Legal and Regulatory Issues Related to the Use of RFID

In the design and implementation of RFID systems, organizations must operate within the framework of several overlapping sets of regulations.  There are regulations from both the Federal Communications Commission and the Food and Drug Administration concerning the selection of radio frequency bands within which the devices will transmit their signals.     

A.	Regulations Related to Safety and Security
The government is concerned about the physical effects of radio waves on humans.  While Radiofrequency energy is not powerful enough to cause the kind of radiation injuries that can occur at the atomic level with stronger energy sources, it has the potential to cause damage through the heating of tissue.   These consequences are often referred to as “thermal effects.”
i.	Radio Frequency
The use of radio frequency bands is regulated by the Federal Communications Commission (FCC).  The FCC is an independent agency that is responsible for the regulation of all communications via radio, television, wire, satellite and cable.  RFID systems do not require a license from the agency, but they must operate within the FCC defined permissible frequency spectrum.  The FCC must approve several aspects of transmission of such signals including: field strength, a limit on the amount of power the system can use in creating a field to read tags; the assignment of which frequency bands the readers can use without interfering with other devices or modes of communication; and the maximum duration a signal can be transmitted without interruption.  These regulations are of great significance to RFID system manufacturers because the limits constrain the distance from which tags can be reliably read.  The FCC can also order noncompliant systems to be shut down, and can issue sizeable fines for regulation violations.  
There are a wide range of frequencies that can be used for RFID, and in the U.S. there are five frequency ranges within which most systems operate.  These are low frequency (LF), high frequency (HF), ultra-high frequency (UHF), microwave, and a newly defined range called ultra-wide band (UWB). As described by the FDA,
Radio waves are created due to the movement of electrical charges in antennas. As they are created, these waves radiate away from the antenna. All electromagnetic waves travel at the speed of light. The major differences between the different types of waves are the distances covered by one cycle of the wave and the number of waves that pass a certain point during a set time period. The wavelength is the distance covered by one cycle of a wave. The frequency is the number of waves passing a given point in one second. For any electromagnetic wave, the wavelength multiplied by the frequency equals the speed of light. The frequency of an RF signal is usually expressed in units called hertz (Hz). One Hz equals one wave per second. One kilohertz (kHz) equals one thousand waves per second, one megahertz (MHz) equals one million waves per second, and one gigahertz (GHz) equals one billion waves per second.

A manufacturer’s selection of operating frequencies depends in large part upon the specific application for which a system will be used.  It is almost always the case that the higher the frequency a system uses the more expensive its tags will be.  
Low Frequency, which in the U.S. usually ranges less than 135 Kilohertz (KHz), is generally used in passive systems where tags will be read at close range.  The benefit of such systems is that they operate with very minimal power, the tags can be quite small and are relatively inexpensive, and they are reliably read in short distances.  LF also works well where tags must be read through metal or liquids.   For this reason, it is the ideal frequency for use in the tracking of assets, inventory and blood products.   
  Higher frequency devices, which in the U.S. typically operate at 13.56 Megahertz (MHz), are useful where tags are to be read at somewhat longer distance. Tags operating in this range can transmit more data at a higher rate than in the low frequency, but a trade off is that the orientation of the tag can affect its ability to be read, increasing the chance of passing a reader undetected.  Signals in this frequency range do not fare well when obstructed by metal.  HF is ideal where a person is actively trying to have the tag read, such as in smart access cards.
Ultra-high frequency devices operate in the range of 300 MHz to 3 GHz.  These are active RFID systems that operate at greater distance.  However, unlike the lower frequency applications, UHF tags must be within the direct line of sight of the reader.  This is the frequency band generally used in toll collection systems.  
Microwave, the most powerful of the bands, ranges from 2.45 Gigahertz (GHz)  to 5.8 GHz.  Use of the microwave band has the greatest safety implications for RFID. According to Dr. David Engels, a research director at MIT’s Auto-Id Labs (creators of the EPC), if you use too strong of a read signal to achieve a high and accurate read range, you will “cook the people” who stand in the read field.        
Ultra-wide band systems operate in the range from 3.1 GHz to 10.6 GHz.  The FCC recently established this new band which is uniquely suited for a certain set of applications.  Signals sent using UWB can better penetrate walls and other dense materials than lower frequencies.  Advanced RFID systems using UWB actually send multiple simultaneous signals over several different frequencies.  This fact along with the fact that UWB signals travel faster makes it possible to transmit more information in less time.  This speed also results in the use of less power.   Properties such as low power use and a signal that can travel through almost any surface makes UWB the best frequency range for applications such as real-time location tracking of tags within hospitals.  The signals do not interfere with hospital equipment and can pinpoint objects to very small areas.  Use of 13.56 MHz HF or some UHF readers would have serious potential hazards in the hospital environment, because many medical devices operate at that frequency.  While most tags are placed on the market without licenses, some UWB manufacturers have taken the extra step of seeking and obtaining formal approval from the FCC.  
As devices emitting radiation, RFID systems are also subject to FDA health and safety regulations.   The regulations are public protection measures designed to prevent overexposure to potentially harmful radiation such as microwaves.   The regulations provide for various limits and performance standards which vary by radio frequency band.  Under the FDCA, unless granted a specific exemption, devices that violate these standards can trigger civil liability of up to $300,000 in addition to any other penalties issued by a United States district court.  The FDA’s standing committee that advises the agency about its standards for radiation emitting devices, the Technical Electronic Product Radiation Safety Standards Committee (TEPRSSC) is a part of the Center for Devices and Radiological Health (CDRH).  The TEPRSSC has yet to formally issue a set of mandatory standards for RFID devices.  For this reason, the FDA does not currently perform the type of pre-market safety testing it conducts on medical devices with RFID systems or other consumer products such as wireless telephones that emit radiation.  Instead, the FDA relies on data collected once a device is in use, and can, in conjunction with the FCC order a company to remove a product from the market until it meets the radiation standards under the FDCA.  The FDA and FCC share responsibility for the effort to protect the public from radiofrequency hazards with several other agencies.  The Radiofrequency Interagency Work Group also consists of the National Institute for Occupational Safety and Health, Environmental Protection Agency, Occupational Safety and Health Administration, National Telecommunications and Information Administration and the National Institutes of Health.
Testing is required to develop a clear picture of the full effects of RFID on products intended for human consumption.  According to Dr. Engels of MIT’s Auto-ID Labs, the FDA has a pretty clear understanding about how food will be affected, given its long history of regulating microwave ovens.  What is not as clear is how the various frequency waves will affect different drugs and biologics to which tags may be attached.  It may be necessary to amend the current drug testing protocols to include testing of this sort.  Until the effects on a particular medication are understood, manufacturers should exercise caution, limiting tagging to the pallet level (insofar as such actions do not undercut FDA anti-counterfeiting and safety efforts).     

ii.	FDA Labeling Regulations 
The FDA has strict guidelines regulating labeling and the information contained on drug labels.  Initially, some of these requirements posed an impediment to the adoption of RFID in the pharmaceutical industry.  Drug manufacturers informed the FDA of the problem and some specifically identified it as the reason why they had not yet undertaken RFID pilot projects.  For example, the FDA demands formal notification from manufacturers every time any change is made in the manufacturing process, to the label or to the packaging.  Another regulation states that companies that produce drugs and medical devices must conform to minimum standards called “current good manufacturing practices” (CGMP).  Even where the end result is perfect, if a product is produced in a manner that fails to satisfy the CGMP standard, it is deemed “adulterated” by the FDA.  In response to these complaints, the FDA has temporarily lifted many of the restrictions to facilitate the use of RFID.   In announcing the relaxed standards, the FDA stated that it was responding directly to inquiries about whether regulatory requirements “including those related to labeling, electronic records, and product quality, appl[ied] to . . . pilot programs using RFID tags for drugs .”  The FDA statement responded by assuring the manufacturers that it would “exercise enforcement discretion regarding such studies;” such discretion is set to expire on December 31, 2007.  The FDA’s stated goal in provided such exemption “is to facilitate the performance of RFID studies and allow industry to gain experience with the use of RFID;” in so doing, the FDA reaffirmed its commitment to RFID, repeating the statement that the agency views “RFID technology [as] critical to ensuring the long-term safety and integrity of the U.S. drug supply. . .”

iii.	Electronic Drug Pedigree
There are governmental regulations requiring drug manufacturers to keep a pedigree tracking a drug’s history from the moment it is manufactured until its moment of sale.   As described in the section of drug re-importation, the primary motivations for the law concern the public health and welfare.   RFID technology could be used in place of the existing inefficient paper based system for recording pedigree information.  As written, the law requires a pedigree for the wholesale distribution of prescription drugs to include:
[An] identifying statement for sales by unauthorized distributors. Before the completion of any wholesale distribution by a wholesale distributor of a prescription drug for which the seller is not an authorized distributor of record to another wholesale distributor or retail pharmacy, the seller shall provide to the purchaser a statement identifying each prior sale, purchase, or trade of such drug. This identifying statement shall include:
(1) The proprietary and established name of the drug;
(2) Dosage;
(3) Container size;
(4) Number of containers;
(5) The drug's lot or control number(s);
(6) The business name and address of all parties to each prior transaction involving the drug, starting with the manufacturer; and
(7) The date of each previous transaction.

Any RFID system used for pedigree tracking would be required to use tags with sufficient data capacity to store and reliably transmit the numerous pieces of information required under the PDMA.

B.	Privacy
i.	The RFID Privacy Debate
Perhaps the largest impediment to the spread and adoption of RFID has been the vocal concern raised by individuals who fear malevolent uses of the technology.  Critics charge that RFID will be used as a tool to monitor and track the movements and activities of individuals.  These critics often invoke the imagery of George Orwell, warning that RFID is the tool “Big Brother” will be using to watch us.  Professor Helen Nissenbaum of NYU has identified the three prevailing principles that have dominated public policy discussions in the area of privacy: “(1) limiting surveillance of citizens and use of information about them by agents of government, (2) restricting access to sensitive, personal, or private information, and (3) curtailing intrusions into places deemed private or personal.”  What appears to alarm privacy advocates to the possibility of intrusion into these general areas of concern is EPCglobal’s stated goal of eventual creation of an “Internet of things” using RFID tags with a unique identifiers on every marketable item in the world.  MIT’s Auto-Id Labs, the original creators of the EPC, use the motto “identify any object anywhere automatically”.  This ubiquity of RFID along with other factors such as the ease with which tags can be concealed, the potential for the development of interoperability that would enable readers to read different kinds of tags, and the ability to uniquely identify each object lies at the heart of the apprehension.  
One concern is that RFID will be used to collect information about individuals without their knowledge.  Critics warn of the ability to link a particular item to an individual purchaser through a credit card at the time of purchase.  A central database of information would then contain a list of specific items an individual owns, making it possible to track people by reading those tags.  Over time a person’s activities could be tracked and used by retailers or advertisers to tailor marketing to an individual.  Privacy advocates caution that if such information fell into the wrong hands it could be used in more malevolent ways.  They even warn of uses by RFID hackers that resemble plotlines from science fiction thrillers.   These third parties could use the RFID databases by replicating a tag and having it read somewhere on purpose.  This aim would be to fool the system into thinking that a person was somewhere they were not, perhaps to create either an alibi or a patsy, to facilitate a criminal act.  Another example of privacy invasion by third party unauthorized scanning would involve tracking of individuals entering a hall to attend a meeting of a politically unpopular group in order to use that information for political purposes.  
According to James Nehf, a professor at Indiana University—Indianapolis School of Law, the industry is moving toward a system of consumer notice and choice.   He says that the system of consumer self-protection advocated by the RFID industry poses some problems.  His main criticism is that such a regime assumes a high level of consumer awareness and willingness to be proactive without questioning if people will take the time to opt out.   Nehf says most people do not call toll free numbers to opt out of programs that involve information sharing and do not read privacy policies or license agreements.   In his opinion, if a self-protection regime is to work, several things must happen.  First, to make an informed decision, consumers must be able to identify the costs, benefits, risks and rewards.  Effective choices require effective feedback.  Consumers must know what information is being recorded, who is taking that information, and any harm that has resulted.  He says that knowledge should not be limited to situations in which a breach of privacy has occurred.  Nehf states that without all of the above described knowledge, it is impossible to properly value the choice options.  A major problem is that it is difficult to assign accountability by linking a breach of privacy to the resulting harm, particularly in the context of RFID, where one may not even be aware of the presence of a tag, let alone who has read it.  In the end, he says that the uncertainty leads to inaction as the correct path is not clear.  This benefits the RFID industry, because as the use of the technology grows and people become accustomed to its presence, attitudes of acceptance crystallize.   At the same time, RFID stakeholders become imbedded and gain increasing power. 
At present, the default practice in the retail context is the automatic electronic “killing” of the tag, which renders it inactive when it leaves the store.  Professor Nehf argues that this is insufficient, claiming that RFID tags should be deactivated once the item arrives at the store before it is ever placed on shelf for sale or can get into consumer’s hands.  He warns that there is plenty of information that could be collected from readers on the shelves or in the shopping basket.  Some critics warn of the necessity of the disabling feature to protect from potential criminal misuse and threats to physical safety.  RFID proponents also claim that even if a tag survived the store, it would not matter, because without a password, not only would others not be able to read the tag, they would not even be aware of its existence.

ii.	Privacy Laws
As a result of these concerns, privacy advocacy groups have been lobbying hard for legislation to regulate the use of RFID.  The Federal Trade Commission (FTC) has also responded to these concerns by holding a conference at which privacy issues where a key issue.   Numerous laws have been proposed at the state level to address the specific issue of RFID and privacy, but none have garnered enough votes to gain passage.   In 2003, privacy groups managed to introduce legislation labeled as the “RFID Right to Know Act” in five states.  They charge that lobbying efforts by EPCglobal and the RFID industry are responsible for their legislative defeats.  EPCglobal’s response is that self-regulation is best because at this early stage of the technology’s use, such regulation would unnecessarily stifle its development. RFID proponents also counter that regulation is unnecessary because the technology itself limits the uses described by privacy advocates.
At this point, there is no specific legal cause of action for individuals concerned about the use of RFID except deceptive practice acts at the state level.   Such laws typically require a showing of demonstrable harm, and that the company or organization accused of making improper use of the technology acted in violation of an articulated policy.  According to Professor Nehf, it is very difficult to collect damages in such a case even in a class action suit.   
There are several privacy protection statutes though these laws apply to a specific industry or sector of the economy.  The law that most directly impacts industries under FDA regulation is the Health Insurance Portability and Accountability Act of 1996 (HIPAA).  The law’s federal standards, which took effect in 2003, created a set of privacy requirements for medical records and patient health information.  The Department of Health and Human Services, FDA’s parent agency, administers and enforces the act’s provisions.  HIPAA includes a number of patient protections to safeguard the confidentiality of health information.  It applies to all health care providers, health plans, clearinghouses of health care information, and all financial transactions related to medical care.
The privacy regulations adopted under HIPAA create a baseline of protections that limit the ways medical information can be used.  A central focus is the prevention of access to any individually identifiable health information.  Major privacy provisions include:  mandatory notification of privacy practices informing patients about their rights and how their personal medical information will be used;  specific limits on the permissible uses of such information; a ban on marketing to patients with the use of information contained in medical records; a call for heightened protection at the state level to supplement federal protections; the right to demand that communications with medical personnel be kept confidential; and the ability to file formal complaints with HHS for privacy violations.  The regulations also provide HHS enforcement authority in the form of civil and criminal penalties for the misuse of personal health information.  These can include civil fines of up to $25,000 per violation per year, and up to $250,000 and 10 years imprisonment for the most serious criminal offenses.   
HIPAA addresses specific concerns that privacy advocates have articulated, including the worry that RFID will compromise the security of medical information.   It is conceivable that health information in the wrong hands could be used to a person’s disadvantage.  For example, employers could refuse to hire someone they perceived as likely to face significant health care costs or necessitate more days off from work than the average employee.  Insurance companies could also use such information to deny coverage to new applicants.  Privacy advocates have also questioned whether health records are vulnerable to hacking and unauthorized access, another threat which HIPAA was designed to address. These concerns require a careful balancing, because they may lead to constraints in the areas of patient care where RFID has the potential to provide the greatest benefit; namely, increased efficiency and accuracy in the treatment of patients.
HHS recently held hearings on the issue of RFID and privacy where patient concerns were a major focus.  In her testimony, Lisa Soto, an attorney specializing in the privacy law, stated that some of the RFID privacy concerns in the “medical context” are addressed by the fact that as it stands the system is entirely “opt-in”; “[p]atients affirmatively choose to provide medical information through RFID technology.” She went on to add that in the case of VeriChip, the most physically invasive of the patient RFID technologies, the data is stored in a central database and not on the chip, making even unauthorized reads innocuous.  

C.	Patent Liability
When asked about the single greatest legal challenge a company looking to get into the business of creating RFID applications for use in areas regulated by the FDA, Dr. Engels immediately answered “indemnification against patent liability.” A patent is a grant of exclusive intellectual property rights in an invention that is issued by the government.  Patents are issued by the United States Patent and Trademark Office, and allow their holders to prevent others from profiting from the marketing or sale of the patented inventions.  So many patents have been issued for variations of RFID technology, that almost any new application runs the risk of infringing some existing patent.   A recent report revealed that as of 2003, the USPTO has granted more than 4,000 RFID patents.  Up until recently, RFID patents went unenforced as patent holders typically granted others free licenses to use their patents to help drive the development and spread of the technology. This changed last year, when Intermec Technologies, a Washington State company that is the largest holder of RFID patents, filed a patent infringement suit against Matrics, one of its largest rivals.  Experts in the industry fear that this will create a shift in the cooperative climate that has helped the field come so far so fast, and warn that sudden hard-line enforcement of licensing fees for the right to use RFID patents could reverse the trend of lowering costs per tag.  Per-tag cost is perhaps the most important criterion companies evaluate in deciding whether to adopt RFID, so a rise in disputes over patents could result in higher tag costs and slowed growth in the field. 

Conclusion
In RFID, there is great transformative promise for every industry that operates under the FDA’s watchful regulatory eye.  While agencies may typically be predisposed to eschew change in administrative practices in favor of maintaining regulation status quo, the wave of change need not be viewed negatively.   The technology not only has the potential to save countless lives and an enormous sum of money; RFID also carries the promise of increased efficiency in facilitating compliance with the FDA’s legal requirements.    With powerful mandates driving the technology’s adoption, its greatest impediment lies in the fears and distrust of a vocal group of privacy advocates.  Enough legislative pressure could slow and limit the development of RFID and its adoption.   This would be most unfortunate.   While it is important to ensure that RFID is not used to society’s detriment, beneficial uses should not be similarly restrained.  The lifesaving and economic potential of RFID cannot be denied.  Unnecessary delay will undoubtedly result in innumerable preventable injuries and needless loss of life.