Track-and-Trace Drug Verification

P&T Journal ... April 2011

FDA Plans New National Standards, Pharmacies Tread With Trepidation
Stephen Barlas

As if the integration of electronic health records (EHRs) into
pharmacy operations hasn’t been difficult enough, hospitals
will soon face a secondHerculean technology task imposed by
the federal government—a challenge that most medical facilities
and pharmacies don’t even know is coming. A national
requirement to “track and trace” prescription drug packages—
in order to preventing counterfeit products from getting into
pharmacies—is coming down the pike, thanks to California.
That state already has its own deadline in place for January 1,
2015; however, the FDA will almost certainly be replacing the
requirement with a national standard in order to prevent the
drug-supply chain from getting tangled up in 50 different
state laws.

The California 2015 deadline formanufacturers to
apply an electronic pedigree (e-Pedigree) to each
item-level package has been delayed twice before
because of anguished cries from manufacturers,
wholesalers, and pharmacies that were not ready to
comply. The new final deadline is July 1, 2017, for all
California pharmacies to authenticate the e-Pedigrees
of all packages that arrive at their back door.

“The delays in California gave us a little breathing
room,” acknowledges Robert J. Bepko, Jr., RPh,MHA, Director
of Professional Services at Norwalk Hospital in Connecticut.
As a result of those delays, the National Council for PrescriptionDrug
Programs (NCPDP),which develops standards
for the pharmacy industry, set up its Work Group 17.

This group has been tracking the potential impact of a California
e-Pedigree requirement on pharmacies. In December 2010,
Work Group 17 issued a white paper on the topic.Mr. Bepko,
a member of the Work Group, says that even after California’s
deadline for implementation was delayed,Work Group 17 was
made aware of efforts by New York andMassachusetts to develop
their own e-Pedigree laws.

“We are hoping for a national law,” Mr. Bepko asserts.
FDA’s Role and Timetable Are Unclear

It is not clear when the FDA will establish a national requirement
that would brush away the California program or
whether the agency needs authorization fromCongress to do
that. At a suburban Maryland FDA workshop that took place
on February 14 and 15, 2011, Grant Hodgkins, Manager of
Strategy, Standards, and Processes at Alcon’s supply chain,
asked that very question of Ilisa Bernstein, Acting Deputy
Director of the Office of Compliance at the FDA’s Centers for
Drug Evaluation and Research (CDER).
“I will defer answering that,” she replied.

The FDA does have the authority to set national standards
drug packages, as permitted by the 2007 FDA Amendments
Act (FDAAA). The February workshop had been scheduled
to obtain industry input on standards for interoperability,
authentication, and data management that the FDA plans to
write. Many in the audience equated the writing of standards
with the imposition of a national requirement to track pharmaceutical
packages (forward) and trace them (backwards
from the pharmacy). There was also confusion about the
difference between California’s e-Pedigree requirements and
the prospective requirements of a track-and-trace system (to
be imposed by the FDA at a future date).

The confusion is understandable. There are three
major permutations of an item-level drug-tagging
system meant to make it impossible for counterfeiters
to divert products. All three steps start with a
Standardized Numerical Identifier (SNI), as follows:
(1) The SNI is established and printed on item-level;
(2) the SNI is incorporated into an e-Pedigree, which
is passed forward only; and (3) the e-Pedigree becomes
part of a track-and-trace system, with each
person along the distribution channel adding
information and being able to be queried “backwards” to obtain
information or to communicate (e.g., the pharmacy with
the wholesaler or manufacturer).

The SNI is printed in a two-dimensional (2D) datamatrix bar
code—or, alternatively, on a radiofrequency identification
(RFID) tag—on the immediate package as it goes down the
packaging line.

In March 2010, in response to a requirement in the 2007
FDAAA, the agency issued guidelines onwhat to include in the
SNI: a serializedNationalDrug Code (NDC), consisting of the
manufacturer’s NDC, plus a unique serial number generated
by the manufacturer or repackager for each individual package.
Serial numbers should be numeric or alphanumeric. The
SNI conforms to the structure of the serialized Global Trade
Item Number (GTIN), GS1’s standard for trade item identification.
GS1 is a nonprofit organization (formerly called EAN
International) with headquarters in Belgium.
Overseas Requirements Are Simpler Than
California e-Pedigree or Track and Trace
Turkey and France already have requirements for drug
packages to be printed with 2D data matrix codes when they
leave a manufacturer’s plant. In this first iteration of an anticounterfeiting
(“point-of-dispensing”) system, however, the
codes are simply uploaded to a data repository and then sent
down the distribution line to the pharmacy, where that SNI is
authenticated via a 2D data matrix bar-code reader.

The e-Pedigree system endorsed by California goes a couple
of steps further by requiring the creation of an e-Pedigree
manufacturer
to a third-party logistics carrier, through a warehouse,
and to the pharmacy. First, the package is placed at the end of
a packaging line inside a case with similar packages; the case
is also given an SNI. The package and case SNIs are matched
up, forming a “parent/child” relationship.
The information, in the form
of a digital shipping document
tied to a specific customer order, is passed along the distribution
channel and is added to the package every time it changes
ownership. These pedigrees would be formatted based on a
GS1 standard called the Drug Pedigree Messaging Standard,
which was developed in 2007. However, many consider that
standard to be antiquated. GS1 is working, ever so slowly, on
an updated standard.

A track-and-trace system is similar, allowing for communications
to go backward; however, an e-Pedigree can be forwarded
only. In track-and-trace systems, when the product
changes hands, the new data that were entered into the pedigree
are sent back to the repository, which maintains the product’s
travel history. For example, a pharmacy can query a
wholesaler or manufacturer or can send an acknowledgment
that a shipment was received. All participants in a manufacturer’s
supply chain would have some access to that data repository,
although access might be controlled by the drug’s manufacturer
or by a third party, often a government agency.

In both e-Pedigree and track-and-trace systems, theoretically
at least, cases must be opened in a warehouse, and the 2D bar
codes on the packages must be read to ensure that the packages
inside are the ones sent by the manufacturer. This is a
huge problem for manufacturers and distributors, especially
in terms of the time it is expected to take and the associated
costs. California allows inference, whereby wholesalers and
others would not have to pull the cases apart to check SNIs or
affirmthe parent/child relationship between each package and
the case.

Dirk Rodgers of RxTrace.com explains that California’s
Board of Pharmacymust draw up rules so that companies will
know how they can make use of inference. He says:
“It is possible that the Board could create rules that define
the concept so narrowly that it will be a far cry from what the
industry means when they use the term. We’ll have to see
where they take it.”

Costs Rise as Requirements Expand

There are also broader implications formanufacturers stemming
from requirements for repositories, inference, and the
like. Steve Drucker, Director of Global Pharmaceutical Commercialization
in Packaging Technologies and Compliance at
Merck, explains:

In a full track-and-trace system, you have to make changes to your
manufacturingmanagement systems, warehousemanagement systems,
and order-to-cash systems to track item-level SNIs andmaintain
the parent/child data instead of simply tracking lot numbers,
which is what we do now. It is a huge endeavor, and the complexity
is far beyond anything we have tried before, as are the costs.
He says that the estimated costs for full track-and-trace compliance
are as high as $100 million.

The challenges and costs for pharmacies mount as one
moves up from a point-of-dispensing system (the main requirement
is to verify the SNI), to e-Pedigree (pharmacists
must decommission the pedigree), to track and trace (pharmacists
must communicate with physicians as well as manufacturers).
These possibilities raise all sorts of questions for hospital
pharmacists such as Robert Bepko, Jr. He already has a
pharmaceutical inventory system that he purchased from
McKesson, his wholesaler. In addition, his hospital is in the
process of installing an electronic health record (EHR) system
from Cerner in order to qualify for Medicare incentive payments
for capital costs—and to avoidMedicare penalties for not
implementing an EHR system. He says:
If we knew what was going to be expected of us, we would work toward
that end. If the Joint Commission, the Drug Enforcement
Agency, or the FDA comes in to a pharmacy and asks a pharmacist
to showthempedigrees for themonth ofMarch, the pharmacist can
pull up that list from McKesson. But what if they want to see the
pedigrees for patientMr. Jones?Does that default to the Cerner system?
So you can see the difficulty we have here—preparing for what
we don’t know.

Each additional responsibility adds pharmacy costs, and a
full track-and-trace requirement is likely to be very costly to all
pharmacies. ChrissyKopple, Vice President ofMedia Relations
at theNational Association of ChainDrug Stores, says that proposals
that would mandate the tracking and tracing of prescription
drugs are faced with complexities, technical and
feasibility issues, and substantial costs for all drug supply
chain stakeholders. She says that these systems have not been
developed or fully tested yet and have not been evaluated in
pilot programs; they also lack uniform national standards and
patient privacy safeguards.

So far, wholesalers such as McKesson haven’t focused on
helping their pharmacy customers get ready for e-Pedigrees,
much less track and trace. Ron Bone, Senior Vice President of
Distribution Support at McKesson, explains:
Once we have established a process to quickly on-board manufacturers,
we will then be able to use this as a basis for on-boarding our
pharmacy provider community.With the California pedigree deadline
for the provider community at July 2017, we have not engaged
with this segment as yet.
Pharmacies Are Particularly Vulnerable
Pharmacies, to a large extent, have been at themercy of the
drug manufacturers, which have been driving the drug package
identification process through their involvement withGS1,
the global standards group. The FDA’s designation of an SNI
in March 2010—based on a GS1 standard—illustrates why
pharmacies in particular are worried about the FDA’s next
steps—establishing standards for interoperability, authentication,
and data management.
The FDA’s SNI guidance prescribed an identifier that contains
the National Drug Code and a second 20-digit alphanumeric
code that a company would choose and that would be
unique to a particular drug package. (There is no require-
Track-and-Trace Drug Verification
2 P&T® • April 2011 • Vol. 36 No. 4
continued on page 208

ment that the SNI guidance must be followed, but it is, in
essence, a de jure standard.) Pharmacy data systems, however,
use a field that allows for only 19 characters. That field is set
by a standard fromthe NCPDP, and pharmacies use it to send
data to health insurers when a patient comes in to fill a prescription.
“We would have to make changes to our data systems to
accommodate the FDA’s SNI,” says John Klimek, RPh, Senior
Vice President of Industry Information Technology at the
NCPDP.
Part of the concern within the pharmacy community is that
the FDA relied too heavily onGS1 in writing the SNI guidance,
and the agencymight do so again when it writes the new standards.
Phillip D. Scott, Senior Vice President of Business and
Development at the NCPDP, explains that GS1, which is
dominated by large drug manufacturers, has “owned” the
e-Pedigree space, but its initiatives essentially stop when the
package gets to the pharmacy back door.
“We have felt for some time that we need to make sure that
any transaction could translate once it got inside the pharmacy,
to the physical transaction of filling the prescription,” he
says.
The NCPDP set upWork Group 17 partly as a watch group
to provide information to the FDA, which would counterGS1’s
Big Pharma slant.
The formation of the NCPDP Work Group, as well as the
issuance of its December 2010 white paper, is just one indication
of the pharmacy industry’s interest in what the FDA is
doing. Companies represented at the FDA workshop on February
14 and 15 included Walgreens, Osborn Drugs, CVS
Caremark,Wal-Mart, Rite-Aid, and several pharmacy associations,
such as the American Society of Health-System Pharmacists.
Swedish Pharmacy Pilot Program Provides Hints
So far, almost nowork has been performed in theU.S. on the
potential impact of pharmacy authentication of drug package
pedigrees. The only pilot program ever instituted was in
Sweden under the auspices of the European Federation of
Pharmaceutical Industries and Associations. In this point-ofdispensing
pilot program, which took place in September 2009,
25 of Sweden’s Apoteket AB retail pharmacies verified 2D
datamatrix bar codes on 95,000 drug packages supplied by 14
drug manufacturers. All par ticipating pharmacies were
equipped with new scanners that could read these codes to
verify the products. Existing point-of-sale software was also
amended to include the necessary extra functionality. Product
verification and dispensing operations were fully integrated
into the ordinary pharmacy workflow.
Although each pharmacy in the pilot program received the
new camera-based scanning equipment, the pilot report does
not indicate that cost or the cost of software upgrades. The
pharmacies were basically able to integrate package verification
via the new bar-code readers into the everyday workflow
with little difficulty; however, this was possible only because
of the high rate of e-prescriptions already coming through the
pharmacies, the quality of the Apoteket point-of-sale systems,
and the standardization of systems within the Apoteket pharmacy
network.

Turkey already imposes a point-of-dispensing requirement
on all incoming drug products; thus, Americanmanufacturers
packaging products for Turkey are now serializing drug packages
for that country. These companies includeGEHealthcare,
which packages contrast media products used in conjunction
with x-ray and magnetic resonance imaging (MRI) devices at
its manufacturing facility in Cork, Ireland. Those products go
to Turkey, theU.S., and elsewhere.GEHealthcare hiredOptel
Vision of Canada to serialize that packaging line; as products
move down the line, each one is given a differentGlobal Trade
Item Number.
When the Cork packaging line becomes fully operational,
perhaps by the end of 2011, GE Healthcare will serialize 12
other lines in Norway, Ireland, and Shanghai, says Gordon
Glass, Director of Manufacturing Project management. He is
now deciding between two vendors for an Electronic Product
Code Information System (EPCIS) for data management.
EPCIS is a GS1 standard that allows “event” data on the packaging
line to be uploaded to a data repository and to be shared
with other company data systems as well as systems outside
the company.
Turkey uses GS1 standards (mainly the Global Item Trade
Number unique numbering scheme), as does France; other European
countries that are working on their own requirements
will probably also use it. That puts the pressure on the FDA to
also pay close attention to standards of interoperability, authentication,
and data management that GS1 is developing.
The FDA, however,will have to consider the needs of all players,
not just Big Pharma. That probably will force the agency
to make some tough choices. For example, according to Bill
Fletcher, Managing Partner of Pharma Logic Solutions, the
larger pharmaceutical companies favor a distributed database,
which each company controls, instead of a central data clearinghouse,
which is run by a third-party chosen by the FDA.
“Small pharmacies at the end of the supply chain will likely
not be able to support costly distributed systems and will likely
require faster authentication response times than largerwholesalers,”
he said.
How Heavily Will the FDA Lean on GS1?
Mr. Fletcher and others have argued that GS1 functions as
a “Big Pharma boys club.”Multinational companies can pay upwards
of five figures formembership in GS1, and they, for the
most part, “pay the bills,” sinceGS1 is a nonprofit organization.
Jon Mellor, a spokesman for GS1 Healthcare U.S., explains,
though, that more than 80% of GS1 members are small to
mediumbusinesses spending in the three or four figures. Bill
Fletcher is a member, but he has mixed feelings about GS1.
He says:
They are open to new ideas, but it would be easier to develop standards
for Pharma if we didn’t have to contend with their bureaucracy.
The weekly participants in the work groups are fromvery Big
Pharma, wholesalers, and a handful of solution providers. In fact,
my joining, because I aman unbiased subjectmatter expert and consultant,
required special approval.
Apart from questions about how representative the organization
is, GS1 has had some issues with the standards it has
already developed. Right now, even the e-Pedigreemessaging
standard that GS1 adopted in 2007 is under fire; it was rushed
into final formtomeet the needs of a Florida law that was going
into effect at the time.
Ruby Raley, Director of Health Care Solutions at Axway,
explains that the document pedigree-management system
standard adopted by GS1 focuses on collecting data on a package’s
chain of custody. The system does not provide information
about the physical location of the package at a particular
moment in time, based on an SNI.
Bob Celeste,Director ofGS1HealthcareUS, admits that the
current data-messaging standard is ill-suited to an e-Pedigree
system. He explains that it was developed in 2006 to meet the
requirements of a Florida law that required the passing of
master data, which every participant in the distribution chain
adds to, resulting in considerable redundancy of information.
However, he admits that there is not much going on with that
standard.
GS1 is now in the process of developing new standards that
could be used by the FDA as the basis for a robust track-andtrace
system, in which data would flow forward from the
manufacturer; the pharmacy could also query back to the
wholesaler andmanufacturer. For example, a pharmacy could
send a receipt back to a trading partner to acknowledge that
the pharmacy received a shipment or even a particular package.
To accommodate the needs of pharmacies for this type of
reverse data transmission, GS1 is developing a discovery
service standard.
Whether or not the FDA leans on GS1 as heavily as it did in
coming up with SNI guidance, the agency will be under pressure—
in an antiregulatory environment—not to go overboard
in terms of the complexity of the standards it writes. At its
February workshop, the FDA presented some preliminary
thoughts on its forthcoming standards.McKesson’s Ron Bone
says:
Authentication, as the FDA defined it at themeeting, is slightly different
than how the industry has been looking at it. Now that we
have insight into what the FDA is proposing, the industry can discuss
the ramifications and effectively address it in our responses to
the docket due on April 16.
The FDA is likely to be inundated with various entreaties.
Wholesalers such as McKesson and the large, multinational
drugmanufacturers will dominate the chorus. The question is
whether the pharmacy industry’s voice will be drowned out.

Congress Considers Regulatory Changes

Financial Executive ... April 2011

During the first few months of this new Congress, newly-empowered House Republicans and their increased numbers in the Senate have been sniffing after overactive federal regulators like bloodhounds on steroids. House committee chairmen have chased administrators and chairmen of regulatory agencies up to Capitol Hill oversight hearings amidst rhetorical baying over excesses of the Dodd-Frank and health care reform rulemakings, plus agency administration actions in the area of greenhouse gas emissions and internet access rules of the road.

"I have tasked our Committee Members to track down burdensome regulations that choke investment and destroy jobs," says Rep. Fred Upton (R-MI), chairman of House Energy & Commerce, which along with the Financial Services Committee focused its first hearings on business complaints about an over-ambitious Obama administration agenda. "We will identify these regulations, shine a light on them, and then seek repeal."

Complaints about regulatory overreaching, expressed repeatedly and strongly by business groups of all stripes, have apparently prompted signs of sympathy from President Obama, who issued an Executive Order in January requiring federal agencies to examine rules now on the books, whose costs may exceed their benefits. But that Executive Order won't affect the major rules going into effect in 2011 which business groups are most concerned with. "The President’s executive order ...will not affect regulations being written to implement health care reform or financial reform, arguably the two largest sources of regulatory uncertainty in the current economy," says Rep. Spencer Bachus (R-Ala.), chairman of the Financial Services Committee. "So it is hard not to conclude that this latest initiative is more about politics than real regulatory reform."

     For corporate financial executives, regulations growing out of the Dodd-Frank Wall Street Reform and Consumer Protection Act pose the biggest threat. The law firm Davis Polk & Wardwell estimates Dodd-Frank requires no fewer than 243 new rules by 11 agencies over 12 years. Compare that to Sarbanes-Oxley, passed in the wake of the Enron meltdown, which led to 16 rule-makings, most from the Securities and Exchange Commission (SEC). 

Many of the Dodd-Frank (DF) rulemakings affect only financial institutions, be they commercial banks, investment banks, credit unions and the like. A few of the rules affect narrow industries, such as the requirement that resource extraction issuers disclose payments made to U.S. or foreign governments for the commercial development of oil, natural gas or minerals.

Then there is the one key rulemaking which directly affects the ability of financial executives in every industry to hedge risk and use swaps for commercial, not trading, purposes. DF requires companies who use swaps and derivatives for financial trading purposes to clear those derivatives through clearinghouses, which will be new, non-profit organizations. Industrial and manufacturing companies argued that they were not abusers of derivatives, so they should not have to clear their risk-hedging trades, given the added costs that clearing will impose. Congress agreed, and provided an end-user exemption from clearing for companies who use derivatives for the purpose of hedging or mitigating commercial risk. The SEC and Commodity Futures Trading Commission (CFTC) put out proposed rules on December 23, 2010 providing their thinking on the exemption.

However, a number of critics have raised concern about the wording of the proposed regulation. For example, would utilizing an interest rate swap to convert a fixed rate financing to LIBOR to take advantage of the current low interest rate environment, which currently is a common strategy for some companies, qualify as hedging or mitigating commercial risk. It is not clear it would qualify for the exemption, according to Bruce C. Bennett, a partner at Covington & Burling.

Another unclear issue involves margin costs. Commercial end-users of swaps who take advantage of the exemption will not have to pay margin costs themselves. That much is clear.

However, a company buys a swap from a swap dealer. That would be an investment bank such as JP Morgan, just to take one example. That swap dealer may well have to pay margin costs on an "uncleared" swap. The question, still unanswered, according to Allison Lurton, another Covington & Burling attorney, and a recent CFTC expatriate, is whether the swap dealer can pass along margin costs to the end user.

Business groups already lost one regulatory battle with the SEC over one of the few Dodd-Frank provisions which affects corporate reporting. Corporate types such as Brenda C. Karickhoff, senior vice president & deputy general counsel at Time Warner, had argued that the SEC's intention to require companies to disclose in their Compensation Discussion & Analysis ("CD&A") whether advisory votes resulted in corporate compensation decisions went beyond what Dodd-Frank required. She says companies should have to disclose those actions only if they are material. When the SEC published its final rule on January 25, 2011, it stuck with its wording from its proposed rule, which Karickhoff and others objected to. "The requirement to include, as a mandatory topic in the CD&A, whether and how a company considered the results of previous shareholder say on pay votes in determining compensation policies and decisions has been included in the final rule," says Scott Olsen, PricewaterhouseCoopers. "The final rule is mandatory and not based on any materiality threshold."

A case can be made that business has been losing even more battles at the Environmental Protection Agency. The EPA, using a federal court ruling as justification, issued a final rule, which went into effect on January 2, 2011, which affects all big industrial and manufacturing plants which are newly built going forward and existing plants which make significant modifications. If that modification results in total air emissions exceeding a threshold because of the addition of greenhouse gas (GHG) emissions the plant must obtain a permit from the state which must be approved by the EPA. The permit will require the company to install "Best Available Control Technology (BACT)." The EPA has established some guidance to help states, which have flexibility, determine what constitutes BACT for different plants in different industries. Really persnickety states could require carbon capture, control and storage technology, a very expensive solution. "This is creating a business uncertainty that business abhors," states Howard Feldman, director of regulatory and scientific affairs for the American Petroleum Institute (API).

Going beyond GHG regulation, the agency was scheduled to issue in February a new air emissions rule affecting companies who use industrial boilers and process heaters. That rule will require "major sources''--large emitters in the auto, chemical, metalworking and many other industries--to install maximum achievable control technology (MACT), which is the equivalent of controls used by the top 12 percent performing plants. "Compliance costs associated with these harsh inflexible proposed rules will cost Virginia manufacturing jobs and hurt our global competitiveness," explains Joseph Croce, senior vice president of the Virginia Manufacturers Association. "

And it is not just the boiler MACT that has brought business tempers to a boil. Six months before it issued the proposed boiler MACT rule in the summer of 2010, the agency issued a proposed rule tightening national ambient air quality standards for ground-level ozone. Ground-level ozone is a primary component of smog. The agency wants to lower the George W. Bush administration standard of 75 parts per billion to between 60-70 ppb. A lower standard would affect virtually the entire country, even a place such as Yellowstone National Park, whose ground level ozone has reached 67 ppb, forcing Wyoming to take control measures there. "EPA is trying to do too much now," states Feldman.

Business compliance costs also explain why corporations want a rollback of some of the provisions in some of the interim final regulations issued under the Affordable Care Act (ACA), the health care reform bill Congress passed in 2010. Here the questions have to do with a company's ability to control costs in existing group health plans. Two examples are the ACA's definition of "grandfathered" health plans and of preventive services which must be provided, cost-sharing free, to employees in non-grandfathered companies. Companies whose employee health insurance plans were in effect on March 23, 2010 are "grandfathered"--meaning they do not have to provide some of the ACA's minimum services--unless they change the contours of that grandfathered plan. One of those minimum requirements starting in 2011 is that a non-grandfathered plan must provide preventive services without imposing cost-sharing on the employee.

The three agencies involved in ACA implementation--the Departments of Health and Human Services (HHS), Labor and the Internal Revenue Service--proposed interim final rules (IFRs) last summer on grandfathered plans and preventive services. Final rules have not been issued in either case, yet, and business groups have been lobbying for changes in the interim language. Joe Trauger, vice president, human resources policy, National Association of Manufacturers, says the interim final rule on grandfathered plans means that if employers "make even modest changes" in group plans in order to stem cost and premium increases they would lose their grandfathered status. He adds, "Controlling costs is essential to manufacturers and implementation of the rule as written will force employers to chose between increased costs as they lose grandfathered status and comply with additional reforms or increased costs as they absorb more of the burden of skyrocketing medical inflation."

If the interpretation of what constitutes a grandfathered plan, laid out in the IFR, becomes permanent, many corporate health plans will lose grandfathered status. So they will have to provide no-cost-sharing preventive services. There, group health plans must provide preventive care benefits, without cost-sharing, for evidence-based items or services that have in effect a rating of A or B in the current recommendations of the United States Preventive Services Task Force. Gretchen Young, senior vice president, health policy, of the ERISA Industry Committee, says, "In a number of cases, it is not clear which specific diagnostic and imaging tests are preventive and which would fall under the category of treatment."

Where interim health care reform regulations are still hanging fire, the final Federal Communications Commission (FCC) Order on net neutrality is creating waves. It was issued on December 21, 2010. The rules prevent Internet service providers from discriminating against content and applications, subject to reasonable network management.

Here is another case where Republicans in Congress may try to bring a wayward Obama agency to heel. After Verizon announced a lawsuit against the FCC in January, Rep. Upton praised the legal assault on the FCC net neutrality rule. "At stake is not just innovation and economic growth, although those concerns are vital," says Upton. "Equally important is putting a check on an FCC that is acting beyond the authority granted to it by Congress."

Some federal agencies such as the Occupational Safety and Health Administration have already backpedaled in the face of Republican and business snarling, using the Obama executive order as a rational. But the President has underlined that he is willing to retreat only so far. So it remains for Republicans in Congress to prove what is worse: their bark or their bite.