What Schedule H2 Means for Your Pharmaceutical Packaging

What Schedule H2 Means for Your Pharmaceutical Packaging

Schedule H2 changes what has to travel with a medicine. The regulation asks pharmaceutical brands to make drug information digitally accessible and to let the person holding the pack verify that it is genuine. Neither of those fits on a folded paper insert.

The practical answer most brands land on is a single QR code on the pack that resolves to three things at once: an authentication check against the batch record, the complete digital leaflet in the patient's language, and a logged scan event that forms an audit trail. One code, one scan, three regulatory obligations satisfied.

Each of those obligations is easy to state and awkward to satisfy on a printed insert. Packaging space is finite, leaflets go out of date the moment a warning changes, and a paper insert cannot prove anything about the pack it came in.

What Schedule H2 Compliance Actually Requires

The commercial case usually arrives second and lands harder. Counterfeit medicines damage the brand long before they damage the balance sheet, and a consumer who can verify a pack in two seconds is a consumer who trusts it. Printed-insert costs fall away as a side effect.

What it actually takes to implement

The technical work is smaller than most teams expect. A serialised code per pack, a hosted leaflet that renders on a phone, and a verification endpoint that answers honestly when a code has been seen before. None of that is research; it is plumbing that already exists.

The work that takes time sits on the packaging line. Codes have to be applied at the right point, read reliably at line speed, and reconciled against the batch record so that a pack which failed inspection never reaches a shelf with a live code on it. That reconciliation is the part auditors examine, and the part a purely marketing-led QR project skips entirely.

Three mistakes that force a reprint

Encoding the leaflet URL directly into the code. The moment a dosage line or a warning changes, every printed pack points at outdated information you cannot recall. The code should carry an identifier; the identifier should resolve to content you control and can update.

Using the same code on every pack of a batch. It satisfies the leaflet requirement and none of the authentication one. If a counterfeiter copies one pack they have copied all of them, and you have no way to see it happening.

Treating the scan as a one-way broadcast. Every verification is a data point: where a pack surfaced, how often a code was checked, whether the same identifier is being scanned in four states at once. Brands that log this find diversion and counterfeiting long before a regulator or a patient tells them about it.

Start with one product line. Tag the packs, publish the leaflet, watch the first thousand scans, and only then roll the approach across the catalogue. Compliance deadlines rarely reward big-bang launches.