Goodwin Life Sciences and Healthcare partner Roger Cohen and associate Anne Brendel along with Life Sciences and FDA associate Steven Tjoe kicked off Goodwin’s multi-part webinar series “Disrupt + Innovate + Transform: A Healthcare Webinar Series” with “Key Regulatory Issues for Digital Health Companies” discussing the key regulatory issues affecting digital health, telemedicine and healthcare IT companies.  The webinar series will be presented by a cross-disciplinary team of Goodwin lawyers exploring the topics that are most relevant for the healthcare industry today. From ever-changing regulatory guidelines to digital health, women’s health and privacy, Goodwin will take attendees through these topics and more and provide guidance to help you navigate the current healthcare landscape.

View the Video:

For  information on upcoming webinars in the Disrupt + Innovate + Transform: A Healthcare Webinar Series, visit our mini site.

Last month, the European Data Protection Board (“EDPB”) issued additional guidance on the application of the General Data Protection Regulation (“GDPR”) in the area of scientific health research. You can read our summary of the key takeaways here. While the EDPB’s responses offer some clarifications, many obstacles and complications remain for controllers located in the US in a post-Schrems-II world.  Fundamental principles that are well settled in the US, including what is and what is not considered human subjects research, and what future uses require consent under US regulations, may be at odds with the approach in the EU under the GDPR. US-based controllers should consider the following when planning trials in the EU or UK:

• Further processing of previously collected data: The EDPB confirmed that controllers may obtain individuals’ consent for future secondary research without specifically defining the research, so long as the purposes of the research are compatible with the purposes of the original data processing and adequate safeguards are implemented. Accordingly, while US-based sponsors might be accustomed to freely using de-identified data for research purposes unrelated to the original purpose for which the data was collected, these broad unrelated uses may be subject to restrictions under GDPR.

• Broad consent: In the US, sponsors  can rely on broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens. However, the EDPB confirmed that broad consent “cannot be asked and relied on for processing health data for any kind of – unspecified – future research purposes” where the scope of the secondary research is not closely related to the original research purpose for which it was collected.[1] These broad consent limitations can cause complications for US sponsors who are accustomed to relying on broad consent for future unspecified research. Broad consent limitations under GDPR may further restrict the downstream use or sale of de-identified biospecimens and data for future unrelated research.

• Anonymized versus pseudonymized data: US sponsors commonly assume that because health research data has been key-coded and de-identified in accordance with HIPAA standards (if applicable), and they do not maintain the key (but a third party does), that the data has been “anonymized” and is not subject to regulation. At that point, the key-coded data can be used for any purpose. However, the GDPR regulates even pseudonymised data, which can be a surprise for US sponsors accustomed to the HIPAA regime. The EDPB has reiterated that where key-codes exist, and are maintained by a site, investigator, or other third party processor, it is reasonably likely that the individual could be re-identified.  As a result, the key-coded data is still subject to GDPR protections. The EDPB plans to issue future guidance as to whether further downstream recipients of key coded data, who are not permitted to access the key, can consider that data to be anonymized.  This guidance will be crucial for research collaborators or specialized research labs who may receive key-coded data for which they have no intent, need, or ability to re-identify data.

• Transfer of research data and biospecimens: The transfer of research data and biospecimens into the US for processing remains an ongoing and unsettled concern.  Transfers of personal data are restricted unless a US based controller can demonstrate adequate safeguards have been implemented to ensure the rights of the data subjects have been protected.  Most of those specific safeguards are either inapplicable to US controllers, or are unduly burdensome for smaller entities to comply with.  EDPB is expected to release future guidance to address the question of whether US or other controllers can rely on the legitimate interest derogation for transfer of special categories of data for research purposes.

Conducting scientific health research in the EU raises specific and difficult considerations for US sponsors, including assessing legal bases for processing sensitive data and transfer mechanisms to ensure data is processed in accordance with GDPR.  This is not helped by the lack of clarity in the EU around some key issues discussed in this blog.  Until the EDPB issues further clarifications, US controllers and trial sponsors are encouraged to consult with counsel to navigate the complexities of EU scientific health research.

___________________________________________________________________________________________

[1] EDPB Document on response to the request from the European Commission for  clarifications on the consistent appliable of the GDPR, focusing on health research, 2 Feb. 2021, response 31.

Despite the turmoil and disruption of 2020, plaintiffs’ lawyers and courts appear to have adapted readily to our “new normal.” Although at lower rates than previous years, plaintiffs’ firms continued to file securities class actions against publicly traded pharmaceutical, biotechnology, medical device and healthcare product and services companies in 2020, while courts continued to issue detailed, substantive decisions in these actions. The number of class action filings in state and federal courts from last year shows a 22% decline from a record level in 2019 – a decrease for the first time since 2016, but still far higher than the 1997-2019 average.

In Goodwin’s fifth annual Year in Review publication, we focus on active jurisdictions that are geographic epicenters for life sciences and healthcare companies: the First Circuit and the District of Massachusetts; the Second Circuit and New York District Courts; and the Ninth Circuit and California District Courts. In our analysis, we summarize key decisions issued in these jurisdictions during 2020 in class actions against life sciences and healthcare companies, as well as cases to watch in 2021.

Read the Report.

Given the breadth of clinical-stage companies that the Goodwin FDA and Healthcare teams advise, our regulatory attorneys together with our commercial contracting, products liability and insurance attorneys play an integral role in counseling clinical-stage companies on matters related to the conduct of clinical trials.

Learn more about our clinical trials service offering here.

On February 3, 2021 Goodwin FDA Regulatory partner, Julie Tibbets, Products Litigation + Counseling partner, Nilda Isidro, and Risk Management & Insurance counsel Brian Mukherjee discussed what drug and biologic companies with late-stage product candidates can do to best position their products to mitigate the risks that come with transitioning from clinical trials to marketing and sales.

Our speakers – leaders in life sciences regulatory compliance, product litigation preparedness, risk management, and insurance – highlighted best practices surrounding pharmaceutical promotion, preparing for risks inherent in the marketing and sale of prescription drugs, and the ways in which insurance can help mitigate those risks. This webinar identified key takeaways for companies that are nearing FDA approval and are poised to launch their commercial products.

Click here to view the slides and webinar recording.

On January 19, 2021, the FDA issued guidance for licensed and investigational cellular and gene therapy (CGT) manufacturers during the COVID-19 pandemic. This new guidance supplements the recommendations provided in FDA’s June 2020 guidance regarding manufacturing controls to prevent contamination in drugs, risk assessment of SARS-CoV-2 as it relates to drug safety and quality, and continuity of manufacturing operations as applied to all drug and biological product manufacturers.

The new guidance provides risk-based recommendations to minimize potential transmission of SARS-CoV-2 to patients and facility personnel with specific considerations relating to, among other things, the assessment of donors, cellular and tissue source materials, manufacturing processes, manufacturing facility control, material testing, and the number of patients that can be treated with the product. While FDA acknowledges in the guidance that is not aware of any CGT products that have been contaminated with SARS-CoV-2 or of information indicating transmission of SARS-CoV-2 via CGT products, FDA notes that “CGT manufacturers are expected to evaluate whether [the virus] poses new risks in the context of their specific products, facilities, processes, and manufacturing controls.”

FDA recommends that CGT manufacturers review the current good manufacturing practice requirements and recommendations and perform a risk assessment that identifies, evaluates, and mitigates factors that may allow for transmission of SARS-CoV-2 to patients and facility personnel and include a description of the risk assessment and mitigation strategies in any investigational new drug application (IND), biologics license application (BLA), or master file. Since this is an evolving area, manufacturers should look to scientific literature to provide justification and support for their risk assessment and mitigation strategies.

CGT manufacturers should evaluate their manufacturing operations for SARS-CoV-2 risks and be sure that all risk assessments of production controls, including any follow-up and changes, are approved by their quality unit and appropriately documented within their quality management system.

On January 12, 2021, the U.S. Food and Drug Administration (FDA) published its Action Plan for further development of the Agency’s framework for regulatory oversight of artificial intelligence (AI) and machine learning (ML) based Software as a Medical Device (SaMD).  The Action Plan identifies several opportunities for SaMD developers to engage the FDA as its regulatory framework for AI/ML-based SaMD oversight evolves:

• Predetermined Change Control Plans: FDA remains committed to refining a regulatory framework that would allow for some post-market SaMD modifications based largely on the establishment and utilization of SaMD Pre-Specifications (SPS) and an Algorithm Change Protocol (ACP) set forth in a “Predetermined Change Control Plan.” SaMD developers can expect, and be ready to submit comments on, a draft guidance in 2021 addressing a Predetermined Change Control Plan.
• Real-World Performance: Real-world data collection and monitoring is another key concept in FDA’s proposed regulatory framework for oversight of modifications to AI/ML-based SaMD. FDA plans to advance real-world performance monitoring pilots with stakeholders on a voluntary basis, and  use the learnings from these activities to develop a framework for gathering and validating relevant real-world performance parameters and metrics.
• Algorithm Transparency: To identify types of information that FDA may recommend SaMD developers include in the labeling of their AI/ML-based devices, FDA intends to hold a public workshop to elicit input from the broader community on how device labeling supports transparency to users.

FDA also will continue to participate in global working groups focused on harmonizing principles of Good Machine Learning Practice (GMLP) as well as expand upon the Agency’s efforts to develop methods for evaluating and addressing algorithmic bias.

The Agency recognizes that continued stakeholder engagement will be crucial for the formation of a sensible regulatory framework for oversight of AI/ML-based SaMD.  SaMD developers seeking to inform the development of FDA’s regulatory framework are strongly encouraged to participate in the specific opportunities outlined in the Action Plan.

As follow-up to our October post on pre-approval and pre-licensure inspections impacting U.S. Food and Drug Administration (FDA) drug and biologic approvals, this blog post discusses FDA’s recently announced temporary policy set forth in its December 2020 guidance on review timelines for company responses to a Complete Response letter (CRL) for applications requiring the conduct of manufacturing or bioresearch monitoring (BIMO) program site facility inspections prior to approval. This guidance augments FDA’s August 2020 guidance, which described FDA’s intent to issue a CRL or defer action on an application until an inspection can be completed.

FDA acknowledges in its recent guidance that it is “facing difficulties” in conducting inspections during the COVID-19 pandemic. Industry has felt the impact of this with delayed approvals of new therapies in 2020 as a result of these inspection delays. While FDA has sought to use alternative tools to mitigate the need for in-person inspections (e.g., requesting records and other information directly from facilities and requesting existing inspection reports from trusted foreign regulators), FDA indicated in its December 2020 guidance that these inspection-alternatives “can be as resource intensive as inspections, if not more,” thereby presenting a challenge to timely completion of required pre-approval and pre-license inspections during the application review period.

To provide greater transparency on expected timeline impacts for company complete responses where FDA issued a CRL either (a) due to its inability to perform a required inspection because of COVID-19, or (b) where the inspection involves the use of time- and resource-intensive alternative tools, the Agency provides the below timeline expectations in its December 2020 guidance for the review of applicant responses to CRLs:

• NDAs & BLAs: Resubmissions of original applications and efficacy supplements for NDAs and BLAs will be subject to a Class 2 review timeline of 6 months, which is “consistent with existing policies and practices when a facility inspection is required.”
• Biosimilars & NDA & BLA manufacturing supplements: There will be no changes in the review timelines for resubmissions of original applications, supplements with clinical data, and manufacturing supplements for biosimilars, or for resubmissions of manufacturing supplements for NDAs and BLAs.
• ANDAs: Regardless of whether the CRL contains a major deficiency, amendments to original ANDAs and amendments to prior approval supplements for approved ANDAs will be treated as major amendments, subject to the timelines provided in FDA’s July 2018 guidance on Generic Drug User Fee Amendments (GDUFA).

The December 2020 guidance enables applicants to better plan for approval timeline delay contingencies as they proceed through FDA’s review process. Comments on the December 2020 guidance may be submitted to the docket for Agency consideration here.

On December 27, 2020, the President signed into law the “Consolidated Appropriations Act, 2021” (the “Act”). Included within this omnibus legislation are several provisions (in Division BB, Title III, Subtitle C) that affect the regulation of generic drugs and biosimilar medicines by the U.S. Food and Drug Administration (FDA).

Read the Alert >>

On December 2, 2020, the Department of Health & Human Services (HHS) published its long-awaited two final rules – one by the Office of Inspector General (OIG) and one by the Center for Medicare & Medicaid Services (CMS) – finalizing changes to regulations implementing the federal anti-kickback statute (AKS), the beneficiary inducement provisions of the civil monetary penalty law (CMPL), and the physician anti-self-referral law (Stark Law) and their safe harbors and exceptions. Among the most anticipated aspects of the final rules are the new value-based arrangement AKS safe harbors and Stark Law exceptions.

The two final rules, while complicated, are aligned in their definitions of value-based arrangements.

A value-based enterprise (VBE) is two or more participants that: (1) are collaborating to achieve at least one value-based purpose; (2) are each a party to a value-based arrangement with the other (or at least one other participant in the same VBE); (3) have an accountable body or person responsible for financial and operational oversight of the VBE; and (4) have a governing document describing the VBE and how its participants intend to achieve the VBE’s value-based purpose(s).

A value-based arrangement is an arrangement entered into between (1) a VBE and one or more of its participants, or (2) among participants in the same VBE, for the provision of one or more value-based activities for a target patient population.

A value-based purpose is (1) coordinating and managing the care of a target patient population; (2) improving the quality of care for a target patient population; (3) appropriately reducing the costs to, or growth in expenditures of, payors without reducing the quality of care for a target patient population; or (4) transitioning from health care delivery and payment mechanisms based on the volume of items and services provided to mechanisms based on the quality of care and control of costs of care for a target patient population.

While the new AKS safe harbors exclude pharmaceutical and medical device manufacturers, distributors, and wholesalers; DMEPOS suppliers; laboratories; compounding pharmacies; and pharmacy benefit managers, there is a narrow exception intended to facilitate the deployment of health technologies for care coordination. These entities are eligible for protection under the care coordination safe harbor as “limited technology participants” that exchange “digital health technology” (defined broadly) with a VBE or VBE participant.  The OIG Final Rule provided as an example “a medical technology company could partner with physician practices, to better coordinate and manage care for patients discharged from a hospital with digitally-equipped devices that collect and transmit data to the physicians to help monitor the patients’ recovery and flag the need to intervene in real time (e.g., a device that monitors range of motion that could inform what an appropriate physical therapy intervention may be). The technology company could provide the physician group with necessary digital health technology that improves the physician group’s ability to observe recovery and intervene, as necessary.” However, the OIG final rule requires that the exchange of digital health technology by a limited technology participant is not conditioned on any recipient’s exclusive use of, or minimum purchase of, any item or service manufactured, distributed, or sold by the limited technology participant.

The Stark Law final rule does not exclude such entities from qualifying as VBE participants under any exception for value-based arrangements.  However, because the Stark Law is focused on prohibiting self-referrals by physicians, the new Stark Law exceptions for value-based arrangements will be of limited value to medical device and pharmaceutical companies.