Compliance Zen

Majority of Mobile Health Apps Class II Devices for FDA

A June interview with FDA’s Bakul Patel, author of FDA's draft guidance on mobile medical apps, revealed that the majority of mobile health apps FDA has reviewed to date are classified as Class II Medical Devices.  Of the 27,000 medical apps available today, FDA has reviewed less than .003%.  Classifying even ten percent of the 27,000 medical apps as Class II Medical Devices risks bringing FDA to its knees, dramatically increasing the number of inspections and enforcement actions FDA needs to take each year.

As more developers around the world jump into the fast paced medical app business, the problem will get worse.  Compounding this is the lifespan of the average mobile app:  14 months.  And during that time, the app will be significantly revised or completely rewritten 3-4 times.  In device terms, that’s a new model every 3-4 months. And yet FDA needs an average of 67 days to review a medical app.  So by the time FDA has finished its review and clearance, the version the agency reviewed may well be obsolete.

This is going to be problematic if the majority of mobile medical apps are classified as Class II Devices as suggested by FDA's draft guidance on mobile medical apps.

Class II Medical Devices are higher risk than Class I devices.  Example Class II devices today include powered wheelchairs and infusion pumps.  Class II devices require their maker to fully comply with FDA's Quality System Regulation (21 CFR § 820) and the Medical Device Reporting (21 CFR § 803) rules, from design control to supplier (including distributor) qualification to postmarket monitoring.  Assuming a firm takes a traditional approach to compliance with the QSR and MDR, their cost of doing business will increase an average 30%.

Many questions about QSR and MDR compliance for medical apps abound.  Is Apple a distributor of the medical mobile app?  What about Google’s Android store?  Or Amazon.com?  How should a maker of a mobile health app qualify Google or Amazon.com or Apple?  If a user posits a poor review and bug problems he/she had on the app store’s reviews section, what responsibility does the developer – or Apple or Google – have to consider that user review for postmarket reporting?  How strict will FDA be in inspecting and enforcing design controls when device models completely change every 3-4 months.  Far too few firms today get design control right with an 18 month development lifecycle.  What is the agency’s compliance expectation for a 90-day development lifecycle?  And for apps that include the ability for a healthcare provider to enter patient data and track treatment plans, for instance, who is responsible for ensuring the app is 21 CFR § 11 compliant such that any data within it has integrity, much less remains confidential and private?

FDA’s current draft guidance on mobile medical apps is woefully short of such practical specifics.  And yet it’s these specifics that will get even the most forthright medical app developer in trouble with FDA-483s and Warning Letters.  Warning Letters have been shown to reduce product sales by at least 8% the first year and for three years thereafter.  For many of these developers, a Warning Letter might be the kiss of death and bring a painful chill to the innovation marketplace.

FDA will need to tread carefully in its final guidance.  I am less concerned about apps that clearly turn a smartphone into a medical device or diagnostic tool (a perfect example is the recent “It Has Come to Our Attention Letter” to Biosense Technologies in California for its mobile medical app, uChek Urine Analyzer).  I am more concerned about missteps in two areas:

1.  Misinterpretations around technological capabilities vis-à-vis wellness versus treatment versus diagnosis.  Many mobile medical apps help healthcare providers and patients track conditions – from weight loss to insulin levels.  It seems to me that FDA’s draft guidance identification of apps doing calculations as Class II devices is extremely broad.  After all, if my weight loss app calculates my body mass index, doesn’t that technically meet the criteria defined by FDA:  “Apps that act as calculators or utilize algorithms to produce an index, score, scale, or other similar calculations.”  And what if my doctor decides to rely upon that to prescribe a weight loss drug or exercise regimen?  Or a clinician, in the midst of a clinical trial, decides that this is how he/she is going to verify and track dosing?

2.  Enforcement of the QSR and MDR requirements.  How will FDA enforce these regulations given the enormous numbers of medical apps and the comparative dearth of FDA investigators and reviewers?  Few app developers today use anything like design control for their rapid development and release cycle.  And many medical app developers are virtual companies.  What is the actual likelihood they will comply versus simply shutdown shop after 14 months (the lifespan of their app) only to re-open under another name?  Think about how the video game development industry operates.  Game studios open and close all the time.  Individual developers jump ship to form a new studio, release a game, and then shut down the studio, only to reform with a slightly different group of developers and reopen a new studio 30 days later.  I can easily foresee this happening in the mobile medical app space, particularly as more and more overseas developers join the fray.  FDA can clarify all it wants that app developers need to register as device makers and comply with the QSR and MDR, but enforcement needs to be realistic to work.  The ability of an app maker to open up, develop the app, sell it for 14 months, and then close up shop faster than FDA can realize the app even existed is going to make for a lot of frustration in FDA, in the marketplace, and among patients and providers.

While FDA continues its case-by-case enforcement and tries to craft guidance-based rules in which to understand and frame the fast-paced mobile health landscape, the market marches forward at double time.

Let’s hope mobile medical app makers are not surprised when FDA finalizes the rules of the game.

3D Printing and Nanobots - FDA Challenges Ahead

Among many products, the US Food and Drug Administration (FDA) regulates medical devices such as stents and prosthetics. FDA regulations - and compliance - are predicated on an assumption that medical device production is an involved undertaking that requires expertise, monies, and physical manufacturing.

Yet, what would happen - is happening right now - if anyone can make a fully functional, complex medical device at home in about an hour?

3D Printing of Medical Devices

Late last year, two folks collaborating from opposite sides of the planet created an articulating prosthetic hand using only a cheap 3D printer.

Then, they went one step further – they uploaded the design specs on the internet so anyone can download, make and use this 3D printer prosthetic hand today.  (*Note - this news story has embedded videos to watch as well so you can see the fully articulate hand in action.) The device design is now in the public domain.

Most prosthetics are Class I devices today, requiring only an FDA quality system (21 CFR 820)  and compliance with the medical device reporting rules (21 CFR 803); a 510(k) is not required. Sounds straightforward when such devices are designed and made in traditional manufacturing firms. But using this public domain specification, anyone with access to the internet and a 3D printer can make this Class I device.

So…is every person who prints one of these now an FDA-regulated manufacturer?

FDA rules, regulations and statutes are predicated on an assumption that in order to start a business – in order to design and sell a product – there are significant fixed costs involved, investors may need to be sought, expensive expertise to obtained, and so on.

Now though, all one needs is a cheap 3D printer and an internet connection to download, make and use a fully articulate, Class I medical device prosthetic.

The times they are a changing.

Beyond just the FDA QSR and MDR rules, the new unique device identifier (UDI) regulation will be phased in over the next six year. 3D printed prosthetics – and other Class I devices – will need their own UDI as of 2019, if not sooner. How will this work if anyone can make their own fully functional, Class I device with a 3D printer? Keep in mind – this fully articulate, 3D printed prosthetic is just the first of future medical devices made onsite, at any site, in real-time with 3D printing.

In February 2012, a woman received an impantable replacement jaw made from a 3D printer. Presumably, any hospital could make such an implantable device on the fly, in real-time, fitted to each individual patient’s characteristics. Fabulous from a healthcare perspective but a real challenge in the context of regulations that date back to last century. Will this mean each hospital in the US has to seek its own UDI? Has to have its own quality system and device adverse event reporting programs?

FDA has an overwhelming workload now. Imagine in a few years when wide-spread 3D printing allows real-time, patient-side creation of almost any type of medical device, from prosthetics to implants, at any hospital, doctor's office or home.

Nanobots and the UDI Rule

It’s only going to get worse, though. A colleague of mine is working to commercialize injectable nanobots that scour arteries for plaque and other problems, and then, within 30 days, completely dissolve. Other firms are drawing up plans for similar nanobots to tackle digestive system issues and so on.

Thankfully for the agency, these nanobot based devices are almost a decade away. And the clinical trials will undoubtedly be highly scrutinized.

Here are just two questions injectable (or injestable) nanobots raise:

1. Are these devices or drugs or combination products?
2. How do you apply a UDI to something the eye cannot discern and that will disappear in 30 days?

Fundamentally, the challenge facing FDA – and facing all of us in compliance and quality – is that scientific and technologic progress is far outstripping FDA’s ability – much less any organization's ability – to understand its implications enough to be able to craft reasonable regulations and practical SOPs and policies. This is a challenge that will get far worse before it gets better.

When I give FDA compliance training and workshops to business execs and scientists, I make a point to note that regulation in the US today takes at least 8 years to go from blank sheet of paper to reality (note that the UDI rule was drafted long before Congress actually passed the authorizing FDAAA statute in 2007). The UDI rule took almost a decade to come to fruition in Congress and then be written so as to go into place this year...and with 3D printing (much less imminent nanobot devices), the UDI rule is already outdated before it formally takes effect.

How can FDA handle 3D printed devices, nano-technology medicines and other new advances?

FDA has little choice left but to regulate through guidance. Guidance documents can take less than a year to publish. And for those of us who provide expert regulatory intelligence and quality systems advice to clients, we’ve also noticed that FDA is increasingly reliant as well upon using Warning Letters to explain rules and requirements; see the recent push of late for FDA records management requirements in warning letters and this year's Ben Venue Laboratories consent decree.

Implications for Firms Today

Firms need to proactively manage the gathering and synthesizing of FDA regulatory intelligence, incorporating and applying it into their quality systems and product planning. Relying upon a regulation written before Y2K to tell you what to do in this era of social media, iPhones and 3D printing is akin to relying on a fax machine to quickly send a document. This is why FDA officials of late have cautioned against relying on former FDA officials whose last stint with the agency was twenty years ago; too much has changed since the 1990s.

Those firms large enough to dedicate a team of personnel to regulatory intelligence and its application will manage just fine over the 5-10 years, but what of firms that don’t have that kind of manpower and money? How will firms with more needs than personnel keep up with new FDA expectations and clarifications from guidance documents, warning letters, consent decrees, and even web-based FAQs?

Stay up with FDA guidance, warning letters and FAQs to avoid enforcement and new product delays.

Small to midsized firms should look to some type of outside service. Consider asking an industry expert with a good reputation to provide you regulatory intelligence services (if you need help determining how to get a good a consultant, follow the tips in this article). Ask the trusted compliance expert to provide ongoing review, analysis and suggestions stemming from “recent and newly published relevant FDA guidance documents, warning letters, consent decrees, and FAQs.” Be sure to scope out the service appropriately. Don’t ask for a weekly update if you only plan on incorporating suggestions on a quarterly basis. Most clients I deal with want advice on a monthly or quarterly basis. A good rule of thumb is to expect the expert to spend approximately 12-20 days a year providing you analysis and suggestions from relevant FDA items. Work this out for the consultant’s hourly rate or a fixed fee.

Another option, albeit much less tailored, is to subscribe to a regulatory intelligence newsletter or a quality systems newsletter such as Cerulean’s SmarterCompliance. Keep in mind that published newsletters have a large readership and so you may not find every issue to be of immediate impact. Make sure the newsletter offers a money-back guarantee of some sort so that if you cannot find anything of any value over a handful of issues, you can at least get some monies back.

FDA regulatory intelligence is only as good as its applicability. Talk with your quality system consultant or regulatory intelligence expert on how best to apply the ongoing advice in your organization; he or she should have some level of insight into what works best in day-to-day practice.

Medical Apps, FDA and Patient Data Integrity

Two recent articles - one in the Washington Post entitled Health-care Apps of Smartphones Pit FDA Against Tech Industry and one in the Wall Street Journal entitled There's a Medical App for That-Or Not - have raised the spectre of how smartphone medical apps imply an imminent trainwreck between today's rapid-pace innovation and last century's slower-going FDA regulation.

 

  vs? 

What's the real question?

As I note in Get to Market Now!, new innovations and technologies emerge on average every 6 months while new or revised regulations take 12-14 years. Today, there are over 13,000 medical apps available for you and me; another 5,000 are available just for physicians and healthcare providers. By the time you finish reading this post, another medical app will have been published.

From a business perspective, the thought of FDA dragging down innovation to the rate of regulation is frightening. And while there is also the need to protect the public - and physicians - from medical apps that are unreliable, faulty, and just plain poor, is new regulation the answer? Is treating a $1.99 app like an MRI the answer? Innovation wouldn't stop. The price would just go up. Instead of paying $1.99, you'd just pay $1,990 for the app.

So, assuming that's not our goal, then what's the answer? Well, maybe we should step back from racing to find an answer, and reframe the question. Afterall, there's no point in arguing over the answer if we're not all answering the same question.

I suggest the real question has little to do with speeding innovation, keeping the public safe, enabling informed healthcare consumers, or making healthcare professionals more efficient. Those are all wonderful points, but they are not the core question behind how to, or even whether, we should regulate a medical app.

The real question is simpler:  How do we - as a society - ensure that patients and healtcare providers can rely upon the health data used/maintained in a medical app?

Think about it. Would you want one of the regular updates to an app on your smartphone to corrupt all the previous data you had in it?

In today's video game market, data corruption is a painful reality becoming more and more common - patches and updates to games increasingly have to be withdrawn and redone because they accidentally corrupted and destroyed people's previous game data. It's too late for those consumers whose data files were destroyed.

"Well, sure," you say, "but those are game files. I mean, come on." And then think about it:  is that what you want for your smartphone health app?  You'd be hard-pressed to find a patient or a physician okay with running that risk for all their health data. Are you okay with all your health data and trends over the past year being wiped out while an update to your app is downloaded as you sit at Starbucks sipping that latte?

So this is the core question:  how do we ensure that data entered into a medical app stays trustworthy?

And if we reframe it in this way, then we can cast about for already existing regulations, controls and tools. And yes, we already have them.

 

Today's Medical App Controls

I see four significant controls available today. The first two are pure market-driven, the second two are more "guiding hand" industry best practice combined with existing regulation:

1. Consumer reviews.  Admittedly, there are some drawbacks to this as we don't know if the person writing the review is knowledgeable, and sites that rely on consumer reviews are usually fairly easy to game. So, consumer reviews are not a stand-alone control, only a piece of the control puzzle.

2. Product liability litigation.  Yes, it's coming if not already occurring. Face it, if you can find a lawyer able to beat a restaurant for serving too hot a cup of coffee, you can find a lawyer able to beat a medical app for allowing your medical data to become corrupt. Still, because it can take up to two years for such product liability litigation to emerge, this is not a preventative except in the long, long-term. Product liability litigation is only another piece of the control puzzle. If nothing else, right now, medical app makers will want to include some level of documented risk assessment to patient data as part of their development process, otherwise, expect to defend why you didn't when you sit before the court in 18 months.

3. Software quality control practices.  Great in theory, often poor in practice. The reality is that often companies cut quality control in order to rush products to market. When a medical app can be written and quality checked by the same person all in the span of a 14-hour day, software quality control is not a stand-alone data integrity control to rely upon. Nonetheless, I'd argue it is still a part of today's control puzzle. Everything from ISO to CMM should be on the table here, and it'd be nice if we could start to see some sort of reference by medical app makers to the software quality coding method used to make their app and its inevitable updates.

4. Part 11.  Yes, I said it. 21 CFR 11 Electronic Records; Electronic Signatures. Now, before you bring up the spectre of "validate everything" (and trust me, as a recovering "validate everything" addict, I've got a lot of personally painful, embarrasing stories), I'm discussing how Part 11 (and the EU's Annex 11) are interpreted and enforced today. Today, Part 11 is all about data integrity - ensuring that data that is trustworthy. And isn't that the core question we just defined above?

So if a medical app provider can show that his/her medical app maintains data with integrity (i.e., is Part 11 compliant), isn't that enough for the vast majority of the 18,000+ medical apps out there?

Coincidentally, Sweden's Medical Products Agency just released a guide to the EU's medical device directives that discusses controls, risks, and expectations for medical software - including medical apps. Download a PDF of Sweden's guide here. It's approach seems quite reasonable. Makers of medical apps are to conduct a risk assessment of their app that includes risk to the patient (see control #2 above), and be able to demonstrate that the app meets its intended performance goals (see controls #3 and #4 above). Finally, the guide notes that smartphones and tablets, etc., will never be considered (and regulated as) medical devices unless they are specifically converted to be a medical device.

If only we in the States could be so reasonable....

FDA Forecast for 2012

Expecting something from the FDA is a risky endeavor, and that makes it all the more worthwhile to read the tea leaves every once in a while.

*Note:  This blog post is excerpted and adapted from Cerulean's special FDA in the New Year issue of our SmarterCompliance regulator intelligence newsletter, a yearly forecast of FDA activities and challenges in the new year along with specific recommendations and suggested activities for quality, regulatory affairs, records management, IT and other compliance executives.

 

General Outlook for FDA in 2012

The agency will struggle to maintain traction in 2012. Congress began second guessing a number of the agency’s actions in 2011. With tight budgets, no real money to spend and heavy lobbying pressure, Congress will continue to pull the FDA’s leaders into hearings and push FDA for new reports on its activities. This will divert agency energy away from making meaningful progress on the broad array of challenges faced by a government agency that oversees at least 27% of the US economy.

Meanwhile, FDA executives will have to ride through congressional hearings and inquiries with calm as President Obama cannot afford embarrassments or distractions in an election year. Expect Republicans in Congress to try to make the most of any FDA missteps. This will act as a drag on agency momentum and further drive downward agency morale. Congressional negativity had a poor effect on the agency in 2011, and we expect more of the same in 2012. Sadly, this will result in more retirements from the agency, continuing the loss of institutional knowledge.

Implications

1. FDA’s continuing knowledge loss, its growing reliance on external regulatory science partnerships, and congressional pressure to "encourage innovation" (i.e., foster jobs in an election year) will leave the agency vulnerable. If you have borderline technologies or medicines that will be made in the US, bring validated, independent science - with data that has integrity - to back up your claims (or counterclaims), the agency may be forced into a stalemate you can favorably resolve with post-market surveillance promises. Even if you are in a device firm, look to recent REMS guidance and examples to pro-actively propose a series of post-market surveillance activities and patient safety control measures.
2. Emphasis on corporate responsibility at the executive level will continue as a subtext of inspections. As we predicted in 2010, this became evident in 2011 with the increased emphasis on the Park Doctrine. Expect more of the same in 2012; the more FDA can showcase industry executives who ignored patient safety regulations, the greater leeway the agency will gain in congressional hearings and in budgetary battles. Thus, if you've been putting it off or haven't done it regularly enough, this is the year to review with senior management their role and seven key responsibilities in ensuring an effective quality system (see a related webinar on January 31 on FDA expectations for senior management).

Want More?

December's issue of SmarterCompliance included 32 outlooks for FDA in 2012 like the ones above, along with 24 specific recommendations for subscribers to consider adopting in their organizations. Get your copy of the issue by subscribing today.

And on another note - FDA has again redesigned its website. For those of you who remember the 2010 redesign, don't start redoing the bookmarking immediately, wait 6-8 months for the agency to get all the kinks worked out. Currently, a number of the links on the new fda.gov landing page don't work or send you off in the wrong direction. Nonetheless, the redesign will be helpful when its complete (Yes, properly functioning links are part of a completed redesign - you can't give a house an exterior paint job and call it "newly renovated").

Here's to a positive 2012 full of easy surprises.

Results from Annual FDA Supplier Quality Congress

Supplier quality management is complicated enough.  Yet, too often, we shoot ourselves in the foot, making supplier qualification and oversight more complicated, more removed from business realities than necessary.  This was the common theme amongst speakers and attendees at FDAnews' third annual Supplier Quality Management Congress.

I was fortunate enought to chair the three day event, from August 9th-11th, with speakers from FDA, pharma and device firms, and suppliers to the industry. To start the conference, my friend, Dan O'Leary, and I provided a half-day workshop on practical approaches to cost-effective supplier qualification and management.  A standing-room only event, the workshop went extremely well and far too quickly, with a good mix of conversation, Q&A, and laughter.  Below are two slides excerpted from our workshop:

We provided attendees with a set of implementation tools in PDF, Word and Excel format:

• Supplier quality ranking radar chart
• Overall process map for supplier qualification
• Sample SOP for supplier selection and qualification
• Audit checklist
• Base questionnaire for all suppliers
• A more comprehensive questionnaire for more critical suppliers
• Supplier re-evaluation form

Throughout the half-day pre-con workshop, we worked through various excercises and questions, and provided copies of multiple regulatory guidance documents as well as items used internally by FDA to train their inspectors.  The workshop was very lean compliance-minded.  We focused on how to actually implement compliant and effective vendor qualification and oversight to meet FDA, GHTF, and ICH harmonized requirements (with a little ISO thrown-in).

We also discussed differences and expectations - including cost ranges - for mock FDA audits versus more laser-focused, single process audits.  While many of us are aware of mock FDA inspections, one tactic I'm increasingly advocating as a more cost-effective, more risk-based approach for supplier oversight is critical process audits.  As I conceive of it, a critical process audit of a supplier is much like a mock FDA audit or third-party supplier qualification audit, but is ONLY focused on one or two critical processes at the supplier.  Thus, it provides the same level of third-party, independent verification, but at lower cost because it only looks at supplier processes critical to your product or compliance status.

As an example, think of a supplier such as a contract sterilizer.  Do you really need to know about their CAPA process and their training procedures?  Maybe.  But put this in the context of what you're using that supplier for - sterilization services - and the context of your business and available budget.  Is it better to spend your budget on one big mock FDA audit of a single supplier, OR spend your money on multiple audits of the critical processes that you are using multiple suppliers for?  In other words, should you spend $10K on a mock FDA audit of a contract sterilizer when, for that same $10K, you could hit five different suppliers by spending $2K to audit the contract sterilizer's sterilization processes, then another $2K on a different supplier's critical activity for you, then another $2K on a third supplier and their critical activity, and so on.

By relying on a judicious  mix of remote qualification (e.g., a supplier qualification), contractual agreements and monitoring, and laser-focused audits of the critical processes actually directly relevant to your product, you minimize your risk, meet FDA, GHTF and ICH requirements, AND maximize your funds.  It's a win for you, a win for your company (and your management team), a win for compliance, AND a win for the suppliers (because they don't need to devote multiple days to hosting your audit team).

The key is to select processes strictly on the basis of current and/or intended use of the supplier using a risk-analysis of their impact to your product (and your compliance).

Some of the other key learnings fro the conference included:

• FDA has really stepped up its border enforcement and product holds (and such holds can be based solely upon "appearance")
• When it comes to supplier agreements, FDA is increasingly examining the concept of "authority" - did the person approving and signing the quality agreement have the authority to commit the company and the capability to enact the terms of the agreement
• Counterfeiting of medical devices is growing (as anticipated in Get to Market Now!, pp. 106-108)
• Do not write into your SOPs that all suppliers will have a quality agreement as some suppliers will simply refuse (even if you are the 800-pound gorilla in the relationship) and you will then be in non-compliance with your own SOPs
• Courts are increasingly looking at the preamble of the regulations as a means test to determine the intent behind the written regulations
• FDA is growing increasingly frustrated with companies who hire consultants whose only qualification is that they are "ex-FDA" or "former FDA" (as one FDA safety officer noted, "Just because someone worked for FDA does not mean they are experts or that they understand current rules and expectations - how many of your former employees would you suggest someone pay as an 'expert' on your company?")
• When dealing with virtual suppliers, your internal supplier controls are paramount
• In any agreement with a supplier make sure you work with your legal department to define a "material breach" - is a material breach a deficiency in the supplier's quality system? Is it more than 3 days of a shipping delay? Is it a reject rate greater than 20%?
• For any supplier qualification process and supplier management process, plan ahead to determine what documented evidence you will want to retain to prove compliance AND limit your liability
• Make sure you understand the document retention requirements for both FDA and other associated regulations - firms need to have an FDA records retention policy, and ideally one that can also meet EU lifecycle document management expectations

Obviously, in three days' time, with a dozen different expert speakers, there was far more information and insight into compliant supplier qualification than I can cover here.  More analysis and recommendations will be in several of my regulatory intel newsletter issues later this year.

FDA Strengthens Global Supplier Oversight

FDA Commissioner Hamburg has created a new FDA enforcement directorate, the Office of Global Regulatory Operations and Policy, under Deb Autor.  The goal is to strengthen FDA oversight and enforcement of global supplier controls regardless of whether the product in question is a medical device, diagnostic equipment, drug, biologic, or nutritional supplement.  As Hamburg noted in her announcement letter, "We have seen the dramatic transformation of globalization – more products, more countries, more access by consumers and companies to global supplies – and this presents an enormous challenge to FDA in ensuring the safety and quality of the products we regulate. In an ever more complex world, products and services do not fit into a single category [such as a drug or a device]."

This dovetails with what I wrote two years ago in Get to Market Now! Turn FDA Compliance in a Competitive Edge:

There should be little doubt that FDA regulations governing pharmaceuticals and biologics will look increasingly like the regulations governing medical devices and diagnostics, with an emphais on risk-based controls, quality by design, and international cooperation. ... For the drug, biologic, or device executive, experience with FDA regulations is no longer enough. ...traditional approaches to compliance-related issues, from FDA enforcement responses to the submission of applications to market a new drug or device, are increasingly out of date.  Executives who fail to adapt their 20th century philosophies to the new realities of the 21st century regulatory landscape will find the odds increasingly stacked against them (excerpted from pp. 26-29).

So what will this new FDA office look at when it comes to international supply chain enforcement in the 21st century?

According to Hamburg, the new directorate has "A mandate from me to make response to the challenges of globalization and import safety a top priority in the years to come."  Well, what does that mean in the day-to-day faced by industry?

Clues can be found in the regulatory harmonized GHTF guidance, Audits of Manufacturer Control of Suppliers. As I wrote in a regulatory analysis article, "FDA Inspectors, the GHTF & Supplier Controls," in the SmarterCompliance newsletter last year:

Firms that outsource to a CRO or a CMO should plan for the FDA inspector to spend his/her primary efforts on scrutinizing the firm's supplier selection, evaluation, qualificaiton and oversight processes.

Specifically, as part of global supplier oversight, FDA will look at how a firm conducts:

• supplier management, oversight and re-evaluation
• supplier selection and qualfication
• change management of materials and suppliers
• risk evaluation and mitigation associated with materials and suppliers
• incoming materials inspections
• corrective and preventative actions associated with materials and suppliers
• supplier audits - both internal suppliers (i.e., subsidiaries) and external suppliers
• internal quality audits and follow-up actions

Add to this the recently released draft of an ICH guideline on quality system expectations for suppliers of drug ingredients, ICH Q11 Development and Manufacture of Drug Substances, and the FDA's new membership in PIC/S, and we can easily foresee a heightened level of scrutiny on industry's qualification and oversight of their global supply chains over at least the next two years.

Next week, I'm presenting a teleconference on how to take advantage of FDA, GHTF, ICH, and PIC/S documents for inspectors to strengthen and streamline your global supplier management processes.  I'll be reviewing in detail:

• critical FDA requirements and expectations
• recent FDA supplier oversight enforcement actions
• a six-step supplier qualification and oversight process compliant with FDA, GHTF, ICH and ISO
• additional lean compliance aspects to consider

And, of course, throughout the teleconference, lots of practical tips and lessons-learned suggestions.  Attendees at the live teleconference will also receive 18 different inspector training documents with questions and points of inspector interest that can easily be adapted into your quality system's internal audits and supplier qualification audits.  Learn more and register online at:  FX Teleconferences.

Data Mining and FDA: What's Missing?

The FDA recently awarded Johns Hopkins University a three-year contract to develop advanced analytical strategies to mine the data residing within multiple FDA databases.  The goal is to find ways to allow drug and diagnostic firms access to anonymous premarket data (from submissions, failed clinical trials, etc.) related to safety and efficacy for specific patient subpopulations.  The project will, as FDA's Dr. Seyfert-Margolis notes, allow the agency to use "data mining with an eye towards sub-stratification of patients for efficacy and toxicity predictors."

Meta-analysis and data mining is actively encouraged in other product development fields outside of the life sciences. New product development specialists even have a term for such endeavors, "bookshelving." The intent is to flag previously gathered data from past products, experiments, failed innovations, consumer feedback, and so on, in order to take one of three possible actions:  skip portions of the development process, avoid dead-ends, or better target a product toward a specific set of consumers. In my book, Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine, I walk readers through how to incorporate this type of meta-analysis and data mining in preclinical and clinical development, as well as include it in quality by design implementation and submissions.

A study published by the Tufts Center for the Study of Drug Development found that less than half of pharmaceutical and biotechnology firms today are pursing personalized medicine projects in their pipeline. Given the slow - admittedly steady - progress of the FDA to publish guidelines associated with various aspects of personalized medicine development and commercialization, it is a testament to the industry's belief in personalized medicine that so many projects are underway without firm FDA rules in place.

Unfortunately, FDA's contract with Johns Hopkins University does not also cover all the postmarket data in FDA's possession.  While some postmarket data is available already publicly, there is little doubt that the agency has access to a great deal more.  And to realize the greatest return on investment in data mining, bookshelving and personalized medicine development, as much data as possible needs to be included in any meta-analysis.  Forcing firms to seek out other individual postmarket databases will not only slow their meta-analysis, it will jeapordize the integrity of any results.  Afterall, what if the one postmarket database containing critically relevant information is ommitted from the data mining? How will firms know?

Until the FDA can make all of its premarket and postmarket personalized medicine-related data available, firms may need regulatory affairs data specialists, adept in finding, collating, synthesizing, analyzing data across multiple sources - but do such experts exist?

Building Compliance in India

This Spring I was invited to an International Informatics summit in Hyderabad, India with the aim of discussing global harmonization as a means to a competitive edge, especially when it comes to lab informatics. Hosted by the Waters corporation out of Germany, the two-day summit was an enlightening experience in which to participate and observe the sharing of knowledge about FDA-regulated data integrity inspections, informatics best practices, and the challenges faced by laboratories and manufacturers in an increasingly globalized marketplace.

Waters kindly distributed my latest book on turning FDA compliance to competitive edge to all the attendees as I gave the keynote address. My talk turned on how to take advantage of FDA’s increasing reliance on regulatory harmonization with the ICH, GHTF and PIC/S.

I noted how the FDA and the EMA have begun a pilot program to coordinate their reviews of quality-by-design submissions. Set to last until 2014, the pilot program is designed to ensure regulatory reviewers have calibrated their review criteria. If successful, companies can expect two things:

1. FDA will require quality by design-based submissions by 2015 or so; and
2. Companies will then need only compile one core submission (quality by design-based) with minor additions to meet both FDA and EMA requirements for marketing authorization for a new drug or biologic

Thus, given the time the required for a new drug to wend its way through the pipeline, now is the time to start collecting the data in the labs and in pilot plant manufacturing to enable such a harmonized submission.

To understand how important this simplified submission will be, a number of the speakers from local Indian pharmaceutical firms discussed their challenges when it came to informatics in their labs – both nonclinical setting and in manufacturing quality control.  Which data rules are important? If a test fails, some regulatory authorities allow a certain number of retests; others allow none. Which to abide by? Going by the most stringent would seem to be the most prudent, but it is also the most costly. And cost is a critical consideration given the revenues of most Indian pharma firms have fallen more than 30% since the worldwide economic struggles began in 2008. With no end in sight to economic malaise in the Western world, Indian pharmas are slowly turning their attention to the developing world and emerging economies of Latin America, Africa and the rest of Asia.

Informal discussions with Indian pharma CEOs and directors made me realize that this shift does not bode well for European and US Big Pharma dreams of entering and dominating these new regions. Indian pharma firms are much better positioned from a cost standpoint and an intuitive understanding of operating in up-and-coming economies than their Western counterparts. And given that most India pharmas are already manufacturing both brand name drugs and their low cost alternatives, the idea of Big Pharma – with its big costs, big overhead, big bureaucracies and 20^th century business practices – competing successfully in 21^st century emerging markets against the more lean, more hungry Indian pharmas must be met with some degree of skepticism.

To succeed, pharmaceutical firms in the US and Europe will need to take a page or two from India. The enthusiasm of Indian pharmaceutical executives, managers, and line workers is palpable. There is a tremendous desire in India to catch up with (and surpass) the West, and to stay at least one step ahead of the Chinese. This double pressure perception, from the top and the bottom, manifests itself in Indian pharmas aggressively scanning the horizon for every advantage they can grab – from new cutting-edge laboratory equipment to simplified, streamlined SOPs designed for ICH, GHTF and PIC/S compliance.

That said, Indian pharmas may – in some instances – be outrunning their compliance infrastructures. The May FDA Warning Letter to Aurobindo Pharma Limited found that environmental monitoring controls and finished product packaging and labeling operations were “inadequate.” While the FDA has few inspectors in India, that the agency can so readily find such inadequacies indicates that Indian pharmaceutical firms still have some ways to go to surpass their US and European counterparts.

From what I saw in Hyderabad, however, such a time is not far off. Indian pharmaceutical firms are taking advantage of India’s decades-old expertise in software development and innovation to re-apply quality lessons learned from IT into drug and biologics innovation.  And just as the Indian government provided tremendous subsidies and IT-based R&D tax benefits to Indian firms in the 1980s and 1990s, the Indian government has begun to offer similar such benefits to Indian firms and startups such as the Translational Health Science Technology Institute (THSTI). The THSTI was established in 2009 to speed the development of new drugs using a strategy taken directly from my book:  a collaborative drug development strategy, fostering collaborations among healthcare providers, hospitals, academic researchers and biotech companies. This 21^st century development collaboration is already gaining tremendous funding and support from healthcare foundations around the world, the most recent being from the Gates Foundation.

As Big Pharma struggles to shed layers of overhead and redundant sales forces while desperately casting about for ways to invigorate stale pipelines, Indian pharmaceutical firms are racing to succeed in the 21^st century, embracing quality by design, new laboratory equipment, cutting-edge software and lean compliance techniques. I look forward to watching their progress.

Personalized Medicine and FDA Dance Closer

FDA has taken several more steps toward a 21st century regulatory framework overseeing personalized medicine. In April, FDA's Elizabeth Mansfield confirmed the imminent publication of a draft FDA guidance on the development and labeling of companion diagnostics.

The FDA guidance will require firms to validate a diagnostic test - or verify its compliance with a similarly approved diagnostic - before its use in a clinical trial associated with its companion drug. Such validation will need to include verifying the intended genetic sub-population and the diagnostic's ability to consistently and accurately assess the sub-population. The label of the diagnostic will also need to specify its companion drug.

While some in the industry argue that diagnostics should not be tied to specific drugs, experience with Roche's drug Herceptin has encouraged FDA to push for firms to indicate, at least initially, the specific drug for a new diagnostic. In this way, the agency hopes to encourage drug and biologics firms to partner with diagnostic makers as early as possible, preferrably during Phase II clinicals of the new drug.

This emphasis echoes an argument made in Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine:  that over the next ten years, companion diagnostics will play the leading edge of mainstream personalized medicine.

The agency is steadily pressing the development of regulatory science to meet the personalized medicine evolution. If you've not already visited and bookmarked the FDA's genomics section of its website, I encourage you to do so. The information can help you determine the specific genomics information the FDA wants to see in a submission. This, in turn, can provide valuable reverse engineering insight for planning clinical trials and even companion diagnostic partnerships.

Back in early 2010, I wrote an article for BioProcess International entitled Building Compliance for Personalized Medicine, about the internal compliance frameworks that companies need to be establishing to stay ahead of both the FDA and the personalized medicine curve. The advice within the article is just one set of regulatory intelligence that regulatory affairs and quality system executives and professionals need in order to plan and succeed in the decade ahead.

If you'd like regulatory affairs expert or quality systems expert help in setting up a 21st century regulatory intelligence program, contact me today.

FDA Focuses More on Supplier Qualification Enforcement

Compliance of suppliers, and the challenges in all stages of purchasing, product development, manufacturing, distribution, and oversight, is getting more and more focus in the eyes of the FDA just as it becomes more and more complicated.  One the hardest challenges is dealing with 10% of the supplier base:  virtual suppliers.

Reviewing FDA's warning letters from 2010 reveals that supplier qualification and the management of the supply chain is increasingly an important part of inspections. The main concerns refer to the quality of supplier qualification and oversight as the following excerpts show:

• "Your vendor qualification has not provided adequate evidence that the supplier can consistently supply raw materials that meet appropriate quality attributes."
• "SOP [...] requires your firm to audit your medical gas supplier every... However, your firm has not conducted audits of your supplier …"
• "Suppliers are not monitored and regularly scrutinized to ensure ongoing reliability. Specifically, your firm has not adequately qualified the supplier of […] API. There is no assurance that the API suppliers are in compliance with CGMPs, without supplier qualification."
• "You did not specify how you intend to document and implement such audits [of a virtual manufacturer]"

In February, the FDA announced a new secure supply chain regulatory strategy that would strengthen enforcement of supplier oversight and qualification.  Given that at least 10% of the vendors in the pharmaceutical and medical device industries are now virtual - they have no physical site that can be audited - how is the industry adapting to this new challenge?

Recognizing complexities associated with qualifying and overseeing virtual vendors, Cerulean and Elsevier have partnered to put together a 90-minute webinar course on qualifying and managing virtual suppliers:  Utilizing Virtual Suppliers on 26 April 2011.

I hope you will consider attending.