Regulatory Changes In - and For - China

There were some interesting sessions at this morning's keynote sessions at the ISPE-CCPIE conference in Beijing.

The Chinese State FDA presented a brief history of the Chinese GMP regulations, comparing these to other international regulations (e.g. WHO) and although they provided an outline of the new Chinese GMP regulations there was no commitment in terms of a date by which these will be made effective.

Cynics at the conference suggested after the session that this is because 90% of local Chinese companies would not comply with the new Chinese GMP regulations, but while the SFDA do appear to be keeping their options open regarding timing (and appear to be moving away from introducing a target date with a period of grace during which companies could move to compliance) a session from the US FDA gave a different picture.

Its 12 months since the US FDA set up shop (a field office) in China and although there are still only seven full time FDA staff in country - with only half of these conducting for-cause and high priority inspections - there appears to have been good progress in working with the Chinese State FDA (SFDA) as well as some of the Provincial FDA offices.

What we appear to be seeing is the Chinese authorities committing to address the regulatory/quality concerns that threatened to impact their export markets last year while also starting to address the reform of regulations in their home market, recognizing that the latter will take a while to address in a market consisting of literally thousands of (rapidly consolidating) manufacturers and distributors.

The US FDA and SFDA now meet on a monthly basis, with the SFDA acting as observers to some US FDA inspections. The US FDA is helping to fund training for the SFDA, reviewed the pending Chinese GMP regulations and have provided 10 GCP regulations for the SFDA to translate. This is all part of the US FDA strategy of helping to educate other regulatory agencies on the requirements of the US market and to help build inspection capacity (through the education of a cadre of SFDA inspectors trained in international regulatory expectations).

At the same time, multinational Life Sciences companies are sharing concerns about Chinese products with the US FDA, who are in turn discussing issues with the SFDA and there is also agreement between the US FDA and SFDA to focus on ten high risk products (mainly pharmaceutical, but some medical devices).
This co-operation provides evidence of the US FDA's desire to work more effectively with other regulatory agencies and will certainly start to address concerns about Chinese product.

At the same time it will also help the Chinese authorities to better regulate their own market, which is forecast to be world's largest by 2013 (behind the US and Japan). While 'rogue traders' operating out of China will undoubtedly be of continuing concern with respect to product quality and counterfeiting at least problems with the legitimate market are starting to be addressed.

Whatever people may think about the Chinese governments method of implementing change, there is no doubt that effective reforms can be implemented and probably more quickly than in many other markets. Although this is just the beginning there is no doubt that regulatory change is happening - which will be good for patients in China as well as the rest of the world.

What’s in a (Unique) Number?

Over the past eighteen months I’ve been contributing to a hefty tome which focuses on supply chain management in the pharmaceutical sector, specifically looking at some of the regulatory issues associated with information systems and information technology.

Amongst the issues I identified as still requiring resolution was the need to be able to more effectively track products through the automated supply chain in order to counter the growing problems of counterfeiting, to reduce dispensing errors and to better support product recalls.
The good news is that in the time it has taken to write, review, edit and publish a book there has been significant progress by various industry bodies and regulators in defining what is needed in terms of:

• Uniquely identifying product at multiple levels, down to the final package or device,
• Establishing databases to share information and reduce duplication of data
• Leveraging existing standards such as GS1 Healthcare Standards

This not only includes drug products but also medical devices and while there is still a way to go with respect to international harmonization the increasing adoption or incorporation of standards such as GS1 means that it should be possible for manufacturers to develop internal identification codes that can be used internationally in the commercial supply chain and also meet the various requirements of different regulatory bodies.

While there is still a long way to go with respect to tackling specific issues such as how to label a re-usable, sterilizable medical device or how to label combination products it seems as if solutions are within the grasp of the industry – a fact borne out by the number of large pharmaceutical and medical device companies now investing considerable sums of money in developing solutions.

Regulators are accepting that any regulations should be indepedent of any specific technology and that sensible exceptions (or alternatives) may be required for specific product profiles or devices.

However, to truly develop and deliver workable and cost effective solutions it is necessary to look beyond the basic information technology that assigns and registers identification numbers, prints and scans and compiles data bases.

Much of the discussion is currently being driven by technology vendors who have admittedly gone a long way to making such solutions possible. However, there appear to be very few technology vendors who are looking at the big picture. It also appears that individual pharmaceutical and medical device companies focus upon specific aspects of the full end-to-end solution, depending on the specific experience and ‘hot buttons’ of the teams looking at these solutions. While some teams focus on how to use RFID others are concerned about how relabeling should be managed, but I've seen relatively few companies putting everything together to deliver not just regulatory compliance, but real business advantage.

While information technology will of course underpin any serialization, track ‘n’ trace or electronic pedigree solution it is information systems that will deliver efficient and cost effective solutions.

This requires that Regulated Companies look beyond the printers, laser etching, label stock, etc and take a look at the strategic information flows and business processes that will be needed to make these technologies work as a business solution.

This requires a strategic review of:

• Product master data management, at multiple levels and across all geographies - addressing the critical issues of consistent product codes and the federation and synchronisation of products codes between systems,
• Serial number allocation, management and security on a global basis - remembering that real time solutions will need to work even while the Internet connection to some central database is down,
• Changes to packaging and labelling operations, which may restrict the flexibility that some organizations are used to - it will no longer be possible to assemble-to-order or label in country unless unique serial numbers can be generated at the right point in the supply chain,
• Modifications to business processes to support serialisation - including necessary changes to supporting transactional applications such as MES, ERP and CRM systems,
• Integration of systems ranging from printing, labelling and scanning systems at the bottom end, through MES and into ERP systems at the top end – and the realignment of the supported business processes,
• Collaborative working with third parties including contract manufacturers, customers and regulators – ensuring that identification data is available to trusted and authenticated users while assuring the security of individual serial numbers. 

These key business challenges need to be addressed while at the same time tackling the necessary information technology challenges. As even small pilots have discovered, relying on people to populate this data is extremely time consuming and inefficient - in many cases we're talking about maintaining tens of thousands of product codes and serial numbers into the hundreds of millions. To work properly solutions will need to rely upon internet services and service oriented architecture (SOA) – and area where the Life Sciences industry has been lagging behind other industries.
With regulatory deadlines (e.g.now looming in the US and Europe Life Sciences organizations are now starting to address the issue seriously – but let’s just hope that it isn’t too late. While it is certainly possible to implement partial solutions in time to meet key regulatory milestones unless these issues are tackled at a strategic business level the cost to industry may well outweigh the benefit in terms of risk mitigation.

IT Implications From A Shift in Regulatory Focus

At yesterday’s ISPE GAMP® UK Forum meeting it was interesting that while the usual regulatory roundup included the usual feedback from Regulated Users who have undergone regulatory inspections of their GMP and GDP areas, there was also a perceived shift in emphasis.

While a number of GMP inspections did look at some computer systems related issues (reviewing validation plans and reports, disaster recovery plans, test protocols, change controls and the like) this appeared less detailed than is usually reported and there were a couple of interesting things of note:

• A significant number of inspections weren’t looking at computer systems validation in detail,
• There was significant discussion around enforcement actions in other parts of the business, specifically in sales and marketing.

As last weeks coordinated action against counterfeit products in the supply chain showed, there is a growing concern with what is going on outside reputable manufacturing. These actions were coordinated by Interpol and supported by industry bodies, national law enforcement agencies and regulatory agencies, resulting in the seizure of more than 1 million tablets, 76 individuals now being actively investigated and leading to the closure of almost 300 websites (with more to come).

Reputable companies may not be the focus of such activities, but regulators have other concerns with regards to what respectable pharmaceutical companies are doing as part of their everyday business and which is perceived as also putting patients at risk.

As highlighted in an opinion piece in last week’s New Scientist (written by Dr Paul Thacker, in the 16th October edition) the increase of off-label prescribing is potentially placing patients at risk, and this is increasingly likely where pharmaceutical companies exercise less than tight control on the activities of those selling their products. As a result of the US Health Reform Bill, from 2013 companies will be required to disclose payments to doctors in excess of $10 and explain why the payment was made.

All of this means that regulations and enforcement actions are extending into almost every part of a Life Sciences company. However, very few companies are prepared to deal with this situation and fail to see that Information Systems can be both a blessing and a curse.

A well-defined and ‘validated’ computerized process can enforce actions that comply with regulatory requirements and can also significantly ease the burden of regulatory reporting. However, computerized systems that are poorly defined, insecure and easy to by-pass allow people to operate outside of the regulations, either mistakenly or by intent.

As such, Life Sciences companies should be looking to leverage experience from the GMP and GDP areas, where the validation of computerized systems is, for large parts of the developed world, a way of life. To rise to these new regulatory challenges it will however be necessary to:

• Take a sensible, cost effective risk-based approach, recognising that GMP and GDP systems are usually of much higher risk and that techniques will need to be adapted to suit lower risk profile systems and applications
• Recognize that the risk is inherent within the overall business and take an approach that considers the computerized system and information technology as just one element of the overall business process and information system (remembering that information also exists in other forms).

When used wisely, information technology can help Life Sciences companies respond to the changing regulatory landscape in a cost effective manner, delivering business improvement and supporting compliance.

The other side of the coin is that we can expect increasing regulatory focus and enforcement when the regulatory issues associated with the use of websites, collaborative portals, social networking sites, CRM systems and the like are ignored.

On the positive side, Life Sciences companies have time to respond and think about how to strategically leverage the knowledge and experience that already exists within other domains within the industry (GMP etc). On the downside is that few appear to be thinking about this at a strategic level just yet. Only time and on-going enforcement actions will tell how long any period of grace will be.

 

Marked Decline in Sponsored Link Advertising following US FDA Enforcement

An interesting recent piece of news was that sponsored link advertisements for pharmaceutical products have declined more than 50% following a spate of Warning Letters from the US FDA. According to various new articles published on March 26, 2009, the Division of Drug Marketing, Advertising, and Communications (DDMAC) of the U.S. Food and Drug Administration (FDA) sent warning letters to 14 major pharmaceutical manufacturers identifying specific brands as being in violation of FDA fair balance guidelines. The letters stated that sponsored link advertisements for specific drugs were misleading due to the exclusion of risk information associated with the use of the drug.

Most of these companies quickly removed their sponsored ads for these products and others not specifically mentioned in the letters. As a result, the number of sponsored links for pharmaceutical brands has dramatically declined as manufacturers changed their strategies to ensure compliance.

This illustrates neatly what we have been pointing out for some time; there is nothing special about the Internet as far as regulation is concerned. Advertising on the Internet is governed in the same way as advertising using any other medium, and non-compliance with the rules that govern advertising will be dealt with similarly.

This poses a challenge on a number of levels for the companies concerned. The very nature of sponsored link advertisements mandates brevity. In a magazine you can have your ad on one page and the list of warnings in small type on the next page or two, but how is this to be handled in a sponsored link of 25 words or even fewer?

This isn’t the only problem with on-line ads. They might be a common sight to US-based consumers but on a global stage they are unusual. In fact the only countries that I know of where direct-to patient advertising is permitted are the USA and New Zealand. Other countries such as the UK specifically prohibit advertising of Prescription Only Medicines to non-health professionals. This places the onus squarely on the regulated company to make sure that they target their adverts correctly otherwise they risk action from other regulatory bodies and not just the FDA.

For more on this topic see the Business & Decision webcast "Controlling Life Sciences Promotional Activities on the Internet"

New Part 11 Assessment (and Enforcement) Is Coming

As we report in this month's copy of our ValidIT newsletter (focusing on IS Compliance and Computer System Validation issues) it looks as if the US FDA's CDER division wants to assess the state of play in the industry with respect to 21 CFR Part 11 (Electronic Records, Electronic Signatures).

Although the scope and specific program areas aren't yet decided the way they intend to do this is to ask specialists in the Agency to accompany Inspectors from the Field Divisions on routine inspections and look at issues around Part 11, taking appropriate enforcement action where necessary. This is to help them to understand how the industry is responding to the 2003 Scope and Applications Guidance and to help the Agency decide how to revise Part 11.

This demonstrates a pragmatic approach to resolving this open issue and the Agency is to be applauded in taking a proactive yet measured approach (other Divisions within FDA aren't directly involved and are playing a watching brief).

I hope that what they'll find - certainly on inspections in North America and Europe - is that:

• Most Regulated Users have taken Part 11 on board and are responding well, applying a risk-based approach where appropriate,
• Technology has moved on, allowing Suppliers to meet Part 11 technical requirements much more easily, leveraging significant advances in security, encryption and digital signatures.

Of more concern is not what is happening in North America and Europe, but what is happening in the emerging economies where an increasing proportion of pharmaceutical (and medical device components and products) are being manufactured. Major international Life Sciences companies who have set up operations in countries like China, India and Brazil are largely applying their own internal processes and procedures and are leveraging mature software products from experienced vendors - Part 11 compliance shouldn't be a problem here - so far, so good.

However, there is also a significant number of indigenous API, pharmaceutical and medical device companies in these markets often using local software developers to avoid the licensing costs or overseas development costs of using more established software from multi-national vendors. Our experience in these markets is that in many of these cases the requirements of Part 11 are well less understood.

Looking at any of the on-line forums that exist, anyone who reads some of the Part 11 questions posed by certain individuals and organizations from some countries will realize that in many cases the current level of understanding (and in some cases the level of technology) is where North America and Europe was ten or more years ago. What we might consider to be 'simple' questions and answers only appear simple based on more than fifteen years discussion and experience in the industry, which many newcomers understandably lack.

Now this isn't a rant about moving jobs 'overseas' or about how unfair lower cost labor is in emerging markets - we all compete in a global economy. Working with end users and suppliers in these markets I know how well educated their labor pool is, how hard working they are and how innovative they can be.

What I hope is that the FDA will not restrict their assessment of the state of Part 11 to just their domestic market or traditional developed markets (Canada and Europe), but that they will also include a broader set of overseas manufacturers, to determine what the overall state of the market is with respect to Part 11 compliance.

Without this representative sample there are two potential risks:

• The Agency concludes that things are in relatively good shape and that no great changes are needed to Part 11, or the enforcement thereof. This has the potential to miss possible issues in emerging economies where fraud can be as much as an issue as accidental problems with electronic records and signatures,
• The Agency develops a revised Part 11 based upon an assumption that all software developers (and their clients) generally have access to the latest technology, which can again lead to compliance risks. Any new Part 11 should clearly avoid the problems created by the original preamble and should not focus on any specific technologies or techniques.

I also hope that the Agency will continue to work in conjunction with the industry to understand the underlying causes of any issues they do find and work with the industry to ensure that all manufacturers and their software suppliers have an adequate understanding of Part 11 and the current (and future) expectations of the Agency.

Computer System Validation – Business as Usual?

A colleague asked me earlier today what were the big issues at the moment in computer system validation – and I couldn’t really think of any.


After more than twenty years introducing computer system validation to a lot of companies, consulting on Part 11, getting ready for Y2K, responding to Part 11, addressing infrastructure qualification and adopting a risk-based approach to validation the question is very much ‘where next?’.

To some extent it depends on what happens with risk-based validation. As the results from our webcast polls show, many Life Sciences organisations are still struggling to adopt a justifiable risk-based and cost effective approach to computer system validation.

At the moment it does appear to be business as usual – we still see computer system validation issues cited in FDA Warning Letters (and anecdotally reported by other regulatory agencies) but its justified and at a reasonable level in comparison to other more pressing topics – very much what we were used to around a decade ago.

However, if companies continue to use taking a risk-based approach as an excuse for simply doing less – rather than providing a real risk-based rationale for shifting resources to areas of the greatest risk – things may change. Some regulatory agencies have already commented that they are getting wise to ‘risk-based’ equating to ‘simply doing less’ and companies simply adopting GAMP® 5 as a flag of convenience for reducing spending on computer system validation without any clear rationale for doing less. Some inspectors have warned that they will take enforcement actions unless there is a clear and sound risk-based rationale for reducing the level of validation. Efficiency savings are fine, but only when the same goals are met.

There is then a possibility that we could see an increase in enforcement actions in response to Life Sciences companies taking the cost savings too far, but hopefully common sense will prevail as more individuals and organisations really start understand how to achieve the same objectives with less time and effort.

That leaves us with the other ‘big issue’ – which is how the industry is looking to changes in IT - such as cloud computing, virtualization, outsourcing and the like – and wondering how to apply risk-based principles to new technology and different business models.

While many Life Sciences companies are still relatively slow to change others are quietly moving ahead and the immediate future is probably one of evolution and not revolution. That’s not to say however that such evolution isn’t exciting – there is great potential to leverage newer technologies and models to deliver enhanced business performance, reduce costs and help restore the bottom line. If we can seize these opportunities and also address the compliance and validation issues in a cost effective manner then we’re in for a very interesting time – even if it’s not quite as exciting as when the regulators were giving everyone a hard time.

Answers to Webcast Questions - Compliant Business Intelligence and Analytics in Life Sciences

Thank you to everyone who attended the webcast "Compliant Business Intelligence and Analytics" and who submitted questions. The recording is now on-line and subscribers can download the slides from the Business & Decision Life Sciences website via the Client Hub.
Listed below are the questions that we didn't have time for in the live webcast, along with the answers we promised to provide.


Q. How could BI be beneficial in an IT industry "IT Project"?
A. IT projects and processes are another subset of business processes and Business Intelligence and Analytics can certainly be applied there. The use of Key Performance Indicators in IT Projects and Processes was covered extensively in our webcast "Measuring IS Compliance Key Performance Indicators". This includes the use of Business Intelligence applications for supporting project and process improvement, both in terms of efficiency and cost effectiveness and also in terms of regulatory compliance.

Q. How would you qualify a BI solution provider (if one ever needed to be hired for a project)?
A. No differently from qualifying any other vendor. We would focus on the maturity of the solution provider in terms of:
- Track record in Business Intelligence (do they know the specific technology/application, can they help develop a BI strategy and architect a BI solution?).
- Track record in Life Sciences (and in the particular business domain [e.g. clinical trials versus sales and marketing] and the particular sector [e.g. pharmaceuticals, medical devices, biomedical etc].
Assuming that a BI solution had already been selected we would also look to the BI vendors to make recommendations with respect to which solution provider they would recommend.
When combined, these factors would reduce a list of potential suppliers to a manageable number.

Supplier selection seems to be a question that has been asked a few times in various webcasts and is something we'll look at covering in more detail in a future webcast.
Thanks again for joining us for the webcast and if there are any follow up questions you can submit them via the Life Sciences website