Implications of policy 0070

Writing the clinical sections of a dossier to apply for a marketing authorisation application (MAA) of a medicinal product is no small feat. The main clinical modules of the common technical document (CTD) dossier (modules 2.7 and 2.5) are, in fact, five different documents covering the key features of a drug (the known pharmacological profile, efficacy and safety) and, altogether, will be hundreds of pages long. It takes a concerted effort and focused oversight to ensure these documents, which are being written in parallel to each other, present a cohesive picture of the data collected during the clinical development of the product.

With the requirement introduced by EMA policy 0070 to proactively publish all of the clinical reports submitted as part of MAAs, a new level of complexity has been introduced to the writing of these documents. Many teams are not yet fully aware of the fact that these documents (modules 2.5 and 2.7, the clinical study reports in module 5, and appendices 16.1.1, 16.1.2 and 16.1.9 of those reports) will be made publicly available. Nor are they aware of the effort involved to redact those documents before making them public to prevent publishing any material that could potentially allow reidentification of individual patients – personal protected data (PPD) – or that could release commercially confidential information (CCI).

Authoring teams have generally erred on the conservative side when deciding if material should be included in a clinical summary or not; if it might be helpful for the assessors at the agencies, they included it.

Now teams need to be made aware of the implications of making some of that information publicly available. Ideally, clinical summaries should be written in such a way that enables public disclosure without the need for too much redaction, and ensuring assessors have all the information to fully evaluate the product. The goal is also to retain a maximum of scientifically useful information to ensure data is usable for secondary research. At times, however, protecting the privacy of study participants and maintaining data utility are competing objectives.

Change the way we write

The challenge, then, is to rethink how to present clinical data so that the most clinically relevant information is available, to give insight into the effects of the medicinal product, without providing any PPD. The information traditionally provided to describe an individual and the adverse events (AEs) they experienced during a study might enable identification of an individual if direct or indirect identifiers are not protected. Of particular concern is data that may not on its own identify an individual, but may do so when combined with other information (indirect identifiers). If PPD is not anonymised or redacted sufficiently, a savvy adversary who wanted to put the pieces together might be able to reidentify a particular person with relative ease.

For example, it is standard practice to include a table that lists all participants who experienced serious AEs. This table typically provides the sex, age, and race of each participant together with the date the event occurred and its duration. If a reader has these details and knows the hospital at which the study was run – which translates to the region the participant lives in – as well as the disease the person has, there is a real possibility they could identify a specific person by doing some research. This is particularly true if the disease is not a common one.

Maintaining data privacy and minimising the risk for an individual to be reidentified are thus important prerequisites for clinical documents to be made public. We need to think about which details are really needed. For example, is it important to know the person was 36 years old? We say this to indicate that the person is neither a child nor an older person. So it would be sufficient to say the person was 30–40 years old. Similarly, is it important to know the event happened on 25 March? We give the date of an event to indicate how long the person was on treatment when it happened. It is actually even more informative to say the event happened 21 days after the start of treatment. These types of changes provide assessors the information needed to determine if there is a possible relationship to the treatment or the clinical profile of the participant, without providing PPD.

To date, implementing EMA policy 0070 and maintaining data privacy, while staying on top of the constantly evolving regulatory guidelines and monitoring the status of the agency’s Brexit hold, has provided unique challenges. Although the anonymisation approach used for a policy 0070 dossier is the responsibility of the marketing authorisation holder (MAH), previously submitted policy 0070 dossiers received a number of detailed comments from EMA on the anonymisation strategy. EMA requested replies to their comments and further modifications to the anonymisation report after submission of the dossiers, although this interaction was not specified by the guidance. This substantiates EMA’s announcement at a webinar in January 2018 that the agency will focus more on anonymisation quality and specificity in the future.

Another confusing area of policy 0070 is the statement that ‘clinical data cannot be considered CCI’. There is a lack of legal definition of what may be accepted as CCI, and it is a matter of considerable debate. CCI decisions are considered on a case-by-case basis. According to recent decisions of the EU General Court for three different EMA policy 0043 cases, MAHs need to provide ‘concrete evidence of how the release of the contested documents would undermine their commercial interests’.

MAHs are to consider CCI according to the following criteria: the information is covered in annex three of policy 0070; the item is not listed in chapter four of the external guidance (information not considered to be CCI); and the item does not meet any of the five rejection codes provided in the guidance. Basically, for each CCI item, MAHs must provide ‘a specific, pertinent, relevant, not overstated and appropriate justification’ explaining how the release of the information would damage the company’s commercial interest. In the first year of policy 0070 being in effect, proposed CCI was rejected in 76% of the instances, most frequently due to insufficient justification. The second-most-frequent reason was that the information an MAH considered to be CCI was actually available in the public domain. Most of the items accepted as CCI concerned manufacturing details and immunological bioassay specifications.

Most policy 0070 dossiers that are currently publicly accessible are based on a qualitative, non-analytical assessment of the risk of patient reidentification. A fairly conservative PPD approach is often selected by companies to achieve a very low risk of reidentification, which is justified by the permanent public release of the documents and likely better technological means to reidentify individuals in the future. Additionally, as more personal data become publicly available over time, it will become easier to link data from policy 0070 documents with other public data to reidentify individuals.

Finalising PPD redaction rules, preparing the PPD redaction proposals, identifying CCI, and writing the anonymisation report can be a time-consuming and costly process. These tasks are typically performed by a designated MAH transparency and disclosure team in consultation with a legal expert for data protection (a privacy officer), intellectual property associates and regulatory affairs representatives, along with members of the clinical development, pharmacology, bioassay or immunology, CMC, pharmacovigilance, non-clinical development and statistics groups, as needed. Often, external vendors with policy 0070 experience and a software tool to search for PPD (for instance, artificial intelligence software) are engaged. Identifying CCI cannot be done using a software tool and involves a manual search through each document by subject matter experts. Once identified, justifications are created for each instance of CCI after verifying that the items are not publicly available. Quality control checks throughout and across documents are done and, finally, CCI justification tables are colour coded and CCI redactions are formatted accordingly in the draft package.

Plan for tomorrow

The EMA’s Brexit-preparedness businesscontinuity plan communicates information about the temporary suspension or reduction of agency activities while it prepares for the consequences of the UK’s exit from the EU (in terms of the impact on the agency’s operations and for its physical move to Amsterdam). Between October 2016 and December 2017, which is basically the first year that the clinical data publication website for policy 0070 went live, EMA published documents for 64 dossiers. However, at the end of 2017, a total of 337 product dossiers were subject to publication under the policy. This backlog of dossiers for publication, in addition to the backlog created since the time of the EMA Brexit hold, means that the timelines defined in the policy are currently not applicable. When the hold is lifted, the EMA will again be notifying MAHs of the dates that their policy 0070 redaction proposal document packages are due. As a consequence, MAHs are left on their own to make decisions about the amount of time and resource to be placed on preparing policy 0070 dossiers that would currently be due, but for which no agency communication or proposed due date is actually available.

Overall, one of the biggest implications of the policy 0070 data transparency requirement on clinical dossiers is that a lot of extra timeconsuming work is involved. It can take many months to properly prepare an MAA dossier for policy 0070 submission and ensure that neither PPD nor CCI is accidentally released into the public domain. As an upstream effect of this, it has changed the way that clinical teams prepare documents for submission dossiers. With a little forethought and some changes in the way data is presented through anonymisation techniques, it is possible to retain clinically relevant information without enabling reidentifying of individuals. Proactively thinking about how to write clinical documents in a way that avoids including PPD or CCI can dramatically reduce the need, and time spent, for redaction of those documents when they are being prepared to be made publicly available.

This is in everyone’s interest because the work to redact clinical documents for policy 0070 submissions can be an enormous burden, in terms of time and cost.

By considering the end use of a clinical document, which will include subsequent publication, medical writers can help facilitate the efficiency of the redaction process by adjusting the content and structure of clinical documents from the start of writing activities. Educating authoring teams to be aware of these implications from the start may reduce the burden of redaction at the time of publication and actually produce documents that help meet the intended goal of bringing this information to the public with minimal risk to patients.