Since the advent of IT systems that can store and analyse large data sets, data has become more and more critical to businesses. Organisations can use the data to track products through the supply chain, identify problems and reveal important information about customer buying habits. Data is also essential for demonstrating compliance with standards to regulatory authorities. In the pharma industry, the need to ensure data integrity is probably greater than any other sector due to its highly competitive and highly regulated nature.
Great reliance leads to greater risk
An increased reliance on data, however, is accompanied by greater risk. In 2018, the FDA issued new guidance for the pharma industry on data integrity and compliance with current good manufacturing practice (CGMP) for drugs. The guidance noted that, in recent years, the FDA had observed an increasing number of CGMP violations involving data integrity. These had led to “numerous regulatory actions, including warning letters, import alerts and consent decrees”.
Data integrity, in the FDA’s definition, refers to the completeness, consistency and accuracy of data that is attributable, legible, contemporaneously recorded, original or a true copy and accurate (ALCOA).
The FDA also uses the term ALCOA+, which includes the additional requirement that data be “complete, consistent, enduring and available”, emphasising the preservation of the integrity of information beyond the point when it is created.
Data integrity is critical throughout the CGMP data life cycle, including in the creation, modification, processing, maintenance, archival, retrieval, transmission and disposition of data after the record’s retention period ends. System design and controls should facilitate easy detection of errors, omissions and aberrant results throughout the data’s life cycle.
A particular challenge
Maintaining data integrity can be particularly challenging for pharma companies handling large volumes of information, particularly as the majority tends to be stored in the cloud. Julia Spain, cyber partner, healthcare and life sciences at Deloitte, emphasises that the adoption of internet of things (IoT) technology in healthcare adds a degree of risk, which is more problematic than in other industries.
“The thing that is particular about pharma, is the need to demonstrate traceability because of the patient safety element,” says Spain.
It is also, she points out, a “high-profile and targeted industry” because of the commercial value in the data and intellectual property.
A 2017 Deloitte report, ‘Under the spotlight: Data Integrity in life sciences’, found that common types of data integrity breaches in pharma included “unauthorised data access, lack of enabled audit trails, accidental and intentional falsification of records”.
Among the examples identified in FDA warning letters was the failure to prevent unauthorised access or changes to data, and the failure to provide adequate controls to prevent omission of data and record activities at the time they are performed and the destruction of original records. So how can pharma companies ensure that critical data, whether it is from clinical trials or the supply chain, maintains its integrity? Technological solutions play an important role in protecting data, whether that relates to clinical trials or the supply chain and new technologies that are emerging that are particularly effective.
However, it is important to remember that any technological solution is only effective if it is implemented in the context of a culture focused on data integrity. “We’re always slightly suspicious of a technology-focused approach, because without the relevant governance, compliance and risk culture, the technology can essentially be a very expensive exercise that doesn’t hugely improve your security posture,” says Spain.
your security posture.” Julia Spain
Promising technology
The most promising of new technologies is blockchain, originally developed to record transactions made in bitcoin. A block is a digital record and the blockchain is a sequence of connected blocks. Each block consists of three types of data: information about a particular transaction (such as a date and timestamp); a record of the individual involved in creating the transaction; and a unique identifying code, called a hash, to distinguish it from other blocks. Each new block added to the blockchain is first verified by a network of servers, known as nodes, using a consensus algorithm.
Essentially, blockchain creates an unbreachable ledger. Each new block of data added to the chain is linked to the previous one by a cryptographic hash function, so any attempt to change a single block is instantly detectable. The ledger is distributed over multiple nodes and anyone wanting to tamper with it would have to do so on over half of the nodes. The algorithm that validates the authenticity of each new block is the final element that makes the blockchain impossible to breach.
The principles of blockchain are particularly well suited to the needs of the pharma industry because the technology makes it possible to ensure processes are standardised and all data is traceable, reducing opportunities for counterfeiting and helping to manage inventory. For example, a pharma manufacturer will make sure that each drug produced has a QR code that includes the drug name, timestamp, location, and manufacturing and expiry date. Once that is added to the blockchain, every supply chain partner can trace the drug through the entire chain.
When the drugs are shipped, temperature sensors connected to the IoT can collect the temperature data and add it to the blockchain to verify that cold-chain conditions have been met. If the transportation vehicle is also connected to the IoT, it can automatically record the time and date the drugs were delivered, adding another element of traceability.
stakeholders in an organisation.” Cameron Brown
A degree of certainty
Similarly, in clinical trials, blockchain technology can offer a strong degree of certainty that data hasn’t been tampered with – so that consent forms aren’t falsely timestamped, for example. “The hashing functions will be used to verify the state of a particular database, a particular data entry or a particular field,” says Cameron Brown, director of cybersecurity at Deloitte. “At the conclusion of harvesting of the information, there’s a hash function representing a particular value, which gives an assurance that if that value hasn’t changed since that data was created, then you’ve got a high degree of certainty that the integrity of that information has been maintained.
“The challenge of blockhain,” says Brown, is that “it can be quite cumbersome to implement and it does require some hygiene.” His advice is to automate as much as possible in order to reduce the “day-to-day firefighting associated with security teams”.
Businesses should try to understand what the dayto- day operations are and how much can be “lifted and shifted to an automated process, and when it comes to security alerting, how much can begin to be vetted in advance using cognitive computing technologies”. This automation enables the company’s security experts to be able to innovate, rather than constantly deal with security alerts.
Transformative technology
The benefits of blockchain can go far beyond the maintenance of data integrity to provide a competitive advantage. “I’ve seen some interesting prototypes or proof of concepts around leveraging blockchain to demonstrate effective decision-making and the ability to trace decisions that are being arrived at through a potential caucus or a committee of stakeholders in an organisation,” says Brown.
Similarly, Spain argues that “you can create serious efficiencies by getting that level of assurance around traceability and integrity in your business”.
The transparency provided by blockchain technology can enhance a company’s reputation and increase confidence among partners, suppliers and customers. Brown notes that some patients, for example, might be more willing to take part in a clinical trial if they rate the integrity of a company highly and are secure in the belief that the company will maintain their confidentiality and privacy. He has seen companies using their security procedures to “demonstrate trust”, both to their consumer base and the other companies that they do business with.
Data integrity is “seen to be a business enabler, not just necessarily a cost centre and that’s a bit of a paradigm shift”, says Brown. “I think it’s starting to resonate more with the leadership of these organisations, where previously it was just something that needed to be done to be compliant.”
Blockchain is set to become a transformative technology for guaranteeing data integrity in the pharmaceutical industry. But it must not come at the expense of maintaining a strong ethos of security and privacy within the business. “There are some brilliant emerging technologies, but they have to be embedded in a context that is appropriate,” says Spain. “If I were to choose one or the other I would go with a positive security culture and all those good governance risk compliance elements.”
2018
Year the FDA issued guidance for the pharma industry on data integrity and compliance with current good manufacturing practice (CGMP) for drugs.
FDA
Data donation issues and how blockchain can help Accessibility and knowledge of clinical research opportunities
A blockchain shared among patients, pharmaceutical companies, academic research institutions, medical providers and government regulators can act as the source of truth for clinical research opportunities, where patients can submit their medical information and search for applicable clinical research opportunities that matches their medical profile.
Incentives for sharing information
Blockchain can help incentivise sharing of information through immediate transparency into clinical study results and crypto-tokens. For example, through blockchain, researchers can incentivise patients to participate by publishing the results of the studies and distributing them to patient participants – so patients can better understand how their information was used and the results that were achieved. Moreover, blockchain crypto-tokens (for example, similar to digital currencies) can be awarded to patients who donate and share information in clinical studies, allowing opportunities such as co-pay relief or other use of currency.
Privacy of patient medical information
Patient information on blockchain can be de-identified and permissioned through smart contracts so that only trusted viewers of the data can associate a record on that contains medical information (such as history of illnesses, vitals and demographics) with the underlying individual who donated the information. This can allow researchers to analyse a rich set of de-identified information and then request access from the underlying individual to use their information for studies.
Interoperability of electronic medical information
Blockchain platforms are uniquely positioned to facilitate interoperability by creating a level playing field among data contributors where there is no single owner of information, where all participants can maintain their own copies of the data and the underlying patient can maintain their identity. Although this blockchain would require standards and agreements from various stakeholders, its distributed nature and capabilities (for example, smart contracts that autonomously and consistently execute rules) can better facilitate wide-scale adoption among groups that do not inherently share information with one another when compared with other traditional technologies.
Source: Deloitte
